Results of system analysis

List of processes

File name	PID	Description	Copyright	MD5	Information
e:\program files\sharp\button manager g\btnman.exe Script: Quarantine, Delete, BC delete, Terminate	2212	Button Manager	Copyright (c) 2000-2004 SHARP CORPORATION	??	172.00 kb, rsAh, created: 10/10/2005 12:48:45 PM, modified: 9/14/2004 3:13:12 AM Command line: "E:\Program Files\SHARP\Button Manager G\btnman.exe"
e:\program files\broadjump\client foundation\cfd.exe Script: Quarantine, Delete, BC delete, Terminate	3940			??	360.08 kb, rsAh, created: 6/13/2003 11:06:50 AM, modified: 8/2/2002 12:33:20 PM Command line: "E:\Program Files\BroadJump\Client Foundation\CFD.exe"
e:\program files\hp\hp ut\bin\hppusg.exe Script: Quarantine, Delete, BC delete, Terminate	3624			??	36.00 kb, rsAh, created: 9/7/2005 3:25:00 AM, modified: 9/7/2005 3:25:00 AM Command line: "E:\Program Files\HP\HP UT\bin\hppusg.exe" "E:\Program Files\HP\HP UT\"
e:\program files\hp\toolboxfx\bin\hptlbxfx.exe Script: Quarantine, Delete, BC delete, Terminate	3264	HPTLBXFX	(c) 2002-2005 Copyright Hewlett-Packard Development Company, L.P.	??	44.00 kb, rsAh, created: 2/2/2006 8:12:30 AM, modified: 2/2/2006 8:12:30 AM Command line: "E:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /systrayIcon:on /fl:on /fr:on /appData:on
e:\program files\sharp\sharpdesk\indexer.exe Script: Quarantine, Delete, BC delete, Terminate	3576	Indexer Module	Copyright (C) 2000-2004	??	180.00 kb, rsAh, created: 10/1/2004 6:07:38 AM, modified: 10/1/2004 6:07:38 AM Command line: "E:\Program Files\Sharp\Sharpdesk\Indexer.exe"
e:\program files\sharp\sharpdesk\indextray.exe Script: Quarantine, Delete, BC delete, Terminate	3548	IndexTray Module	Copyright (C) 2000-2004	??	104.00 kb, rsAh, created: 10/1/2004 6:06:48 AM, modified: 10/1/2004 6:06:48 AM Command line: "E:\Program Files\Sharp\Sharpdesk\IndexTray.exe"
e:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe Script: Quarantine, Delete, BC delete, Terminate	2496	Logitech Desktop Messenger	Copyright (C) Logitech 2000-2007. All rights reserved	??	65.55 kb, rsAh, created: 10/30/2007 7:21:07 AM, modified: 10/30/2007 7:21:07 AM Command line: "E:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" -startup
e:\progra~1\musicm~1\musicm~2\mm_tray.exe Script: Quarantine, Delete, BC delete, Terminate	3472	mm_tray	Copyright © Musicmatch 1998-2004	??	132.00 kb, rsAh, created: 2/19/2007 12:57:40 PM, modified: 5/3/2005 10:10:48 AM Command line: "E:\PROGRA~1\MUSICM~1\MUSICM~2\mm_tray.exe"
e:\program files\musicmatch\musicmatch jukebox\mmtask.exe Script: Quarantine, Delete, BC delete, Terminate	3504		(c) Musicmatch Inc.. All rights reserved.	??	52.00 kb, rsAh, created: 2/19/2007 12:57:40 PM, modified: 5/3/2005 10:10:48 AM Command line: "E:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
e:\program files\trend micro\internet security 2007\pccguide.exe Script: Quarantine, Delete, BC delete, Terminate	3392	PCCGuide	Copyright (C) 1995-2006 Trend Micro Incorporated. All rights reserved.	??	3349.52 kb, rsAh, created: 1/22/2007 11:26:26 PM, modified: 1/22/2007 11:26:26 PM Command line: "E:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
e:\progra~1\trendm~1\intern~1\pcctlcom.exe Script: Quarantine, Delete, BC delete, Terminate	1932	PcCtlCom Module	Copyright (C) 1995-2006 Trend Micro Incorporated. All rights reserved.	??	1877.52 kb, rsAh, created: 1/22/2007 11:27:16 PM, modified: 1/22/2007 11:27:16 PM Command line: E:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
e:\progra~1\trendm~1\intern~1\pcscnsrv.exe Script: Quarantine, Delete, BC delete, Terminate	1964	PcScnSrv	Copyright (C) 1995-2006 Trend Micro Incorporated. All rights reserved.	??	209.52 kb, rsAh, created: 12/28/2006 11:53:14 PM, modified: 12/28/2006 11:53:14 PM Command line: "E:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe"
e:\program files\sharp\sharpdesk\sharptray.exe Script: Quarantine, Delete, BC delete, Terminate	3348	SharpTray Module	Copyright (C) 2000-2004	??	32.00 kb, rsAh, created: 10/1/2004 6:14:50 AM, modified: 10/1/2004 6:14:50 AM Command line: "E:\Program Files\Sharp\Sharpdesk\SharpTray.exe"
e:\windows\system32\spoolsv.exe Script: Quarantine, Delete, BC delete, Terminate	1620	Spooler SubSystem App	© Microsoft Corporation. All rights reserved.	??	56.50 kb, rsAh, created: 2/28/2006 5:00:00 AM, modified: 4/13/2008 5:12:36 PM Command line: E:\WINDOWS\system32\spoolsv.exe
e:\windows\system32\winlogon.exe Script: Quarantine, Delete, BC delete, Terminate	832	Windows NT Logon Application	© Microsoft Corporation. All rights reserved.	??	496.00 kb, rsAh, created: 2/28/2006 5:00:00 AM, modified: 4/13/2008 5:12:39 PM Command line: winlogon.exe
e:\windows\system32\wbem\wmiprvse.exe Script: Quarantine, Delete, BC delete, Terminate	2668	WMI	© Microsoft Corporation. All rights reserved.	??	222.50 kb, rsAh, created: 1/15/2004 3:49:29 PM, modified: 2/6/2009 3:10:02 AM Command line: E:\WINDOWS\system32\wbem\wmiprvse.exe-secured-Embedding
Detected:44, recognized as trusted 33

Module name	Handle	Description	Copyright	MD5	Used by processes
E:\Program Files\BroadJump\Client Foundation\AppProperties.dll Script: Quarantine, Delete, BC delete	1761214464			--	3940
E:\Program Files\BroadJump\Client Foundation\BasicLoaderService.dll Script: Quarantine, Delete, BC delete	1760428032			--	3940
E:\Program Files\BroadJump\Client Foundation\BJComBase.dll Script: Quarantine, Delete, BC delete	1760034816			--	3940
E:\Program Files\BroadJump\Client Foundation\BJComRT.dll Script: Quarantine, Delete, BC delete	1759510528			--	3940
E:\Program Files\BroadJump\Client Foundation\BJComSRCManager.dll Script: Quarantine, Delete, BC delete	1759182848			--	3940
E:\Program Files\BroadJump\Client Foundation\BJIntlCore_1_1_DDR.dll Script: Quarantine, Delete, BC delete	1758855168	BJIntl		--	3940
E:\Program Files\BroadJump\Client Foundation\CFD.exe Script: Quarantine, Delete, BC delete	4194304			??	3940
E:\Program Files\BroadJump\Client Foundation\stlport_4_0_0_DDR.dll Script: Quarantine, Delete, BC delete	1755185152	STLport		--	3940
E:\Program Files\BroadJump\Client Foundation\TimerManager.dll Script: Quarantine, Delete, BC delete	1753612288			--	3940
E:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe Script: Quarantine, Delete, BC delete	4194304	Logitech Desktop Messenger	Copyright (C) Logitech 2000-2007. All rights reserved	??	2496
E:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe Script: Quarantine, Delete, BC delete	4194304		(c) Musicmatch Inc.. All rights reserved.	??	3504
E:\Program Files\SHARP\Button Manager G\ApiTwain.dll Script: Quarantine, Delete, BC delete	268435456	ApiTwain (For Button Manager)	Copyright (C) 2000-2004 SHARP CORPORATION	--	2212
E:\Program Files\SHARP\Button Manager G\BtnEvent.dll Script: Quarantine, Delete, BC delete	3407872	Button Manager for AJ Series	Copyright (C) 2000 SHARP CORPORATION	--	2212
E:\Program Files\SHARP\Button Manager G\btnman.exe Script: Quarantine, Delete, BC delete	4194304	Button Manager	Copyright (c) 2000-2004 SHARP CORPORATION	??	2212
E:\Program Files\SHARP\Button Manager G\btnmanrc.DLL Script: Quarantine, Delete, BC delete	13697024	Button Manager	Copyright (c) 2000-2004 SHARP CORPORATION	--	2212
E:\Program Files\SHARP\Button Manager G\BtnstoFAX.dll Script: Quarantine, Delete, BC delete	3735552	Button Manager for AJ Series	Copyright (C) 2000 SHARP CORPORATION	--	2212
E:\Program Files\SHARP\Button Manager G\BtnstoMAIL.dll Script: Quarantine, Delete, BC delete	3670016	Button Manager	Copyright (c) 2000-2004 SHARP CORPORATION	--	2212
E:\Program Files\SHARP\Button Manager G\BtnstoOCR.dll Script: Quarantine, Delete, BC delete	3801088	Button Manager for AJ Series	Copyright (C) 2000 SHARP Corporation	--	2212
E:\Program Files\SHARP\Button Manager G\BtnstoSD.dll Script: Quarantine, Delete, BC delete	3604480	Button Manager	Copyright (c) 2000-2003 SHARP CORPORATION	--	2212
E:\Program Files\SHARP\Button Manager G\BtnstoWORD.dll Script: Quarantine, Delete, BC delete	3866624	Button Manager for AJ Series	Copyright (C) 2000 SHARP CORPORATION	--	2212
E:\Program Files\SHARP\Button Manager G\MFPStack.dll Script: Quarantine, Delete, BC delete	3473408	MFPStack	Copyright (c) 2000-2003 SHARP CORPORATION	--	2212
E:\Program Files\SHARP\Button Manager G\StiEvent.dll Script: Quarantine, Delete, BC delete	13762560	StiEvent DLL	Copyright (C) 2000 SHARP CORPORATION	--	2212
E:\Program Files\Sharp\Sharpdesk\dten600.dll Script: Quarantine, Delete, BC delete	671088640	dtSearch Text Retrieval Engine	Copyright (c) 1991-2001 dtSearch Corp.	--	3576
E:\Program Files\Sharp\Sharpdesk\Indexer.exe Script: Quarantine, Delete, BC delete	4194304	Indexer Module	Copyright (C) 2000-2004	??	3576
E:\Program Files\Sharp\Sharpdesk\IndexTray.exe Script: Quarantine, Delete, BC delete	4194304	IndexTray Module	Copyright (C) 2000-2004	??	3548
E:\Program Files\Sharp\Sharpdesk\SharpTray.exe Script: Quarantine, Delete, BC delete	4194304	SharpTray Module	Copyright (C) 2000-2004	??	3348
E:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe Script: Quarantine, Delete, BC delete	4194304	PCCGuide	Copyright (C) 1995-2006 Trend Micro Incorporated. All rights reserved.	??	3392
E:\Program Files\Trend Micro\Internet Security 2007\tmdbg.dll Script: Quarantine, Delete, BC delete	15794176			--	3392
E:\PROGRA~1\MUSICM~1\MUSICM~2\CoreDll.dll Script: Quarantine, Delete, BC delete	1610940416			--	3472
E:\PROGRA~1\MUSICM~1\MUSICM~2\Enforce.dll Script: Quarantine, Delete, BC delete	1611595776	ENFORCE DLL	Copyright © Musicmatch 1998-2004	--	3472
E:\PROGRA~1\MUSICM~1\MUSICM~2\FileAssoc.dll Script: Quarantine, Delete, BC delete	1612578816	FileAssoc DLL	Copyright © Musicmatch 1998-2004	--	3472
E:\PROGRA~1\MUSICM~1\MUSICM~2\mm_tray.exe Script: Quarantine, Delete, BC delete	4194304	mm_tray	Copyright © Musicmatch 1998-2004	??	3472
E:\PROGRA~1\MUSICM~1\MUSICM~2\MMC70U.DLL Script: Quarantine, Delete, BC delete	2082799616	MMCDLL Shared Library - Retail Version	© Microsoft Corporation. All rights reserved.	--	3472
E:\PROGRA~1\MUSICM~1\MUSICM~2\MMReg.dll Script: Quarantine, Delete, BC delete	1617952768	mmreg	Copyright © Musicmatch 1998-2004	--	3472
E:\PROGRA~1\MUSICM~1\MUSICM~2\SkinnedCtrls.dll Script: Quarantine, Delete, BC delete	1622081536	SkinnedCtrls.dll	Copyright © Musicmatch 1998-2004	--	3472
E:\PROGRA~1\MUSICM~1\MUSICM~2\TrackUtils.dll Script: Quarantine, Delete, BC delete	1623523328			--	3472
E:\PROGRA~1\TRENDM~1\INTERN~1\PccAltUi.dll Script: Quarantine, Delete, BC delete	30146560	PccAltUI DLL	Copyright (C) 1995-2006 Trend Micro Incorporated. All rights reserved.	--	3392
E:\PROGRA~1\TRENDM~1\INTERN~1\PccNFC.dll Script: Quarantine, Delete, BC delete	10354688	PccNFC DLL	Copyright (C) 1995-2006 Trend Micro Incorporated. All rights reserved.	--	1932
E:\PROGRA~1\TRENDM~1\INTERN~1\PccSpy.dll Script: Quarantine, Delete, BC delete	18022400	PccSpy dll	Copyright (C) 1995-2006 Trend Micro Incorporated. All rights reserved.	--	1964
E:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe Script: Quarantine, Delete, BC delete	4194304	PcCtlCom Module	Copyright (C) 1995-2006 Trend Micro Incorporated. All rights reserved.	??	1932
E:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlPS.dll Script: Quarantine, Delete, BC delete	22216704	PcCtlPS.dll	Copyright (C) 1995-2006 Trend Micro Incorporated. All rights reserved.	--	3392, 1932, 1964
E:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe Script: Quarantine, Delete, BC delete	4194304	PcScnSrv	Copyright (C) 1995-2006 Trend Micro Incorporated. All rights reserved.	??	1964
E:\PROGRA~1\TRENDM~1\INTERN~1\PcSSrvPS.dll Script: Quarantine, Delete, BC delete	16515072	PcSSrvPS dll	Copyright (C) 1995-2006 Trend Micro Incorporated. All rights reserved.	--	1932, 1964
E:\PROGRA~1\TRENDM~1\INTERN~1\tmCfwApi.dll Script: Quarantine, Delete, BC delete	44826624	Trend Micro Common Firewall Module 3.0	Copyright (C) 2001-2006 Trend Micro Inc. All rights reserved.	--	1932
E:\PROGRA~1\TRENDM~1\INTERN~1\tmdbg.dll Script: Quarantine, Delete, BC delete	10813440			--	1932, 1964
E:\PROGRA~1\TRENDM~1\INTERN~1\tmdp.dll Script: Quarantine, Delete, BC delete	34799616	tmdp.dll	Copyright (C) 1995-2006 Trend Micro Incorporated. All rights reserved.	--	1932
E:\PROGRA~1\TRENDM~1\INTERN~1\tmHash.dll Script: Quarantine, Delete, BC delete	45088768	Trend Micro calculation hash Module 2.0	Copyright (C) 2001-2006 Trend Micro Inc. All rights reserved.	--	1932
E:\PROGRA~1\TRENDM~1\INTERN~1\TMOACfg.dll Script: Quarantine, Delete, BC delete	13500416	TMOACfg DLL	Copyright (C) 1995-2006 Trend Micro Incorporated. All rights reserved.	--	1932
E:\PROGRA~1\TRENDM~1\INTERN~1\TmPfwApi.dll Script: Quarantine, Delete, BC delete	19726336	TmPfwApi	Copyright (C) 2001-2006 Trend Micro Inc. All rights reserved.	--	1932
E:\PROGRA~1\TRENDM~1\INTERN~1\TmProxy.dll Script: Quarantine, Delete, BC delete	13303808	TmProxy.dll	Copyright (C) 2001-2006 Trend Micro Inc. All rights reserved.	--	1932
E:\PROGRA~1\TRENDM~1\INTERN~1\TmpxCfg.dll Script: Quarantine, Delete, BC delete	12845056	TmpxCfg	Copyright (C) 2001-2006 Trend Micro Inc. All rights reserved.	--	1932
E:\PROGRA~1\TRENDM~1\INTERN~1\tmufeng.dll Script: Quarantine, Delete, BC delete	1790181376	Trend Micro URL Filter Engine	Copyright (C) 2004-2005 Trend Micro Incorporated. All rights reserved.	--	1932
E:\PROGRA~1\TRENDM~1\INTERN~1\vstlib32.dll Script: Quarantine, Delete, BC delete	1729101824	VST Dynamic Link Library	Copyright (C) 2006, Trend Micro, Incorporated. All rights reserved.	--	1964
e:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_675e6ef4\mscorlib.dll Script: Quarantine, Delete, BC delete	2040070144			--	3624, 3264
e:\windows\assembly\nativeimages1_v1.1.4322\system.drawing\1.0.5000.0__b03f5f7f11d50a3a_ee012a7b\system.drawing.dll Script: Quarantine, Delete, BC delete	2068905984			--	3264
e:\windows\assembly\nativeimages1_v1.1.4322\system.windows.forms\1.0.5000.0__b77a5c561934e089_2340992a\system.windows.forms.dll Script: Quarantine, Delete, BC delete	2072051712			--	3624, 3264
e:\windows\assembly\nativeimages1_v1.1.4322\system.xml\1.0.5000.0__b77a5c561934e089_43da64dc\system.xml.dll Script: Quarantine, Delete, BC delete	2077622272			--	3624, 3264
e:\windows\assembly\nativeimages1_v1.1.4322\system\1.0.5000.0__b77a5c561934e089_0d61aa3d\system.dll Script: Quarantine, Delete, BC delete	2065498112			--	3624, 3264
E:\WINDOWS\system32\SE4BLMON.DLL Script: Quarantine, Delete, BC delete	26935296	Sharp Printer Driver	Copyright Sharp Corporation 2001-2004	--	1620
E:\WINDOWS\System32\spool\DRIVERS\W32X86\2\cmprecntui.dll Script: Quarantine, Delete, BC delete	1787822080	CompRec User Interface	Copyright (C) Microsoft Corp. 1981-1996	--	2668
E:\WINDOWS\System32\spool\DRIVERS\W32X86\3\SE4BU.DLL Script: Quarantine, Delete, BC delete	12451840	Sharp Printer Driver	Copyright Sharp Corporation 2001-2004	--	2668
E:\WINDOWS\System32\spool\DRIVERS\W32X86\3\SE4BUR.dll Script: Quarantine, Delete, BC delete	18087936	Sharp Printer Driver	Copyright Sharp Corporation 2001-2003	--	2668
E:\WINDOWS\System32\spool\PRTPROCS\W32X86\crprproc.dll Script: Quarantine, Delete, BC delete	1789919232	AddSharpPort Module	Copyright (C) 2000-2004	--	1620
E:\WINDOWS\system32\WgaLogon.dll Script: Quarantine, Delete, BC delete	20578304	Windows Genuine Advantage Notification	© 1995-2006 Microsoft Corporation	--	832
Modules detected:418, recognized as trusted 354

Kernel Space Modules Viewer

Module	Base address	Size in memory	Description	Manufacturer
E:\WINDOWS\System32\Drivers\dump_atapi.sys Script: Quarantine, Delete, BC delete	B7A87000	018000 (98304)
E:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Script: Quarantine, Delete, BC delete	F79B3000	002000 (8192)
E:\WINDOWS\system32\SE4BLPT.SYS Script: Quarantine, Delete, BC delete	B6560000	009000 (36864)	IEEE 1284 Driver	Copyright (C) Sharp Corp.1997-1999
E:\WINDOWS\system32\DRIVERS\tm_mbd_c.sys Script: Quarantine, Delete, BC delete	B6126000	01E000 (122880)	Trend Micro Malicious Behavior Detector (i386-fre)	Copyright (C) 2001-2006 Trend Micro Inc. All rights reserved.
Modules detected - 141, recognized as trusted - 137

Services

Service	Description	Status	File	Group	Dependencies
PcCtlCom Service: Stop, Delete, Disable	Trend Micro Central Control Component	Running	E:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe Script: Quarantine, Delete, BC delete		RPCSS
PcScnSrv Service: Stop, Delete, Disable	Trend Micro Protection Against Spyware	Running	E:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe Script: Quarantine, Delete, BC delete		RPCSS
Tmntsrv Service: Stop, Delete, Disable	Trend Micro Real-time Service	Not started	E:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe Script: Quarantine, Delete, BC delete
TmPfw Service: Stop, Delete, Disable	Trend Micro Personal Firewall	Not started	E:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe Script: Quarantine, Delete, BC delete		tmcfw
tmproxy Service: Stop, Delete, Disable	Trend Micro Proxy Service	Not started	E:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe Script: Quarantine, Delete, BC delete		tmtdi
Detected - 96, recognized as trusted - 91

Drivers

Service	Description	Status	File	Group	Dependencies
SE4BLPT Driver: Unload, Delete, Disable	SE4BLPT	Running	E:\WINDOWS\system32\SE4BLPT.SYS Script: Quarantine, Delete, BC delete
tmmbd Driver: Unload, Delete, Disable	Trend Micro MBD Driver	Running	E:\WINDOWS\system32\DRIVERS\tm_mbd_c.sys Script: Quarantine, Delete, BC delete
Abiosdsk Driver: Unload, Delete, Disable	Abiosdsk	Not started	Abiosdsk.sys Script: Quarantine, Delete, BC delete	Primary disk
abp480n5 Driver: Unload, Delete, Disable	abp480n5	Not started	abp480n5.sys Script: Quarantine, Delete, BC delete	SCSI miniport
adpu160m Driver: Unload, Delete, Disable	adpu160m	Not started	adpu160m.sys Script: Quarantine, Delete, BC delete	SCSI miniport
Aha154x Driver: Unload, Delete, Disable	Aha154x	Not started	Aha154x.sys Script: Quarantine, Delete, BC delete	SCSI miniport
aic78u2 Driver: Unload, Delete, Disable	aic78u2	Not started	aic78u2.sys Script: Quarantine, Delete, BC delete	SCSI miniport
aic78xx Driver: Unload, Delete, Disable	aic78xx	Not started	aic78xx.sys Script: Quarantine, Delete, BC delete	SCSI miniport
AliIde Driver: Unload, Delete, Disable	AliIde	Not started	AliIde.sys Script: Quarantine, Delete, BC delete	System Bus Extender
amsint Driver: Unload, Delete, Disable	amsint	Not started	amsint.sys Script: Quarantine, Delete, BC delete	SCSI miniport
asc Driver: Unload, Delete, Disable	asc	Not started	asc.sys Script: Quarantine, Delete, BC delete	SCSI miniport
asc3350p Driver: Unload, Delete, Disable	asc3350p	Not started	asc3350p.sys Script: Quarantine, Delete, BC delete	SCSI miniport
asc3550 Driver: Unload, Delete, Disable	asc3550	Not started	asc3550.sys Script: Quarantine, Delete, BC delete	SCSI miniport
Atdisk Driver: Unload, Delete, Disable	Atdisk	Not started	Atdisk.sys Script: Quarantine, Delete, BC delete	Primary disk
cd20xrnt Driver: Unload, Delete, Disable	cd20xrnt	Not started	cd20xrnt.sys Script: Quarantine, Delete, BC delete	SCSI miniport
Changer Driver: Unload, Delete, Disable	Changer	Not started	Changer.sys Script: Quarantine, Delete, BC delete	Filter
CmdIde Driver: Unload, Delete, Disable	CmdIde	Not started	CmdIde.sys Script: Quarantine, Delete, BC delete	System Bus Extender
Cpqarray Driver: Unload, Delete, Disable	Cpqarray	Not started	Cpqarray.sys Script: Quarantine, Delete, BC delete	SCSI miniport
dac960nt Driver: Unload, Delete, Disable	dac960nt	Not started	dac960nt.sys Script: Quarantine, Delete, BC delete	SCSI miniport
dpti2o Driver: Unload, Delete, Disable	dpti2o	Not started	dpti2o.sys Script: Quarantine, Delete, BC delete	SCSI miniport
hpn Driver: Unload, Delete, Disable	hpn	Not started	hpn.sys Script: Quarantine, Delete, BC delete	SCSI miniport
hpt3xx Driver: Unload, Delete, Disable	hpt3xx	Not started	hpt3xx.sys Script: Quarantine, Delete, BC delete	SCSI miniport
i2omgmt Driver: Unload, Delete, Disable	i2omgmt	Not started	i2omgmt.sys Script: Quarantine, Delete, BC delete	SCSI Class
i2omp Driver: Unload, Delete, Disable	i2omp	Not started	i2omp.sys Script: Quarantine, Delete, BC delete	SCSI miniport
ini910u Driver: Unload, Delete, Disable	ini910u	Not started	ini910u.sys Script: Quarantine, Delete, BC delete	SCSI miniport
IntelIde Driver: Unload, Delete, Disable	IntelIde	Not started	IntelIde.sys Script: Quarantine, Delete, BC delete	System Bus Extender
lbrtfdc Driver: Unload, Delete, Disable	lbrtfdc	Not started	lbrtfdc.sys Script: Quarantine, Delete, BC delete	System Bus Extender
mraid35x Driver: Unload, Delete, Disable	mraid35x	Not started	mraid35x.sys Script: Quarantine, Delete, BC delete	SCSI miniport
PCIDump Driver: Unload, Delete, Disable	PCIDump	Not started	PCIDump.sys Script: Quarantine, Delete, BC delete	PCI Configuration
PDCOMP Driver: Unload, Delete, Disable	PDCOMP	Not started	PDCOMP.sys Script: Quarantine, Delete, BC delete
PDFRAME Driver: Unload, Delete, Disable	PDFRAME	Not started	PDFRAME.sys Script: Quarantine, Delete, BC delete
PDRELI Driver: Unload, Delete, Disable	PDRELI	Not started	PDRELI.sys Script: Quarantine, Delete, BC delete
PDRFRAME Driver: Unload, Delete, Disable	PDRFRAME	Not started	PDRFRAME.sys Script: Quarantine, Delete, BC delete
perc2 Driver: Unload, Delete, Disable	perc2	Not started	perc2.sys Script: Quarantine, Delete, BC delete	SCSI miniport
perc2hib Driver: Unload, Delete, Disable	perc2hib	Not started	perc2hib.sys Script: Quarantine, Delete, BC delete	Filter
ql1080 Driver: Unload, Delete, Disable	ql1080	Not started	ql1080.sys Script: Quarantine, Delete, BC delete	SCSI miniport
Ql10wnt Driver: Unload, Delete, Disable	Ql10wnt	Not started	Ql10wnt.sys Script: Quarantine, Delete, BC delete	SCSI miniport
ql12160 Driver: Unload, Delete, Disable	ql12160	Not started	ql12160.sys Script: Quarantine, Delete, BC delete	SCSI miniport
ql1240 Driver: Unload, Delete, Disable	ql1240	Not started	ql1240.sys Script: Quarantine, Delete, BC delete	SCSI miniport
ql1280 Driver: Unload, Delete, Disable	ql1280	Not started	ql1280.sys Script: Quarantine, Delete, BC delete	SCSI miniport
Simbad Driver: Unload, Delete, Disable	Simbad	Not started	Simbad.sys Script: Quarantine, Delete, BC delete	Filter
Sparrow Driver: Unload, Delete, Disable	Sparrow	Not started	Sparrow.sys Script: Quarantine, Delete, BC delete	SCSI miniport
sym_hi Driver: Unload, Delete, Disable	sym_hi	Not started	sym_hi.sys Script: Quarantine, Delete, BC delete	SCSI miniport
sym_u3 Driver: Unload, Delete, Disable	sym_u3	Not started	sym_u3.sys Script: Quarantine, Delete, BC delete	SCSI miniport
symc810 Driver: Unload, Delete, Disable	symc810	Not started	symc810.sys Script: Quarantine, Delete, BC delete	SCSI miniport
symc8xx Driver: Unload, Delete, Disable	symc8xx	Not started	symc8xx.sys Script: Quarantine, Delete, BC delete	SCSI miniport
TosIde Driver: Unload, Delete, Disable	TosIde	Not started	TosIde.sys Script: Quarantine, Delete, BC delete	System Bus Extender
ultra Driver: Unload, Delete, Disable	ultra	Not started	ultra.sys Script: Quarantine, Delete, BC delete	SCSI miniport
ViaIde Driver: Unload, Delete, Disable	ViaIde	Not started	ViaIde.sys Script: Quarantine, Delete, BC delete	System Bus Extender
WDICA Driver: Unload, Delete, Disable	WDICA	Not started	WDICA.sys Script: Quarantine, Delete, BC delete
Detected - 198, recognized as trusted - 148

Autoruns

File name	Status	Startup method	Description
E:\PROGRA~1\MUSICM~1\MUSICM~2\mm_tray.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, MMTray
E:\Program Files\BroadJump\Client Foundation\CFD.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, BJCFD
E:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	E:\Documents and Settings\All Users\Start Menu\Programs\Startup\, E:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk,
E:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, mmtask
E:\Program Files\SHARP\Button Manager G\btnman.exe Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	E:\Documents and Settings\All Users\Start Menu\Programs\Startup\, E:\Documents and Settings\All Users\Start Menu\Programs\Startup\Button Manager G.lnk,
E:\Program Files\Sharp\Sharpdesk\IndexTray.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, IndexTray
E:\Program Files\Sharp\Sharpdesk\Indexer.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, Indexer
E:\Program Files\Sharp\Sharpdesk\SharpTray.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, SharpTray
E:\Program Files\Sharp\Sharpdesk\TypeRegChecker.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, TypeRegChecker
E:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, pccguide.exe
WgaLogon.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon, DLLName
Autoruns items detected - 82, recognized as trusted - 71

Internet Explorer extension modules (BHOs, Toolbars ...)

File name	Type	Description	Manufacturer	CLSID
E:\Program Files\Yahoo!\Messenger\yhexbmes.dll Script: Quarantine, Delete, BC delete	Extension module	YhExBMes	Copyright © Yahoo! Inc. 2002	{4528BBE0-4E08-11D5-AD55-00010333D0AD} Delete
E:\Program Files\Yahoo!\Messenger\yhexbmes.dll Script: Quarantine, Delete, BC delete	Extension module	YhExBMes	Copyright © Yahoo! Inc. 2002	{92780B25-18CC-41C8-B9BE-3C9C571A8263} Delete
Elements detected - 6, recognized as trusted - 4

Windows Explorer extension modules

File name	Destination	Description	Manufacturer	CLSID
deskpan.dll Script: Quarantine, Delete, BC delete	Display Panning CPL Extension			{42071714-76d4-11d1-8b24-00a0c9068ff3}
	Shell extensions for file compression			{764BF0E1-F219-11ce-972D-00AA00A14F56}
	Encryption Context Menu			{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}
	Taskbar and Start Menu			{0DF44EAA-FF21-4412-828E-260A8728E7F1}
	Media Band			{32683183-48a0-441b-a342-7c2a440a9478}
	User Accounts			{7A9D77BD-5403-11d2-8785-2E0420524153}
E:\Program Files\Trend Micro\Internet Security 2007\VBProp.dll Script: Quarantine, Delete, BC delete	VBPropSheet	VBProp Module	Copyright (C) 1995-2006 Trend Micro Incorporated. All rights reserved.	{771A9DA0-731A-11CE-993C-00AA004ADB6C}
E:\Program Files\Trend Micro\Internet Security 2007\Tmdshell.dll Script: Quarantine, Delete, BC delete	TMD Shell Extension	Tmdshell Module	Copyright (C) 1995-2006 Trend Micro Incorporated. All rights reserved.	{48F45200-91E6-11CE-8A4F-0080C81A28D4}
rundll32.exe E:\WINDOWS\system32\shimgvw.dll,ImageView_COMServer {00E7B358-F65B-4dcf-83DF-CD026B94BFD4} Script: Quarantine, Delete, BC delete	Autoplay for SlideShow			{00E7B358-F65B-4dcf-83DF-CD026B94BFD4}
Elements detected - 193, recognized as trusted - 184

Printing system extensions (print monitors, providers)

File name	Type	Name	Description	Manufacturer
E:\WINDOWS\system32\SE4BLMON.DLL Script: Quarantine, Delete, BC delete	Monitor	SHARP AR-M162/M207 Language Monitor	Sharp Printer Driver	Copyright Sharp Corporation 2001-2004
Elements detected - 12, recognized as trusted - 11

Task Scheduler jobs

File name	Job name	Job status	Description	Manufacturer
Elements detected - 0, recognized as trusted - 0

SPI/LSP settings

Namespace providers (NSP)

Manufacturer	Status	EXE file	Description	GUID
Detected - 3, recognized as trusted - 3

Transport protocol providers (TSP, LSP)

Manufacturer EXE file Description
Detected - 17, recognized as trusted - 17
Results of automatic SPI settings check
LSP settings checked. No errors detected

TCP/UDP ports

Port Status Remote Host Remote Port Application Notes
TCP ports
135 LISTENING 0.0.0.0 57415 [1220] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
139 LISTENING 0.0.0.0 61526 [4] System
Script: Quarantine, Delete, BC delete, Terminate
445 LISTENING 0.0.0.0 2160 [4] System
Script: Quarantine, Delete, BC delete, Terminate
1026 LISTENING 0.0.0.0 2234 [1344] e:\windows\system32\alg.exe
Script: Quarantine, Delete, BC delete, Terminate
1039 ESTABLISHED 192.168.1.10 139 [4] System
Script: Quarantine, Delete, BC delete, Terminate
1065 TIME_WAIT 192.168.1.10 135 [0]
1516 LISTENING 0.0.0.0 57500 [1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
2869 LISTENING 0.0.0.0 2112 [1400] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
2869 CLOSE_WAIT 192.168.1.1 1087 [1400] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
2869 TIME_WAIT 192.168.1.1 1088 [0]
5152 LISTENING 0.0.0.0 2272 [1796] e:\program files\java\jre6\bin\jqs.exe
Script: Quarantine, Delete, BC delete, Terminate
UDP ports
123 LISTENING -- -- [1304] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
123 LISTENING -- -- [1304] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
137 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
138 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
445 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
500 LISTENING -- -- [888] e:\windows\system32\lsass.exe
Script: Quarantine, Delete, BC delete, Terminate
1058 LISTENING -- -- [1304] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
1900 LISTENING -- -- [1400] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
1900 LISTENING -- -- [1400] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
4500 LISTENING -- -- [888] e:\windows\system32\lsass.exe
Script: Quarantine, Delete, BC delete, Terminate
9370 LISTENING -- -- [2496] e:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe
Script: Quarantine, Delete, BC delete, Terminate
40116 LISTENING -- -- [1932] e:\progra~1\trendm~1\intern~1\pcctlcom.exe
Script: Quarantine, Delete, BC delete, Terminate

Downloaded Program Files (DPF)

File name Description Manufacturer CLSID Source URL
E:\PROGRA~1\MICROS~2\OFFICE11\IEAWSDC.DLL
Script: Quarantine, Delete, BC delete {02BCC737-B171-4746-94C9-0D8A0B2C0089}
Delete http://office.microsoft.com/templates/ieawsdc.cab
E:\WINDOWS\DOWNLO~1\xscan60.ocx
Script: Quarantine, Delete, BC delete xscan OLE Control Module Copyright (C) 1989-2005 Trend Micro Incorporated. All rights reserved. {04E214E5-63AF-4236-83C6-A7ADCBF9BD02}
Delete http://housecall60.trendmicro.com/housecall/xscan60.cab
E:\Program Files\HP\Common\HPDeviceDetection.dll
Script: Quarantine, Delete, BC delete HPDeviceDetection Library (c)Hewlett-Packard. All rights reserved. {6B75345B-AA36-438A-BBE6-4078B4C6984D}
Delete http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
{9F1C11AA-197B-4942-BA54-47A8489BB47F}
Delete http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38001.5912037037
{A17E30C4-A9BA-11D4-8673-60DB54C10000}
Delete http://download.yahoo.com/dl/installs/ymail/ymmapi.dll
E:\WINDOWS\Downloaded Program Files\cpcScan.dll
Script: Quarantine, Delete, BC delete BIOS Scanner Crucial Technology, Inc. All rights reserved. {A90A5822-F108-45AD-8482-9BC8B12DD539}
Delete http://www.crucial.com/controls/cpcScanner.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000}
Delete http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
{E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD}
Delete http://download.abacast.com/download/files/abasetup132.cab
Elements detected - 19, recognized as trusted - 11

Control Panel Applets (CPL)

File name Description Manufacturer
E:\WINDOWS\system32\PccWSC32.cpl
Script: Quarantine, Delete, BC delete PCCWSC Copyright (C) 1995-2006 Trend Micro Incorporated. All rights reserved.
Elements detected - 26, recognized as trusted - 25

Active Setup

File name Description Manufacturer CLSID
Elements detected - 14, recognized as trusted - 14

HOSTS file

Hosts file record
127.0.0.1 localhost

Protocols and handlers

File name Type Description Manufacturer CLSID
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
E:\Program Files\Sharp\Sharpdesk\ExplorerExtensions.dll
Script: Quarantine, Delete, BC delete Handler ExplorerExtensions Module (SharpDesk Thumbnail Extractor Protocol) Copyright (C) 2000-2004 {79E0F14C-9C52-4218-89A7-7C4B0563D121}
Elements detected - 35, recognized as trusted - 31

Suspicious objects

File Description Type
E:\WINDOWS\system32\DRIVERS\tm_mbd_c.sys
Script: Quarantine, Delete, BC delete Suspicion for Rootkit Kernel-mode hook
E:\WINDOWS\system32\Drivers\IPVNMon.sys
Script: Quarantine, Delete, BC delete Suspicion for Rootkit Kernel-mode hook

AVZ Antiviral Toolkit log; AVZ version is 4.30 Scanning started at 4/24/2009 1:21:40 PM Database loaded: signatures - 219995, NN profile(s) - 2, microprograms of healing - 56, signature database released 22.04.2009 21:39 Heuristic microprograms loaded: 372 SPV microprograms loaded: 9 Digital signatures of system files loaded: 108883 Heuristic analyzer mode: Maximum heuristics level Healing mode: disabled Windows version: 5.1.2600, Service Pack 3 ; AVZ is launched with administrator rights System Restore: enabled 1. Searching for Rootkits and programs intercepting API functions 1.1 Searching for user-mode API hooks Analysis: kernel32.dll, export table found in section .text Analysis: ntdll.dll, export table found in section .text Analysis: user32.dll, export table found in section .text Analysis: advapi32.dll, export table found in section .text Analysis: ws2_32.dll, export table found in section .text Analysis: wininet.dll, export table found in section .text Analysis: rasapi32.dll, export table found in section .text Analysis: urlmon.dll, export table found in section .text Analysis: netapi32.dll, export table found in section .text 1.2 Searching for kernel-mode API hooks Driver loaded successfully SDT found (RVA=083220) Kernel ntoskrnl.exe found in memory at address 804D7000 SDT = 8055A220 KiST = 804E26A8 (284) Function NtClose (19) intercepted (805678DD->B6127CE0), hook E:\WINDOWS\system32\DRIVERS\tm_mbd_c.sys Function NtConnectPort (1F) intercepted (805879F7->B6127FB0), hook E:\WINDOWS\system32\DRIVERS\tm_mbd_c.sys Function NtCreateProcess (2F) intercepted (805B136A->B6127310), hook E:\WINDOWS\system32\DRIVERS\tm_mbd_c.sys Function NtCreateProcessEx (30) intercepted (8057FC6C->B61275E0), hook E:\WINDOWS\system32\DRIVERS\tm_mbd_c.sys Function NtDeviceIoControlFile (42) intercepted (8058EFB9->BAFD7803), hook E:\WINDOWS\system32\Drivers\IPVNMon.sys, driver recognized as trusted Function NtEnumerateKey (47) - machine code modification Method of JmpTo. jmp E19A0294 Function NtFlushInstructionCache (4E) - machine code modification Method of JmpTo. jmp E19A0374 Function NtOpenProcess (7A) intercepted (805717C7->B6127840), hook E:\WINDOWS\system32\DRIVERS\tm_mbd_c.sys Function NtRequestWaitReplyPort (C8) intercepted (80576CE6->B6128150), hook E:\WINDOWS\system32\DRIVERS\tm_mbd_c.sys Function NtWriteVirtualMemory (115) intercepted (8057E42A->B6127E80), hook E:\WINDOWS\system32\DRIVERS\tm_mbd_c.sys Functions checked: 284, intercepted: 8, restored: 0 1.3 Checking IDT and SYSENTER Analysis for CPU 1 Checking IDT and SYSENTER - complete 1.4 Searching for masking processes and drivers Checking not performed: extended monitoring driver (AVZPM) is not installed Driver loaded successfully 1.5 Checking of IRP handlers Checking - complete 2. Scanning memory Number of processes found: 47 Analyzer: process under analysis is 400 E:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe [ES]:Contains network functionality [ES]:Listens on TCP ports ! [ES]:Application has no visible windows [ES]:Loads RASAPI DLL - may use dialing ? Analyzer: process under analysis is 444 E:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe [ES]:Contains network functionality [ES]:Listens on TCP ports ! [ES]:Application has no visible windows Analyzer: process under analysis is 1964 E:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe [ES]:Contains network functionality [ES]:Application has no visible windows Analyzer: process under analysis is 3348 E:\Program Files\Sharp\Sharpdesk\SharpTray.exe [ES]:Contains network functionality [ES]:Application has no visible windows [ES]:Registered in autoruns !! Analyzer: process under analysis is 3472 E:\PROGRA~1\MUSICM~1\MUSICM~2\mm_tray.exe [ES]:Contains network functionality [ES]:Application has no visible windows [ES]:Registered in autoruns !! Analyzer: process under analysis is 3504 E:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe [ES]:Contains network functionality [ES]:Application has no visible windows [ES]:Registered in autoruns !! Analyzer: process under analysis is 3548 E:\Program Files\Sharp\Sharpdesk\IndexTray.exe [ES]:Contains network functionality [ES]:Application has no visible windows [ES]:Registered in autoruns !! Analyzer: process under analysis is 3576 E:\Program Files\Sharp\Sharpdesk\Indexer.exe [ES]:Contains network functionality [ES]:Application has no visible windows [ES]:Registered in autoruns !! Analyzer: process under analysis is 3940 E:\Program Files\BroadJump\Client Foundation\CFD.exe [ES]:Contains network functionality [ES]:Application has no visible windows [ES]:Registered in autoruns !! [ES]:Loads RASAPI DLL - may use dialing ? Analyzer: process under analysis is 2212 E:\Program Files\SHARP\Button Manager G\btnman.exe [ES]:Contains network functionality [ES]:Application has no visible windows [ES]:Registered in autoruns !! Analyzer: process under analysis is 2496 E:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [ES]:Contains network functionality [ES]:Listens on HTTP ports ! [ES]:Application has no visible windows [ES]:Registered in autoruns !! [ES]:Loads RASAPI DLL - may use dialing ? Number of modules loaded: 414 Scanning memory - complete 3. Scanning disks 4. Checking Winsock Layered Service Provider (SPI/LSP) LSP settings checked. No errors detected 5. Searching for keyboard/mouse/windows events hooks (Keyloggers, Trojan DLLs) 6. Searching for opened TCP/UDP ports used by malicious programs Checking disabled by user 7. Heuristic system check Checking - complete 8. Searching for vulnerabilities >> Services: potentially dangerous service allowed: RemoteRegistry (Remote Registry) >> Services: potentially dangerous service allowed: TermService (Terminal Services) >> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery Service) >> Services: potentially dangerous service allowed: Schedule (Task Scheduler) >> Services: potentially dangerous service allowed: mnmsrvc (NetMeeting Remote Desktop Sharing) >> Services: potentially dangerous service allowed: RDSessMgr (Remote Desktop Help Session Manager) > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)! >> Security: disk drives' autorun is enabled >> Security: administrative shares (C$, D$ ...) are enabled >> Security: anonymous user access is enabled >> Security: sending Remote Assistant queries is enabled Checking - complete 9. Troubleshooting wizard >> HDD autorun are allowed >> Autorun from network drives are allowed >> Removable media autorun are allowed Checking - complete Files scanned: 462, extracted from archives: 0, malicious software found 0, suspicions - 0 Scanning finished at 4/24/2009 1:22:40 PM Time of scanning: 00:01:03 If you have a suspicion on presence of viruses or questions on the suspected objects, you can address http://virusinfo.info conference System Analysis in progress
Script commands

Add commands to script:
Blocking hooks using Anti-Rootkit
Enable AVZGuard
BootCleaner - import list of deleted files
Registry cleanup after deleting files
BootCleaner - activate
Reboot
Insert template for QuarantineFile() - quarantining file
Insert template for BC_QrFile() - quarantining file via BootCleaner
Insert template for DeleteFile() - deleting file
Insert template for DelCLSID() - deleting CLSID item from registry
Additional operations:
Performance tweaking: disable service RemoteRegistry (Remote Registry)
Performance tweaking: disable service TermService (Terminal Services)
Performance tweaking: disable service SSDPSRV (SSDP Discovery Service)
Performance tweaking: disable service Schedule (Task Scheduler)
Performance tweaking: disable service mnmsrvc (NetMeeting Remote Desktop Sharing)
Performance tweaking: disable service RDSessMgr (Remote Desktop Help Session Manager)
Security tweaking: disable CD autorun
Security tweaking: disable administrative shares
Security tweaking: disable anonymous user access
Security: disable sending Remote Assistant queries
File list

Port	Status	Remote Host	Remote Port	Application	Notes
TCP ports
135	LISTENING	0.0.0.0	57415	[1220] e:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
139	LISTENING	0.0.0.0	61526	[4] System Script: Quarantine, Delete, BC delete, Terminate
445	LISTENING	0.0.0.0	2160	[4] System Script: Quarantine, Delete, BC delete, Terminate
1026	LISTENING	0.0.0.0	2234	[1344] e:\windows\system32\alg.exe Script: Quarantine, Delete, BC delete, Terminate
1039	ESTABLISHED	192.168.1.10	139	[4] System Script: Quarantine, Delete, BC delete, Terminate
1065	TIME_WAIT	192.168.1.10	135	[0]
1516	LISTENING	0.0.0.0	57500	[1084] e:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
2869	LISTENING	0.0.0.0	2112	[1400] e:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
2869	CLOSE_WAIT	192.168.1.1	1087	[1400] e:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
2869	TIME_WAIT	192.168.1.1	1088	[0]
5152	LISTENING	0.0.0.0	2272	[1796] e:\program files\java\jre6\bin\jqs.exe Script: Quarantine, Delete, BC delete, Terminate
UDP ports
123	LISTENING	--	--	[1304] e:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
123	LISTENING	--	--	[1304] e:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
137	LISTENING	--	--	[4] System Script: Quarantine, Delete, BC delete, Terminate
138	LISTENING	--	--	[4] System Script: Quarantine, Delete, BC delete, Terminate
445	LISTENING	--	--	[4] System Script: Quarantine, Delete, BC delete, Terminate
500	LISTENING	--	--	[888] e:\windows\system32\lsass.exe Script: Quarantine, Delete, BC delete, Terminate
1058	LISTENING	--	--	[1304] e:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
1900	LISTENING	--	--	[1400] e:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
1900	LISTENING	--	--	[1400] e:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
4500	LISTENING	--	--	[888] e:\windows\system32\lsass.exe Script: Quarantine, Delete, BC delete, Terminate
9370	LISTENING	--	--	[2496] e:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe Script: Quarantine, Delete, BC delete, Terminate
40116	LISTENING	--	--	[1932] e:\progra~1\trendm~1\intern~1\pcctlcom.exe Script: Quarantine, Delete, BC delete, Terminate