Am I infected?

Norton Security | Norton Internet Security
1

Please check the Sysprot log.

2

The usual place for sysprot cannot be found (the link in the forum).  I used the sysprot found at MajorGeek.com

3

I don’t see any issue in your log.  Did something happen to cause concern? 

4

Nope, just a monthly rootkit check. Hope you understand.

5

For infor Wikipedian:

 

If you do get one, it will normally show up in this area.

 

Name: C:\Program Files\Norton Internet Security\Engine\17.0.0.136\ccSvcHst.exe
PID: 4
Hidden: Yes
Window Visible: No

******************************************************************************************
******************************************************************************************
Kernel Modules:
Module Name: \??\C:\Documents and Settings\The Win Family\Desktop\SysProt\SysProt\SysProtDrv.sys
Service Name: SysProtDrv.sys
Module Base: AC6D1000
Module End: AC6DC000
Hidden: No

Module Name: \WINDOWS\system32\ntkrnlpa.exe
Service Name: ---
Module Base: 804D7000
Module End: 806E4000
Hidden: No

You can see the ESQUL in this example
 Name: C:\Users\bharath\Desktop\pot.exe
PID: 2600
Hidden: No
Window Visible: Yes

******************************************************************************************
******************************************************************************************
Kernel Modules:
Module Name: \systemroot\system32\drivers\ESQULqainyweubissryvsrtveoxtbovbsfrnx.sys
Service Name: ESQULserv.sys
Module Base: ---
Module End: ---
Hidden: Yes

Module Name: \??\C:\Users\bharath\Desktop\SysProtDrv.sys
Service Name: SysProtDrv.sys
Module Base: A7D1C000
Module End: A7D27000
Hidden: No
6

Thanks Delph

 

I was wondering what a sysprot log looked like.