:Processes
Explorer.EXE

:OTL

:services
SSHNAS

:reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Videohost"=-
"SSHNAS"=-
"vegas"=-
"LosAlamos"=-
"ZagrebLand"=-

:files
%windir%\msa.exe
%windir%\system32\sshnas.dll
%windir%\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job
%windir%\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

:Commands
[emptytemp]
[Reboot]