AVZ 4.35 http://z-oleg.com/secur/avz/
| File name | PID | Description | Copyright | MD5 | Information
| c:\program files\sfr\kit\9props.exe | Script: Quarantine, Delete, Delete via BC, Terminate 264 | Propriétés de la connexion SFR | (c) SFR. Tous droits réservés. | ?? | 937.31 kb, rsAh, | created: 15.10.2009 09:53:54, modified: 15.10.2009 09:53:54 Command line: "C:\Program Files\SFR\Kit\9props.exe" /trayicon c:\program files\avira\antivir desktop\avguard.exe | Script: Quarantine, Delete, Delete via BC, Terminate 796 | Antivirus On-Access Service | Copyright © 2000 - 2010 Avira GmbH. All rights reserved. | ?? | 261.66 kb, rsAh, | created: 03.11.2010 22:23:03, modified: 09.12.2010 20:53:50 Command line: "C:\Program Files\Avira\AntiVir Desktop\avguard.exe" c:\program files\intel\wireless\bin\ifrmewrk.exe | Script: Quarantine, Delete, Delete via BC, Terminate 1632 | Intel Framework MFC Application | Copyright © Intel Corporation 1999-2004 | ?? | 376.00 kb, rsAh, | created: 30.10.2004 15:59:54, modified: 30.10.2004 15:59:54 Command line: "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless c:\program files\fichiers communs\microsoft shared\vs7debug\mdm.exe | Script: Quarantine, Delete, Delete via BC, Terminate 1012 | Machine Debug Manager | Copyright© Microsoft Corporation. All rights reserved. | ?? | 328.00 kb, rsAh, | created: 19.03.2003 09:55:56, modified: 19.03.2003 09:55:56 Command line: "C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe" c:\windows\system32\winlogon.exe | Script: Quarantine, Delete, Delete via BC, Terminate 1100 | Application d'ouverture de session Windows NT | © Microsoft Corporation. Tous droits réservés. | ?? | 500.00 kb, rsAh, | created: 20.08.2004 11:24:09, modified: 14.04.2008 03:34:28 Command line: winlogon.exe c:\program files\intel\wireless\bin\wlkeeper.exe | Script: Quarantine, Delete, Delete via BC, Terminate 1780 | WLKEEPER | Copyright © 2004 | ?? | 220.07 kb, rsAh, | created: 07.09.2004 17:12:32, modified: 07.09.2004 17:12:32 Command line: "C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe" c:\program files\intel\wireless\bin\zcfgsvc.exe | Script: Quarantine, Delete, Delete via BC, Terminate 2552 | ZeroCfgSvc MFC Application | Copyright (c) Intel Corporation 1999-2004 | ?? | 380.00 kb, rsAh, | created: 07.09.2004 17:08:02, modified: 07.09.2004 17:08:02 Command line: "C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe" Detected:47, recognized as trusted 44
| | |||||
| Module name | Handle | Description | Copyright | MD5 | Used by processes
| C:\Program Files\Avira\AntiVir Desktop\aecore.dll | Script: Quarantine, Delete, Delete via BC 17956864 | AntiVir Engine Module for Windows | Copyright © 2010 Avira GmbH. All rights reserved. | -- | 796
| C:\Program Files\Avira\AntiVir Desktop\aegen.dll | Script: Quarantine, Delete, Delete via BC 28114944 | AntiVir Engine Module for Windows | Copyright © 2010 Avira GmbH. All rights reserved. | -- | 796
| C:\Program Files\Avira\AntiVir Desktop\aehelp.dll | Script: Quarantine, Delete, Delete via BC 27787264 | AntiVir Engine Module for Windows | Copyright © 2010 Avira GmbH. All rights reserved. | -- | 796
| C:\Program Files\Avira\AntiVir Desktop\aeheur.dll | Script: Quarantine, Delete, Delete via BC 24576000 | AntiVir Engine Module for Windows | Copyright © 2010 Avira GmbH. All rights reserved. | -- | 796
| C:\Program Files\Avira\AntiVir Desktop\aepack.dll | Script: Quarantine, Delete, Delete via BC 23199744 | AntiVir Engine Module for Windows | Copyright © 2010 Avira GmbH. All rights reserved. | -- | 796
| C:\Program Files\Avira\AntiVir Desktop\aescript.dll | Script: Quarantine, Delete, Delete via BC 18481152 | AntiVir Engine Module for Windows | Copyright © 2010 Avira GmbH. All rights reserved. | -- | 796
| C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\1036\mdmui.dll | Script: Quarantine, Delete, Delete via BC 1369833472 | Ressources MDM | Copyright© Microsoft Corporation. Tous droits réservés. | -- | 1012
| C:\Program Files\Intel\Wireless\Bin\C8021FRA.dll | Script: Quarantine, Delete, Delete via BC 13500416 | C8021XSettings DLL | Copyright (c) Intel Corporation 1999-2004 | -- | 1632, 1780, 2552
| C:\Program Files\Intel\Wireless\Bin\FrWrkFRA.dll | Script: Quarantine, Delete, Delete via BC 11010048 | Intel Framework MFC Application | Copyright © Intel Corporation 1999-2004 | -- | 1632
| C:\Program Files\Intel\Wireless\Bin\IntWAFRA.dll | Script: Quarantine, Delete, Delete via BC 15073280 | Intel PROSet/Wireless Application | Copyright © Intel Corporation 1999-2004 | -- | 1632
| C:\Program Files\Intel\Wireless\Bin\ZcSvcFRA.dll | Script: Quarantine, Delete, Delete via BC 13041664 | ZeroCfgSvc MFC Application | Copyright (c) Intel Corporation 1999-2004 | -- | 2552
| C:\WINDOWS\system32\WgaLogon.dll | Script: Quarantine, Delete, Delete via BC 22675456 | Notifications Windows Genuine Advantage | © 1995-2007 Microsoft Corporation | -- | 1100
| Modules found:404, recognized as trusted 392
| | |||||
| Module | Base address | Size in memory | Description | Manufacturer
| C:\WINDOWS\system32\DRIVERS\avipbb.sys | Script: Quarantine, Delete, Delete via BC F448F000 | 026000 (155648) | Avira Driver for Security Enhancement | Copyright © 1996-2009 Avira GmbH. All rights reserved.
| C:\WINDOWS\System32\drivers\keyscrambler.sys | Script: Quarantine, Delete, Delete via BC F68A2000 | 01B000 (110592) | KeyScrambler Keyboard Encryption Driver | Copyright (c) QFX Software Corporation. All rights reserved
| C:\WINDOWS\system32\Drivers\sptd.sys | Script: Quarantine, Delete, Delete via BC F72C9000 | 0D1000 (856064) |
| C:\WINDOWS\System32\Drivers\SPTD7549.SYS | Script: Quarantine, Delete, Delete via BC F72B1000 | 018000 (98304) |
| Modules found - 141, recognized as trusted - 137
| | ||||||
| File name | Status | Startup method | Description
| 3ivxVfWCodec.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, VIDC.3iv2 | Delete C:\Program Files\AOL 9.0\aol.exe | Script: Quarantine, Delete, Delete via BC Active | Shortcut in Startup folder | C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Internet Explorer\Quick Launch\AOL 9.0.lnk,
| C:\Program Files\Airytec\Switch Off\swoff.exe | Script: Quarantine, Delete, Delete via BC Active | Shortcut in Startup folder | C:\Documents and Settings\Daniel\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\Daniel\Application Data\Microsoft\Internet Explorer\Quick Launch\Airytec Switch Off.lnk,
| C:\Program Files\DivX\DivX Update\DivXUpdate.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, DivXUpdate | Delete C:\Program Files\Fichiers communs\Microsoft Shared\Help 8\msenv.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Visual Studio - VsTemplate, EventMessageFile
| C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\MDM, EventMessageFile
| C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\vbexpress.exe | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\vbexpress, EventMessageFile
| C:\Program Files\MySQL\MySQL Server 5.1\bin\mysqld.exe | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\MySQL, EventMessageFile
| C:\Program Files\SFR\Kit\9props.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_CURRENT_USER, Software\Microsoft\Windows\CurrentVersion\Run, Connexion SFR 9props.exe | Delete C:\Program Files\Spotify\spotify.exe | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Spotify, EventMessageFile
| C:\Program Files\Windows Media Player\WMPNetwk.exe | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\WMPNetworkSvc, EventMessageFile
| C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\fr\aspnet_rc.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\ASP.NET 1.1.4322.0, EventMessageFile
| C:\WINDOWS\System32\Drivers\lbrtfdc.sys | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\lbrtfdc, EventMessageFile
| C:\WINDOWS\System32\PrintFilterPipelineSvc.exe | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PrintFilterPipelineSvc, EventMessageFile
| C:\WINDOWS\System32\appmgmts.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters, ServiceDll | Delete C:\WINDOWS\System32\appmgmts.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Application Management, EventMessageFile
| C:\WINDOWS\System32\appmgr.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Software Installation, EventMessageFile
| C:\WINDOWS\System32\drivers\avipbb.sys | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\avipbb, EventMessageFile
| C:\WINDOWS\System32\fdeploy.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\File Deployment, EventMessageFile
| C:\WINDOWS\System32\fdeploy.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Folder Redirection, EventMessageFile
| C:\WINDOWS\System32\igmpv2.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile
| C:\WINDOWS\System32\ipbootp.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile
| C:\WINDOWS\System32\iprip2.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile
| C:\WINDOWS\System32\ntbackup.exe | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\ntbackup, EventMessageFile
| C:\WINDOWS\System32\ospf.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPF, EventMessageFile
| C:\WINDOWS\System32\ospfmib.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPFMib, EventMessageFile
| C:\WINDOWS\System32\polagent.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PolicyAgent, EventMessageFile
| C:\WINDOWS\System32\spmsg.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Internet Explorer 7 Disk, EventMessageFile
| C:\WINDOWS\System32\spmsg.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Internet Explorer 8, EventMessageFile
| C:\WINDOWS\System32\spmsg.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\NtServicePack, EventMessageFile
| C:\WINDOWS\System32\spmsg.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\WGA, EventMessageFile
| C:\WINDOWS\System32\spmsg.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\WgaNotify, EventMessageFile
| C:\WINDOWS\System32\spmsg.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Windows Installer 3.1, EventMessageFile
| C:\WINDOWS\System32\spmsg.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\WindowsMedia, EventMessageFile
| C:\WINDOWS\System32\spmsg.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Wudf01000, EventMessageFile
| C:\WINDOWS\System32\tssdis.exe | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\TermServSessDir, EventMessageFile
| C:\WINDOWS\system32\AegisE5.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\AegisP, EventMessageFile
| C:\WINDOWS\system32\DRIVERS\NaiFiltr.sys | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\NaiFiltr, EventMessageFile
| C:\WINDOWS\system32\MsSip1.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 1, $DLL | Delete C:\WINDOWS\system32\MsSip2.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 2, $DLL | Delete C:\WINDOWS\system32\MsSip3.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 3, $DLL | Delete C:\WINDOWS\system32\SP5X_32.DLL | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, VIDC.SP53 | Delete C:\WINDOWS\system32\SP5X_32.DLL | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, VIDC.SP54 | Delete C:\WINDOWS\system32\SP5X_32.DLL | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, VIDC.SP55 | Delete C:\WINDOWS\system32\SP5X_32.DLL | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, VIDC.SP56 | Delete C:\WINDOWS\system32\SP5X_32.DLL | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, VIDC.SP57 | Delete C:\WINDOWS\system32\SP5X_32.DLL | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, VIDC.SP58 | Delete C:\WINDOWS\system32\SP5X_32.DLL | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, VIDC.SP59 | Delete C:\WINDOWS\system32\asr_fmt.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR format utility for volumes | Delete C:\WINDOWS\system32\asr_ldm.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR utility for Logical Disk Manager | Delete C:\WINDOWS\system32\asr_pfu.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR protected file utility | Delete C:\WINDOWS\system32\psxss.exe | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
| C:\WINDOWS\system32\stisvc.exe | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System, EventMessageFile
| SDEvents.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Spybot - Search & Destroy 2, EventMessageFile
| WgaLogon.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon, DLLName | Delete ac3acm.acm | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, msacm.ac3acm | Delete appmgmts.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}, DLLName | Delete c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\aspnet_rc.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\ASP.NET 2.0.50727.0, EventMessageFile
| deskpan.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {42071714-76d4-11d1-8b24-00a0c9068ff3} | Delete kbd101.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver JPN | Delete kbd101a.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver KOR | Delete mvfs32.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_USERS, .DEFAULT\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_USERS, S-1-5-19\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_USERS, S-1-5-20\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_USERS, S-1-5-18\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_CURRENT_USER, Control Panel\IOProcs, MVB | Delete vgafix.fon | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon | Delete vgaoem.fon | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon | Delete vgasys.fon | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon | Delete wmv9vcm.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, VIDC.wmv3 | Delete x264vfw.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, VIDC.X264 | Delete Autoruns items found - 920, recognized as trusted - 849
| | ||||||
| File name | Type | Description | Manufacturer | CLSID
| C:\Program Files\SFR\Kit\SFRNavErrorHelper.dll | Script: Quarantine, Delete, Delete via BC BHO | Aide à la navigation SFR | (c) SFR. Tous droits réservés. | {0F6E720A-1A6B-40E1-A294-1D4D19F156C8} | Delete C:\Program Files\KeyScrambler\KeyScramblerIE.dll | Script: Quarantine, Delete, Delete via BC BHO | KeyScrambler Program DLL | (c) QFX Software Corporation. All rights reserved. | {2B9F5787-88A5-4945-90E7-C4B18563BC5E} | Delete BHO | {5C255C8A-E604-49b4-9D64-90988571CECB} | Delete Toolbar | {0BF43445-2F28-4351-9252-17FE6E806AA0} | Delete Extension module | {2670000A-7350-4f3c-8081-5663EE0C6C49} | Delete Extension module | {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} | Delete URLSearchHook | {EF99BD32-C1FB-11D2-892F-0090271D4F88} | Delete Items found - 20, recognized as trusted - 13
| | |||||||||||||||||||||
| File name | Destination | Description | Manufacturer | CLSID
| deskpan.dll | Script: Quarantine, Delete, Delete via BC Extension Affichage Panorama du Panneau de configuration | {42071714-76d4-11d1-8b24-00a0c9068ff3} | Delete Extensions de l'environnement de compression de fichiers | {764BF0E1-F219-11ce-972D-00AA00A14F56} | Delete Menu contextuel de cryptage | {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} | Delete Barre des tâches et menu Démarrer | {0DF44EAA-FF21-4412-828E-260A8728E7F1} | Delete Comptes d'utilisateurs | {7A9D77BD-5403-11d2-8785-2E0420524153} | Delete WinAce Archiver 2.61 Context Menu Shell Extension | {8FF88D21-7BD0-11D1-BFB7-00AA00262A11} | Delete WinAce Archiver 2.61 DragDrop Shell Extension | {8FF88D25-7BD0-11D1-BFB7-00AA00262A11} | Delete WinAce Archiver 2.61 Context Menu Shell Extension | {8FF88D27-7BD0-11D1-BFB7-00AA00262A11} | Delete WinAce Archiver 2.61 Property Sheet Shell Extension | {8FF88D23-7BD0-11D1-BFB7-00AA00262A11} | Delete AlcoholShellEx | {32020A01-506E-484D-A2A8-BE3CF17601C3} | Delete Items found - 225, recognized as trusted - 215
| | |||||||||||||||||||||||||||||||||||
| File name | Type | Name | Description | Manufacturer
| LEXLMPM.DLL | Script: Quarantine, Delete, Delete via BC Monitor | Dell Network Port |
| Items found - 12, recognized as trusted - 11
| | |||||||
| File name | Job name | Job state | Description | Manufacturer
| C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe | Script: Quarantine, Delete, Delete via BC Ad-Aware Update (Weekly).job | The task has not yet run. |
| C:\WINDOWS\system32\wunauclt.exe | Script: Quarantine, Delete, Delete via BC At1.job | The task has not yet run. |
| C:\WINDOWS\system32\wunauclt.exe | Script: Quarantine, Delete, Delete via BC At2.job | The task has not yet run. |
| C:\WINDOWS\system32\wunauclt.exe | Script: Quarantine, Delete, Delete via BC At3.job | The task has not yet run. |
| c:\program files\mcafee.com\vso\mcmnhdlr.exe | Script: Quarantine, Delete, Delete via BC Recherche de virus de McAfee.com - Mon ordinateur (INDIUMGALLIUM-Daniel).job | The task has not yet run. |
| C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe | Script: Quarantine, Delete, Delete via BC Uniblue SpyEraser Nag.job | The task is ready to run at its next scheduled time. |
| C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe | Script: Quarantine, Delete, Delete via BC Uniblue SpyEraser.job | One or more of the properties that are needed to run this task on a schedule have not been set. |
| Items found - 12, recognized as trusted - 5
| | |||||||||||||
| Manufacturer | Status | EXE file | Description | GUID
| Detected - 4, recognized as trusted - 4
| | ||||||
| Manufacturer | EXE file | Description
| Detected - 19, recognized as trusted - 19
| | ||||||
| File name | Description | Manufacturer | CLSID | Source URL
| {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} | Delete http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
| {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} | Delete http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
| C:\WINDOWS\system32\Macromed\Flash\FlDbg10a.ocx | Script: Quarantine, Delete, Delete via BC Adobe Flash Player 10.0 r12 | Adobe® Flash® Player. Copyright © 1996-2008 Adobe Systems Incorporated. All Rights Reserved. Protected by U.S. Patent 6,879,327; Patents Pending in the United States and other countries. Adobe and Flash are either trademarks or registered trademarks in the United States and/or other countries. | {D27CDB6E-AE6D-11CF-96B8-444553540000} | Delete http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
| Items found - 9, recognized as trusted - 6
| | ||||||||||||
| File name | Description | Manufacturer
| Items found - 28, recognized as trusted - 28
| | ||||||
| File name | Description | Manufacturer | CLSID
| Items found - 16, recognized as trusted - 16
| | ||||||
Hosts file record
|