Results of system analysis

Process List

File name	PID	Description	Copyright	MD5	Information
c:\program files\avg\avg9\avgchsvx.exe Script: Quarantine, Delete, Delete via BC, Terminate	3224	AVG Cache Server	Copyright © 2010 AVG Technologies CZ, s.r.o.	??	1075.34 kb, rsAh, created: 1.1.2008 1:17:39, modified: 2.4.2010 9:52:35 Command line:
c:\program files\avg\avg9\avgchsvx.exe Script: Quarantine, Delete, Delete via BC, Terminate	3192	AVG Cache Server	Copyright © 2010 AVG Technologies CZ, s.r.o.	??	1075.34 kb, rsAh, created: 1.1.2008 1:17:39, modified: 2.4.2010 9:52:35 Command line:
c:\program files\avg\avg9\avgcsrvx.exe Script: Quarantine, Delete, Delete via BC, Terminate	3260	AVG Scanning Core Module - Server Part	Copyright © 2010 AVG Technologies CZ, s.r.o.	??	693.77 kb, rsAh, created: 1.1.2008 1:17:33, modified: 1.1.2008 1:17:33 Command line:
c:\program files\avg\avg9\avgnsx.exe Script: Quarantine, Delete, Delete via BC, Terminate	604	AVG Network scanner Service	Copyright © 2010 AVG Technologies CZ, s.r.o.	??	603.27 kb, rsAh, created: 1.1.2008 1:17:56, modified: 1.1.2008 1:17:57 Command line:
c:\program files\avg\avg9\avgrsx.exe Script: Quarantine, Delete, Delete via BC, Terminate	316	AVG Resident Shield Service	Copyright © 2010 AVG Technologies CZ, s.r.o.	??	496.27 kb, rsAh, created: 1.1.2008 1:17:57, modified: 1.1.2008 1:17:57 Command line:
c:\progra~1\avg\avg9\avgtray.exe Script: Quarantine, Delete, Delete via BC, Terminate	2876	AVG Tray Monitor	Copyright © 2010 AVG Technologies CZ, s.r.o.	??	2015.84 kb, rsAh, created: 1.1.2008 1:18:05, modified: 2.4.2010 9:52:57 Command line: "C:\PROGRA~1\AVG\AVG9\avgtray.exe"
c:\program files\avg\avg9\avgupd.exe Script: Quarantine, Delete, Delete via BC, Terminate	2444	AVG Update module	Copyright © 2010 AVG Technologies CZ, s.r.o.	??	1014.34 kb, rsAh, created: 30.1.2010 17:24:14, modified: 2.4.2010 9:51:51 Command line:
c:\program files\avg\avg9\avgwdsvc.exe Script: Quarantine, Delete, Delete via BC, Terminate	208	AVG Watchdog Service	Copyright © 2010 AVG Technologies CZ, s.r.o.	??	300.84 kb, rsAh, created: 1.1.2008 1:17:50, modified: 1.1.2008 1:17:50 Command line:
c:\documents and settings\administrator\plocha\avz4\avz4\avz.exe Script: Quarantine, Delete, Delete via BC, Terminate	4024	???????????? ??????? AVZ	???????????? ??????? AVZ	??	733.00 kb, rsAh, created: 8.4.2010 20:19:13, modified: 21.8.2009 14:40:32 Command line: "C:\Documents and Settings\Administrator\Plocha\avz4\avz4\avz.exe"
c:\program files\canon\myprinter\bjmyprt.exe Script: Quarantine, Delete, Delete via BC, Terminate	2884	Canon My Printer	Copyright 2004-2009 CANON INC. All Rights Reserved.	??	1937.32 kb, rsAh, created: 6.2.2010 21:58:35, modified: 27.7.2009 4:10:00 Command line: "C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" /logon
c:\windows\system32\ctfmon.exe Script: Quarantine, Delete, Delete via BC, Terminate	1500	CTF Loader	© Microsoft Corporation. All rights reserved.	??	39.50 kb, rsAh, created: 17.8.2004 14:49:24, modified: 14.4.2008 9:52:18 Command line: "C:\WINDOWS\system32\ctfmon.exe"
c:\program files\faronics\deep freeze\install c-0\dfserv.exe Script: Quarantine, Delete, Delete via BC, Terminate	1048	Deep Freeze 6.53 service	Copyright © 1999-2009 Faronics Corporation	??	1031.50 kb, rsAh, created: 5.8.2009 18:38:58, modified: 5.8.2009 18:38:58 Command line:
c:\windows\explorer.exe Script: Quarantine, Delete, Delete via BC, Terminate	1376	Prщzkumnнk Windows	© Microsoft Corporation. Vљechna prбva vyhrazena.	??	1505.00 kb, rsAh, created: 17.8.2004 14:49:24, modified: 14.4.2008 9:52:24 Command line: C:\WINDOWS\Explorer.EXE
c:\program files\mozilla firefox\firefox.exe Script: Quarantine, Delete, Delete via BC, Terminate	3088	Firefox	©Firefox and Mozilla Developers, according to the MPL 1.1/GPL 2.0/LGPL 2.1 licenses, as applicable.	??	888.96 kb, rsAh, created: 19.12.2009 21:20:15, modified: 8.4.2010 20:15:31 Command line: "C:\Program Files\Mozilla Firefox\firefox.exe"
c:\program files\faronics\deep freeze\install c-0\_$df\frzstate2k.exe Script: Quarantine, Delete, Delete via BC, Terminate	2052	Deep Freeze 6.53 utility	Copyright © 1999-2009 Faronics Corporation	??	1780.12 kb, rsAh, created: 8.4.2010 20:14:53, modified: 8.4.2010 20:14:53 Command line: "C:\Program Files\Faronics\Deep Freeze\Install C-0\_$Df\FrzState2k.exe" 1 106917
c:\program files\gigabyte\gamer hud\hud.exe Script: Quarantine, Delete, Delete via BC, Terminate	2460			??	1895.50 kb, rsAh, created: 26.6.2008 16:49:44, modified: 26.6.2008 16:49:44 Command line: "C:\Program Files\GIGABYTE\Gamer HUD\HUD.exe"
c:\program files\canon\ijplm\ijplmsvc.exe Script: Quarantine, Delete, Delete via BC, Terminate	1516	Inkjet Printer/Scanner/Fax Extended Servey Program Service	Copyright CANON INC. 2006-2009 All Rights Reserved	??	113.38 kb, rsAh, created: 6.2.2010 22:04:56, modified: 10.2.2009 18:01:49 Command line:
c:\program files\common files\installshield\updateservice\issch.exe Script: Quarantine, Delete, Delete via BC, Terminate	2936	InstallShield Update Service Scheduler	Copyright (C) 1990-2004 InstallShield Software Corporation	??	68.00 kb, rsAh, created: 16.2.2010 16:31:29, modified: 13.4.2004 7:07:18 Command line: "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
c:\program files\java\jre6\bin\jqs.exe Script: Quarantine, Delete, Delete via BC, Terminate	1684	Java(TM) Quick Starter Service	Copyright © 2004	??	149.78 kb, rsAh, created: 4.1.2010 22:26:36, modified: 4.1.2010 22:26:36 Command line:
c:\program files\java\jre6\bin\jusched.exe Script: Quarantine, Delete, Delete via BC, Terminate	2868	Java(TM) Platform SE binary	Copyright © 2004	??	145.78 kb, rsAh, created: 4.1.2010 22:26:36, modified: 4.1.2010 22:26:36 Command line: "C:\Program Files\Java\jre6\bin\jusched.exe"
c:\windows\system32\lsass.exe Script: Quarantine, Delete, Delete via BC, Terminate	872	LSA Shell (Export Version)	© Microsoft Corporation. All rights reserved.	??	13.00 kb, rsAh, created: 17.8.2004 14:49:24, modified: 14.4.2008 9:52:30 Command line:
c:\windows\system32\nvsvc32.exe Script: Quarantine, Delete, Delete via BC, Terminate	1088	NVIDIA Driver Helper Service, Version 177.83	(C) NVIDIA Corporation. All rights reserved.	??	160.07 kb, rsAh, created: 16.3.2010 3:37:50, modified: 2.8.2008 6:20:00 Command line:
c:\windows\system32\pnkbstra.exe Script: Quarantine, Delete, Delete via BC, Terminate	504			??	73.30 kb, rsAh, created: 19.12.2009 22:07:29, modified: 23.2.2010 22:26:24 Command line:
PresentationFontCache.exe Script: Quarantine, Delete, Delete via BC, Terminate	3032			??	error getting file info Command line:
c:\windows\rthdcpl.exe Script: Quarantine, Delete, Delete via BC, Terminate	280	Realtek HD Audio Control Panel	Copyright (c) 2004 Realtek Semiconductor Corp.	??	15888.00 kb, rsAh, created: 19.12.2009 20:34:19, modified: 30.10.2006 19:49:54 Command line: "C:\WINDOWS\RTHDCPL.EXE"
c:\windows\system32\rundll32.exe Script: Quarantine, Delete, Delete via BC, Terminate	3956	Run a DLL as an App	© Microsoft Corporation. Vљechna prбva vyhrazena.	??	34.00 kb, rsAh, created: 17.8.2004 14:49:28, modified: 14.4.2008 9:52:44 Command line: "C:\WINDOWS\system32\RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
c:\windows\system32\services.exe Script: Quarantine, Delete, Delete via BC, Terminate	860	Services and Controller app	© Microsoft Corporation. Vљechna prбva vyhrazena.	??	108.50 kb, rsAh, created: 17.8.2004 14:49:28, modified: 9.2.2009 13:25:57 Command line:
c:\windows\system32\spoolsv.exe Script: Quarantine, Delete, Delete via BC, Terminate	1964	Spooler SubSystem App	© Microsoft Corporation. All rights reserved.	??	56.50 kb, rsAh, created: 17.8.2004 14:49:28, modified: 14.4.2008 9:52:50 Command line:
c:\windows\system32\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate	1116	Generic Host Process for Win32 Services	© Microsoft Corporation. All rights reserved.	??	14.00 kb, rsAh, created: 17.8.2004 14:49:28, modified: 14.4.2008 9:52:50 Command line:
c:\windows\system32\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate	1224	Generic Host Process for Win32 Services	© Microsoft Corporation. All rights reserved.	??	14.00 kb, rsAh, created: 17.8.2004 14:49:28, modified: 14.4.2008 9:52:50 Command line:
c:\windows\system32\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate	1280	Generic Host Process for Win32 Services	© Microsoft Corporation. All rights reserved.	??	14.00 kb, rsAh, created: 17.8.2004 14:49:28, modified: 14.4.2008 9:52:50 Command line:
c:\windows\system32\winlogon.exe Script: Quarantine, Delete, Delete via BC, Terminate	816	Windows NT Logon Application	© Microsoft Corporation. Vљechna prбva vyhrazena.	??	534.50 kb, rsAh, created: 17.8.2004 14:49:28, modified: 14.4.2008 9:52:54 Command line:
c:\windows\system32\wbem\wmiapsrv.exe Script: Quarantine, Delete, Delete via BC, Terminate	4028	WMI Performance Adapter Service	© Microsoft Corporation. Vљechna prбva vyhrazena.	??	123.50 kb, rsAh, created: 19.12.2009 20:17:27, modified: 14.4.2008 9:52:54 Command line:
c:\windows\system32\wuauclt.exe Script: Quarantine, Delete, Delete via BC, Terminate	2268	Windows Update	© Microsoft Corporation. All rights reserved.	??	52.22 kb, rsAh, created: 19.12.2009 20:18:33, modified: 6.8.2009 20:24:06 Command line:
Detected:44, recognized as trusted 23

Module name	Handle	Description	Copyright	MD5	Used by processes
C:\Program Files\AVG\AVG9\avgcclix.dll Script: Quarantine, Delete, Delete via BC	268435456	AVG Scanning Core Module - Client Part	Copyright © 2010 AVG Technologies CZ, s.r.o.	--	316
C:\Program Files\AVG\AVG9\avgcertx.dll Script: Quarantine, Delete, Delete via BC	1853358080	AVG Cert SDK	Copyright © 2010 AVG Technologies CZ, s.r.o.	--	3224, 3260
C:\Program Files\AVG\AVG9\avgcfgx.dll Script: Quarantine, Delete, Delete via BC	1787953152	AVG Configuration Module	Copyright © 2010 AVG Technologies CZ, s.r.o.	--	2876, 2444, 3088
C:\Program Files\AVG\AVG9\avgchclx.dll Script: Quarantine, Delete, Delete via BC	1852833792	AVG Cache Manager Module - Client Part	Copyright © 2010 AVG Technologies CZ, s.r.o.	--	3260
C:\Program Files\AVG\AVG9\avgchjwx.dll Script: Quarantine, Delete, Delete via BC	1854341120	AVG Scanning Cache Module	Copyright © 2010 AVG Technologies CZ, s.r.o.	--	3224
C:\Program Files\AVG\AVG9\avgchsvx.exe Script: Quarantine, Delete, Delete via BC	4194304	AVG Cache Server	Copyright © 2010 AVG Technologies CZ, s.r.o.	??	3224
C:\Program Files\AVG\AVG9\avgclitx.dll Script: Quarantine, Delete, Delete via BC	1789329408	AVG Scanning Core Module - Lite Version	Copyright © 2010 AVG Technologies CZ, s.r.o.	--	3224
C:\Program Files\AVG\AVG9\avgcorex.dll Script: Quarantine, Delete, Delete via BC	1789984768	AVG Scanning Core Module	Copyright © 2010 AVG Technologies CZ, s.r.o.	--	3260
C:\Program Files\AVG\AVG9\avgcsrvx.exe Script: Quarantine, Delete, Delete via BC	4194304	AVG Scanning Core Module - Server Part	Copyright © 2010 AVG Technologies CZ, s.r.o.	??	3260
C:\Program Files\AVG\AVG9\avginet.dll Script: Quarantine, Delete, Delete via BC	1806303232	AVG Update downloader	Copyright © 2010 AVG Technologies CZ, s.r.o.	--	2444
C:\Program Files\AVG\AVG9\avglngx.dll Script: Quarantine, Delete, Delete via BC	1807548416	AVG Language Module	Copyright © 2010 AVG Technologies CZ, s.r.o.	--	2876, 3088
C:\Program Files\AVG\AVG9\avglogx.dll Script: Quarantine, Delete, Delete via BC	1808072704	AVG Logging Library	Copyright © 2010 AVG Technologies CZ, s.r.o.	--	3224, 3260, 316, 2876, 2444, 3088
C:\Program Files\AVG\AVG9\avglvex.dll Script: Quarantine, Delete, Delete via BC	74448896	AVG Prevalence Reporting Library	Copyright © 2010 AVG Technologies CZ, s.r.o.	--	3088
C:\Program Files\AVG\AVG9\avgrsx.exe Script: Quarantine, Delete, Delete via BC	4194304	AVG Resident Shield Service	Copyright © 2010 AVG Technologies CZ, s.r.o.	??	316
C:\Program Files\AVG\AVG9\avgse.dll Script: Quarantine, Delete, Delete via BC	1815281664	AVG Shell Extension	Copyright © 2010 AVG Technologies CZ, s.r.o.	--	1376
C:\Program Files\AVG\AVG9\AVGUIRES.DLL Script: Quarantine, Delete, Delete via BC	1829437440	AVG User Interface Resource Library	Copyright © 2010 AVG Technologies CZ, s.r.o.	--	2876
C:\Program Files\AVG\AVG9\avgupd.dll Script: Quarantine, Delete, Delete via BC	1833041920	AVG Update library module	Copyright © 2010 AVG Technologies CZ, s.r.o.	--	2444
C:\Program Files\AVG\AVG9\avgupd.exe Script: Quarantine, Delete, Delete via BC	4194304	AVG Update module	Copyright © 2010 AVG Technologies CZ, s.r.o.	??	2444
C:\Program Files\AVG\AVG9\avgxpl.dll Script: Quarantine, Delete, Delete via BC	1840840704	LinkScanner SDK	Copyright © 2010 AVG Technologies CZ, s.r.o.	--	3088
C:\Program Files\AVG\AVG9\Firefox\components\avgssff.dll Script: Quarantine, Delete, Delete via BC	1818624000	Safe Search for Firefox	Copyright © 2010 AVG Technologies CZ, s.r.o.	--	3088
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE Script: Quarantine, Delete, Delete via BC	4194304	Inkjet Printer/Scanner/Fax Extended Servey Program Service	Copyright CANON INC. 2006-2009 All Rights Reserved	??	1516
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe Script: Quarantine, Delete, Delete via BC	4194304	Canon My Printer	Copyright 2004-2009 CANON INC. All Rights Reserved.	??	2884
C:\Program Files\Canon\MyPrinter\BJMyRes.dll Script: Quarantine, Delete, Delete via BC	268435456	Canon My Printer	Copyright 2004-2009 CANON INC. All Rights Reserved.	--	2884
C:\Program Files\Faronics\Deep Freeze\Install C-0\_$Df\FrzState2k.exe Script: Quarantine, Delete, Delete via BC	4194304	Deep Freeze 6.53 utility	Copyright © 1999-2009 Faronics Corporation	??	2052
C:\Program Files\Faronics\Deep Freeze\Install C-0\DFServ.exe Script: Quarantine, Delete, Delete via BC	4194304	Deep Freeze 6.53 service	Copyright © 1999-2009 Faronics Corporation	??	1048
C:\Program Files\GIGABYTE\Gamer HUD\GBNVAPI.DLL Script: Quarantine, Delete, Delete via BC	3670016			--	2460
C:\Program Files\GIGABYTE\Gamer HUD\HUD.exe Script: Quarantine, Delete, Delete via BC	4194304			??	2460
C:\Program Files\Java\jre6\bin\jqs.exe Script: Quarantine, Delete, Delete via BC	4194304	Java(TM) Quick Starter Service	Copyright © 2004	??	1684
C:\Program Files\Java\jre6\bin\jusched.exe Script: Quarantine, Delete, Delete via BC	4194304	Java(TM) Platform SE binary	Copyright © 2004	??	2868
C:\Program Files\Mozilla Firefox\components\browserdirprovider.dll Script: Quarantine, Delete, Delete via BC	19988480		License: MPL 1.1/GPL 2.0/LGPL 2.1	--	3088
C:\Program Files\Mozilla Firefox\components\brwsrcmp.dll Script: Quarantine, Delete, Delete via BC	20054016		License: MPL 1.1/GPL 2.0/LGPL 2.1	--	3088
C:\Program Files\Mozilla Firefox\firefox.exe Script: Quarantine, Delete, Delete via BC	4194304	Firefox	©Firefox and Mozilla Developers, according to the MPL 1.1/GPL 2.0/LGPL 2.1 licenses, as applicable.	??	3088
C:\Program Files\Mozilla Firefox\freebl3.dll Script: Quarantine, Delete, Delete via BC	63504384	NSS freebl Library		--	3088
C:\Program Files\Mozilla Firefox\js3250.dll Script: Quarantine, Delete, Delete via BC	5111808			--	3088
C:\Program Files\Mozilla Firefox\MOZCRT19.dll Script: Quarantine, Delete, Delete via BC	2014511104	User-Generated Microsoft (R) C/C++ Runtime Library	Copyright (C) Microsoft Corporation.	--	3088
C:\Program Files\Mozilla Firefox\nspr4.dll Script: Quarantine, Delete, Delete via BC	3473408	NSPR Library		--	3088
C:\Program Files\Mozilla Firefox\nss3.dll Script: Quarantine, Delete, Delete via BC	6160384	NSS Base Library		--	3088
C:\Program Files\Mozilla Firefox\nssckbi.dll Script: Quarantine, Delete, Delete via BC	67108864	NSS Builtin Trusted Root CAs		--	3088
C:\Program Files\Mozilla Firefox\nssdbm3.dll Script: Quarantine, Delete, Delete via BC	63373312	Legacy Database Driver		--	3088
C:\Program Files\Mozilla Firefox\nssutil3.dll Script: Quarantine, Delete, Delete via BC	3801088	NSS Utility Library		--	3088
C:\Program Files\Mozilla Firefox\plc4.dll Script: Quarantine, Delete, Delete via BC	3932160	PLC Library		--	3088
C:\Program Files\Mozilla Firefox\plds4.dll Script: Quarantine, Delete, Delete via BC	3997696	PLDS Library		--	3088
C:\Program Files\Mozilla Firefox\plugins\npnul32.dll Script: Quarantine, Delete, Delete via BC	42598400	Default Plug-in	Copyright © 1995-2000	--	3088
C:\Program Files\Mozilla Firefox\smime3.dll Script: Quarantine, Delete, Delete via BC	3670016	NSS S/MIME Library		--	3088
C:\Program Files\Mozilla Firefox\softokn3.dll Script: Quarantine, Delete, Delete via BC	63176704	NSS PKCS #11 Library		--	3088
C:\Program Files\Mozilla Firefox\sqlite3.dll Script: Quarantine, Delete, Delete via BC	2949120	SQLite Database Library		--	3088
C:\Program Files\Mozilla Firefox\ssl3.dll Script: Quarantine, Delete, Delete via BC	6815744	NSS SSL Library		--	3088
C:\Program Files\Mozilla Firefox\xpcom.dll Script: Quarantine, Delete, Delete via BC	4063232		License: MPL 1.1/GPL 2.0/LGPL 2.1	--	3088
C:\Program Files\Mozilla Firefox\xul.dll Script: Quarantine, Delete, Delete via BC	268435456		License: MPL 1.1/GPL 2.0/LGPL 2.1	--	3088
C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll Script: Quarantine, Delete, Delete via BC	1612120064		Copyright © 2008 by Sun Microsystems, Inc.	--	1376
C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\stlport_vc7145.dll Script: Quarantine, Delete, Delete via BC	1603207168	STLport	Copyright (C) Boris Fomitchev	--	1376
C:\Program Files\WinRAR\rarext.dll Script: Quarantine, Delete, Delete via BC	268435456			--	1376
C:\PROGRA~1\AVG\AVG9\avgtray.exe Script: Quarantine, Delete, Delete via BC	4194304	AVG Tray Monitor	Copyright © 2010 AVG Technologies CZ, s.r.o.	??	2876
C:\WINDOWS\Explorer.EXE Script: Quarantine, Delete, Delete via BC	16777216	Prщzkumnнk Windows	© Microsoft Corporation. Vљechna prбva vyhrazena.	??	1376
c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll Script: Quarantine, Delete, Delete via BC	15007744	Microsoft .NET Runtime Common Language Runtime - WorkStation	© Microsoft Corporation. All rights reserved.	--	1684
C:\WINDOWS\system32\avgrsstx.dll Script: Quarantine, Delete, Delete via BC	1813708800	AVG Resident Shield Starter	Copyright © 2010 AVG Technologies CZ, s.r.o.	--	816
C:\WINDOWS\system32\BatMeter.dll Script: Quarantine, Delete, Delete via BC	1957429248	Battery Meter Helper DLL	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	1376
C:\WINDOWS\system32\comctl32.dll Script: Quarantine, Delete, Delete via BC	1566179328	Common Controls Library	© Microsoft Corporation. All rights reserved.	--	2444, 1048, 1376, 2460, 1516, 1684, 2868, 872, 1088, 504, 280, 3956, 1964, 1116, 1224, 1280, 816, 4028
C:\WINDOWS\system32\comdlg32.dll Script: Quarantine, Delete, Delete via BC	1983447040	Common Dialogs DLL	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	4024, 1376, 3088, 2052, 1684, 280, 816
C:\WINDOWS\system32\COMRes.dll Script: Quarantine, Delete, Delete via BC	34865152		Copyright (C) Microsoft Corp. 1995-1999	--	4024, 1376, 3088, 1684, 1964, 1116, 1224, 1280, 816, 4028, 2268
C:\WINDOWS\system32\credui.dll Script: Quarantine, Delete, Delete via BC	39976960	Credential Manager User Interface	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	1376, 1280
C:\WINDOWS\system32\CRYPTUI.dll Script: Quarantine, Delete, Delete via BC	1986396160	Microsoft Trust UI Provider	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	1376, 3088, 1280
C:\WINDOWS\System32\CSCDLL.dll Script: Quarantine, Delete, Delete via BC	1985871872	Offline Network Agent	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	4024, 1376, 3088, 816
C:\WINDOWS\System32\cscui.dll Script: Quarantine, Delete, Delete via BC	36438016	Client Side Caching UI	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	4024, 1376, 3088, 816
C:\WINDOWS\system32\ctfmon.exe Script: Quarantine, Delete, Delete via BC	4194304	CTF Loader	© Microsoft Corporation. All rights reserved.	??	1500
C:\WINDOWS\system32\hnetcfg.dll Script: Quarantine, Delete, Delete via BC	1770717184	Home Networking Configuration Manager	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	2444, 3088, 1684, 872, 504, 1280
C:\WINDOWS\system32\LogonDll.dll Script: Quarantine, Delete, Delete via BC	268435456			--	816
C:\WINDOWS\system32\midimap.dll Script: Quarantine, Delete, Delete via BC	2008809472	Microsoft MIDI Mapper	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	1376, 3088, 280, 816
C:\WINDOWS\system32\MSGINA.dll Script: Quarantine, Delete, Delete via BC	1972699136	Windows NT Logon GINA DLL	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	1376, 816
C:\WINDOWS\system32\MSUTB.dll Script: Quarantine, Delete, Delete via BC	1611792384	MSUTB Server DLL	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	1500, 1376
C:\WINDOWS\system32\MSVFW32.dll Script: Quarantine, Delete, Delete via BC	1973747712	Microsoft Video for Windows DLL	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	2876
C:\WINDOWS\system32\msxml3.dll Script: Quarantine, Delete, Delete via BC	1955921920	MSXML 3.0 SP10	Copyright (C) Microsoft Corporation. 1981-2007	--	1280
C:\WINDOWS\system32\mydocs.dll Script: Quarantine, Delete, Delete via BC	1916731392	My Documents Folder UI	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	1376
C:\WINDOWS\system32\NETSHELL.dll Script: Quarantine, Delete, Delete via BC	37617664	Network Connections Shell	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	1376, 1280
C:\WINDOWS\system32\ntshrui.dll Script: Quarantine, Delete, Delete via BC	1989672960	Shell extensions for sharing	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	1376
C:\WINDOWS\system32\NVRSCS.DLL Script: Quarantine, Delete, Delete via BC	11730944	NVIDIA Czech language resource library	(C) NVIDIA Corporation. All rights reserved.	--	3956
C:\WINDOWS\system32\odbcint.dll Script: Quarantine, Delete, Delete via BC	528744448	Microsoft Data Access - ODBC Resources	Copyright (C) Microsoft Corporation 1990-2000	--	1376, 1684, 816
C:\WINDOWS\system32\ole32.dll Script: Quarantine, Delete, Delete via BC	2001534976	Microsoft OLE for Windows	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	2876, 2444, 4024, 2884, 1500, 1048, 1376, 3088, 2052, 2460, 1684, 2868, 872, 1088, 280, 3956, 1964, 1116, 1224, 1280, 816, 4028, 2268
C:\WINDOWS\system32\psbase.dll Script: Quarantine, Delete, Delete via BC	17956864	Protected Storage default provider	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	872
C:\WINDOWS\System32\RASDLG.dll Script: Quarantine, Delete, Delete via BC	60096512	Remote Access Common Dialog API	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	1280
C:\WINDOWS\system32\RUNDLL32.EXE Script: Quarantine, Delete, Delete via BC	16777216	Run a DLL as an App	© Microsoft Corporation. Vљechna prбva vyhrazena.	??	3956
C:\WINDOWS\system32\SETUPAPI.dll Script: Quarantine, Delete, Delete via BC	9961472	Windows Setup API	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	2444, 4024, 1376, 3088, 2460, 1684, 872, 1088, 280, 3956, 1116, 1224, 1280, 816
C:\WINDOWS\system32\sfc_os.dll Script: Quarantine, Delete, Delete via BC	1992622080	Ochrana souborщ systйmu Windows	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	1964, 1280, 816
C:\WINDOWS\system32\shdoclc.dll Script: Quarantine, Delete, Delete via BC	1904214016	Shell Doc Object and Control Library	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	1376
C:\WINDOWS\system32\SHELL32.dll Script: Quarantine, Delete, Delete via BC	2090598400	Windows Shell Common Dll	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	2876, 2444, 4024, 2884, 1500, 1376, 3088, 2052, 2460, 1516, 1684, 2868, 872, 1088, 504, 280, 3956, 1964, 1116, 1224, 1280, 816, 4028, 2268
C:\WINDOWS\system32\srclient.dll Script: Quarantine, Delete, Delete via BC	1549074432	SR CLIENT DLL	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	2444
C:\WINDOWS\system32\sti.dll Script: Quarantine, Delete, Delete via BC	1941307392	Still Image Devices client DLL	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	1376, 1224
C:\WINDOWS\system32\stobject.dll Script: Quarantine, Delete, Delete via BC	1977090048	Systray shell service object	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	1376
C:\WINDOWS\System32\SXS.DLL Script: Quarantine, Delete, Delete via BC	2120810496	Fusion 2.5	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	1280, 816
C:\WINDOWS\system32\themeui.dll Script: Quarantine, Delete, Delete via BC	1610743808	Windows Theme API	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	1376
C:\WINDOWS\System32\unimdm.tsp Script: Quarantine, Delete, Delete via BC	1474756608	Unimodem 5 Service Provider	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	1280
C:\WINDOWS\system32\USER32.dll Script: Quarantine, Delete, Delete via BC	2117468160	Windows XP USER API Client DLL	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	3224, 2876, 2444, 4024, 2884, 1500, 1048, 1376, 3088, 2052, 2460, 1516, 2936, 1684, 2868, 872, 1088, 504, 280, 3956, 860, 1964, 1116, 1224, 1280, 816, 4028, 2268
C:\WINDOWS\system32\USERENV.dll Script: Quarantine, Delete, Delete via BC	1989869568	Userenv	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	1500, 1376, 3088, 2052, 1684, 872, 1088, 3956, 860, 1964, 1116, 1224, 1280, 816, 4028, 2268
C:\WINDOWS\system32\uxtheme.dll Script: Quarantine, Delete, Delete via BC	1529151488	Microsoft UxTheme Library	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	3224, 2876, 4024, 2884, 1500, 1048, 1376, 3088, 2052, 2460, 2868, 872, 1088, 280, 3956, 1964, 1116, 1224, 1280, 816, 4028, 2268
C:\WINDOWS\system32\webcheck.dll Script: Quarantine, Delete, Delete via BC	1957691392	Web Site Monitor	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	1376
C:\WINDOWS\system32\wiashext.dll Script: Quarantine, Delete, Delete via BC	1515782144	Imaging Devices Shell Folder UI	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	1376
C:\WINDOWS\system32\winlogon.exe Script: Quarantine, Delete, Delete via BC	16777216	Windows NT Logon Application	© Microsoft Corporation. Vљechna prбva vyhrazena.	??	816
C:\WINDOWS\system32\wintrust.dll Script: Quarantine, Delete, Delete via BC	1992425472	Microsoft Trust Verification APIs	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	4024, 1376, 3088, 1088, 504, 280, 1964, 1116, 1224, 1280, 816, 2268
C:\WINDOWS\system32\wpdshext.dll Script: Quarantine, Delete, Delete via BC	371261440	Portable Devices Shell Extension	© Microsoft Corporation. All rights reserved.	--	1376
C:\WINDOWS\system32\wuapi.dll Script: Quarantine, Delete, Delete via BC	1349124096	Windows Update Client API	© Microsoft Corporation. All rights reserved.	--	3088
C:\WINDOWS\system32\xpsp2res.dll Script: Quarantine, Delete, Delete via BC	131006464	Zprбvy aktualizace Service Pack 2	© Microsoft Corporation. Vљechna prбva vyhrazena.	--	4024, 1376, 3088, 1964, 1116, 1224, 1280, 816, 4028, 2268
C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_b77cec8e\MFC80U.DLL Script: Quarantine, Delete, Delete via BC	2016280576	MFCDLL Shared Library - Retail Version	© Microsoft Corporation. All rights reserved.	--	2876
Modules found:368, recognized as trusted 266

Kernel Space Modules Viewer

Module	Base address	Size in memory	Description	Manufacturer
C:\WINDOWS\System32\Drivers\avgldx86.sys Script: Quarantine, Delete, Delete via BC	B475A000	034000 (212992)	AVG AVI Loader Driver	Copyright © 2010 AVG Technologies CZ, s.r.o.
C:\WINDOWS\System32\Drivers\avgmfx86.sys Script: Quarantine, Delete, Delete via BC	B8460000	006000 (24576)	AVG Resident Shield Minifilter Driver	Copyright © 2010 AVG Technologies CZ, s.r.o.
C:\WINDOWS\System32\Drivers\avgtdix.sys Script: Quarantine, Delete, Delete via BC	B48C1000	03A000 (237568)	AVG Network connection watcher	Copyright © 2010 AVG Technologies CZ, s.r.o.
C:\WINDOWS\system32\Drivers\DeepFrz.sys Script: Quarantine, Delete, Delete via BC	B7CF0000	024000 (147456)	Deep Freeze 6.53 driver	Copyright © 1999-2009 Faronics Corporation
C:\WINDOWS\System32\Drivers\dump_atapi.sys Script: Quarantine, Delete, Delete via BC	B467E000	018000 (98304)
C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Script: Quarantine, Delete, Delete via BC	B866E000	002000 (8192)
C:\WINDOWS\gdrv.sys Script: Quarantine, Delete, Delete via BC	B3995000	003000 (12288)	GIGABYTE Tools	Copyright (C) Microsoft Corp. 1981-1999
C:\WINDOWS\System32\LGDispDrv.dll Script: Quarantine, Delete, Delete via BC	BD012000	007000 (28672)	Monitor Rotation Driver for 32 bit WIN2K & WINXP	LG Soft India Copyright © 2007-2008
Modules found - 125, recognized as trusted - 117

Services

Service	Description	Status	File	Group	Dependencies
avg9emc Service: Stop, Delete, Disable	AVG Free E-mail Scanner	Running	C:\Program Files\AVG\AVG9\avgemc.exe Script: Quarantine, Delete, Delete via BC		RPCSS
avg9wd Service: Stop, Delete, Disable	AVG Free WatchDog	Running	C:\Program Files\AVG\AVG9\avgwdsvc.exe Script: Quarantine, Delete, Delete via BC
DFServ Service: Stop, Delete, Disable	DFServ	Running	C:\Program Files\Faronics\Deep Freeze\Install C-0\DFServ.exe Script: Quarantine, Delete, Delete via BC	Boot Bus Extender
IJPLMSVC Service: Stop, Delete, Disable	Canon Inkjet Printer/Scanner/Fax Extended Survey Program	Running	C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE Script: Quarantine, Delete, Delete via BC
JavaQuickStarterService Service: Stop, Delete, Disable	Java Quick Starter	Running	C:\Program Files\Java\jre6\bin\jqs.exe Script: Quarantine, Delete, Delete via BC
ClipSrv Service: Stop, Delete, Disable	Sнќovб schrбnka	Not started	C:\WINDOWS\system32\clipsrv.exe Script: Quarantine, Delete, Delete via BC		NetDDE
GEST Service Service: Stop, Delete, Disable	GEST Service for program management.	Not started	C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe Script: Quarantine, Delete, Delete via BC
mnmsrvc Service: Stop, Delete, Disable	NetMeeting - Vzdбlenй sdнlenн plochy	Not started	C:\WINDOWS\system32\mnmsrvc.exe Script: Quarantine, Delete, Delete via BC
Detected - 99, recognized as trusted - 91

Drivers

Service	Description	Status	File	Group	Dependencies
AvgLdx86 Driver: Unload, Delete, Disable	AVG Free AVI Loader Driver x86	Running	C:\WINDOWS\System32\Drivers\avgldx86.sys Script: Quarantine, Delete, Delete via BC	AVG
AvgMfx86 Driver: Unload, Delete, Disable	AVG Free On-access Scanner Minifilter Driver x86	Running	C:\WINDOWS\System32\Drivers\avgmfx86.sys Script: Quarantine, Delete, Delete via BC	AVG
AvgTdiX Driver: Unload, Delete, Disable	AVG Free Network Redirector	Running	C:\WINDOWS\System32\Drivers\avgtdix.sys Script: Quarantine, Delete, Delete via BC	PNP_TDI
DeepFrz Driver: Unload, Delete, Disable	DeepFrz	Running	C:\WINDOWS\system32\Drivers\DeepFrz.sys Script: Quarantine, Delete, Delete via BC
gdrv Driver: Unload, Delete, Disable	gdrv	Running	C:\WINDOWS\gdrv.sys Script: Quarantine, Delete, Delete via BC
Abiosdsk Driver: Unload, Delete, Disable	Abiosdsk	Not started	Abiosdsk.sys Script: Quarantine, Delete, Delete via BC	Primary disk
abp480n5 Driver: Unload, Delete, Disable	abp480n5	Not started	abp480n5.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
adpu160m Driver: Unload, Delete, Disable	adpu160m	Not started	adpu160m.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
Aha154x Driver: Unload, Delete, Disable	Aha154x	Not started	Aha154x.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
aic78u2 Driver: Unload, Delete, Disable	aic78u2	Not started	aic78u2.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
aic78xx Driver: Unload, Delete, Disable	aic78xx	Not started	aic78xx.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
AliIde Driver: Unload, Delete, Disable	AliIde	Not started	AliIde.sys Script: Quarantine, Delete, Delete via BC	System Bus Extender
amsint Driver: Unload, Delete, Disable	amsint	Not started	amsint.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
asc Driver: Unload, Delete, Disable	asc	Not started	asc.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
asc3350p Driver: Unload, Delete, Disable	asc3350p	Not started	asc3350p.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
asc3550 Driver: Unload, Delete, Disable	asc3550	Not started	asc3550.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
Atdisk Driver: Unload, Delete, Disable	Atdisk	Not started	Atdisk.sys Script: Quarantine, Delete, Delete via BC	Primary disk
cd20xrnt Driver: Unload, Delete, Disable	cd20xrnt	Not started	cd20xrnt.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
Changer Driver: Unload, Delete, Disable	Changer	Not started	Changer.sys Script: Quarantine, Delete, Delete via BC	Filter
CmdIde Driver: Unload, Delete, Disable	CmdIde	Not started	CmdIde.sys Script: Quarantine, Delete, Delete via BC	System Bus Extender
Cpqarray Driver: Unload, Delete, Disable	Cpqarray	Not started	Cpqarray.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
cpuz130 Driver: Unload, Delete, Disable	cpuz130	Not started	C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\cpuz130\cpuz_x32.sys Script: Quarantine, Delete, Delete via BC
dac960nt Driver: Unload, Delete, Disable	dac960nt	Not started	dac960nt.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
dpti2o Driver: Unload, Delete, Disable	dpti2o	Not started	dpti2o.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
ENTECH Driver: Unload, Delete, Disable	ENTECH	Not started	C:\WINDOWS\system32\DRIVERS\ENTECH.sys Script: Quarantine, Delete, Delete via BC
etdrv Driver: Unload, Delete, Disable	etdrv	Not started	C:\WINDOWS\etdrv.sys Script: Quarantine, Delete, Delete via BC
EverestDriver Driver: Unload, Delete, Disable	Lavalys EVEREST Kernel Driver	Not started	C:\Program Files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt Script: Quarantine, Delete, Delete via BC
hpn Driver: Unload, Delete, Disable	hpn	Not started	hpn.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
i2omgmt Driver: Unload, Delete, Disable	i2omgmt	Not started	i2omgmt.sys Script: Quarantine, Delete, Delete via BC	SCSI Class
i2omp Driver: Unload, Delete, Disable	i2omp	Not started	i2omp.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
ini910u Driver: Unload, Delete, Disable	ini910u	Not started	ini910u.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
IntelIde Driver: Unload, Delete, Disable	IntelIde	Not started	IntelIde.sys Script: Quarantine, Delete, Delete via BC	System Bus Extender
lbrtfdc Driver: Unload, Delete, Disable	lbrtfdc	Not started	lbrtfdc.sys Script: Quarantine, Delete, Delete via BC	System Bus Extender
LGDDCDevice Driver: Unload, Delete, Disable	LGDDCDevice	Not started	C:\Program Files\LG Soft India\forteManager\bin\I2CDriver.sys Script: Quarantine, Delete, Delete via BC
LGII2CDevice Driver: Unload, Delete, Disable	LGII2CDevice	Not started	C:\Program Files\LG Soft India\forteManager\bin\PII2CDriver.sys Script: Quarantine, Delete, Delete via BC
mraid35x Driver: Unload, Delete, Disable	mraid35x	Not started	mraid35x.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
PCIDump Driver: Unload, Delete, Disable	PCIDump	Not started	PCIDump.sys Script: Quarantine, Delete, Delete via BC	PCI Configuration
PDCOMP Driver: Unload, Delete, Disable	PDCOMP	Not started	PDCOMP.sys Script: Quarantine, Delete, Delete via BC
PDFRAME Driver: Unload, Delete, Disable	PDFRAME	Not started	PDFRAME.sys Script: Quarantine, Delete, Delete via BC
PDRELI Driver: Unload, Delete, Disable	PDRELI	Not started	PDRELI.sys Script: Quarantine, Delete, Delete via BC
PDRFRAME Driver: Unload, Delete, Disable	PDRFRAME	Not started	PDRFRAME.sys Script: Quarantine, Delete, Delete via BC
perc2 Driver: Unload, Delete, Disable	perc2	Not started	perc2.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
perc2hib Driver: Unload, Delete, Disable	perc2hib	Not started	perc2hib.sys Script: Quarantine, Delete, Delete via BC	Filter
ql1080 Driver: Unload, Delete, Disable	ql1080	Not started	ql1080.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
Ql10wnt Driver: Unload, Delete, Disable	Ql10wnt	Not started	Ql10wnt.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
ql12160 Driver: Unload, Delete, Disable	ql12160	Not started	ql12160.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
ql1240 Driver: Unload, Delete, Disable	ql1240	Not started	ql1240.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
ql1280 Driver: Unload, Delete, Disable	ql1280	Not started	ql1280.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
Simbad Driver: Unload, Delete, Disable	Simbad	Not started	Simbad.sys Script: Quarantine, Delete, Delete via BC	Filter
Sparrow Driver: Unload, Delete, Disable	Sparrow	Not started	Sparrow.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
sym_hi Driver: Unload, Delete, Disable	sym_hi	Not started	sym_hi.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
sym_u3 Driver: Unload, Delete, Disable	sym_u3	Not started	sym_u3.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
symc810 Driver: Unload, Delete, Disable	symc810	Not started	symc810.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
symc8xx Driver: Unload, Delete, Disable	symc8xx	Not started	symc8xx.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
TosIde Driver: Unload, Delete, Disable	TosIde	Not started	TosIde.sys Script: Quarantine, Delete, Delete via BC	System Bus Extender
ultra Driver: Unload, Delete, Disable	ultra	Not started	ultra.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
ViaIde Driver: Unload, Delete, Disable	ViaIde	Not started	ViaIde.sys Script: Quarantine, Delete, Delete via BC	System Bus Extender
WDICA Driver: Unload, Delete, Disable	WDICA	Not started	WDICA.sys Script: Quarantine, Delete, Delete via BC
Detected - 186, recognized as trusted - 128

Autoruns

File name	Status	Startup method	Description
C:\PROGRA~1\AVG\AVG9\avgemc.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\AvgEms, EventMessageFile Delete
C:\PROGRA~1\AVG\AVG9\avgtray.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, AVG9_TRAY Delete
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\IJPLMSVC, EventMessageFile Delete
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, CanonMyPrinter Delete
C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, CanonSolutionMenu Delete
C:\Program Files\Common Files\Microsoft Shared\Speech\sapi.cpl Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cpls, Speech Delete
C:\Program Files\Electronic Arts\EADM\Core.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_CURRENT_USER, Software\Microsoft\Windows\CurrentVersion\Run, EA Core Delete
C:\Program Files\Foxit Software\Foxit Reader\Foxit Reader.exe Script: Quarantine, Delete, Delete via BC	Active	Shortcut in Startup folder	C:\Documents and Settings\Administrator\Data aplikacн\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\Administrator\Data aplikacн\Microsoft\Internet Explorer\Quick Launch\Foxit Reader.lnk,
C:\Program Files\GIGABYTE\Gamer HUD\HUD.exe Script: Quarantine, Delete, Delete via BC	Active	Shortcut in Startup folder	C:\Documents and Settings\Administrator\Nabнdka Start\Programy\Po spuљtмnн\, C:\Documents and Settings\Administrator\Nabнdka Start\Programy\Po spuљtмnн\GIGABYTE Gamer HUD.lnk,
C:\Program Files\ICQ6.5\ICQ.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_CURRENT_USER, Software\Microsoft\Windows\CurrentVersion\Run, ICQ Delete
C:\Program Files\ITE\Smart Guardian\ITESMART.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, SmartGuardian Delete
C:\Program Files\Java\jre6\bin\jqs.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\JavaQuickStarterService, EventMessageFile Delete
C:\Program Files\Java\jre6\bin\jusched.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, SunJavaUpdateSched Delete
C:\Program Files\LG Soft India\forteManager\bin\Monitor.exe Script: Quarantine, Delete, Delete via BC	Active	Shortcut in Startup folder	C:\Documents and Settings\All Users\Nabнdka Start\Programy\Po spuљtмnн\, C:\Documents and Settings\All Users\Nabнdka Start\Programy\Po spuљtмnн\forteManager.lnk,
C:\Program Files\Mozilla Firefox\firefox.exe Script: Quarantine, Delete, Delete via BC	Active	Shortcut in Startup folder	C:\Documents and Settings\Administrator\Data aplikacн\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\Administrator\Data aplikacн\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk,
C:\Program Files\QIP Infium\infium.exe Script: Quarantine, Delete, Delete via BC	Active	Shortcut in Startup folder	C:\Documents and Settings\Administrator\Data aplikacн\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\Administrator\Data aplikacн\Microsoft\Internet Explorer\Quick Launch\QIP Infium.lnk,
C:\Program Files\Vista Drive Icon\DrvIcon.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, DrvIcon Delete
C:\WINDOWS\MemSave\MemSet.exe Script: Quarantine, Delete, Delete via BC	Active	Shortcut in Startup folder	C:\Documents and Settings\Administrator\Nabнdka Start\Programy\Po spuљtмnн\, C:\Documents and Settings\Administrator\Nabнdka Start\Programy\Po spuљtмnн\MemSet.exe.lnk,
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpCtr.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Event Viewer, MicrosoftRedirectionProgram Delete
C:\WINDOWS\System32\PrintFilterPipelineSvc.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PrintFilterPipelineSvc, EventMessageFile Delete
C:\WINDOWS\System32\appmgr.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Software Installation, EventMessageFile Delete
C:\WINDOWS\System32\comres.dll;C:\WINDOWS\System32\xpsp2res.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\MSDTC, EventMessageFile Delete
C:\WINDOWS\System32\comres.dll;C:\WINDOWS\System32\xpsp2res.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\MSDTC Client, EventMessageFile Delete
C:\WINDOWS\System32\cscript.exe Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SOFTWARE\Microsoft\Windows Scripting Host\Locations, CScript
C:\WINDOWS\System32\cscui.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}, DLLName Delete
C:\WINDOWS\System32\cscui.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Offline Files, EventMessageFile Delete
C:\WINDOWS\System32\drwtsn32.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\DrWatson, EventMessageFile Delete
C:\WINDOWS\System32\els.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Security, DisplayNameFile Delete
C:\WINDOWS\System32\hidserv.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\HidServ\Parameters, ServiceDll Delete
C:\WINDOWS\System32\igmpv2.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile Delete
C:\WINDOWS\System32\ipbootp.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile Delete
C:\WINDOWS\System32\iprip2.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile Delete
C:\WINDOWS\System32\msshavmsg.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\MSSHA, EventMessageFile Delete
C:\WINDOWS\System32\ntbackup.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\ntbackup, EventMessageFile Delete
C:\WINDOWS\System32\ospf.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPF, EventMessageFile Delete
C:\WINDOWS\System32\ospfmib.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPFMib, EventMessageFile Delete
C:\WINDOWS\System32\pautoenr.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\AutoEnrollment, EventMessageFile Delete
C:\WINDOWS\System32\perfmon.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Perfmon, EventMessageFile Delete
C:\WINDOWS\System32\polagent.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PolicyAgent, EventMessageFile Delete
C:\WINDOWS\System32\sfc_os.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Windows File Protection, EventMessageFile Delete
C:\WINDOWS\System32\spmsg.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\NtServicePack, EventMessageFile Delete
C:\WINDOWS\System32\spmsg.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\WindowsMedia, EventMessageFile Delete
C:\WINDOWS\System32\spmsg.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Wudf01000, EventMessageFile Delete
C:\WINDOWS\System32\sxs.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\SideBySide, EventMessageFile Delete
C:\WINDOWS\System32\syssetup.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Setup, EventMessageFile Delete
C:\WINDOWS\System32\tssdis.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\TermServSessDir, EventMessageFile Delete
C:\WINDOWS\System32\user32.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\USER32, EventMessageFile Delete
C:\WINDOWS\System32\userenv.dll;C:\WINDOWS\System32\xpsp1res.dll;C:\WINDOWS\System32\xpsp2res.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Userenv, EventMessageFile Delete
C:\WINDOWS\System32\winlogon.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Autochk, EventMessageFile Delete
C:\WINDOWS\System32\winlogon.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Winlogon, EventMessageFile Delete
C:\WINDOWS\System32\xpsp2res.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\MSSQLSERVER/MSDE, EventMessageFile Delete
C:\WINDOWS\System32\xpsp2res.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Remote Assistance, EventMessageFile Delete
C:\WINDOWS\System32\xpsp2res.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Starter, EventMessageFile Delete
C:\WINDOWS\System32\xpsp2res.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Http, EventMessageFile Delete
C:\WINDOWS\System32\xpsp3res.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\RPC, EventMessageFile Delete
C:\WINDOWS\system32\COMRes.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\COM+, EventMessageFile Delete
C:\WINDOWS\system32\COMRes.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\EventSystem, EventMessageFile Delete
C:\WINDOWS\system32\CTFMON.EXE Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_USERS, .DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run, CTFMON.EXE Delete
C:\WINDOWS\system32\CTFMON.EXE Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_USERS, S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run, CTFMON.EXE Delete
C:\WINDOWS\system32\CTFMON.EXE Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_USERS, S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run, CTFMON.EXE Delete
C:\WINDOWS\system32\CTFMON.EXE Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_USERS, S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run, CTFMON.EXE Delete
C:\WINDOWS\system32\KB905474\wgasetup.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\WgaSetup, EventMessageFile Delete
C:\WINDOWS\system32\MsSip1.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 1, $DLL Delete
C:\WINDOWS\system32\MsSip2.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 2, $DLL Delete
C:\WINDOWS\system32\MsSip3.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 3, $DLL Delete
C:\WINDOWS\system32\NIWRAD~1.SCR Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_CURRENT_USER, Control Panel\Desktop, scrnsave.exe Delete
C:\WINDOWS\system32\NIWRAD~1.SCR Script: Quarantine, Delete, Delete via BC	Active	File system.ini	C:\WINDOWS\system.ini, boot, SCRNSAVE.EXE
C:\WINDOWS\system32\SHELL32.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad, PostBootReminder Delete
C:\WINDOWS\system32\SHELL32.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad, CDBurn Delete
C:\WINDOWS\system32\cleanmgr.exe /D %c Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\cleanuppath,
C:\WINDOWS\system32\cmd.exe Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\Environment, ComSpec
C:\WINDOWS\system32\ctfmon.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_CURRENT_USER, Software\Microsoft\Windows\CurrentVersion\Run, CTFMON.EXE Delete
C:\WINDOWS\system32\digest.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\SecurityProviders, SecurityProviders
C:\WINDOWS\system32\els.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application, DisplayNameFile Delete
C:\WINDOWS\system32\els.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System, DisplayNameFile Delete
C:\WINDOWS\system32\frapsvid.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, VIDC.FPS1 Delete
C:\WINDOWS\system32\gptext.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}, DLLName Delete
C:\WINDOWS\system32\gptext.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{426031c0-0b47-4852-b0ca-ac3d37bfcb39}, DLLName Delete
C:\WINDOWS\system32\gptext.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{42B5FAAE-6536-11d2-AE5A-0000F87571E3}, DLLName Delete
C:\WINDOWS\system32\gptext.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{e437bc1c-aa7d-11d2-a382-00c04f991e27}, DLLName Delete
C:\WINDOWS\system32\midimap.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, midimapper Delete
C:\WINDOWS\system32\midimap.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32\Terminal Server\RDP, midimapper Delete
C:\WINDOWS\system32\ntbackup.exe Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\BackupPath,
C:\WINDOWS\system32\progman.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, shell Delete
C:\WINDOWS\system32\psxss.exe Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
C:\WINDOWS\system32\shell32.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks, {AEB6717E-7E19-11d0-97EE-00C04FD91972} Delete
C:\WINDOWS\system32\stisvc.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System, EventMessageFile Delete
C:\WINDOWS\system32\stobject.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad, SysTray Delete
C:\WINDOWS\system32\webcheck.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad, WebCheck Delete
C:\WINDOWS\system32\wuaucpl.cpl;C:\WINDOWS\system32\wuaucpl.cpl.mui Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Windows Update Agent, EventMessageFile Delete
C:\WINDOWS\system32\xpsp2res.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\SecurityCenter, EventMessageFile Delete
C:\WINDOWS\system32\xvid.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, vidc.xvid Delete
LogonDll.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\DfLogon, DLLName Delete
Magnify.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Accessibility\Utility Manager\Magnifier, Application path Delete
avgrsstx.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avgrsstarter, DLLName Delete
c:\WINDOWS\system32\xlive.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\XLive, EventMessageFile Delete
cscdll.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll, DLLName Delete
kbd101.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver JPN Delete
kbd101a.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver KOR Delete
m‘\|\ь Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, GEST Delete
mvfs32.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_USERS, .DEFAULT\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_USERS, S-1-5-19\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_USERS, S-1-5-20\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_USERS, S-1-5-18\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_CURRENT_USER, Control Panel\IOProcs, MVB Delete
osk.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Accessibility\Utility Manager\On-Screen Keyboard, Application path Delete
psbase.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SOFTWARE\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb, Image Path Delete
vgafix.fon Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon Delete
vgaoem.fon Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon Delete
vgasys.fon Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon Delete
Autoruns items found - 583, recognized as trusted - 473

Internet Explorer extension modules (BHOs, Toolbars ...)

File name	Type	Description	Manufacturer	CLSID
C:\Program Files\AVG\AVG9\avgssie.dll Script: Quarantine, Delete, Delete via BC	BHO	Safe Search for Internet Explorer	Copyright © 2010 AVG Technologies CZ, s.r.o.	{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} Delete
C:\Program Files\Java\jre6\bin\jp2ssv.dll Script: Quarantine, Delete, Delete via BC	BHO	Java(TM) Platform SE binary	Copyright © 2004	{DBC80044-A445-435b-BC74-9C25C1C588A9} Delete
C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll Script: Quarantine, Delete, Delete via BC	BHO	Java(TM) Quick Starter binary	Copyright © 2004	{E7E6F031-17CE-4C07-BC86-EABFE594F69C} Delete
C:\WINDOWS\system32\dvmurl.dll Script: Quarantine, Delete, Delete via BC	URLSearchHook	DeviceVM Url Search Hook	(c) Copyright 2007-2008 DeviceVM, Inc.	{0063BF63-BFFF-4B8F-9D26-4267DF7F17DD} Delete
Items found - 9, recognized as trusted - 5

Windows Explorer extension modules

File name	Destination	Description	Manufacturer	CLSID
C:\WINDOWS\system32\mmsys.cpl Script: Quarantine, Delete, Delete via BC	Strбnka vlastnostн multimediбlnнho souboru	Control Panel Drivers Applet	© Microsoft Corporation. Vљechna prбva vyhrazena.	{00022613-0000-0000-C000-000000000046} Delete
C:\WINDOWS\system32\icmui.dll Script: Quarantine, Delete, Delete via BC	Sprбva skeneru s korekcн ICM	Microsoft Color Matching System User Interface DLL	© Microsoft Corporation. Vљechna prбva vyhrazena.	{176d6597-26d3-11d1-b350-080036a75b03} Delete
C:\WINDOWS\system32\ntshrui.dll Script: Quarantine, Delete, Delete via BC	Rozљншenн prostшedн pro sdнlenн	Shell extensions for sharing	© Microsoft Corporation. Vљechna prбva vyhrazena.	{40dd6e20-7c17-11ce-a804-00aa003ca9f6} Delete
C:\WINDOWS\system32\themeui.dll Script: Quarantine, Delete, Delete via BC	PlusPack CPL Extension	Windows Theme API	© Microsoft Corporation. Vљechna prбva vyhrazena.	{41E300E0-78B6-11ce-849B-444553540000} Delete
C:\WINDOWS\system32\deskadp.dll Script: Quarantine, Delete, Delete via BC	Rozљншenн panelu Zobrazenн pro grafickэ adaptйr	Advanced display adapter properties	© Microsoft Corporation. Vљechna prбva vyhrazena.	{42071712-76d4-11d1-8b24-00a0c9068ff3} Delete
C:\WINDOWS\system32\deskmon.dll Script: Quarantine, Delete, Delete via BC	Rozљншenн panelu Zobrazenн pro monitor	Advanced display monitor properties	© Microsoft Corporation. Vљechna prбva vyhrazena.	{42071713-76d4-11d1-8b24-00a0c9068ff3} Delete
deskpan.dll Script: Quarantine, Delete, Delete via BC	Rozљншenн panelu Zobrazenн pro panoramatickй zobrazenн			{42071714-76d4-11d1-8b24-00a0c9068ff3} Delete
C:\WINDOWS\system32\shscrap.dll Script: Quarantine, Delete, Delete via BC	Popisovaи dat vэstшiћku prostшedн	Shell scrap object handler	© Microsoft Corporation. Vљechna prбva vyhrazena.	{56117100-C0CD-101B-81E2-00AA004AE837} Delete
C:\WINDOWS\system32\diskcopy.dll Script: Quarantine, Delete, Delete via BC	Rozљншenн programu Kopнrovбnн disku	Program DiskCopy systйmu Windows	© Microsoft Corporation. Vљechna prбva vyhrazena.	{59099400-57FF-11CE-BD94-0020AF85B590} Delete
C:\WINDOWS\system32\ntlanui2.dll Script: Quarantine, Delete, Delete via BC	Rozљншenн prostшedн pro objekty sнtм Microsoft Windows Network	Network object shell UI	© Microsoft Corporation. Vљechna prбva vyhrazena.	{59be4990-f85c-11ce-aff7-00aa003ca9f6} Delete
C:\WINDOWS\System32\icmui.dll Script: Quarantine, Delete, Delete via BC	Sprбva monitoru s korekcн ICM	Microsoft Color Matching System User Interface DLL	© Microsoft Corporation. Vљechna prбva vyhrazena.	{5DB2625A-54DF-11D0-B6C4-0800091AA605} Delete
C:\WINDOWS\system32\icmui.dll Script: Quarantine, Delete, Delete via BC	Sprбva tiskбrny s korekcн ICM	Microsoft Color Matching System User Interface DLL	© Microsoft Corporation. Vљechna prбva vyhrazena.	{675F097E-4C4D-11D0-B6C1-0800091AA605} Delete
	Rozљншenн prostшedн pro kompresi souborщ			{764BF0E1-F219-11ce-972D-00AA00A14F56} Delete
C:\WINDOWS\system32\printui.dll Script: Quarantine, Delete, Delete via BC	Rozљншenн prostшedн o tiskбrnu v sнti WWW	Print UI DLL	© Microsoft Corporation. Vљechna prбva vyhrazena.	{77597368-7b15-11d0-a0c2-080036af3f03} Delete
	Kontextovб nabнdka љifrovбnн			{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} Delete
C:\WINDOWS\system32\syncui.dll Script: Quarantine, Delete, Delete via BC	Aktovka	Aktovka systйmu Windows	© Microsoft Corporation. Vљechna prбva vyhrazena.	{85BBD920-42A0-1069-A2E4-08002B30309D} Delete
C:\WINDOWS\system32\hticons.dll Script: Quarantine, Delete, Delete via BC	Rozљншenн ikony programu HyperTerminal			{88895560-9AA2-1069-930E-00AA0030EBC8} Delete
C:\WINDOWS\system32\fontext.dll Script: Quarantine, Delete, Delete via BC	Fonts	Windows Font Folder	© Microsoft Corporation. Vљechna prбva vyhrazena.	{BD84B380-8CA2-1069-AB1D-08000948F534} Delete
C:\WINDOWS\system32\icmui.dll Script: Quarantine, Delete, Delete via BC	Profil ICC	Microsoft Color Matching System User Interface DLL	© Microsoft Corporation. Vљechna prбva vyhrazena.	{DBCE2480-C732-101B-BE72-BA78E9AD5B27} Delete
C:\WINDOWS\system32\ntshrui.dll Script: Quarantine, Delete, Delete via BC	Rozљншenн prostшedн pro sdнlenн	Shell extensions for sharing	© Microsoft Corporation. Vљechna prбva vyhrazena.	{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} Delete
C:\WINDOWS\system32\deskperf.dll Script: Quarantine, Delete, Delete via BC	Display TroubleShoot CPL Extension	Advanced display performance properties	© Microsoft Corporation. Vљechna prбva vyhrazena.	{f92e8c40-3d33-11d2-b1aa-080036a75b03} Delete
C:\WINDOWS\system32\NETSHELL.dll Script: Quarantine, Delete, Delete via BC	Sнќovб pшipojenн	Network Connections Shell	© Microsoft Corporation. Vљechna prбva vyhrazena.	{7007ACC7-3202-11D1-AAD2-00805FC1270E} Delete
C:\WINDOWS\system32\NETSHELL.dll Script: Quarantine, Delete, Delete via BC	Sнќovб pшipojenн	Network Connections Shell	© Microsoft Corporation. Vљechna prбva vyhrazena.	{992CFFA0-F557-101A-88EC-00DD010CCC48} Delete
C:\WINDOWS\system32\wiashext.dll Script: Quarantine, Delete, Delete via BC	Skenery a fotoaparбty	Imaging Devices Shell Folder UI	© Microsoft Corporation. Vљechna prбva vyhrazena.	{E211B736-43FD-11D1-9EFB-0000F8757FCD} Delete
C:\WINDOWS\system32\wiashext.dll Script: Quarantine, Delete, Delete via BC	Skenery a fotoaparбty	Imaging Devices Shell Folder UI	© Microsoft Corporation. Vљechna prбva vyhrazena.	{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD} Delete
C:\WINDOWS\system32\wiashext.dll Script: Quarantine, Delete, Delete via BC	Skenery a fotoaparбty	Imaging Devices Shell Folder UI	© Microsoft Corporation. Vљechna prбva vyhrazena.	{905667aa-acd6-11d2-8080-00805f6596d2} Delete
C:\WINDOWS\system32\wiashext.dll Script: Quarantine, Delete, Delete via BC	Skenery a fotoaparбty	Imaging Devices Shell Folder UI	© Microsoft Corporation. Vљechna prбva vyhrazena.	{3F953603-1008-4f6e-A73A-04AAC7A992F1} Delete
C:\WINDOWS\system32\wiashext.dll Script: Quarantine, Delete, Delete via BC	Skenery a fotoaparбty	Imaging Devices Shell Folder UI	© Microsoft Corporation. Vљechna prбva vyhrazena.	{83bbcbf3-b28a-4919-a5aa-73027445d672} Delete
C:\WINDOWS\system32\remotepg.dll Script: Quarantine, Delete, Delete via BC	Remote Sessions CPL Extension	Remote Sessions CPL Extension	© Microsoft Corporation. Vљechna prбva vyhrazena.	{F0152790-D56E-4445-850E-4F3117DB740C} Delete
C:\WINDOWS\system32\mstask.dll Script: Quarantine, Delete, Delete via BC	Tasks Folder Icon Handler	Task Scheduler interface DLL	© Microsoft Corporation. Vљechna prбva vyhrazena.	{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF} Delete
C:\WINDOWS\system32\mstask.dll Script: Quarantine, Delete, Delete via BC	Tasks Folder Shell Extension	Task Scheduler interface DLL	© Microsoft Corporation. Vљechna prбva vyhrazena.	{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF} Delete
C:\WINDOWS\system32\mstask.dll Script: Quarantine, Delete, Delete via BC	Naplбnovanй ъlohy	Task Scheduler interface DLL	© Microsoft Corporation. Vљechna prбva vyhrazena.	{D6277990-4C6A-11CF-8D87-00AA0060F5BF} Delete
C:\WINDOWS\system32\wuaucpl.cpl Script: Quarantine, Delete, Delete via BC	Auto Update Property Sheet Extension	Automatic Updates Control Panel	© Microsoft Corporation. All rights reserved.	{5F327514-6C5E-4d60-8F16-D07FA08A78ED} Delete
	Hlavnн panel a nabнdka Start			{0DF44EAA-FF21-4412-828E-260A8728E7F1} Delete
C:\WINDOWS\system32\sendmail.dll Script: Quarantine, Delete, Delete via BC	Sendmail service	Send Mail	© Microsoft Corporation. Vљechna prбva vyhrazena.	{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE} Delete
C:\WINDOWS\system32\sendmail.dll Script: Quarantine, Delete, Delete via BC	Sendmail service	Send Mail	© Microsoft Corporation. Vљechna prбva vyhrazena.	{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE} Delete
C:\WINDOWS\system32\occache.dll Script: Quarantine, Delete, Delete via BC	Sloћka mezipamмti pro kуdy ActiveX	Object Control Viewer	© Microsoft Corporation. Vљechna prбva vyhrazena.	{88C6C381-2E85-11D0-94DE-444553540000} Delete
C:\WINDOWS\system32\webcheck.dll Script: Quarantine, Delete, Delete via BC	WebCheck	Web Site Monitor	© Microsoft Corporation. Vљechna prбva vyhrazena.	{E6FB5E20-DE35-11CF-9C87-00AA005127ED} Delete
C:\WINDOWS\system32\webcheck.dll Script: Quarantine, Delete, Delete via BC	Subscription Mgr	Web Site Monitor	© Microsoft Corporation. Vљechna prбva vyhrazena.	{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE} Delete
C:\WINDOWS\system32\webcheck.dll Script: Quarantine, Delete, Delete via BC	Sloћka odbмrщ	Web Site Monitor	© Microsoft Corporation. Vљechna prбva vyhrazena.	{F5175861-2688-11d0-9C5E-00AA00A45957} Delete
C:\WINDOWS\system32\webcheck.dll Script: Quarantine, Delete, Delete via BC	WebCheckWebCrawler	Web Site Monitor	© Microsoft Corporation. Vљechna prбva vyhrazena.	{08165EA0-E946-11CF-9C87-00AA005127ED} Delete
C:\WINDOWS\system32\webcheck.dll Script: Quarantine, Delete, Delete via BC	WebCheckChannelAgent	Web Site Monitor	© Microsoft Corporation. Vљechna prбva vyhrazena.	{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB} Delete
C:\WINDOWS\system32\webcheck.dll Script: Quarantine, Delete, Delete via BC	TrayAgent	Web Site Monitor	© Microsoft Corporation. Vљechna prбva vyhrazena.	{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7} Delete
C:\WINDOWS\system32\webcheck.dll Script: Quarantine, Delete, Delete via BC	Code Download Agent	Web Site Monitor	© Microsoft Corporation. Vљechna prбva vyhrazena.	{7D559C10-9FE9-11d0-93F7-00AA0059CE02} Delete
C:\WINDOWS\system32\webcheck.dll Script: Quarantine, Delete, Delete via BC	ConnectionAgent	Web Site Monitor	© Microsoft Corporation. Vљechna prбva vyhrazena.	{E6CC6978-6B6E-11D0-BECA-00C04FD940BE} Delete
C:\WINDOWS\system32\webcheck.dll Script: Quarantine, Delete, Delete via BC	PostAgent	Web Site Monitor	© Microsoft Corporation. Vљechna prбva vyhrazena.	{D8BD2030-6FC9-11D0-864F-00AA006809D9} Delete
C:\WINDOWS\system32\webcheck.dll Script: Quarantine, Delete, Delete via BC	WebCheck SyncMgr Handler	Web Site Monitor	© Microsoft Corporation. Vљechna prбva vyhrazena.	{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB} Delete
C:\WINDOWS\system32\shimgvw.dll Script: Quarantine, Delete, Delete via BC	Shell Image Verbs	Prohlнћeи obrбzkщ a faxщ	© Microsoft Corporation. Vљechna prбva vyhrazena.	{e84fda7c-1d6a-45f6-b725-cb260c236066} Delete
C:\WINDOWS\system32\shimgvw.dll Script: Quarantine, Delete, Delete via BC	Shell Image Data Factory	Prohlнћeи obrбzkщ a faxщ	© Microsoft Corporation. Vљechna prбva vyhrazena.	{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178} Delete
rundll32.exe C:\WINDOWS\system32\shimgvw.dll,ImageView_COMServer {00E7B358-F65B-4dcf-83DF-CD026B94BFD4} Script: Quarantine, Delete, Delete via BC	Autoplay for SlideShow			{00E7B358-F65B-4dcf-83DF-CD026B94BFD4} Delete
C:\WINDOWS\system32\shimgvw.dll Script: Quarantine, Delete, Delete via BC	Extraktor miniatur souborщ GDI+	Prohlнћeи obrбzkщ a faxщ	© Microsoft Corporation. Vљechna prбva vyhrazena.	{3F30C968-480A-4C6C-862D-EFC0897BB84B} Delete
C:\WINDOWS\system32\shimgvw.dll Script: Quarantine, Delete, Delete via BC	Popisovaи miniatur souhrnnэch informacн (DOCFILES)	Prohlнћeи obrбzkщ a faxщ	© Microsoft Corporation. Vљechna prбva vyhrazena.	{9DBD2C50-62AD-11d0-B806-00C04FD706EC} Delete
C:\WINDOWS\system32\shimgvw.dll Script: Quarantine, Delete, Delete via BC	Extraktor miniatur HTML	Prohlнћeи obrбzkщ a faxщ	© Microsoft Corporation. Vљechna prбva vyhrazena.	{EAB841A0-9550-11cf-8C16-00805F1408F3} Delete
C:\WINDOWS\system32\shimgvw.dll Script: Quarantine, Delete, Delete via BC	Shell Image Property Handler	Prohlнћeи obrбzkщ a faxщ	© Microsoft Corporation. Vљechna prбva vyhrazena.	{eb9b1153-3b57-4e68-959a-a3266bc3d7fe} Delete
C:\WINDOWS\system32\netplwiz.dll Script: Quarantine, Delete, Delete via BC	Prщvodce publikovбnнm na webu	Map Network Drives/Network Places Wizard	© Microsoft Corporation. Vљechna prбva vyhrazena.	{CC6EEFFB-43F6-46c5-9619-51D571967F7D} Delete
C:\WINDOWS\system32\netplwiz.dll Script: Quarantine, Delete, Delete via BC	Objednбvбnн tisku pшes web	Map Network Drives/Network Places Wizard	© Microsoft Corporation. Vљechna prбva vyhrazena.	{add36aa8-751a-4579-a266-d66f5202ccbb} Delete
C:\WINDOWS\system32\netplwiz.dll Script: Quarantine, Delete, Delete via BC	Objekt prostшedн Prщvodce publikovбnнm	Map Network Drives/Network Places Wizard	© Microsoft Corporation. Vљechna prбva vyhrazena.	{6b33163c-76a5-4b6c-bf21-45de9cd503a1} Delete
C:\WINDOWS\system32\netplwiz.dll Script: Quarantine, Delete, Delete via BC	Prщvodce zнskбnнm ъиtu sluћby Passport	Map Network Drives/Network Places Wizard	© Microsoft Corporation. Vљechna prбva vyhrazena.	{58f1f272-9240-4f51-b6d4-fd63d1618591} Delete
	Uћivatelskй ъиty			{7A9D77BD-5403-11d2-8785-2E0420524153} Delete
C:\WINDOWS\system32\zipfldr.dll Script: Quarantine, Delete, Delete via BC	Komprimovanб sloћka (metoda ZIP)	Komprimovanй sloћky (metoda ZIP)	© Microsoft Corporation. Vљechna prбva vyhrazena.	{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31} Delete
C:\WINDOWS\system32\zipfldr.dll Script: Quarantine, Delete, Delete via BC	Compressed (zipped) Folder Right Drag Handler	Komprimovanй sloћky (metoda ZIP)	© Microsoft Corporation. Vљechna prбva vyhrazena.	{BD472F60-27FA-11cf-B8B4-444553540000} Delete
C:\WINDOWS\system32\zipfldr.dll Script: Quarantine, Delete, Delete via BC	Compressed (zipped) Folder SendTo Target	Komprimovanй sloћky (metoda ZIP)	© Microsoft Corporation. Vљechna prбva vyhrazena.	{888DCA60-FC0A-11CF-8F0F-00C04FD7D062} Delete
C:\WINDOWS\system32\cdfview.dll Script: Quarantine, Delete, Delete via BC	Soubor kanбlu	Channel Definition File Viewer	© Microsoft Corporation. Vљechna prбva vyhrazena.	{f39a0dc0-9cc8-11d0-a599-00c04fd64433} Delete
C:\WINDOWS\system32\cdfview.dll Script: Quarantine, Delete, Delete via BC	Zбstupce kanбlu	Channel Definition File Viewer	© Microsoft Corporation. Vљechna prбva vyhrazena.	{f3aa0dc0-9cc8-11d0-a599-00c04fd64434} Delete
C:\WINDOWS\system32\cdfview.dll Script: Quarantine, Delete, Delete via BC	Objekt popisovaиe kanбlu	Channel Definition File Viewer	© Microsoft Corporation. Vљechna prбva vyhrazena.	{f3ba0dc0-9cc8-11d0-a599-00c04fd64435} Delete
C:\WINDOWS\system32\cdfview.dll Script: Quarantine, Delete, Delete via BC	Channel Menu	Channel Definition File Viewer	© Microsoft Corporation. Vљechna prбva vyhrazena.	{f3da0dc0-9cc8-11d0-a599-00c04fd64437} Delete
C:\WINDOWS\system32\cdfview.dll Script: Quarantine, Delete, Delete via BC	Channel Properties	Channel Definition File Viewer	© Microsoft Corporation. Vљechna prбva vyhrazena.	{f3ea0dc0-9cc8-11d0-a599-00c04fd64438} Delete
C:\WINDOWS\system32\msieftp.dll Script: Quarantine, Delete, Delete via BC	FTP Folders Webview	Microsoft Internet Explorer FTP Folder Shell Extension	© Microsoft Corporation. Vљechna prбva vyhrazena.	{63da6ec0-2e98-11cf-8d82-444553540000} Delete
C:\WINDOWS\system32\dsquery.dll Script: Quarantine, Delete, Delete via BC	Directory Query UI	Directory Service Find	© Microsoft Corporation. Vљechna prбva vyhrazena.	{8A23E65E-31C2-11d0-891C-00A024AB2DBB} Delete
C:\WINDOWS\system32\dsquery.dll Script: Quarantine, Delete, Delete via BC	Shell properties for a DS object	Directory Service Find	© Microsoft Corporation. Vљechna prбva vyhrazena.	{9E51E0D0-6E0F-11d2-9601-00C04FA31A86} Delete
C:\WINDOWS\system32\dsquery.dll Script: Quarantine, Delete, Delete via BC	Directory Object Find	Directory Service Find	© Microsoft Corporation. Vљechna prбva vyhrazena.	{163FDC20-2ABC-11d0-88F0-00A024AB2DBB} Delete
C:\WINDOWS\system32\dsquery.dll Script: Quarantine, Delete, Delete via BC	Directory Start/Search Find	Directory Service Find	© Microsoft Corporation. Vљechna prбva vyhrazena.	{F020E586-5264-11d1-A532-0000F8757D7E} Delete
C:\WINDOWS\system32\dsuiext.dll Script: Quarantine, Delete, Delete via BC	Directory Property UI	Directory Service Common UI	© Microsoft Corporation. Vљechna prбva vyhrazena.	{0D45D530-764B-11d0-A1CA-00AA00C16E65} Delete
C:\WINDOWS\system32\dsuiext.dll Script: Quarantine, Delete, Delete via BC	Directory Context Menu Verbs	Directory Service Common UI	© Microsoft Corporation. Vљechna prбva vyhrazena.	{62AE1F9A-126A-11D0-A14B-0800361B1103} Delete
C:\WINDOWS\system32\mydocs.dll Script: Quarantine, Delete, Delete via BC	MyDocs Copy Hook	My Documents Folder UI	© Microsoft Corporation. Vљechna prбva vyhrazena.	{ECF03A33-103D-11d2-854D-006008059367} Delete
C:\WINDOWS\system32\mydocs.dll Script: Quarantine, Delete, Delete via BC	MyDocs Drop Target	My Documents Folder UI	© Microsoft Corporation. Vљechna prбva vyhrazena.	{ECF03A32-103D-11d2-854D-006008059367} Delete
C:\WINDOWS\system32\mydocs.dll Script: Quarantine, Delete, Delete via BC	MyDocs Properties	My Documents Folder UI	© Microsoft Corporation. Vљechna prбva vyhrazena.	{4a7ded0a-ad25-11d0-98a8-0800361b1103} Delete
C:\WINDOWS\System32\cscui.dll Script: Quarantine, Delete, Delete via BC	Offline Files Menu	Client Side Caching UI	© Microsoft Corporation. Vљechna prбva vyhrazena.	{750fdf0e-2a26-11d1-a3ea-080036587f03} Delete
C:\WINDOWS\System32\cscui.dll Script: Quarantine, Delete, Delete via BC	Offline Files Folder Options	Client Side Caching UI	© Microsoft Corporation. Vљechna prбva vyhrazena.	{10CFC467-4392-11d2-8DB4-00C04FA31A66} Delete
C:\WINDOWS\System32\cscui.dll Script: Quarantine, Delete, Delete via BC	Sloћka souborщ offline	Client Side Caching UI	© Microsoft Corporation. Vљechna prбva vyhrazena.	{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E} Delete
C:\WINDOWS\system32\photowiz.dll Script: Quarantine, Delete, Delete via BC	%DESC_PublishDropTarget%	Photo Printing Wizard	© Microsoft Corporation. Vљechna prбva vyhrazena.	{60fd46de-f830-4894-a628-6fa81bc0190d} Delete
C:\WINDOWS\System32\mmcshext.dll Script: Quarantine, Delete, Delete via BC	MMC Icon Handler	MMC Shell Extension DLL	© Microsoft Corporation. All rights reserved.	{7A80E4A8-8005-11D2-BCF8-00C04F72C717} Delete
C:\WINDOWS\system32\cabview.dll Script: Quarantine, Delete, Delete via BC	.CAB file viewer	Cabinet File Viewer Shell Extension	© Microsoft Corporation. Vљechna prбva vyhrazena.	{0CD7A5C0-9F37-11CE-AE65-08002B2E1262} Delete
C:\Program Files\Outlook Express\wabfind.dll Script: Quarantine, Delete, Delete via BC	Oso&by...	Najнt osoby	© Microsoft Corporation. Vљechna prбva vyhrazena.	{32714800-2E5F-11d0-8B85-00AA0044F941} Delete
C:\Program Files\WinRAR\rarext.dll Script: Quarantine, Delete, Delete via BC	WinRAR shell extension			{B41DB860-8EE4-11D2-9906-E49FADC173CA} Delete
"C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll" Script: Quarantine, Delete, Delete via BC	OpenOffice.org Column Handler			{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} Delete
"C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll" Script: Quarantine, Delete, Delete via BC	OpenOffice.org Infotip Handler			{087B3AE3-E237-4467-B8DB-5A38AB959AC9} Delete
"C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll" Script: Quarantine, Delete, Delete via BC	OpenOffice.org Property Sheet Handler			{63542C48-9552-494A-84F7-73AA6A7C99C1} Delete
"C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll" Script: Quarantine, Delete, Delete via BC	OpenOffice.org Thumbnail Viewer			{3B092F0C-7696-40E3-A80F-68D74DA84210} Delete
C:\WINDOWS\system32\wpdshext.dll Script: Quarantine, Delete, Delete via BC	Portable Devices	Portable Devices Shell Extension	© Microsoft Corporation. All rights reserved.	{35786D3C-B075-49b9-88DD-029876E11C01} Delete
C:\WINDOWS\system32\wpdshext.dll Script: Quarantine, Delete, Delete via BC	Portable Devices Menu	Portable Devices Shell Extension	© Microsoft Corporation. All rights reserved.	{D6791A63-E7E2-4fee-BF52-5DED8E86E9B8} Delete
C:\Program Files\AVG\AVG9\avgse.dll Script: Quarantine, Delete, Delete via BC	AVG Shell Extension	AVG Shell Extension	Copyright © 2010 AVG Technologies CZ, s.r.o.	{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} Delete
	AVG Find Extension			{9F97547E-460A-42C5-AE0C-81C61FFAEBC3} Delete
C:\Program Files\LG Soft India\forteManager\bin\ContextMenu.dll Script: Quarantine, Delete, Delete via BC	Test directory background ctx menu extension	ContextMenu Module	Copyright 2006	{83AE6768-28C3-4057-A4A0-21AADA4B88E3} Delete
C:\WINDOWS\system32\SHELL32.dll Script: Quarantine, Delete, Delete via BC	ColumnHandler	Windows Shell Common Dll	© Microsoft Corporation. Vљechna prбva vyhrazena.	{0D2E74C4-3C34-11d2-A27E-00C04FC30871} Delete
C:\WINDOWS\system32\SHELL32.dll Script: Quarantine, Delete, Delete via BC	ColumnHandler	Windows Shell Common Dll	© Microsoft Corporation. Vљechna prбva vyhrazena.	{24F14F01-7B1C-11d1-838f-0000F80461CF} Delete
C:\WINDOWS\system32\SHELL32.dll Script: Quarantine, Delete, Delete via BC	ColumnHandler	Windows Shell Common Dll	© Microsoft Corporation. Vљechna prбva vyhrazena.	{24F14F02-7B1C-11d1-838f-0000F80461CF} Delete
C:\WINDOWS\system32\SHELL32.dll Script: Quarantine, Delete, Delete via BC	ColumnHandler	Windows Shell Common Dll	© Microsoft Corporation. Vљechna prбva vyhrazena.	{66742402-F9B9-11D1-A202-0000F81FEDEE} Delete
"C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll" Script: Quarantine, Delete, Delete via BC	ColumnHandler			{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} Delete
Items found - 196, recognized as trusted - 97

Printing system extensions (print monitors, providers)

File name	Type	Name	Description	Manufacturer
Items found - 8, recognized as trusted - 8

Task Scheduler jobs

File name	Job name	Job state	Description	Manufacturer
Items found - 2, recognized as trusted - 2

SPI/LSP settings

Namespace providers (NSP)

Manufacturer	Status	EXE file	Description	GUID
Detected - 3, recognized as trusted - 3

Transport protocol providers (TSP, LSP)

Manufacturer EXE file Description
Detected - 20, recognized as trusted - 20
Results of automatic SPI settings check
LSP settings checked. No errors detected

TCP/UDP ports

Port Status Remote Host Remote Port Application Notes
TCP ports
135 LISTENING 0.0.0.0 39038 [1184] svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
139 LISTENING 0.0.0.0 18586 [4] System
Script: Quarantine, Delete, Delete via BC, Terminate
445 LISTENING 0.0.0.0 24628 [4] System
Script: Quarantine, Delete, Delete via BC, Terminate
1027 LISTENING 0.0.0.0 33011 [2540] alg.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1037 ESTABLISHED 127.0.0.1 1038 [3088] c:\program files\mozilla firefox\firefox.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1038 ESTABLISHED 127.0.0.1 1037 [3088] c:\program files\mozilla firefox\firefox.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1042 ESTABLISHED 127.0.0.1 1043 [3088] c:\program files\mozilla firefox\firefox.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1043 ESTABLISHED 127.0.0.1 1042 [3088] c:\program files\mozilla firefox\firefox.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1080 TIME_WAIT 209.85.129.113 80 [0]
1107 TIME_WAIT 209.85.129.139 80 [0]
1139 LAST_ACK 78.128.147.42 80 [3088] c:\program files\mozilla firefox\firefox.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1145 LAST_ACK 77.75.76.72 80 [3088] c:\program files\mozilla firefox\firefox.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1155 TIME_WAIT 92.122.217.113 80 [0]
1160 TIME_WAIT 92.122.217.1 80 [0]
1168 LAST_ACK 78.128.147.42 80 [3088] c:\program files\mozilla firefox\firefox.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1179 LAST_ACK 77.75.72.22 80 [3088] c:\program files\mozilla firefox\firefox.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1182 LAST_ACK 77.75.76.72 80 [3088] c:\program files\mozilla firefox\firefox.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1185 LAST_ACK 173.194.1.26 80 [3088] c:\program files\mozilla firefox\firefox.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1186 TIME_WAIT 92.122.217.96 80 [0]
1187 TIME_WAIT 92.122.217.96 80 [0]
1188 TIME_WAIT 92.122.217.96 80 [0]
1189 TIME_WAIT 92.122.217.96 80 [0]
1190 TIME_WAIT 92.122.217.96 80 [0]
1214 TIME_WAIT 212.96.161.234 80 [0]
1216 TIME_WAIT 212.96.161.234 80 [0]
1218 TIME_WAIT 212.96.161.234 80 [0]
1223 TIME_WAIT 77.75.76.72 80 [0]
1224 TIME_WAIT 77.75.76.72 80 [0]
1225 TIME_WAIT 77.75.76.72 80 [0]
1227 TIME_WAIT 77.75.76.72 80 [0]
1235 TIME_WAIT 77.75.76.72 80 [0]
1237 TIME_WAIT 77.75.76.72 80 [0]
1238 LAST_ACK 77.75.76.72 80 [3088] c:\program files\mozilla firefox\firefox.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1242 ESTABLISHED 173.194.1.26 80 [3088] c:\program files\mozilla firefox\firefox.exe
Script: Quarantine, Delete, Delete via BC, Terminate
5152 CLOSE_WAIT 127.0.0.1 1040 [1684] c:\program files\java\jre6\bin\jqs.exe
Script: Quarantine, Delete, Delete via BC, Terminate
5152 LISTENING 0.0.0.0 43109 [1684] c:\program files\java\jre6\bin\jqs.exe
Script: Quarantine, Delete, Delete via BC, Terminate
10110 LISTENING 0.0.0.0 18436 [2408] c:\program files\avg\avg9\avgemc.exe
Script: Quarantine, Delete, Delete via BC, Terminate
UDP ports
123 LISTENING -- -- [1280] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
123 LISTENING -- -- [1280] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
137 LISTENING -- -- [4] System
Script: Quarantine, Delete, Delete via BC, Terminate
138 LISTENING -- -- [4] System
Script: Quarantine, Delete, Delete via BC, Terminate
445 LISTENING -- -- [4] System
Script: Quarantine, Delete, Delete via BC, Terminate
500 LISTENING -- -- [872] c:\windows\system32\lsass.exe
Script: Quarantine, Delete, Delete via BC, Terminate
4500 LISTENING -- -- [872] c:\windows\system32\lsass.exe
Script: Quarantine, Delete, Delete via BC, Terminate
44301 LISTENING -- -- [504] c:\windows\system32\pnkbstra.exe
Script: Quarantine, Delete, Delete via BC, Terminate

Downloaded Program Files (DPF)

File name Description Manufacturer CLSID Source URL
C:\Program Files\Java\jre6\bin\jp2iexp.dll
Script: Quarantine, Delete, Delete via BC {8AD9C840-044E-11D1-B3E9-00805F499D93}
Delete http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
C:\Program Files\Java\jre6\bin\jp2iexp.dll
Script: Quarantine, Delete, Delete via BC {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
Delete http://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
C:\Program Files\Java\jre6\bin\jp2iexp.dll
Script: Quarantine, Delete, Delete via BC {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
Delete http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
C:\Program Files\Java\jre6\bin\npjpi160_17.dll
Script: Quarantine, Delete, Delete via BC Classic Java Plug-in 1.6.0_17 for Netscape and Mozilla Copyright © 2004 {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Delete http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
Items found - 4, recognized as trusted - 0

Control Panel Applets (CPL)

File name Description Manufacturer
C:\WINDOWS\system32\desk.cpl
Script: Quarantine, Delete, Delete via BC Desktop Control Panel © Microsoft Corporation. Vљechna prбva vyhrazena.
C:\WINDOWS\system32\hdwwiz.cpl
Script: Quarantine, Delete, Delete via BC Add Hardware Control Panel Applet © Microsoft Corporation. Vљechna prбva vyhrazena.
C:\WINDOWS\system32\inetcpl.cpl
Script: Quarantine, Delete, Delete via BC Internet Control Panel © Microsoft Corporation. Vљechna prбva vyhrazena.
C:\WINDOWS\system32\intl.cpl
Script: Quarantine, Delete, Delete via BC Control Panel DLL © Microsoft Corporation. Vљechna prбva vyhrazena.
C:\WINDOWS\system32\javacpl.cpl
Script: Quarantine, Delete, Delete via BC Java(TM) Control Panel Copyright © 2004
C:\WINDOWS\system32\joy.cpl
Script: Quarantine, Delete, Delete via BC Game Controllers Control Panel Applet © Microsoft Corporation. Vљechna prбva vyhrazena.
C:\WINDOWS\system32\main.cpl
Script: Quarantine, Delete, Delete via BC Control Panel DLL Copyright (C) Microsoft Corp. 1991-1999
C:\WINDOWS\system32\mmsys.cpl
Script: Quarantine, Delete, Delete via BC Control Panel Drivers Applet © Microsoft Corporation. Vљechna prбva vyhrazena.
C:\WINDOWS\system32\ncpa.cpl
Script: Quarantine, Delete, Delete via BC Network Connections Control-Panel Stub © Microsoft Corporation. Vљechna prбva vyhrazena.
C:\WINDOWS\system32\nusrmgr.cpl
Script: Quarantine, Delete, Delete via BC Sprбvce uћivatelщ systйmu Windows © Microsoft Corporation. Vљechna prбva vyhrazena.
C:\WINDOWS\system32\odbccp32.cpl
Script: Quarantine, Delete, Delete via BC Microsoft Data Access - ODBC Control Panel Copyright (C) Microsoft Corporation 1990-2000
C:\WINDOWS\system32\powercfg.cpl
Script: Quarantine, Delete, Delete via BC Power Management Configuration Control Panel Applet © Microsoft Corporation. Vљechna prбva vyhrazena.
C:\WINDOWS\system32\sysdm.cpl
Script: Quarantine, Delete, Delete via BC System Applet for the Control Panel © Microsoft Corporation. Vљechna prбva vyhrazena.
C:\WINDOWS\system32\telephon.cpl
Script: Quarantine, Delete, Delete via BC Telephony Control Panel © Microsoft Corporation. Vљechna prбva vyhrazena.
C:\WINDOWS\system32\timedate.cpl
Script: Quarantine, Delete, Delete via BC Time Date Control Panel Applet © Microsoft Corporation. Vљechna prбva vyhrazena.
C:\WINDOWS\system32\wscui.cpl
Script: Quarantine, Delete, Delete via BC Security Center © Microsoft Corporation. All rights reserved.
C:\WINDOWS\system32\wuaucpl.cpl
Script: Quarantine, Delete, Delete via BC Automatic Updates Control Panel © Microsoft Corporation. All rights reserved.
Items found - 29, recognized as trusted - 12

Active Setup

File name Description Manufacturer CLSID
c:\WINDOWS\system32\Rundll32.exe
Script: Quarantine, Delete, Delete via BC Run a DLL as an App © Microsoft Corporation. Vљechna prбva vyhrazena. {89B4C1CD-B018-4511-B0A1-5476DBF70820}
Items found - 13, recognized as trusted - 12

HOSTS file

Hosts file record
127.0.0.1 localhost

Protocols and handlers

File name Type Description Manufacturer CLSID
mscoree.dll
Script: Quarantine, Delete, Delete via BC Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
mscoree.dll
Script: Quarantine, Delete, Delete via BC Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
mscoree.dll
Script: Quarantine, Delete, Delete via BC Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
C:\WINDOWS\system32\SHELL32.dll
Script: Quarantine, Delete, Delete via BC Protocol Windows Shell Common Dll (WebView MIME Filter) © Microsoft Corporation. Vљechna prбva vyhrazena. {733AC4CB-F1A4-11d0-B951-00A0C90312E1}
C:\WINDOWS\system32\itss.dll
Script: Quarantine, Delete, Delete via BC Handler Microsoft® InfoTech Storage System Library (its: Asychronous Pluggable Protocol Handler) © Microsoft Corporation. All rights reserved. {9D148291-B9C8-11D0-A4CC-0000F80149F6}
C:\Program Files\AVG\AVG9\avgpp.dll
Script: Quarantine, Delete, Delete via BC Handler Safe Search pluggable protocol (linkscanner: ExPLabs.com Pluggable Protocol) Copyright © 2010 AVG Technologies CZ, s.r.o. {F274614C-63F8-47D5-A4D1-FBDDE494F8D1}
C:\WINDOWS\system32\itss.dll
Script: Quarantine, Delete, Delete via BC Handler Microsoft® InfoTech Storage System Library (ms-its: Asychronous Pluggable Protocol Handler) © Microsoft Corporation. All rights reserved. {9D148291-B9C8-11D0-A4CC-0000F80149F6}
Items found - 29, recognized as trusted - 22

Suspicious objects

File Description Type

Attention !!! Database was last updated 21.8.2009 it is necessary to update the database (via File - Database update) AVZ Antiviral Toolkit log; AVZ version is 4.32 Scanning started at 8.4.2010 20:19:41 Database loaded: signatures - 237871, NN profile(s) - 2, malware removal microprograms - 56, signature database released 21.08.2009 14:23 Heuristic microprograms loaded: 374 PVS microprograms loaded: 9 Digital signatures of system files loaded: 135524 Heuristic analyzer mode: Medium heuristics mode Malware removal mode: disabled Windows version is: 5.1.2600, Service Pack 3 ; AVZ is run with administrator rights System Restore: enabled 1. Searching for Rootkits and other software intercepting API functions 1.1 Searching for user-mode API hooks Analysis: kernel32.dll, export table found in section .text Analysis: ntdll.dll, export table found in section .text Analysis: user32.dll, export table found in section .text Analysis: advapi32.dll, export table found in section .text Analysis: ws2_32.dll, export table found in section .text Analysis: wininet.dll, export table found in section .text Analysis: rasapi32.dll, export table found in section .text Analysis: urlmon.dll, export table found in section .text Analysis: netapi32.dll, export table found in section .text 1.2 Searching for kernel-mode API hooks Driver loaded successfully SDT found (RVA=085700) Kernel ntkrnlpa.exe found in memory at address 804D7000 SDT = 8055C700 KiST = 8050446C (284) Functions checked: 284, intercepted: 0, restored: 0 1.3 Checking IDT and SYSENTER Analyzing CPU 1 Analyzing CPU 2 Checking IDT and SYSENTER - complete 1.4 Searching for masking processes and drivers Checking not performed: extended monitoring driver (AVZPM) is not installed Driver loaded successfully 1.5 Checking IRP handlers Checking - complete 2. Scanning RAM Number of processes found: 35 Number of modules loaded: 350 Scanning RAM - complete 3. Scanning disks 4. Checking Winsock Layered Service Provider (SPI/LSP) LSP settings checked. No errors detected 5. Searching for keyboard/mouse/windows events hooks (Keyloggers, Trojan DLLs) 6. Searching for opened TCP/UDP ports used by malicious software Checking - disabled by user 7. Heuristic system check Checking - complete 8. Searching for vulnerabilities >> Services: potentially dangerous service allowed: RemoteRegistry (Vzd?len? registr) >> Services: potentially dangerous service allowed: TermService (Termin?lov? slu?ba) >> Services: potentially dangerous service allowed: SSDPSRV (Slu?ba rozpozn?v?n? pomoc? protokolu SSDP) >> Services: potentially dangerous service allowed: Schedule (Pl?nova? ?loh) >> Services: potentially dangerous service allowed: mnmsrvc (NetMeeting - Vzd?len? sd?len? plochy) >> Services: potentially dangerous service allowed: RDSessMgr (Spr?vce relac? n?pov?dy ke vzd?len? plo?e) > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)! >> Security: disk drives' autorun is enabled >> Security: administrative shares (C$, D$ ...) are enabled >> Security: anonymous user access is enabled >> Security: sending Remote Assistant queries is enabled Checking - complete 9. Troubleshooting wizard >> HDD autorun is allowed >> Network drives autorun is allowed >> Removable media autorun is allowed Checking - complete Files scanned: 385, extracted from archives: 0, malicious software found 0, suspicions - 0 Scanning finished at 8.4.2010 20:20:01 Time of scanning: 00:00:20 If you have a suspicion on presence of viruses or questions on the suspected objects, you can address http://virusinfo.info conference Creating archive of files from Quarantine Creating archive of files from Quarantine - complete System Analysis in progress
Script commands

Add commands to script:
Blocking hooks using Anti-Rootkit
Enable AVZGuard
Operations with AVZPM (true=enable,false=disable)
BootCleaner - import list of deleted files
Remove traces of deleted files
BootCleaner - activate
Reboot
Insert template for QuarantineFile() - quarantining a file
Insert template for BC_QrFile() - quarantining file via BootCleaner
Insert template for DeleteFile() - deleting a file
Insert template for DelCLSID() - removing a CLSID item from registry
Additional operations:
Performance tweaking: disable service RemoteRegistry (Vzdбlenэ registr)
Performance tweaking: disable service TermService (Terminбlovб sluћba)
Performance tweaking: disable service SSDPSRV (Sluћba rozpoznбvбnн pomocн protokolu SSDP)
Performance tweaking: disable service Schedule (Plбnovaи ъloh)
Performance tweaking: disable service mnmsrvc (NetMeeting - Vzdбlenй sdнlenн plochy)
Performance tweaking: disable service RDSessMgr (Sprбvce relacн nбpovмdy ke vzdбlenй ploљe)
Security tweaking: disable CD autorun
Security tweaking: disable administrative shares
Security tweaking: disable anonymous user access
Security: disable sending Remote Assistant queries
File list

Port	Status	Remote Host	Remote Port	Application	Notes
TCP ports
135	LISTENING	0.0.0.0	39038	[1184] svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
139	LISTENING	0.0.0.0	18586	[4] System Script: Quarantine, Delete, Delete via BC, Terminate
445	LISTENING	0.0.0.0	24628	[4] System Script: Quarantine, Delete, Delete via BC, Terminate
1027	LISTENING	0.0.0.0	33011	[2540] alg.exe Script: Quarantine, Delete, Delete via BC, Terminate
1037	ESTABLISHED	127.0.0.1	1038	[3088] c:\program files\mozilla firefox\firefox.exe Script: Quarantine, Delete, Delete via BC, Terminate
1038	ESTABLISHED	127.0.0.1	1037	[3088] c:\program files\mozilla firefox\firefox.exe Script: Quarantine, Delete, Delete via BC, Terminate
1042	ESTABLISHED	127.0.0.1	1043	[3088] c:\program files\mozilla firefox\firefox.exe Script: Quarantine, Delete, Delete via BC, Terminate
1043	ESTABLISHED	127.0.0.1	1042	[3088] c:\program files\mozilla firefox\firefox.exe Script: Quarantine, Delete, Delete via BC, Terminate
1080	TIME_WAIT	209.85.129.113	80	[0]
1107	TIME_WAIT	209.85.129.139	80	[0]
1139	LAST_ACK	78.128.147.42	80	[3088] c:\program files\mozilla firefox\firefox.exe Script: Quarantine, Delete, Delete via BC, Terminate
1145	LAST_ACK	77.75.76.72	80	[3088] c:\program files\mozilla firefox\firefox.exe Script: Quarantine, Delete, Delete via BC, Terminate
1155	TIME_WAIT	92.122.217.113	80	[0]
1160	TIME_WAIT	92.122.217.1	80	[0]
1168	LAST_ACK	78.128.147.42	80	[3088] c:\program files\mozilla firefox\firefox.exe Script: Quarantine, Delete, Delete via BC, Terminate
1179	LAST_ACK	77.75.72.22	80	[3088] c:\program files\mozilla firefox\firefox.exe Script: Quarantine, Delete, Delete via BC, Terminate
1182	LAST_ACK	77.75.76.72	80	[3088] c:\program files\mozilla firefox\firefox.exe Script: Quarantine, Delete, Delete via BC, Terminate
1185	LAST_ACK	173.194.1.26	80	[3088] c:\program files\mozilla firefox\firefox.exe Script: Quarantine, Delete, Delete via BC, Terminate
1186	TIME_WAIT	92.122.217.96	80	[0]
1187	TIME_WAIT	92.122.217.96	80	[0]
1188	TIME_WAIT	92.122.217.96	80	[0]
1189	TIME_WAIT	92.122.217.96	80	[0]
1190	TIME_WAIT	92.122.217.96	80	[0]
1214	TIME_WAIT	212.96.161.234	80	[0]
1216	TIME_WAIT	212.96.161.234	80	[0]
1218	TIME_WAIT	212.96.161.234	80	[0]
1223	TIME_WAIT	77.75.76.72	80	[0]
1224	TIME_WAIT	77.75.76.72	80	[0]
1225	TIME_WAIT	77.75.76.72	80	[0]
1227	TIME_WAIT	77.75.76.72	80	[0]
1235	TIME_WAIT	77.75.76.72	80	[0]
1237	TIME_WAIT	77.75.76.72	80	[0]
1238	LAST_ACK	77.75.76.72	80	[3088] c:\program files\mozilla firefox\firefox.exe Script: Quarantine, Delete, Delete via BC, Terminate
1242	ESTABLISHED	173.194.1.26	80	[3088] c:\program files\mozilla firefox\firefox.exe Script: Quarantine, Delete, Delete via BC, Terminate
5152	CLOSE_WAIT	127.0.0.1	1040	[1684] c:\program files\java\jre6\bin\jqs.exe Script: Quarantine, Delete, Delete via BC, Terminate
5152	LISTENING	0.0.0.0	43109	[1684] c:\program files\java\jre6\bin\jqs.exe Script: Quarantine, Delete, Delete via BC, Terminate
10110	LISTENING	0.0.0.0	18436	[2408] c:\program files\avg\avg9\avgemc.exe Script: Quarantine, Delete, Delete via BC, Terminate
UDP ports
123	LISTENING	--	--	[1280] c:\windows\system32\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
123	LISTENING	--	--	[1280] c:\windows\system32\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
137	LISTENING	--	--	[4] System Script: Quarantine, Delete, Delete via BC, Terminate
138	LISTENING	--	--	[4] System Script: Quarantine, Delete, Delete via BC, Terminate
445	LISTENING	--	--	[4] System Script: Quarantine, Delete, Delete via BC, Terminate
500	LISTENING	--	--	[872] c:\windows\system32\lsass.exe Script: Quarantine, Delete, Delete via BC, Terminate
4500	LISTENING	--	--	[872] c:\windows\system32\lsass.exe Script: Quarantine, Delete, Delete via BC, Terminate
44301	LISTENING	--	--	[504] c:\windows\system32\pnkbstra.exe Script: Quarantine, Delete, Delete via BC, Terminate