Results of system analysis

Process List

File name	PID	Description	Copyright	MD5	Information
c:\documents and settings\erika\local settings\application data\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate	3748	Google Chrome	Copyright (C) 2006-2010 Google Inc. All Rights Reserved.	??	1012.05 kb, rsAh, created: 28.10.2011 18:53:38, modified: 26.10.2011 10:10:47 Command line: "C:\Documents and Settings\Erika\Local Settings\Application Data\Google\Chrome\Application\chrome.exe" --type=extension --lang=sk --force-fieldtest=ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_10/Prefetch/ContentPrefetchPrerender2/ProxyConnectionImpact/proxy_connections_32/SpdyCwnd/cwnd10/SpdyImpact/npn_with_spdy/SuggestHostPrefix/Default_Prefix/WarmSocketImpact/warmest_socket/ --enable-print-preview --channel=2004.01199840.1795876145 --ignored=" --type=renderer " /prefetch:3
c:\documents and settings\erika\local settings\application data\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate	2632	Google Chrome	Copyright (C) 2006-2010 Google Inc. All Rights Reserved.	??	1012.05 kb, rsAh, created: 28.10.2011 18:53:38, modified: 26.10.2011 10:10:47 Command line: "C:\Documents and Settings\Erika\Local Settings\Application Data\Google\Chrome\Application\chrome.exe" --type=extension --lang=sk --force-fieldtest=ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_10/Prefetch/ContentPrefetchPrerender2/ProxyConnectionImpact/proxy_connections_32/SpdyCwnd/cwnd10/SpdyImpact/npn_with_spdy/SuggestHostPrefix/Default_Prefix/WarmSocketImpact/warmest_socket/ --enable-print-preview --disable-webgl --disable-pepper-3d-for-untrusted-use --disable-gl-multisampling --disable-accelerated-compositing --disable-accelerated-2d-canvas --channel=2004.011996E0.832218346 --ignored=" --type=renderer " /prefetch:3
c:\documents and settings\erika\local settings\application data\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate	420	Google Chrome	Copyright (C) 2006-2010 Google Inc. All Rights Reserved.	??	1012.05 kb, rsAh, created: 28.10.2011 18:53:38, modified: 26.10.2011 10:10:47 Command line: "C:\Documents and Settings\Erika\Local Settings\Application Data\Google\Chrome\Application\chrome.exe" --type=renderer --lang=sk --force-fieldtest=ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_10/Prefetch/ContentPrefetchPrerender2/ProxyConnectionImpact/proxy_connections_32/SpdyCwnd/cwnd10/SpdyImpact/npn_with_spdy/SuggestHostPrefix/Default_Prefix/WarmSocketImpact/warmest_socket/ --enable-print-preview --disable-webgl --disable-pepper-3d-for-untrusted-use --disable-gl-multisampling --disable-accelerated-compositing --disable-accelerated-2d-canvas --channel=2004.0755CB00.1069026339 /prefetch:3
c:\documents and settings\erika\local settings\application data\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate	3036	Google Chrome	Copyright (C) 2006-2010 Google Inc. All Rights Reserved.	??	1012.05 kb, rsAh, created: 28.10.2011 18:53:38, modified: 26.10.2011 10:10:47 Command line: "C:\Documents and Settings\Erika\Local Settings\Application Data\Google\Chrome\Application\chrome.exe" --type=plugin --plugin-path="C:\Documents and Settings\Erika\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.7.0.8524_0\npSkypeChromePlugin.dll" --lang=sk --channel=2004.081191C0.1824210752 /prefetch:4
c:\documents and settings\erika\local settings\application data\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate	604	Google Chrome	Copyright (C) 2006-2010 Google Inc. All Rights Reserved.	??	1012.05 kb, rsAh, created: 28.10.2011 18:53:38, modified: 26.10.2011 10:10:47 Command line: "C:\Documents and Settings\Erika\Local Settings\Application Data\Google\Chrome\Application\chrome.exe" --type=plugin --plugin-path="C:\Documents and Settings\Erika\Local Settings\Application Data\Google\Chrome\Application\15.0.874.106\gcswf32.dll" --lang=sk --channel=2004.0810A1C0.925572454 /prefetch:4
c:\documents and settings\erika\local settings\application data\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate	2004	Google Chrome	Copyright (C) 2006-2010 Google Inc. All Rights Reserved.	??	1012.05 kb, rsAh, created: 28.10.2011 18:53:38, modified: 26.10.2011 10:10:47 Command line: "C:\Documents and Settings\Erika\Local Settings\Application Data\Google\Chrome\Application\chrome.exe" http://www.viry.cz/forum/viewtopic.php?f=13&t=105895
c:\windows\explorer.exe Script: Quarantine, Delete, Delete via BC, Terminate	1968	Windows Explorer	© Microsoft Corporation. All rights reserved.	??	1009.50 kb, rsAh, created: 16.01.2007 22:05:41, modified: 14.04.2008 02:12:19 Command line: C:\WINDOWS\Explorer.EXE
c:\program files\common files\microsoft shared\vs7debug\mdm.exe Script: Quarantine, Delete, Delete via BC, Terminate	1268	Machine Debug Manager	© Microsoft Corporation. All rights reserved.	??	314.57 kb, rsAh, created: 20.06.2003 00:25:00, modified: 20.06.2003 00:25:00 Command line: "C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE"
c:\windows\system32\pnkbstrb.exe Script: Quarantine, Delete, Delete via BC, Terminate	628			??	209.49 kb, rsAh, created: 24.12.2009 20:56:57, modified: 28.10.2011 17:54:35 Command line: C:\WINDOWS\system32\PnkBstrB.exe
c:\windows\system32\rundll32.exe Script: Quarantine, Delete, Delete via BC, Terminate	476	Run a DLL as an App	© Microsoft Corporation. All rights reserved.	??	32.50 kb, rsAh, created: 04.08.2004 01:56:56, modified: 14.04.2008 02:12:33 Command line: "C:\WINDOWS\system32\RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate	2572			??	1901.00 kb, rsAh, created: 28.10.2011 18:27:15, modified: 28.10.2011 23:27:11 Command line: C:\WINDOWS\update.2\svchost.exe srv
c:\windows\update.5.0\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate	2660			??	336.50 kb, rsAh, created: 28.10.2011 23:17:09, modified: 28.10.2011 23:16:55 Command line: "C:\WINDOWS\update.5.0\svchost.exe" stand
c:\windows\update.1\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate	2056	Ron	Paces © Wino Cloth 2004-2007	??	1173.00 kb, rsaH, created: 28.10.2011 18:22:39, modified: 28.10.2011 18:12:15 Command line: C:\WINDOWS\update.1\svchost.exe srv
c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate	2804			??	1901.00 kb, rsAh, created: 28.10.2011 18:27:15, modified: 28.10.2011 23:27:11 Command line: "C:\WINDOWS\update.2\svchost.exe" stand
c:\windows\update.tray-3-0\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate	1784	Ron	Paces © Wino Cloth 2004-2007	??	1173.00 kb, rsaH, created: 28.10.2011 18:22:31, modified: 28.10.2011 18:12:15 Command line: "C:\WINDOWS\update.tray-3-0\svchost.exe"
c:\windows\update.tray-2-0\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate	1900	Ron	Paces © Wino Cloth 2004-2007	??	1173.00 kb, rsaH, created: 28.10.2011 18:22:31, modified: 28.10.2011 18:12:15 Command line: "C:\WINDOWS\update.tray-2-0\svchost.exe"
c:\windows\system32\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate	584	Generic Host Process for Win32 Services	© Microsoft Corporation. All rights reserved.	??	14.00 kb, rsAh, created: 04.08.2004 01:56:58, modified: 14.04.2008 02:12:36 Command line: C:\WINDOWS\System32\svchost.exe -k Akamai
c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate	1864			??	1901.00 kb, rsAh, created: 28.10.2011 18:27:15, modified: 28.10.2011 23:27:11 Command line: "C:\WINDOWS\update.2\svchost.exe" spamer
c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate	952			??	1901.00 kb, rsAh, created: 28.10.2011 18:27:15, modified: 28.10.2011 23:27:11 Command line: "C:\WINDOWS\update.2\svchost.exe" spamer
c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate	1152			??	1901.00 kb, rsAh, created: 28.10.2011 18:27:15, modified: 28.10.2011 23:27:11 Command line: "C:\WINDOWS\update.2\svchost.exe" spamer
c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate	2848			??	1901.00 kb, rsAh, created: 28.10.2011 18:27:15, modified: 28.10.2011 23:27:11 Command line: "C:\WINDOWS\update.2\svchost.exe" spamer
c:\windows\update.5.0\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate	608			??	336.50 kb, rsAh, created: 28.10.2011 23:17:09, modified: 28.10.2011 23:16:55 Command line: C:\WINDOWS\update.5.0\svchost.exe srv
c:\windows\sysdriver32.exe Script: Quarantine, Delete, Delete via BC, Terminate	4036			??	252.00 kb, rsAh, created: 28.10.2011 18:26:12, modified: 28.10.2011 18:25:54 Command line: C:\WINDOWS\sysdriver32.exe srv
Detected:52, recognized as trusted 33

Module name	Handle	Description	Copyright	MD5	Used by processes
C:\Documents and Settings\Erika\Local Settings\Application Data\Google\Chrome\Application\15.0.874.106\avcodec-53.dll Script: Quarantine, Delete, Delete via BC	1709965312			--	3748, 2632, 420
C:\Documents and Settings\Erika\Local Settings\Application Data\Google\Chrome\Application\15.0.874.106\avformat-53.dll Script: Quarantine, Delete, Delete via BC	1789919232			--	3748, 2632, 420
C:\Documents and Settings\Erika\Local Settings\Application Data\Google\Chrome\Application\15.0.874.106\avutil-51.dll Script: Quarantine, Delete, Delete via BC	1756889088			--	3748, 2632, 420
C:\Documents and Settings\Erika\Local Settings\Application Data\Google\Chrome\Application\15.0.874.106\chrome.dll Script: Quarantine, Delete, Delete via BC	29556736	Google Chrome	Copyright (C) 2006-2010 Google Inc. All Rights Reserved.	--	3748, 2632, 420, 3036, 604, 2004
C:\Documents and Settings\Erika\Local Settings\Application Data\Google\Chrome\Application\15.0.874.106\icudt.dll Script: Quarantine, Delete, Delete via BC	1255145472	ICU Data DLL	Copyright (C) 2010, International Business Machines Corporation and others. All Rights Reserved.	--	3748, 2632, 420, 3036, 604, 2004
C:\Documents and Settings\Erika\Local Settings\Application Data\Google\Chrome\Application\15.0.874.106\pdf.dll Script: Quarantine, Delete, Delete via BC	268435456	Chrome PDF Viewer	Copyright (C) 2010	--	3748, 2632, 420
C:\Documents and Settings\Erika\Local Settings\Application Data\Google\Chrome\Application\15.0.874.106\ppGoogleNaClPluginChrome.dll Script: Quarantine, Delete, Delete via BC	18087936			--	3748, 2632, 420
C:\Documents and Settings\Erika\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.7.0.8524_0\npSkypeChromePlugin.dll Script: Quarantine, Delete, Delete via BC	268435456	Skype Click to Call for Chrome	(c) Skype Technologies S.A.	--	3036
C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.SKY Script: Quarantine, Delete, Delete via BC	139198464	PDF Shell Extension	Copyright 2000-2007 Adobe Systems, Inc.	--	2004, 1968
c:\program files\common files\akamai\netsession_win_807ba95.dll Script: Quarantine, Delete, Delete via BC	268435456			--	584
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MSDBG2.DLL Script: Quarantine, Delete, Delete via BC	1364721664	Active Debugging Proxy/Stub	© Microsoft Corporation. All rights reserved.	--	1268, 1864, 952, 1152, 2848
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\PDM.DLL Script: Quarantine, Delete, Delete via BC	1365639168	Process Debug Manager	© Microsoft Corporation. All rights reserved.	--	1864, 952, 1152, 2848
C:\Program Files\Skype\Toolbars\Shared\SkypePnr.dll Script: Quarantine, Delete, Delete via BC	66584576	Skype Phone Number Recognizer	(c) Skype Technologies S.A.	--	3036
C:\Program Files\WinRAR\rarlng.dll Script: Quarantine, Delete, Delete via BC	43778048			--	1968
C:\Program Files\Zoner\Photo Studio 13\Program32\SHELLEXT.DLL Script: Quarantine, Delete, Delete via BC	37158912	Zoner Photo Studio 13	Copyright © 1995-2010	--	1968
C:\WINDOWS\system32\NVRSSK.DLL Script: Quarantine, Delete, Delete via BC	40435712	NVIDIA Slovak language resource library	(C) NVIDIA Corporation. All rights reserved.	--	1968, 476
Modules found:309, recognized as trusted 293

Kernel Space Modules Viewer

Module	Base address	Size in memory	Description	Manufacturer
.sys Script: Quarantine, Delete, Delete via BC	F7474000	018000 (98304)
C:\WINDOWS\System32\Drivers\dump_atapi.sys Script: Quarantine, Delete, Delete via BC	B560A000	018000 (98304)
C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Script: Quarantine, Delete, Delete via BC	F79C3000	002000 (8192)
C:\WINDOWS\system32\drivers\sp_rsdrv2.sys Script: Quarantine, Delete, Delete via BC	B56E5000	027000 (159744)
Modules found - 120, recognized as trusted - 116

Services

Service	Description	Status	File	Group	Dependencies
PnkBstrB Service: Stop, Delete, Disable, Delete via BC	PnkBstrB	Running	C:\WINDOWS\system32\PnkBstrB.exe Script: Quarantine, Delete, Delete via BC
srvbtcclient Service: Stop, Delete, Disable, Delete via BC	srvbtcclient	Running	C:\WINDOWS\update.5.0\svchost.exe Script: Quarantine, Delete, Delete via BC
srviecheck Service: Stop, Delete, Disable, Delete via BC	srviecheck	Running	C:\WINDOWS\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC
srvsysdriver32 Service: Stop, Delete, Disable, Delete via BC	srvsysdriver32	Running	C:\WINDOWS\sysdriver32.exe Script: Quarantine, Delete, Delete via BC
wxpdrivers Service: Stop, Delete, Disable, Delete via BC	wxpdrivers	Running	C:\WINDOWS\update.1\svchost.exe Script: Quarantine, Delete, Delete via BC
EhttpSrv Service: Stop, Delete, Disable, Delete via BC	ESET HTTP Server	Not started	C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe Script: Quarantine, Delete, Delete via BC
ekrn Service: Stop, Delete, Disable, Delete via BC	ESET Service	Not started	C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe Script: Quarantine, Delete, Delete via BC
npggsvc Service: Stop, Delete, Disable, Delete via BC	nProtect GameGuard Service	Not started	C:\WINDOWS\system32\GameMon.des Script: Quarantine, Delete, Delete via BC
Detected - 109, recognized as trusted - 101

Drivers

Service	Description	Status	File	Group	Dependencies
sp_rsdrv2 Driver: Unload, Delete, Disable, Delete via BC	Spyware Terminator 2012 Realtime Shield Driver	Running	C:\WINDOWS\system32\Drivers\sp_rsdrv2.sys Script: Quarantine, Delete, Delete via BC
Abiosdsk Driver: Unload, Delete, Disable, Delete via BC	Abiosdsk	Not started	Abiosdsk.sys Script: Quarantine, Delete, Delete via BC	Primary disk
abp480n5 Driver: Unload, Delete, Disable, Delete via BC	abp480n5	Not started	abp480n5.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
adpu160m Driver: Unload, Delete, Disable, Delete via BC	adpu160m	Not started	adpu160m.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
Aha154x Driver: Unload, Delete, Disable, Delete via BC	Aha154x	Not started	Aha154x.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
aic78u2 Driver: Unload, Delete, Disable, Delete via BC	aic78u2	Not started	aic78u2.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
aic78xx Driver: Unload, Delete, Disable, Delete via BC	aic78xx	Not started	aic78xx.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
AliIde Driver: Unload, Delete, Disable, Delete via BC	AliIde	Not started	AliIde.sys Script: Quarantine, Delete, Delete via BC	System Bus Extender
amsint Driver: Unload, Delete, Disable, Delete via BC	amsint	Not started	amsint.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
asc Driver: Unload, Delete, Disable, Delete via BC	asc	Not started	asc.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
asc3350p Driver: Unload, Delete, Disable, Delete via BC	asc3350p	Not started	asc3350p.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
asc3550 Driver: Unload, Delete, Disable, Delete via BC	asc3550	Not started	asc3550.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
Atdisk Driver: Unload, Delete, Disable, Delete via BC	Atdisk	Not started	Atdisk.sys Script: Quarantine, Delete, Delete via BC	Primary disk
cd20xrnt Driver: Unload, Delete, Disable, Delete via BC	cd20xrnt	Not started	cd20xrnt.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
Changer Driver: Unload, Delete, Disable, Delete via BC	Changer	Not started	Changer.sys Script: Quarantine, Delete, Delete via BC	Filter
CmdIde Driver: Unload, Delete, Disable, Delete via BC	CmdIde	Not started	CmdIde.sys Script: Quarantine, Delete, Delete via BC	System Bus Extender
Cpqarray Driver: Unload, Delete, Disable, Delete via BC	Cpqarray	Not started	Cpqarray.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
dac960nt Driver: Unload, Delete, Disable, Delete via BC	dac960nt	Not started	dac960nt.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
dpti2o Driver: Unload, Delete, Disable, Delete via BC	dpti2o	Not started	dpti2o.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
EagleXNt Driver: Unload, Delete, Disable, Delete via BC	EagleXNt	Not started	C:\WINDOWS\system32\drivers\EagleXNt.sys Script: Quarantine, Delete, Delete via BC
GGSAFERDriver Driver: Unload, Delete, Disable, Delete via BC	GGSAFER Driver	Not started	C:\Program Files\Garena\safedrv.sys Script: Quarantine, Delete, Delete via BC
hpn Driver: Unload, Delete, Disable, Delete via BC	hpn	Not started	hpn.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
i2omgmt Driver: Unload, Delete, Disable, Delete via BC	i2omgmt	Not started	i2omgmt.sys Script: Quarantine, Delete, Delete via BC	SCSI Class
i2omp Driver: Unload, Delete, Disable, Delete via BC	i2omp	Not started	i2omp.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
ini910u Driver: Unload, Delete, Disable, Delete via BC	ini910u	Not started	ini910u.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
IntelIde Driver: Unload, Delete, Disable, Delete via BC	IntelIde	Not started	IntelIde.sys Script: Quarantine, Delete, Delete via BC	System Bus Extender
lbrtfdc Driver: Unload, Delete, Disable, Delete via BC	lbrtfdc	Not started	lbrtfdc.sys Script: Quarantine, Delete, Delete via BC	System Bus Extender
mraid35x Driver: Unload, Delete, Disable, Delete via BC	mraid35x	Not started	mraid35x.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
PCIDump Driver: Unload, Delete, Disable, Delete via BC	PCIDump	Not started	PCIDump.sys Script: Quarantine, Delete, Delete via BC	PCI Configuration
PDCOMP Driver: Unload, Delete, Disable, Delete via BC	PDCOMP	Not started	PDCOMP.sys Script: Quarantine, Delete, Delete via BC
PDFRAME Driver: Unload, Delete, Disable, Delete via BC	PDFRAME	Not started	PDFRAME.sys Script: Quarantine, Delete, Delete via BC
PDRELI Driver: Unload, Delete, Disable, Delete via BC	PDRELI	Not started	PDRELI.sys Script: Quarantine, Delete, Delete via BC
PDRFRAME Driver: Unload, Delete, Disable, Delete via BC	PDRFRAME	Not started	PDRFRAME.sys Script: Quarantine, Delete, Delete via BC
perc2 Driver: Unload, Delete, Disable, Delete via BC	perc2	Not started	perc2.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
perc2hib Driver: Unload, Delete, Disable, Delete via BC	perc2hib	Not started	perc2hib.sys Script: Quarantine, Delete, Delete via BC	Filter
ql1080 Driver: Unload, Delete, Disable, Delete via BC	ql1080	Not started	ql1080.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
Ql10wnt Driver: Unload, Delete, Disable, Delete via BC	Ql10wnt	Not started	Ql10wnt.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
ql12160 Driver: Unload, Delete, Disable, Delete via BC	ql12160	Not started	ql12160.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
ql1240 Driver: Unload, Delete, Disable, Delete via BC	ql1240	Not started	ql1240.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
ql1280 Driver: Unload, Delete, Disable, Delete via BC	ql1280	Not started	ql1280.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
Simbad Driver: Unload, Delete, Disable, Delete via BC	Simbad	Not started	Simbad.sys Script: Quarantine, Delete, Delete via BC	Filter
Sparrow Driver: Unload, Delete, Disable, Delete via BC	Sparrow	Not started	Sparrow.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
sym_hi Driver: Unload, Delete, Disable, Delete via BC	sym_hi	Not started	sym_hi.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
sym_u3 Driver: Unload, Delete, Disable, Delete via BC	sym_u3	Not started	sym_u3.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
symc810 Driver: Unload, Delete, Disable, Delete via BC	symc810	Not started	symc810.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
symc8xx Driver: Unload, Delete, Disable, Delete via BC	symc8xx	Not started	symc8xx.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
TosIde Driver: Unload, Delete, Disable, Delete via BC	TosIde	Not started	TosIde.sys Script: Quarantine, Delete, Delete via BC	System Bus Extender
ultra Driver: Unload, Delete, Disable, Delete via BC	ultra	Not started	ultra.sys Script: Quarantine, Delete, Delete via BC	SCSI miniport
ViaIde Driver: Unload, Delete, Disable, Delete via BC	ViaIde	Not started	ViaIde.sys Script: Quarantine, Delete, Delete via BC	System Bus Extender
WDICA Driver: Unload, Delete, Disable, Delete via BC	WDICA	Not started	WDICA.sys Script: Quarantine, Delete, Delete via BC
Detected - 191, recognized as trusted - 141

Autoruns

File name	Status	Startup method	Description
C:\DOCUME~1\Erika\LOCALS~1\Temp\3269838.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, 3269838.exe Delete
C:\DOCUME~1\Erika\LOCALS~1\Temp\9589922.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, 9589922.exe Delete
C:\DOCUME~1\Erika\LOCALS~1\Temp\wininitd.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, Audio HD Driver Delete
C:\Documents and Settings\Erika\Application Data\audiohd.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_CURRENT_USER, Software\Microsoft\Windows\CurrentVersion\Run, Windows Audio Driver Delete
C:\Documents and Settings\Erika\Local Settings\Application Data\Google\Chrome\Application\chrome.exe Script: Quarantine, Delete, Delete via BC	Active	Shortcut in Startup folder	C:\Documents and Settings\Erika\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\Erika\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome (2).lnk,
C:\Documents and Settings\Erika\Local Settings\Application Data\Google\Chrome\Application\chrome.exe Script: Quarantine, Delete, Delete via BC	Active	Shortcut in Startup folder	C:\Documents and Settings\Erika\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\Erika\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk,
C:\Program Files\Activision\Call of Duty 2\GamePark2\gpcl.exe Script: Quarantine, Delete, Delete via BC	Active	Shortcut in Startup folder	C:\Documents and Settings\All Users\Start Menu\Programs\Startup\, C:\Documents and Settings\All Users\Start Menu\Programs\Startup\GamePark klient 2.lnk,
C:\Program Files\Common Files\Logitech\LCD Manager\lcdmon.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, Launch LCDMon Delete
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, egui Delete
C:\Program Files\ESET\ESET NOD32 Antivirus\shellExt.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {B089FE88-FB52-11D3-BDF1-0050DA34150D} Delete
C:\Program Files\Electronic Arts\EADM\Core.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_CURRENT_USER, Software\Microsoft\Windows\CurrentVersion\Run, EA Core Delete
C:\Program Files\Gameforge4D\4Story\PrePatch.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, 4StoryPrePatch Delete
C:\Program Files\ICQ7.2\ICQ.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_CURRENT_USER, Software\Microsoft\Windows\CurrentVersion\Run, ICQ Delete
C:\Program Files\NuGardt Software\Seismovision 3\Seismovision3.exe Script: Quarantine, Delete, Delete via BC	Active	Shortcut in Startup folder	C:\Documents and Settings\Erika\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\Erika\Application Data\Microsoft\Internet Explorer\Quick Launch\Seismovision 3.lnk,
C:\Program Files\PokerStars\PokerStarsUpdate.exe Script: Quarantine, Delete, Delete via BC	Active	Shortcut in Startup folder	C:\Documents and Settings\Erika\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\Erika\Application Data\Microsoft\Internet Explorer\Quick Launch\PokerStars.lnk,
C:\Program Files\Skype\Phone\Skype.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_CURRENT_USER, Software\Microsoft\Windows\CurrentVersion\Run, Skype Delete
C:\Program Files\Winamp\winampa.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, WinampAgent Delete
C:\Program Files\Zoner\Photo Studio 13\Program32\Zps.exe Script: Quarantine, Delete, Delete via BC	Active	Shortcut in Startup folder	C:\Documents and Settings\Erika\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\Erika\Application Data\Microsoft\Internet Explorer\Quick Launch\Zoner Photo Studio 13.lnk,
C:\WINDOWS\System32\Drivers\AliIde.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\aliide, EventMessageFile
C:\WINDOWS\System32\Drivers\CmdIde.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\cmdide, EventMessageFile
C:\WINDOWS\System32\Drivers\IntelIde.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\intelide, EventMessageFile
C:\WINDOWS\System32\Drivers\TosIde.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\toside, EventMessageFile
C:\WINDOWS\System32\Drivers\ViaIde.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\viaide, EventMessageFile
C:\WINDOWS\System32\Drivers\lbrtfdc.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\lbrtfdc, EventMessageFile
C:\WINDOWS\System32\PrintFilterPipelineSvc.exe Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PrintFilterPipelineSvc, EventMessageFile
C:\WINDOWS\System32\drivers\ss_bbus.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\ss_bbus, EventMessageFile
C:\WINDOWS\System32\igmpv2.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile
C:\WINDOWS\System32\ipbootp.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile
C:\WINDOWS\System32\iprip2.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile
C:\WINDOWS\System32\ospf.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPF, EventMessageFile
C:\WINDOWS\System32\ospfmib.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPFMib, EventMessageFile
C:\WINDOWS\System32\polagent.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PolicyAgent, EventMessageFile
C:\WINDOWS\System32\tssdis.exe Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\TermServSessDir, EventMessageFile
C:\WINDOWS\TEMP\7847201.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, 7847201.exe Delete
C:\WINDOWS\TEMP\8661981.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, 8661981.exe Delete
C:\WINDOWS\TEMP\9595252.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, 9595252.exe Delete
C:\WINDOWS\services32.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, wxpdrv Delete
C:\WINDOWS\sysdriver32.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, sysdriver32.exe Delete
C:\WINDOWS\sysdriver32_.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, sysdriver32_.exe Delete
C:\WINDOWS\system32\KB905474\wgasetup.exe Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\WgaSetup, EventMessageFile
C:\WINDOWS\system32\MsSip1.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 1, $DLL Delete
C:\WINDOWS\system32\MsSip2.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 2, $DLL Delete
C:\WINDOWS\system32\MsSip3.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 3, $DLL Delete
C:\WINDOWS\system32\SEISMO~1.SCR Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_CURRENT_USER, Control Panel\Desktop, scrnsave.exe Delete
C:\WINDOWS\system32\SEISMO~1.SCR Script: Quarantine, Delete, Delete via BC	Active	File system.ini	C:\WINDOWS\system.ini, boot, SCRNSAVE.EXE
C:\WINDOWS\system32\WUDHost.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, Windows-Network Component Delete
C:\WINDOWS\system32\psxss.exe Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
C:\WINDOWS\system32\stisvc.exe Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System, EventMessageFile
C:\WINDOWS\update.tray-2-0\svchost.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, tray_ico1 Delete
C:\WINDOWS\update.tray-3-0\svchost.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, tray_ico0 Delete
c:\program files\common files\akamai\netsession_win_807ba95.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Akamai\Parameters, ServiceDll Delete
kbd101.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver JPN Delete
kbd101a.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver KOR Delete
mvfs32.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_USERS, .DEFAULT\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_USERS, S-1-5-19\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_USERS, S-1-5-20\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_USERS, S-1-5-18\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_CURRENT_USER, Control Panel\IOProcs, MVB Delete
services32.exe Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\SafeBoot, AlternateShell
vgafix.fon Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon Delete
vgaoem.fon Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon Delete
vgasys.fon Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon Delete
Autoruns items found - 880, recognized as trusted - 818

Internet Explorer extension modules (BHOs, Toolbars ...)

File name	Type	Description	Manufacturer	CLSID
C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll Script: Quarantine, Delete, Delete via BC	BHO	Skype Click to Call for Internet Explorer	(c) Skype Technologies S.A.	{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Delete
C:\Program Files\PokerStars\PokerStarsUpdate.exe Script: Quarantine, Delete, Delete via BC	Extension module	PokerStars Update	Copyright (C) 2001 - 2010 PokerStars	{3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} Delete
C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll Script: Quarantine, Delete, Delete via BC	Extension module	Skype Click to Call for Internet Explorer	(c) Skype Technologies S.A.	{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Delete
C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll Script: Quarantine, Delete, Delete via BC	Extension module	Skype Click to Call for Internet Explorer	(c) Skype Technologies S.A.	{92780B25-18CC-41C8-B9BE-3C9C571A8263} Delete
Items found - 27, recognized as trusted - 23

Windows Explorer extension modules

File name	Destination	Description	Manufacturer	CLSID
	Display Panning CPL Extension			{42071714-76d4-11d1-8b24-00a0c9068ff3} Delete
	Shell extensions for file compression			{764BF0E1-F219-11ce-972D-00AA00A14F56} Delete
	Encryption Context Menu			{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} Delete
	Taskbar and Start Menu			{0DF44EAA-FF21-4412-828E-260A8728E7F1} Delete
	User Accounts			{7A9D77BD-5403-11d2-8785-2E0420524153} Delete
C:\Program Files\ESET\ESET NOD32 Antivirus\shellExt.dll Script: Quarantine, Delete, Delete via BC	ESET Smart Security - Context Menu Shell Extension			{B089FE88-FB52-11D3-BDF1-0050DA34150D} Delete
Items found - 197, recognized as trusted - 191

Printing system extensions (print monitors, providers)

File name	Type	Name	Description	Manufacturer
Items found - 8, recognized as trusted - 8

Task Scheduler jobs

File name	Job name	Job state	Description	Manufacturer
Items found - 4, recognized as trusted - 4

SPI/LSP settings

Namespace providers (NSP)

Manufacturer	Status	EXE file	Description	GUID
Detected - 3, recognized as trusted - 3

Transport protocol providers (TSP, LSP)

Manufacturer EXE file Description
Detected - 19, recognized as trusted - 19
Results of automatic SPI settings check
LSP settings checked. No errors detected

TCP/UDP ports

Port Status Remote Host Remote Port Application Notes
TCP ports
80 LISTENING 0.0.0.0 12516 [2804] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
135 LISTENING 0.0.0.0 30793 [1060] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
139 LISTENING 0.0.0.0 57404 [4] System
Script: Quarantine, Delete, Delete via BC, Terminate
443 LISTENING 0.0.0.0 8340 [2804] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
445 LISTENING 0.0.0.0 45080 [4] System
Script: Quarantine, Delete, Delete via BC, Terminate
1143 LISTENING 0.0.0.0 16520 [2480] c:\windows\system32\alg.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1188 LISTENING 0.0.0.0 2048 [2804] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1492 ESTABLISHED 127.0.0.1 45771 [1864] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1512 ESTABLISHED 127.0.0.1 53935 [952] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1526 ESTABLISHED 127.0.0.1 45771 [1864] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1537 ESTABLISHED 127.0.0.1 53935 [952] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1573 ESTABLISHED 127.0.0.1 26888 [1152] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1578 ESTABLISHED 127.0.0.1 43169 [2848] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1600 ESTABLISHED 127.0.0.1 26888 [1152] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1605 ESTABLISHED 127.0.0.1 43169 [2848] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1634 ESTABLISHED 127.0.0.1 45771 [1864] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1649 ESTABLISHED 127.0.0.1 45771 [1864] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
2438 ESTABLISHED 74.125.79.100 80 [2004] c:\documents and settings\erika\local settings\application data\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
2479 ESTABLISHED 127.0.0.1 53935 [952] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
2489 ESTABLISHED 127.0.0.1 53935 [952] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
2808 ESTABLISHED 127.0.0.1 26888 [1152] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
2840 ESTABLISHED 127.0.0.1 26888 [1152] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
3170 SYN_SENT 79.118.212.10 62999 [4036] c:\windows\sysdriver32.exe
Script: Quarantine, Delete, Delete via BC, Terminate
3175 SYN_SENT 92.249.218.46 62999 [4036] c:\windows\sysdriver32.exe
Script: Quarantine, Delete, Delete via BC, Terminate
3192 SYN_SENT 188.129.251.50 62999 [2804] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
3224 SYN_SENT 85.198.211.222 9442 [2660] c:\windows\update.5.0\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
3227 SYN_SENT 188.190.79.23 9442 [2660] c:\windows\update.5.0\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
3321 ESTABLISHED 89.108.66.156 80 [2680] c:\program files\avz4\avz.exe
Script: Quarantine, Delete, Delete via BC, Terminate
3337 SYN_SENT 156.17.190.34 62999 [2848] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
3343 SYN_SENT 78.139.158.219 62999 [2848] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
3352 SYN_SENT 109.87.216.164 62999 [952] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
3356 SYN_SENT 213.111.112.79 62999 [952] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
3361 SYN_SENT 188.230.15.250 62999 [952] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
5152 LISTENING 0.0.0.0 8204 [1132] c:\program files\java\jre6\bin\jqs.exe
Script: Quarantine, Delete, Delete via BC, Terminate
8081 LISTENING 0.0.0.0 18523 [4036] c:\windows\sysdriver32.exe
Script: Quarantine, Delete, Delete via BC, Terminate
9421 LISTENING 0.0.0.0 16546 [584] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
9422 LISTENING 0.0.0.0 2240 [584] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
9423 LISTENING 0.0.0.0 12444 [584] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
22616 LISTENING 0.0.0.0 39074 [2660] c:\windows\update.5.0\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
26888 ESTABLISHED 127.0.0.1 2808 [1152] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
26888 ESTABLISHED 127.0.0.1 2840 [1152] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
26888 LISTENING 0.0.0.0 2096 [1152] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
26888 ESTABLISHED 127.0.0.1 1573 [1152] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
26888 ESTABLISHED 127.0.0.1 1600 [1152] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
34304 LISTENING 0.0.0.0 8444 [2804] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
41711 LISTENING 0.0.0.0 38942 [2080] c:\program files\dna\btdna.exe
Script: Quarantine, Delete, Delete via BC, Terminate
43169 ESTABLISHED 127.0.0.1 1578 [2848] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
43169 ESTABLISHED 127.0.0.1 1605 [2848] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
43169 LISTENING 0.0.0.0 39070 [2848] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
45771 ESTABLISHED 127.0.0.1 1634 [1864] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
45771 ESTABLISHED 127.0.0.1 1649 [1864] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
45771 LISTENING 0.0.0.0 59622 [1864] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
45771 ESTABLISHED 127.0.0.1 1492 [1864] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
45771 ESTABLISHED 127.0.0.1 1526 [1864] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
53935 ESTABLISHED 127.0.0.1 2479 [952] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
53935 ESTABLISHED 127.0.0.1 2489 [952] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
53935 LISTENING 0.0.0.0 14496 [952] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
53935 ESTABLISHED 127.0.0.1 1512 [952] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
53935 ESTABLISHED 127.0.0.1 1537 [952] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
UDP ports
123 LISTENING -- -- [1156] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
123 LISTENING -- -- [1156] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
137 LISTENING -- -- [4] System
Script: Quarantine, Delete, Delete via BC, Terminate
138 LISTENING -- -- [4] System
Script: Quarantine, Delete, Delete via BC, Terminate
445 LISTENING -- -- [4] System
Script: Quarantine, Delete, Delete via BC, Terminate
500 LISTENING -- -- [816] c:\windows\system32\lsass.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1026 LISTENING -- -- [1584] c:\program files\divx\divx update\divxupdate.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1027 LISTENING -- -- [584] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1028 LISTENING -- -- [584] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1491 LISTENING -- -- [1864] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1510 LISTENING -- -- [952] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1572 LISTENING -- -- [1152] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1577 LISTENING -- -- [2848] c:\windows\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1900 LISTENING -- -- [1408] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1900 LISTENING -- -- [2080] c:\program files\dna\btdna.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1900 LISTENING -- -- [1408] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
4500 LISTENING -- -- [816] c:\windows\system32\lsass.exe
Script: Quarantine, Delete, Delete via BC, Terminate
41711 LISTENING -- -- [2080] c:\program files\dna\btdna.exe
Script: Quarantine, Delete, Delete via BC, Terminate
44301 LISTENING -- -- [1700] c:\windows\system32\pnkbstra.exe
Script: Quarantine, Delete, Delete via BC, Terminate
45301 LISTENING -- -- [628] c:\windows\system32\pnkbstrb.exe
Script: Quarantine, Delete, Delete via BC, Terminate

Downloaded Program Files (DPF)

File name Description Manufacturer CLSID Source URL
Items found - 6, recognized as trusted - 6

Control Panel Applets (CPL)

File name Description Manufacturer
Items found - 33, recognized as trusted - 33

Active Setup

File name Description Manufacturer CLSID
Items found - 14, recognized as trusted - 14

HOSTS file

Hosts file record
127.0.0.1 localhost
127.0.0.1 facebook.com
127.0.0.1 www.facebook.com
127.0.0.1 af-za.facebook.com
127.0.0.1 az-az.facebook.com
127.0.0.1 id-id.facebook.com
127.0.0.1 ms-my.facebook.com
127.0.0.1 bs-ba.facebook.com
127.0.0.1 ca-es.facebook.com
127.0.0.1 cs-cz.facebook.com
127.0.0.1 cy-gb.facebook.com
127.0.0.1 da-dk.facebook.com
127.0.0.1 de-de.facebook.com
127.0.0.1 et-ee.facebook.com
127.0.0.1 en-gb.facebook.com
127.0.0.1 es-la.facebook.com
127.0.0.1 eo-eo.facebook.com
127.0.0.1 eu-es.facebook.com
127.0.0.1 tl-ph.facebook.com
127.0.0.1 fo-fo.facebook.com
127.0.0.1 fr-fr.facebook.com
127.0.0.1 fy-nl.facebook.com
127.0.0.1 ga-ie.facebook.com
127.0.0.1 gl-es.facebook.com
127.0.0.1 ko-kr.facebook.com
127.0.0.1 hr-hr.facebook.com
127.0.0.1 is-is.facebook.com
127.0.0.1 it-it.facebook.com
127.0.0.1 ka-ge.facebook.com
127.0.0.1 sw-ke.facebook.com
127.0.0.1 ku-tr.facebook.com
127.0.0.1 lv-lv.facebook.com
127.0.0.1 fb-lt.facebook.com
127.0.0.1 lt-lt.facebook.com
127.0.0.1 la-va.facebook.com
127.0.0.1 hu-hu.facebook.com
127.0.0.1 nl-nl.facebook.com
127.0.0.1 ja-jp.facebook.com
127.0.0.1 nb-no.facebook.com
127.0.0.1 nn-no.facebook.com
127.0.0.1 pl-pl.facebook.com
127.0.0.1 pt-br.facebook.com
127.0.0.1 ro-ro.facebook.com
127.0.0.1 ru-ru.facebook.com
127.0.0.1 sq-al.facebook.com
127.0.0.1 sk-sk.facebook.com
127.0.0.1 sl-si.facebook.com
127.0.0.1 fi-fi.facebook.com
127.0.0.1 sv-se.facebook.com
127.0.0.1 th-th.facebook.com
127.0.0.1 vi-vn.facebook.com
127.0.0.1 tr-tr.facebook.com
127.0.0.1 zh-tw.facebook.com
127.0.0.1 el-gr.facebook.com
127.0.0.1 be-by.facebook.com
127.0.0.1 bg-bg.facebook.com
127.0.0.1 mk-mk.facebook.com
127.0.0.1 sr-rs.facebook.com
127.0.0.1 uk-ua.facebook.com
127.0.0.1 hy-am.facebook.com
127.0.0.1 he-il.facebook.com
127.0.0.1 ar-ar.facebook.com
127.0.0.1 ps-af.facebook.com
127.0.0.1 fa-ir.facebook.com
127.0.0.1 ne-np.facebook.com
127.0.0.1 hi-in.facebook.com
127.0.0.1 bn-in.facebook.com
127.0.0.1 pa-in.facebook.com
127.0.0.1 ta-in.facebook.com
127.0.0.1 te-in.facebook.com
127.0.0.1 ml-in.facebook.com
127.0.0.1 es-es.facebook.com
127.0.0.1 fr-ca.facebook.com
127.0.0.1 pt-pt.facebook.com
127.0.0.1 zh-cn.facebook.com
127.0.0.1 zh-hk.facebook.com
Clear Hosts file

Protocols and handlers

File name Type Description Manufacturer CLSID
mscoree.dll
Script: Quarantine, Delete, Delete via BC Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, Delete via BC Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, Delete via BC Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Script: Quarantine, Delete, Delete via BC Handler Skype Click to Call for Internet Explorer (skype-ie-addon-data: pluggable protocol) (c) Skype Technologies S.A. {91774881-D725-4E58-B298-07617B9B86A8}
Delete
Items found - 33, recognized as trusted - 29

Suspicious objects

File Description Type
C:\WINDOWS\services32.exe
Script: Quarantine, Delete, Delete via BC Suspicion by Heuristic analysis HSC: suspicion for File with suspicious name (CH) (high degree of probability)
C:\WINDOWS\sysdriver32.exe
Script: Quarantine, Delete, Delete via BC Suspicion by Heuristic analysis HSC: suspicion for File with suspicious name (CH) (high degree of probability)
C:\WINDOWS\sysdriver32_.exe
Script: Quarantine, Delete, Delete via BC Suspicion by Heuristic analysis HSC: suspicion for File with suspicious name (CH) (high degree of probability)
C:\WINDOWS\ufa\ufa.exe
Script: Quarantine, Delete, Delete via BC Suspicion by Heuristic analysis HSC: suspicion for File with suspicious name (CH)
C:\WINDOWS\update.tray-2-0\svchost.exe
Script: Quarantine, Delete, Delete via BC Suspicion by Heuristic analysis HSC: suspicion for File with suspicious name (CH)
C:\WINDOWS\update.tray-3-0\svchost.exe
Script: Quarantine, Delete, Delete via BC Suspicion by Heuristic analysis HSC: suspicion for File with suspicious name (CH)
C:\WINDOWS\update.1\svchost.exe
Script: Quarantine, Delete, Delete via BC Suspicion by Heuristic analysis HSC: suspicion for File with suspicious name (CH)
C:\WINDOWS\update.2\svchost.exe
Script: Quarantine, Delete, Delete via BC Suspicion by Heuristic analysis HSC: suspicion for File with suspicious name (CH)
C:\WINDOWS\update.5.0\svchost.exe
Script: Quarantine, Delete, Delete via BC Suspicion by Heuristic analysis HSC: suspicion for File with suspicious name (CH)
C:\DOCUME~1\Erika\LOCALS~1\Temp\wininitd.exe
Script: Quarantine, Delete, Delete via BC Suspicion by Heuristic analysis HSC: suspicion for File with suspicious name (CH - Autorun) (high degree of probability)

AVZ Antiviral Toolkit log; AVZ version is 4.37
Scanning started at 29.10.2011 16:34:37
Database loaded: signatures - 294598, NN profile(s) - 2, malware removal microprograms - 56, signature database released 29.10.2011 16:00
Heuristic microprograms loaded: 388
PVS microprograms loaded: 9
Digital signatures of system files loaded: 302280
Heuristic analyzer mode: Maximum heuristics mode
Malware removal mode: disabled
Windows version is: 5.1.2600, Service Pack 3 ; AVZ is run with administrator rights
System Restore: enabled
1. Searching for Rootkits and other software intercepting API functions
1.1 Searching for user-mode API hooks
 Analysis: kernel32.dll, export table found in section .text
 Analysis: ntdll.dll, export table found in section .text
 Analysis: user32.dll, export table found in section .text
 Analysis: advapi32.dll, export table found in section .text
 Analysis: ws2_32.dll, export table found in section .text
 Analysis: wininet.dll, export table found in section .text
 Analysis: rasapi32.dll, export table found in section .text
 Analysis: urlmon.dll, export table found in section .text
 Analysis: netapi32.dll, export table found in section .text
1.2 Searching for kernel-mode API hooks
 Driver loaded successfully
 SDT found (RVA=08B520)
 Kernel ntoskrnl.exe found in memory at address 804D7000
   SDT = 80562520
   KiST = 804E48D0 (284)
Functions checked: 284, intercepted: 0, restored: 0
1.3 Checking IDT and SYSENTER
 Analyzing CPU 1
 Analyzing CPU 2
 Analyzing CPU 3
 Analyzing CPU 4
 Checking IDT and SYSENTER - complete
1.4 Searching for masking processes and drivers
 Checking not performed: extended monitoring driver (AVZPM) is not installed
1.5 Checking IRP handlers
 Driver loaded successfully
 Checking - complete
2. Scanning RAM
 Number of processes found: 51
Extended process analysis: 628 C:\WINDOWS\system32\PnkBstrB.exe
[ES]:Program code includes networking-related functionality
[ES]:Capable of sending mail ?!
[ES]:Application has no visible windows
[ES]:Located in system folder
Extended process analysis: 608 C:\WINDOWS\update.5.0\svchost.exe
[ES]:Program code includes networking-related functionality
[ES]:Application has no visible windows
[ES]:EXE runtime packer ?
[ES]:Located in system folder
Extended process analysis: 2660 C:\WINDOWS\update.5.0\svchost.exe
[ES]:Program code includes networking-related functionality
[ES]:Listens on TCP ports !
[ES]:Application has no visible windows
[ES]:EXE runtime packer ?
[ES]:Located in system folder
[ES]:Loads RASAPI DLL - may use dialing ?
Extended process analysis: 4036 C:\WINDOWS\sysdriver32.exe
[ES]:Program code includes networking-related functionality
[ES]:Listens on TCP ports !
[ES]:Application has no visible windows
[ES]:EXE runtime packer ?
[ES]:Located in system folder
[ES]:Registered for automatic startup !!
[ES]:Loads RASAPI DLL - may use dialing ?
 Number of modules loaded: 309
Scanning RAM - complete
3. Scanning disks
4. Checking  Winsock Layered Service Provider (SPI/LSP)
 LSP settings checked. No errors detected
5. Searching for keyboard/mouse/windows events hooks (Keyloggers, Trojan DLLs)
6. Searching for opened TCP/UDP ports used by malicious software
 Checking - disabled by user
7. Heuristic system check
Non-standard registry key for system service: BITS ImagePath=""
Non-standard registry key for system service: wuauserv ImagePath=""
>>> C:\WINDOWS\services32.exe HSC: suspicion for File with suspicious name (CH) (high degree of probability)
>>> C:\WINDOWS\sysdriver32.exe HSC: suspicion for File with suspicious name (CH) (high degree of probability)
>>> C:\WINDOWS\sysdriver32_.exe HSC: suspicion for File with suspicious name (CH) (high degree of probability)
>>> C:\WINDOWS\ufa\ufa.exe HSC: suspicion for File with suspicious name (CH)
>>> C:\WINDOWS\update.tray-2-0\svchost.exe HSC: suspicion for File with suspicious name (CH)
>>> C:\WINDOWS\update.tray-3-0\svchost.exe HSC: suspicion for File with suspicious name (CH)
>>> C:\WINDOWS\update.1\svchost.exe HSC: suspicion for File with suspicious name (CH)
>>> C:\WINDOWS\update.2\svchost.exe HSC: suspicion for File with suspicious name (CH)
>>> C:\WINDOWS\update.5.0\svchost.exe HSC: suspicion for File with suspicious name (CH)
>>> C:\DOCUME~1\Erika\LOCALS~1\Temp\wininitd.exe HSC: suspicion for File with suspicious name (CH - Autorun) (high degree of probability)
>>> C:\WINDOWS\sysdriver32.exe HSC: suspicion for File with suspicious name (CH - Autorun) (high degree of probability)
>>> C:\WINDOWS\sysdriver32_.exe HSC: suspicion for File with suspicious name (CH - Autorun) (high degree of probability)
>>> C:\WINDOWS\update.tray-3-0\svchost.exe HSC: suspicion for File with suspicious name (CH - Autorun) (high degree of probability)
>>> C:\WINDOWS\update.tray-2-0\svchost.exe HSC: suspicion for File with suspicious name (CH - Autorun) (high degree of probability)
>>> C:\WINDOWS\services32.exe HSC: suspicion for File with suspicious name (CH - Autorun) (high degree of probability)
>>> C:\WINDOWS\update.5.0\svchost.exe HSC: suspicion for File with suspicious name (CH - Service) (high degree of probability)
>>> C:\WINDOWS\update.2\svchost.exe HSC: suspicion for File with suspicious name (CH - Service) (high degree of probability)
>>> C:\WINDOWS\sysdriver32.exe HSC: suspicion for File with suspicious name (CH - Service) (high degree of probability)
>>> C:\WINDOWS\update.1\svchost.exe HSC: suspicion for File with suspicious name (CH - Service) (high degree of probability)
Checking - complete
8. Searching for vulnerabilities
>> Services: potentially dangerous service allowed: RemoteRegistry (Remote Registry)
>> Services: potentially dangerous service allowed: TermService (Terminal Services)
>> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery Service)
>> Services: potentially dangerous service allowed: Schedule (Task Scheduler)
>> Services: potentially dangerous service allowed: mnmsrvc (NetMeeting Remote Desktop Sharing)
>> Services: potentially dangerous service allowed: RDSessMgr (Remote Desktop Help Session Manager)
> Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)!
>> Security: disk drives' autorun is enabled
>> Security: administrative shares (C$, D$ ...) are enabled
>> Security: anonymous user access is enabled
>> Security: sending Remote Assistant queries is enabled
Checking - complete
9. Troubleshooting wizard
 >>  HDD autorun is allowed
 >>  Network drives autorun is allowed
 >>  Removable media autorun is allowed
Checking - complete
Files scanned: 363, extracted from archives: 0, malicious software found 0, suspicions - 0
Scanning finished at 29.10.2011 16:35:06
Time of scanning: 00:00:30
If you have a suspicion on presence of viruses or questions on the suspected objects,
you can address http://forum.kaspersky.com/index.php?showforum=19
System Analysis in progress

 System Analysis - complete


Script commands 
Add commands to script:
Blocking hooks using Anti-Rootkit
Enable AVZGuard
Operations with AVZPM (true=enable,false=disable)
BootCleaner - import list of deleted files
BootCleaner - import all
Remove traces of deleted files
ExecuteWizard ('TSW',2,3,true) - Running Troubleshooting wizard
BootCleaner - activate
Reboot
Insert template for QuarantineFile() - quarantining a file
Insert template for BC_QrFile() - quarantining file via BootCleaner
Insert template for DeleteFile() - deleting a file
Insert template for DelCLSID() - removing a CLSID item from registry
Additional operations:Performance tweaking: disable service RemoteRegistry (Remote Registry)
Performance tweaking: disable service TermService (Terminal Services)
Performance tweaking: disable service SSDPSRV (SSDP Discovery Service)
Performance tweaking: disable service Schedule (Task Scheduler)
Performance tweaking: disable service mnmsrvc (NetMeeting Remote Desktop Sharing)
Performance tweaking: disable service RDSessMgr (Remote Desktop Help Session Manager)
Security tweaking: disable CD autorun
Security tweaking: disable administrative shares
Security tweaking: disable anonymous user access
Security: disable sending Remote Assistant queries

File list

Port	Status	Remote Host	Remote Port	Application	Notes
TCP ports
80	LISTENING	0.0.0.0	12516	[2804] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
135	LISTENING	0.0.0.0	30793	[1060] c:\windows\system32\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
139	LISTENING	0.0.0.0	57404	[4] System Script: Quarantine, Delete, Delete via BC, Terminate
443	LISTENING	0.0.0.0	8340	[2804] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
445	LISTENING	0.0.0.0	45080	[4] System Script: Quarantine, Delete, Delete via BC, Terminate
1143	LISTENING	0.0.0.0	16520	[2480] c:\windows\system32\alg.exe Script: Quarantine, Delete, Delete via BC, Terminate
1188	LISTENING	0.0.0.0	2048	[2804] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
1492	ESTABLISHED	127.0.0.1	45771	[1864] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
1512	ESTABLISHED	127.0.0.1	53935	[952] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
1526	ESTABLISHED	127.0.0.1	45771	[1864] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
1537	ESTABLISHED	127.0.0.1	53935	[952] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
1573	ESTABLISHED	127.0.0.1	26888	[1152] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
1578	ESTABLISHED	127.0.0.1	43169	[2848] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
1600	ESTABLISHED	127.0.0.1	26888	[1152] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
1605	ESTABLISHED	127.0.0.1	43169	[2848] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
1634	ESTABLISHED	127.0.0.1	45771	[1864] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
1649	ESTABLISHED	127.0.0.1	45771	[1864] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
2438	ESTABLISHED	74.125.79.100	80	[2004] c:\documents and settings\erika\local settings\application data\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
2479	ESTABLISHED	127.0.0.1	53935	[952] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
2489	ESTABLISHED	127.0.0.1	53935	[952] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
2808	ESTABLISHED	127.0.0.1	26888	[1152] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
2840	ESTABLISHED	127.0.0.1	26888	[1152] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
3170	SYN_SENT	79.118.212.10	62999	[4036] c:\windows\sysdriver32.exe Script: Quarantine, Delete, Delete via BC, Terminate
3175	SYN_SENT	92.249.218.46	62999	[4036] c:\windows\sysdriver32.exe Script: Quarantine, Delete, Delete via BC, Terminate
3192	SYN_SENT	188.129.251.50	62999	[2804] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
3224	SYN_SENT	85.198.211.222	9442	[2660] c:\windows\update.5.0\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
3227	SYN_SENT	188.190.79.23	9442	[2660] c:\windows\update.5.0\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
3321	ESTABLISHED	89.108.66.156	80	[2680] c:\program files\avz4\avz.exe Script: Quarantine, Delete, Delete via BC, Terminate
3337	SYN_SENT	156.17.190.34	62999	[2848] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
3343	SYN_SENT	78.139.158.219	62999	[2848] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
3352	SYN_SENT	109.87.216.164	62999	[952] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
3356	SYN_SENT	213.111.112.79	62999	[952] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
3361	SYN_SENT	188.230.15.250	62999	[952] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
5152	LISTENING	0.0.0.0	8204	[1132] c:\program files\java\jre6\bin\jqs.exe Script: Quarantine, Delete, Delete via BC, Terminate
8081	LISTENING	0.0.0.0	18523	[4036] c:\windows\sysdriver32.exe Script: Quarantine, Delete, Delete via BC, Terminate
9421	LISTENING	0.0.0.0	16546	[584] c:\windows\system32\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
9422	LISTENING	0.0.0.0	2240	[584] c:\windows\system32\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
9423	LISTENING	0.0.0.0	12444	[584] c:\windows\system32\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
22616	LISTENING	0.0.0.0	39074	[2660] c:\windows\update.5.0\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
26888	ESTABLISHED	127.0.0.1	2808	[1152] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
26888	ESTABLISHED	127.0.0.1	2840	[1152] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
26888	LISTENING	0.0.0.0	2096	[1152] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
26888	ESTABLISHED	127.0.0.1	1573	[1152] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
26888	ESTABLISHED	127.0.0.1	1600	[1152] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
34304	LISTENING	0.0.0.0	8444	[2804] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
41711	LISTENING	0.0.0.0	38942	[2080] c:\program files\dna\btdna.exe Script: Quarantine, Delete, Delete via BC, Terminate
43169	ESTABLISHED	127.0.0.1	1578	[2848] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
43169	ESTABLISHED	127.0.0.1	1605	[2848] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
43169	LISTENING	0.0.0.0	39070	[2848] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
45771	ESTABLISHED	127.0.0.1	1634	[1864] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
45771	ESTABLISHED	127.0.0.1	1649	[1864] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
45771	LISTENING	0.0.0.0	59622	[1864] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
45771	ESTABLISHED	127.0.0.1	1492	[1864] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
45771	ESTABLISHED	127.0.0.1	1526	[1864] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
53935	ESTABLISHED	127.0.0.1	2479	[952] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
53935	ESTABLISHED	127.0.0.1	2489	[952] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
53935	LISTENING	0.0.0.0	14496	[952] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
53935	ESTABLISHED	127.0.0.1	1512	[952] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
53935	ESTABLISHED	127.0.0.1	1537	[952] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
UDP ports
123	LISTENING	--	--	[1156] c:\windows\system32\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
123	LISTENING	--	--	[1156] c:\windows\system32\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
137	LISTENING	--	--	[4] System Script: Quarantine, Delete, Delete via BC, Terminate
138	LISTENING	--	--	[4] System Script: Quarantine, Delete, Delete via BC, Terminate
445	LISTENING	--	--	[4] System Script: Quarantine, Delete, Delete via BC, Terminate
500	LISTENING	--	--	[816] c:\windows\system32\lsass.exe Script: Quarantine, Delete, Delete via BC, Terminate
1026	LISTENING	--	--	[1584] c:\program files\divx\divx update\divxupdate.exe Script: Quarantine, Delete, Delete via BC, Terminate
1027	LISTENING	--	--	[584] c:\windows\system32\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
1028	LISTENING	--	--	[584] c:\windows\system32\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
1491	LISTENING	--	--	[1864] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
1510	LISTENING	--	--	[952] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
1572	LISTENING	--	--	[1152] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
1577	LISTENING	--	--	[2848] c:\windows\update.2\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
1900	LISTENING	--	--	[1408] c:\windows\system32\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
1900	LISTENING	--	--	[2080] c:\program files\dna\btdna.exe Script: Quarantine, Delete, Delete via BC, Terminate
1900	LISTENING	--	--	[1408] c:\windows\system32\svchost.exe Script: Quarantine, Delete, Delete via BC, Terminate
4500	LISTENING	--	--	[816] c:\windows\system32\lsass.exe Script: Quarantine, Delete, Delete via BC, Terminate
41711	LISTENING	--	--	[2080] c:\program files\dna\btdna.exe Script: Quarantine, Delete, Delete via BC, Terminate
44301	LISTENING	--	--	[1700] c:\windows\system32\pnkbstra.exe Script: Quarantine, Delete, Delete via BC, Terminate
45301	LISTENING	--	--	[628] c:\windows\system32\pnkbstrb.exe Script: Quarantine, Delete, Delete via BC, Terminate