Results of system analysis

Kaspersky Virus Removal Tool 2010 9.0.0.722 (database released 28/06/2011; 19:54)

List of processes

File name	PID	Description	Copyright	MD5	Information
AERTSr64.exe Script: Quarantine, Delete, BC delete, Terminate	1968			??	is (user-mode Rootkit),error getting file info Command line:
c:\program files (x86)\amazon\amazon games & software downloader\amazongsdownloaderservice.exe Script: Quarantine, Delete, BC delete, Terminate	2008	Amazon Games & Software Downloader Service	(c) 2009 Amazon.com, Inc. or its affiliates	??	392.50 kb, rsAh, created: 11/13/2010 12:12:45 PM, modified: 10/23/2009 1:31:44 PM Command line: "C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe"
c:\program files (x86)\amazon\amazon games & software downloader\amazongsdownloadertray.exe Script: Quarantine, Delete, BC delete, Terminate	3752	TaskTray Application	(c) 2009 Amazon.com, Inc. or its affiliates	??	318.50 kb, rsAh, created: 11/13/2010 12:12:45 PM, modified: 10/23/2009 1:31:44 PM Command line: "C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe"
audiodg.exe Script: Quarantine, Delete, BC delete, Terminate	5808			??	is (user-mode Rootkit),error getting file info Command line:
c:\program files\avast software\avast\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate	1336	avast! Service	Copyright (c) 2011 AVAST Software	??	41.20 kb, rsAh, created: 6/24/2011 5:42:33 PM, modified: 5/10/2011 8:10:57 AM Command line: "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
consent.exe Script: Quarantine, Delete, BC delete, Terminate	6488			??	is (user-mode Rootkit),error getting file info Command line:
csrss.exe Script: Quarantine, Delete, BC delete, Terminate	660			??	is (user-mode Rootkit),error getting file info Command line:
csrss.exe Script: Quarantine, Delete, BC delete, Terminate	580			??	is (user-mode Rootkit),error getting file info Command line:
c:\program files (x86)\dell datasafe online\datasafeonline.exe Script: Quarantine, Delete, BC delete, Terminate	3196	DataSafeOnline	Copyright © 2007	??	1765.23 kb, rsAh, created: 11/13/2009 6:15:00 PM, modified: 11/13/2009 6:15:00 PM Command line: "C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe" /m
DellDock.exe Script: Quarantine, Delete, BC delete, Terminate	4532			??	is (user-mode Rootkit),error getting file info Command line:
dwm.exe Script: Quarantine, Delete, BC delete, Terminate	1456			??	is (user-mode Rootkit),error getting file info Command line:
hkcmd.exe Script: Quarantine, Delete, BC delete, Terminate	4892			??	is (user-mode Rootkit),error getting file info Command line:
igfxpers.exe Script: Quarantine, Delete, BC delete, Terminate	4924			??	is (user-mode Rootkit),error getting file info Command line:
igfxtray.exe Script: Quarantine, Delete, BC delete, Terminate	4868			??	is (user-mode Rootkit),error getting file info Command line:
c:\program files (x86)\common files\intuit\update service\intuitupdateservice.exe Script: Quarantine, Delete, BC delete, Terminate	6896	Intuit Update Service	Copyright © 2010 Intuit Inc. All Rights Reserved.	??	13.35 kb, rsAh, created: 8/23/2010 8:21:40 PM, modified: 8/23/2010 8:21:40 PM Command line: "C:\Program Files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe"
iPodService.exe Script: Quarantine, Delete, BC delete, Terminate	4192			??	is (user-mode Rootkit),error getting file info Command line:
lsass.exe Script: Quarantine, Delete, BC delete, Terminate	740			??	is (user-mode Rootkit),error getting file info Command line:
lsm.exe Script: Quarantine, Delete, BC delete, Terminate	756			??	is (user-mode Rootkit),error getting file info Command line:
mcagent.exe Script: Quarantine, Delete, BC delete, Terminate	4348			??	is (user-mode Rootkit),error getting file info Command line:
mcshield.exe Script: Quarantine, Delete, BC delete, Terminate	2672			??	is (user-mode Rootkit),error getting file info Command line:
McSvHost.exe Script: Quarantine, Delete, BC delete, Terminate	2876			??	is (user-mode Rootkit),error getting file info Command line:
mfefire.exe Script: Quarantine, Delete, BC delete, Terminate	2768			??	is (user-mode Rootkit),error getting file info Command line:
mfevtps.exe Script: Quarantine, Delete, BC delete, Terminate	2328			??	is (user-mode Rootkit),error getting file info Command line:
PresentationFontCache.exe Script: Quarantine, Delete, BC delete, Terminate	7140			??	is (user-mode Rootkit),error getting file info Command line:
RAVCpl64.exe Script: Quarantine, Delete, BC delete, Terminate	4640			??	is (user-mode Rootkit),error getting file info Command line:
services.exe Script: Quarantine, Delete, BC delete, Terminate	700			??	is (user-mode Rootkit),error getting file info Command line:
smss.exe Script: Quarantine, Delete, BC delete, Terminate	348			??	is (user-mode Rootkit),error getting file info Command line:
spoolsv.exe Script: Quarantine, Delete, BC delete, Terminate	1768			??	is (user-mode Rootkit),error getting file info Command line:
taskhost.exe Script: Quarantine, Delete, BC delete, Terminate	2068			??	is (user-mode Rootkit),error getting file info Command line:
taskhost.exe Script: Quarantine, Delete, BC delete, Terminate	1784			??	is (user-mode Rootkit),error getting file info Command line:
c:\program files (x86)\dell datasafe local backup\toaster.exe Script: Quarantine, Delete, BC delete, Terminate	4428	Dell DataSafe Local Backup	© 2007-2009 SoftThinks SAS	??	327.73 kb, rsAh, created: 2/18/2010 2:30:44 PM, modified: 9/18/2009 6:10:26 PM Command line: "C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe" C:\Users\Cathy"
TrustedInstaller.exe Script: Quarantine, Delete, BC delete, Terminate	4048			??	is (user-mode Rootkit),error getting file info Command line:
winlogon.exe Script: Quarantine, Delete, BC delete, Terminate	748			??	is (user-mode Rootkit),error getting file info Command line:
wmpnetwk.exe Script: Quarantine, Delete, BC delete, Terminate	4404			??	is (user-mode Rootkit),error getting file info Command line:
wuauclt.exe Script: Quarantine, Delete, BC delete, Terminate	604			??	is (user-mode Rootkit),error getting file info Command line:
WUDFHost.exe Script: Quarantine, Delete, BC delete, Terminate	3616			??	is (user-mode Rootkit),error getting file info Command line:
ZuneLauncher.exe Script: Quarantine, Delete, BC delete, Terminate	4684			??	is (user-mode Rootkit),error getting file info Command line:
Detected:87, recognized as trusted 54

Module name	Handle	Description	Copyright	MD5	Used by processes
C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe Script: Quarantine, Delete, BC delete	14090240	Amazon Games & Software Downloader Service	(c) 2009 Amazon.com, Inc. or its affiliates	??	2008
C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe Script: Quarantine, Delete, BC delete	2883584	TaskTray Application	(c) 2009 Amazon.com, Inc. or its affiliates	??	3752
C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\LIBEAY32.dll Script: Quarantine, Delete, BC delete	2424832	OpenSSL Shared Library	Copyright © 1998-2005 The OpenSSL Project. Copyright © 1995-1998 Eric A. Young, Tim J. Hudson. All rights reserved.	--	2008
C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\SSLEAY32.dll Script: Quarantine, Delete, BC delete	268435456	OpenSSL Shared Library	Copyright © 1998-2005 The OpenSSL Project. Copyright © 1995-1998 Eric A. Young, Tim J. Hudson. All rights reserved.	--	2008
C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\utility.dll Script: Quarantine, Delete, BC delete	1928134656			--	2008, 3752
C:\Program Files\AVAST Software\Avast\defs\11062900\algo.dll Script: Quarantine, Delete, BC delete	1665138688			--	1336
C:\Windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\2e8bbdf2a971ffe1ba403c620989954c\CustomMarshalers.ni.dll Script: Quarantine, Delete, BC delete	1678311424	Microsoft .NET Framework Custom Marshalers	© Microsoft Corporation. All rights reserved.	--	6896
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\23bc3936180ff789f44259a211dfc7fc\mscorlib.ni.dll Script: Quarantine, Delete, BC delete	1871511552	Microsoft Common Language Runtime Class Library	© Microsoft Corporation. All rights reserved.	--	3196, 6896, 4428
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\eef110caf6629511d8cec40960035d6a\PresentationCore.ni.dll Script: Quarantine, Delete, BC delete	1845493760	PresentationCore.dll	© Microsoft Corporation. All rights reserved.	--	4428
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\431b1d1e45e04da6ef224b1dca8c1d92\PresentationFramework.ni.dll Script: Quarantine, Delete, BC delete	1830879232	PresentationFramework.dll	© Microsoft Corporation. All rights reserved.	--	4428
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\d739c4b3c1f9e479a626f67071017128\PresentationFramework.Aero.ni.dll Script: Quarantine, Delete, BC delete	1783365632	PresentationFramework.Aero.dll	© Microsoft Corporation. All rights reserved.	--	4428
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\565a1d9d3fed4d64ddb884a49a1a0e25\System.Management.ni.dll Script: Quarantine, Delete, BC delete	1730412544	.NET Framework	© Microsoft Corporation. All rights reserved.	--	3196
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\77631b8c99bc572962e558cdac417477\System.Web.Services.ni.dll Script: Quarantine, Delete, BC delete	1731723264	.NET Framework	© Microsoft Corporation. All rights reserved.	--	3196
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\933baa29f5feba3093ba81c5b9b82b1c\System.Windows.Forms.ni.dll Script: Quarantine, Delete, BC delete	1940389888	.NET Framework	© Microsoft Corporation. All rights reserved.	--	3196, 4428
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\682572c507ea7552c3db1842c21bf9c8\System.Xml.ni.dll Script: Quarantine, Delete, BC delete	1757937664	.NET Framework	© Microsoft Corporation. All rights reserved.	--	3196, 4428
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\f7048e198c963fa189cff3aea17dfee3\System.ni.dll Script: Quarantine, Delete, BC delete	1861091328	.NET Framework	© Microsoft Corporation. All rights reserved.	--	3196, 6896, 4428
C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\93e867e55d7df3a8b4bd1aba3af6f18d\WindowsBase.ni.dll Script: Quarantine, Delete, BC delete	1857748992	WindowsBase.dll	© Microsoft Corporation. All rights reserved.	--	4428
Modules detected:595, recognized as trusted 578

Kernel Space Modules Viewer

Module	Base address	Size in memory	Description	Manufacturer
C:\Windows\system32\DRIVERS\9020797.sys Script: Quarantine, Delete, BC delete	2A3D000	05C000 (376832)	Klif Mini-Filter [fre_wlh_AMD64]	Copyright © Kaspersky Lab 1996-2009.
C:\Windows\system32\DRIVERS\90207971.sys Script: Quarantine, Delete, BC delete	4671000	529000 (5410816)	Kaspersky Unified Driver	Copyright © Kaspersky Lab 1997-2009.
C:\Windows\system32\DRIVERS\90207972.sys Script: Quarantine, Delete, BC delete	16F2000	00E000 (57344)	Kaspersky Lab Boot Guard Driver	Copyright © Kaspersky Lab 1997-2009.
C:\Windows\system32\DRIVERS\ACPI.sys Script: Quarantine, Delete, BC delete	E00000	057000 (356352)	ACPI Driver for NT	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\drivers\afd.sys Script: Quarantine, Delete, BC delete	3AD4000	089000 (561152)	Ancillary Function Driver for WinSock	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\AgileVpn.sys Script: Quarantine, Delete, BC delete	5FCC000	016000 (90112)	RAS Agile Vpn Miniport Call Manager	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\drivers\amdxata.sys Script: Quarantine, Delete, BC delete	DD9000	00B000 (45056)	Storage Filter Driver	Copyright © 2008-2010 AMD, Inc.
C:\Windows\System32\Drivers\aswFsBlk.SYS Script: Quarantine, Delete, BC delete	20AA000	009000 (36864)	avast! File System Access Blocking Driver	Copyright (c) 1996-2010 AVAST Software
C:\Windows\system32\drivers\aswMonFlt.sys Script: Quarantine, Delete, BC delete	2070000	03A000 (237568)	avast! File System Minifilter for Windows 2003/Vista	Copyright (c) 1996-2010 AVAST Software
C:\Windows\System32\Drivers\aswRdr.SYS Script: Quarantine, Delete, BC delete	3B5D000	00A000 (40960)	avast! TDI RDR Driver	Copyright (c) 1996-2010 AVAST Software
C:\Windows\System32\Drivers\aswSnx.SYS Script: Quarantine, Delete, BC delete	1760000	098000 (622592)	avast! Virtualization Driver	Copyright (c) 1996-2010 AVAST Software
C:\Windows\System32\Drivers\aswSP.SYS Script: Quarantine, Delete, BC delete	4019000	04D000 (315392)	avast! self protection module	Copyright (c) 1996-2010 AVAST Software
C:\Windows\System32\Drivers\aswTdi.SYS Script: Quarantine, Delete, BC delete	2BDC000	010000 (65536)	avast! TDI Filter Driver	Copyright (c) 1996-2010 AVAST Software
C:\Windows\system32\DRIVERS\atapi.sys Script: Quarantine, Delete, BC delete	E7E000	009000 (36864)	ATAPI IDE Miniport Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\ataport.SYS Script: Quarantine, Delete, BC delete	DAF000	02A000 (172032)	ATAPI Driver Extension	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\Drivers\Beep.SYS Script: Quarantine, Delete, BC delete	2AA2000	007000 (28672)	BEEP Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\blbdrive.sys Script: Quarantine, Delete, BC delete	3A77000	011000 (69632)	BLB Drive Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\bowser.sys Script: Quarantine, Delete, BC delete	3D8C000	01E000 (122880)	NT Lan Manager Datagram Receiver Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\cdd.dll Script: Quarantine, Delete, BC delete	610000	027000 (159744)
C:\Windows\system32\DRIVERS\cdrom.sys Script: Quarantine, Delete, BC delete	1736000	02A000 (172032)	SCSI CD-ROM Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\drivers\cfwids.sys Script: Quarantine, Delete, BC delete	6C67000	00E000 (57344)	McAfee Personal Firewall IDS Plugin	Copyright© 1995-2011 McAfee, Inc. All Rights Reserved.
C:\Windows\system32\CI.dll Script: Quarantine, Delete, BC delete	E88000	0C0000 (786432)
C:\Windows\system32\DRIVERS\CLASSPNP.SYS Script: Quarantine, Delete, BC delete	16C2000	030000 (196608)	SCSI Class System Dll	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\CLFS.SYS Script: Quarantine, Delete, BC delete	CF4000	05E000 (385024)
C:\Windows\System32\Drivers\cng.sys Script: Quarantine, Delete, BC delete	115F000	073000 (471040)	Kernel Cryptography, Next Generation	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\CompositeBus.sys Script: Quarantine, Delete, BC delete	5499000	010000 (65536)	Multi-Transport Composite Bus Enumerator	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\Drivers\crashdmp.sys Script: Quarantine, Delete, BC delete	4E76000	00E000 (57344)	Crash Dump Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\Drivers\dfsc.sys Script: Quarantine, Delete, BC delete	2A00000	01E000 (122880)	DFS Namespace Client Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\drivers\discache.sys Script: Quarantine, Delete, BC delete	3A68000	00F000 (61440)	System Indexer/Cache Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\disk.sys Script: Quarantine, Delete, BC delete	16AC000	016000 (90112)	PnP Disk Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\drivers\drmk.sys Script: Quarantine, Delete, BC delete	4ED4000	022000 (139264)	Microsoft Trusted Audio Drivers	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\Drivers\dump_atapi.sys Script: Quarantine, Delete, BC delete	4FA7000	009000 (36864)
C:\Windows\System32\Drivers\dump_dumpata.sys Script: Quarantine, Delete, BC delete	4E84000	00C000 (49152)
C:\Windows\System32\Drivers\dump_dumpfve.sys Script: Quarantine, Delete, BC delete	4FB0000	013000 (77824)
C:\Windows\System32\drivers\Dxapi.sys Script: Quarantine, Delete, BC delete	4E6A000	00C000 (49152)	DirectX API Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\drivers\dxgkrnl.sys Script: Quarantine, Delete, BC delete	5ED8000	0F4000 (999424)	DirectX Graphics Kernel	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\drivers\dxgmms1.sys Script: Quarantine, Delete, BC delete	5400000	046000 (286720)	DirectX Graphics MMS	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\Drivers\fastfat.SYS Script: Quarantine, Delete, BC delete	6DC7000	036000 (221184)	Fast FAT File System Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\drivers\fileinfo.sys Script: Quarantine, Delete, BC delete	1061000	014000 (81920)	FileInfo Filter Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\drivers\fltmgr.sys Script: Quarantine, Delete, BC delete	1015000	04C000 (311296)	Microsoft Filesystem Filter Manager	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\Drivers\Fs_Rec.sys Script: Quarantine, Delete, BC delete	13F0000	00A000 (40960)	File System Recognizer Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\DRIVERS\fvevol.sys Script: Quarantine, Delete, BC delete	1672000	03A000 (237568)	BitLocker Drive Encryption Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\drivers\fwpkclnt.sys Script: Quarantine, Delete, BC delete	2B23000	04A000 (303104)	FWP/IPsec Kernel-Mode API	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\GEARAspiWDM.sys Script: Quarantine, Delete, BC delete	548C000	00D000 (53248)	CD DVD Filter	Copyright (C) GEAR Software Inc. 1997-2009
C:\Windows\system32\hal.dll Script: Quarantine, Delete, BC delete	3401000	049000 (299008)
C:\Windows\system32\DRIVERS\HDAudBus.sys Script: Quarantine, Delete, BC delete	5468000	024000 (147456)	High Definition Audio Bus Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\HECIx64.sys Script: Quarantine, Delete, BC delete	5446000	011000 (69632)	Intel(R) Management Engine Interface	Copyright © 2006-2009, Intel Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\HIDCLASS.SYS Script: Quarantine, Delete, BC delete	4F48000	019000 (102400)	Hid Class Library	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\HIDPARSE.SYS Script: Quarantine, Delete, BC delete	4F61000	009000 (36864)	Hid Parsing Library	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\hidusb.sys Script: Quarantine, Delete, BC delete	4F3A000	00E000 (57344)	USB Miniport Driver for Input Devices	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\drivers\HTTP.sys Script: Quarantine, Delete, BC delete	3CC4000	0C8000 (819200)	HTTP Protocol Stack	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\drivers\hwpolicy.sys Script: Quarantine, Delete, BC delete	1669000	009000 (36864)	Hardware Policy Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\igdkmd64.sys Script: Quarantine, Delete, BC delete	54B9000	A1F000 (10612736)	Intel Graphics Kernel Mode Driver	Copyright (c) 1998-2006 Intel Corporation.
C:\Windows\system32\DRIVERS\IntcDAud.sys Script: Quarantine, Delete, BC delete	4EFC000	03E000 (253952)	Intel(R) Display HD Audio driver	Intel(R) Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\intelppm.sys Script: Quarantine, Delete, BC delete	4BC0000	016000 (90112)	Processor Device Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\k57nd60a.sys Script: Quarantine, Delete, BC delete	4066000	051000 (331776)	Broadcom NetLink (TM) Gigabit Ethernet NDIS6.x Unified Driver.	Copyright 2000-2009, Broadcom Corporation.
C:\Windows\system32\DRIVERS\kbdclass.sys Script: Quarantine, Delete, BC delete	5FEE000	00F000 (61440)	Keyboard Class Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\kbdhid.sys Script: Quarantine, Delete, BC delete	4F6C000	00E000 (57344)	HID Keyboard Filter Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\kdcom.dll Script: Quarantine, Delete, BC delete	BC9000	00A000 (40960)
C:\Windows\system32\DRIVERS\ks.sys Script: Quarantine, Delete, BC delete	4121000	043000 (274432)	Kernel CSA Library	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\Drivers\ksecdd.sys Script: Quarantine, Delete, BC delete	13C5000	01A000 (106496)	Kernel Security Support Provider Interface	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\Drivers\ksecpkg.sys Script: Quarantine, Delete, BC delete	1400000	02B000 (176128)	Kernel Security Support Provider Interface Packages	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\drivers\ksthunk.sys Script: Quarantine, Delete, BC delete	4EF6000	006000 (24576)	Kernel Streaming WOW Thunk Service	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\lltdio.sys Script: Quarantine, Delete, BC delete	20D4000	015000 (86016)	Link-Layer Topology Mapper I/O Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\drivers\luafv.sys Script: Quarantine, Delete, BC delete	1700000	023000 (143360)	LUA File Virtualization Filter Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\mcupdate_GenuineIntel.dll Script: Quarantine, Delete, BC delete	C9C000	044000 (278528)
C:\Windows\system32\drivers\mfeapfk.sys Script: Quarantine, Delete, BC delete	6CA6000	01C000 (114688)	Access Protection Filter Driver	Copyright© 1995-2011 McAfee, Inc. All Rights Reserved.
C:\Windows\system32\drivers\mfeavfk.sys Script: Quarantine, Delete, BC delete	4F7A000	02D000 (184320)	Anti-Virus File System Filter Driver	Copyright© 1995-2011 McAfee, Inc. All Rights Reserved.
C:\Windows\system32\drivers\mfefirek.sys Script: Quarantine, Delete, BC delete	4E00000	06A000 (434176)	McAfee Core Firewall Engine Driver	Copyright© 1995-2011 McAfee, Inc. All Rights Reserved.
C:\Windows\system32\drivers\mfehidk.sys Script: Quarantine, Delete, BC delete	1075000	080000 (524288)	McAfee Link Driver	Copyright© 1995-2011 McAfee, Inc. All Rights Reserved.
C:\Windows\system32\DRIVERS\mfenlfk.sys Script: Quarantine, Delete, BC delete	3B96000	011000 (69632)	McAfee NDIS Light Filter Driver	Copyright© 1995-2011 McAfee, Inc. All Rights Reserved.
C:\Windows\system32\drivers\mfewfpk.sys Script: Quarantine, Delete, BC delete	2B6D000	044000 (278528)	Anti-Virus Mini-Firewall Driver	Copyright© 1995-2011 McAfee, Inc. All Rights Reserved.
C:\Windows\system32\DRIVERS\monitor.sys Script: Quarantine, Delete, BC delete	4FEB000	00E000 (57344)	Monitor Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\mouclass.sys Script: Quarantine, Delete, BC delete	54A9000	00F000 (61440)	Mouse Class Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\mouhid.sys Script: Quarantine, Delete, BC delete	4FC3000	00D000 (53248)	HID Mouse Filter Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\drivers\mountmgr.sys Script: Quarantine, Delete, BC delete	C6C000	01A000 (106496)	Mount Point Manager	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\drivers\mpsdrv.sys Script: Quarantine, Delete, BC delete	3DAA000	018000 (98304)	Microsoft Protection Service Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\mrxsmb.sys Script: Quarantine, Delete, BC delete	3DC2000	02D000 (184320)	Windows NT SMB Minirdr	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\mrxsmb10.sys Script: Quarantine, Delete, BC delete	3C00000	04E000 (319488)	Longhorn SMB Downlevel SubRdr	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\mrxsmb20.sys Script: Quarantine, Delete, BC delete	3C4E000	023000 (143360)	Longhorn SMB 2.0 Redirector	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\Drivers\Msfs.SYS Script: Quarantine, Delete, BC delete	2B07000	00B000 (45056)	Mailslot driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\msisadrv.sys Script: Quarantine, Delete, BC delete	E60000	00A000 (40960)	ISA Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\Drivers\msrpc.sys Script: Quarantine, Delete, BC delete	1101000	05E000 (385024)	Kernel Remote Procedure Call Provider	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\mssmbios.sys Script: Quarantine, Delete, BC delete	3A5D000	00B000 (45056)	System Management BIOS Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\Drivers\mup.sys Script: Quarantine, Delete, BC delete	1657000	012000 (73728)	Multiple UNC Provider Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\drivers\ndis.sys Script: Quarantine, Delete, BC delete	14A5000	0F2000 (991232)	NDIS 6.20 driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\ndistapi.sys Script: Quarantine, Delete, BC delete	5FE2000	00C000 (49152)	NDIS 3.0 connection wrapper driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\ndisuio.sys Script: Quarantine, Delete, BC delete	213C000	013000 (77824)	NDIS User mode I/O driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\ndiswan.sys Script: Quarantine, Delete, BC delete	40B7000	02F000 (192512)	MS PPP Framing Driver (Strong Encryption)	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\Drivers\NDProxy.SYS Script: Quarantine, Delete, BC delete	41D0000	015000 (86016)	NDIS Proxy	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\netbios.sys Script: Quarantine, Delete, BC delete	3BBD000	00F000 (61440)	NetBIOS interface driver	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\DRIVERS\netbt.sys Script: Quarantine, Delete, BC delete	3A8F000	045000 (282624)	MBT Transport driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\drivers\NETIO.SYS Script: Quarantine, Delete, BC delete	1597000	060000 (393216)	Network I/O Subsystem	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\Drivers\Npfs.SYS Script: Quarantine, Delete, BC delete	2B12000	011000 (69632)	NPFS Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\drivers\nsiproxy.sys Script: Quarantine, Delete, BC delete	3A51000	00C000 (49152)	NSI Proxy	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\Drivers\Ntfs.sys Script: Quarantine, Delete, BC delete	1223000	1A2000 (1712128)	NT File System Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\Drivers\Null.SYS Script: Quarantine, Delete, BC delete	2A99000	009000 (36864)	NULL Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\nwifi.sys Script: Quarantine, Delete, BC delete	20E9000	053000 (339968)	NativeWiFi Miniport Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\pacer.sys Script: Quarantine, Delete, BC delete	3B70000	026000 (155648)	QoS Packet Scheduler	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\drivers\partmgr.sys Script: Quarantine, Delete, BC delete	D85000	015000 (86016)	Partition Management Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\pci.sys Script: Quarantine, Delete, BC delete	D52000	033000 (208896)	NT Plug and Play PCI Enumerator	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\pciide.sys Script: Quarantine, Delete, BC delete	E77000	007000 (28672)	Generic PCI IDE Bus Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\PCIIDEX.SYS Script: Quarantine, Delete, BC delete	C5C000	010000 (65536)	PCI IDE Bus Driver Extension	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\drivers\pcw.sys Script: Quarantine, Delete, BC delete	13DF000	011000 (69632)	Performance Counters for Windows Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\drivers\peauth.sys Script: Quarantine, Delete, BC delete	6CD7000	0A6000 (679936)	Protected Environment Authentication and Authorization Export Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\drivers\portcls.sys Script: Quarantine, Delete, BC delete	4E97000	03D000 (249856)	Port Class (Class Driver for Port/Miniport Devices)	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\Drivers\PxHlpa64.sys Script: Quarantine, Delete, BC delete	10F5000	00C000 (49152)	Px Engine Device Driver for 64-bit Windows	Copyright © Sonic Solutions
C:\Windows\system32\DRIVERS\rasl2tp.sys Script: Quarantine, Delete, BC delete	4BD6000	024000 (147456)	RAS L2TP mini-port/call-manager driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\raspppoe.sys Script: Quarantine, Delete, BC delete	4656000	01B000 (110592)	RAS PPPoE mini-port/call-manager driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\raspptp.sys Script: Quarantine, Delete, BC delete	40E6000	021000 (135168)	Peer-to-Peer Tunneling Protocol	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\rassstp.sys Script: Quarantine, Delete, BC delete	4107000	01A000 (106496)	RAS SSTP Miniport Call Manager	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\rdbss.sys Script: Quarantine, Delete, BC delete	3A00000	051000 (331776)	Redirected Drive Buffering SubSystem Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\DRIVERS\RDPCDD.sys Script: Quarantine, Delete, BC delete	2AEC000	009000 (36864)	RDP Miniport	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\drivers\rdpencdd.sys Script: Quarantine, Delete, BC delete	2AF5000	009000 (36864)	RDP Encoder Miniport	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\drivers\rdprefmp.sys Script: Quarantine, Delete, BC delete	2AFE000	009000 (36864)	RDP Reflector Driver Miniport	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\drivers\rdyboost.sys Script: Quarantine, Delete, BC delete	161D000	03A000 (237568)	ReadyBoost Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\rspndr.sys Script: Quarantine, Delete, BC delete	214F000	018000 (98304)	Link-Layer Topology Responder Driver for NDIS 6	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\drivers\RTKVHD64.sys Script: Quarantine, Delete, BC delete	4C01000	1E3000 (1978368)	Realtek(r) High Definition Audio Function Driver	Copyright (c) Realtek Semiconductor Corp.1998-2012
C:\Windows\System32\Drivers\secdrv.SYS Script: Quarantine, Delete, BC delete	6D7D000	00B000 (45056)	Macrovision SECURITY Driver	© 2006 Macrovision Corporation
C:\Windows\System32\smss.exe Script: Quarantine, Delete, BC delete	48400000	020000 (131072)
C:\Windows\System32\Drivers\spldr.sys Script: Quarantine, Delete, BC delete	1477000	008000 (32768)	loader for security processor	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\DRIVERS\srv.sys Script: Quarantine, Delete, BC delete	2167000	095000 (610304)	Server driver	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\DRIVERS\srv2.sys Script: Quarantine, Delete, BC delete	6C00000	067000 (421888)	Smb 2.0 Server driver	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\DRIVERS\srvnet.sys Script: Quarantine, Delete, BC delete	6D88000	02D000 (184320)	Server Network driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\swenum.sys Script: Quarantine, Delete, BC delete	5FFD000	002000 (8192)	Plug and Play Software Device Enumerator	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\drivers\tcpip.sys Script: Quarantine, Delete, BC delete	3803000	1FD000 (2084864)	TCP/IP Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\drivers\tcpipreg.sys Script: Quarantine, Delete, BC delete	6DB5000	012000 (73728)	TCP/IP Registry Compatibility Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\drivers\TDI.SYS Script: Quarantine, Delete, BC delete	2BB1000	00D000 (53248)	TDI Wrapper	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\tdx.sys Script: Quarantine, Delete, BC delete	2BBE000	01E000 (122880)	TDI Translation Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\termdd.sys Script: Quarantine, Delete, BC delete	3BE7000	014000 (81920)	Remote Desktop Server Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\TSDDD.dll Script: Quarantine, Delete, BC delete	470000	00A000 (40960)
C:\Windows\system32\DRIVERS\tunnel.sys Script: Quarantine, Delete, BC delete	4B9A000	026000 (155648)	Microsoft Tunnel Interface Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\umbus.sys Script: Quarantine, Delete, BC delete	4164000	012000 (73728)	User-Mode Bus Enumerator	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\USBD.SYS Script: Quarantine, Delete, BC delete	4F6A000	002000 (8192)	Universal Serial Bus Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\drivers\usbehci.sys Script: Quarantine, Delete, BC delete	5457000	011000 (69632)	EHCI eUSB Miniport Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\usbhub.sys Script: Quarantine, Delete, BC delete	4176000	05A000 (368640)	Default Hub Driver for USB	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\drivers\USBPORT.SYS Script: Quarantine, Delete, BC delete	4600000	056000 (352256)	USB 1.1 & 2.0 Port Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\USBSTOR.SYS Script: Quarantine, Delete, BC delete	4FD0000	01B000 (110592)	USB Mass Storage Class Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\vdrvroot.sys Script: Quarantine, Delete, BC delete	E6A000	00D000 (53248)	Virtual Drive Root Enumerator	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\drivers\vga.sys Script: Quarantine, Delete, BC delete	2AA9000	00E000 (57344)	VGA/Super VGA Video Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\drivers\VIDEOPRT.SYS Script: Quarantine, Delete, BC delete	2AB7000	025000 (151552)	Video Port Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\volmgr.sys Script: Quarantine, Delete, BC delete	D9A000	015000 (86016)	Volume Manager Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\drivers\volmgrx.sys Script: Quarantine, Delete, BC delete	C00000	05C000 (376832)	Volume Manager Extension Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\volsnap.sys Script: Quarantine, Delete, BC delete	142B000	04C000 (311296)	Volume Shadow Copy Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\vwififlt.sys Script: Quarantine, Delete, BC delete	3BA7000	016000 (90112)	Virtual WiFi Filter Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\wanarp.sys Script: Quarantine, Delete, BC delete	3BCC000	01B000 (110592)	MS Remote Access and Routing ARP Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\drivers\watchdog.sys Script: Quarantine, Delete, BC delete	2ADC000	010000 (65536)	Watchdog Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\drivers\Wdf01000.sys Script: Quarantine, Delete, BC delete	F48000	0A4000 (671744)	Kernel Mode Driver Framework Runtime	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\drivers\WDFLDR.SYS Script: Quarantine, Delete, BC delete	FEC000	00F000 (61440)	Kernel Mode Driver Framework Loader	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\wfplwf.sys Script: Quarantine, Delete, BC delete	3B67000	009000 (36864)	WFP NDIS 6.20 Lightweight Filter Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\System32\win32k.sys Script: Quarantine, Delete, BC delete	0A0000	312000 (3219456)
C:\Windows\system32\DRIVERS\WMILIB.SYS Script: Quarantine, Delete, BC delete	E57000	009000 (36864)	WMILIB WMI support library Dll	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\drivers\WudfPf.sys Script: Quarantine, Delete, BC delete	20B3000	021000 (135168)	Windows Driver Foundation - User-mode Driver Framework Platform Driver	© Microsoft Corporation. All rights reserved.
C:\Windows\system32\DRIVERS\WUDFRd.sys Script: Quarantine, Delete, BC delete	6C75000	031000 (200704)	Windows Driver Foundation - User-mode Driver Framework Reflector	© Microsoft Corporation. All rights reserved.
Modules detected - 195, recognized as trusted - 41

Services

Service	Description	Status	File	Group	Dependencies
Amazon Download Agent Service: Stop, Delete, Disable	Amazon Download Agent	Running	C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe Script: Quarantine, Delete, BC delete
EFS Service: Stop, Delete, Disable	Encrypting File System (EFS)	Running	C:\Windows\System32\lsass.exe Script: Quarantine, Delete, BC delete		RPCSS
KeyIso Service: Stop, Delete, Disable	CNG Key Isolation	Running	C:\Windows\system32\lsass.exe Script: Quarantine, Delete, BC delete		RpcSs
SamSs Service: Stop, Delete, Disable	Security Accounts Manager	Running	C:\Windows\system32\lsass.exe Script: Quarantine, Delete, BC delete	MS_WindowsLocalValidation	RPCSS
Spooler Service: Stop, Delete, Disable	Print Spooler	Running	C:\Windows\System32\spoolsv.exe Script: Quarantine, Delete, BC delete	SpoolerGroup	RPCSS
ALG Service: Stop, Delete, Disable	Application Layer Gateway Service	Not started	C:\Windows\System32\alg.exe Script: Quarantine, Delete, BC delete
Fax Service: Stop, Delete, Disable	Fax	Not started	C:\Windows\system32\fxssvc.exe Script: Quarantine, Delete, BC delete		TapiSrv
MSDTC Service: Stop, Delete, Disable	Distributed Transaction Coordinator	Not started	C:\Windows\System32\msdtc.exe Script: Quarantine, Delete, BC delete		RPCSS
Netlogon Service: Stop, Delete, Disable	Netlogon	Not started	C:\Windows\system32\lsass.exe Script: Quarantine, Delete, BC delete	MS_WindowsRemoteValidation	LanmanWorkstation
ProtectedStorage Service: Stop, Delete, Disable	Protected Storage	Not started	C:\Windows\system32\lsass.exe Script: Quarantine, Delete, BC delete		RpcSs
RpcLocator Service: Stop, Delete, Disable	Remote Procedure Call (RPC) Locator	Not started	C:\Windows\system32\locator.exe Script: Quarantine, Delete, BC delete
SNMPTRAP Service: Stop, Delete, Disable	SNMP Trap	Not started	C:\Windows\System32\snmptrap.exe Script: Quarantine, Delete, BC delete
sppsvc Service: Stop, Delete, Disable	Software Protection	Not started	C:\Windows\system32\sppsvc.exe Script: Quarantine, Delete, BC delete		RpcSs
UI0Detect Service: Stop, Delete, Disable	Interactive Services Detection	Not started	C:\Windows\system32\UI0Detect.exe Script: Quarantine, Delete, BC delete
VaultSvc Service: Stop, Delete, Disable	Credential Manager	Not started	C:\Windows\system32\lsass.exe Script: Quarantine, Delete, BC delete		rpcss
vds Service: Stop, Delete, Disable	Virtual Disk	Not started	C:\Windows\System32\vds.exe Script: Quarantine, Delete, BC delete		RpcSs
VSS Service: Stop, Delete, Disable	Volume Shadow Copy	Not started	C:\Windows\system32\vssvc.exe Script: Quarantine, Delete, BC delete		RPCSS
WatAdminSvc Service: Stop, Delete, Disable	Windows Activation Technologies Service	Not started	C:\Windows\system32\Wat\WatAdminSvc.exe Script: Quarantine, Delete, BC delete
wbengine Service: Stop, Delete, Disable	Block Level Backup Engine Service	Not started	C:\Windows\system32\wbengine.exe Script: Quarantine, Delete, BC delete
wmiApSrv Service: Stop, Delete, Disable	WMI Performance Adapter	Not started	C:\Windows\system32\wbem\WmiApSrv.exe Script: Quarantine, Delete, BC delete
Detected - 181, recognized as trusted - 161

Drivers

Service	Description	Status	File	Group	Dependencies
90207971 Driver: Unload, Delete, Disable	90207971	Running	C:\Windows\system32\DRIVERS\90207971.sys Script: Quarantine, Delete, BC delete
90207972 Driver: Unload, Delete, Disable	90207972 Boot Guard Driver	Running	C:\Windows\system32\DRIVERS\90207972.sys Script: Quarantine, Delete, BC delete
ACPI Driver: Unload, Delete, Disable	Microsoft ACPI Driver	Running	C:\Windows\system32\DRIVERS\ACPI.sys Script: Quarantine, Delete, BC delete	Boot Bus Extender
AFD Driver: Unload, Delete, Disable	Ancillary Function Driver for Winsock	Running	C:\Windows\system32\drivers\afd.sys Script: Quarantine, Delete, BC delete	PNP_TDI
amdxata Driver: Unload, Delete, Disable	amdxata	Running	C:\Windows\system32\drivers\amdxata.sys Script: Quarantine, Delete, BC delete	SCSI miniport
aswFsBlk Driver: Unload, Delete, Disable	aswFsBlk	Running	aswFsBlk.sys Script: Quarantine, Delete, BC delete	FSFilter Activity Monitor	FltMgr
aswMonFlt Driver: Unload, Delete, Disable	aswMonFlt	Running	C:\Windows\system32\drivers\aswMonFlt.sys Script: Quarantine, Delete, BC delete	FSFilter Anti-Virus	FltMgr
aswRdr Driver: Unload, Delete, Disable	aswRdr	Running	aswRdr.sys Script: Quarantine, Delete, BC delete	PNP_TDI	tcpip
aswSnx Driver: Unload, Delete, Disable	aswSnx	Running	aswSnx.sys Script: Quarantine, Delete, BC delete	FSFilter Virtualization	FltMgr
aswSP Driver: Unload, Delete, Disable	aswSP	Running	aswSP.sys Script: Quarantine, Delete, BC delete
aswTdi Driver: Unload, Delete, Disable	avast! Network Shield Support	Running	aswTdi.sys Script: Quarantine, Delete, BC delete	PNP_TDI	tcpip
atapi Driver: Unload, Delete, Disable	IDE Channel	Running	C:\Windows\system32\DRIVERS\atapi.sys Script: Quarantine, Delete, BC delete	SCSI Miniport
Beep Driver: Unload, Delete, Disable	Beep	Running	Beep.sys Script: Quarantine, Delete, BC delete	Base
blbdrive Driver: Unload, Delete, Disable	blbdrive	Running	C:\Windows\system32\DRIVERS\blbdrive.sys Script: Quarantine, Delete, BC delete
bowser Driver: Unload, Delete, Disable	Browser Support Driver	Running	C:\Windows\system32\DRIVERS\bowser.sys Script: Quarantine, Delete, BC delete	Network
cdrom Driver: Unload, Delete, Disable	CD-ROM Driver	Running	C:\Windows\system32\DRIVERS\cdrom.sys Script: Quarantine, Delete, BC delete	SCSI CDROM Class
cfwids Driver: Unload, Delete, Disable	McAfee Inc. cfwids	Running	C:\Windows\system32\drivers\cfwids.sys Script: Quarantine, Delete, BC delete
CLFS Driver: Unload, Delete, Disable	Common Log (CLFS)	Running	C:\Windows\System32\CLFS.sys Script: Quarantine, Delete, BC delete	Filter
CNG Driver: Unload, Delete, Disable	CNG	Running	C:\Windows\System32\Drivers\cng.sys Script: Quarantine, Delete, BC delete	Base
CompositeBus Driver: Unload, Delete, Disable	Composite Bus Enumerator Driver	Running	C:\Windows\system32\DRIVERS\CompositeBus.sys Script: Quarantine, Delete, BC delete	Extended Base
DfsC Driver: Unload, Delete, Disable	DFS Namespace Client Driver	Running	C:\Windows\system32\Drivers\dfsc.sys Script: Quarantine, Delete, BC delete	Network	Mup
discache Driver: Unload, Delete, Disable	System Attribute Cache	Running	C:\Windows\system32\drivers\discache.sys Script: Quarantine, Delete, BC delete
Disk Driver: Unload, Delete, Disable	Disk Driver	Running	C:\Windows\system32\DRIVERS\disk.sys Script: Quarantine, Delete, BC delete
DXGKrnl Driver: Unload, Delete, Disable	LDDM Graphics Subsystem	Running	C:\Windows\System32\drivers\dxgkrnl.sys Script: Quarantine, Delete, BC delete	Video Init
fastfat Driver: Unload, Delete, Disable	FAT12/16/32 File System Driver	Running	fastfat.sys Script: Quarantine, Delete, BC delete	Boot File System
FileInfo Driver: Unload, Delete, Disable	File Information FS MiniFilter	Running	C:\Windows\system32\drivers\fileinfo.sys Script: Quarantine, Delete, BC delete	FSFilter Bottom	fltmgr
FltMgr Driver: Unload, Delete, Disable	FltMgr	Running	C:\Windows\system32\drivers\fltmgr.sys Script: Quarantine, Delete, BC delete	FSFilter Infrastructure
fvevol Driver: Unload, Delete, Disable	Bitlocker Drive Encryption Filter Driver	Running	C:\Windows\System32\DRIVERS\fvevol.sys Script: Quarantine, Delete, BC delete	PnP Filter
GEARAspiWDM Driver: Unload, Delete, Disable	GEAR ASPI Filter Driver	Running	C:\Windows\system32\DRIVERS\GEARAspiWDM.sys Script: Quarantine, Delete, BC delete	PnP Filter
HDAudBus Driver: Unload, Delete, Disable	Microsoft UAA Bus Driver for High Definition Audio	Running	C:\Windows\system32\DRIVERS\HDAudBus.sys Script: Quarantine, Delete, BC delete	Extended Base
HECIx64 Driver: Unload, Delete, Disable	Intel(R) Management Engine Interface	Running	C:\Windows\system32\DRIVERS\HECIx64.sys Script: Quarantine, Delete, BC delete	Extended Base
HidUsb Driver: Unload, Delete, Disable	Microsoft HID Class Driver	Running	C:\Windows\system32\DRIVERS\hidusb.sys Script: Quarantine, Delete, BC delete	extended base
HTTP Driver: Unload, Delete, Disable	HTTP	Running	C:\Windows\system32\drivers\HTTP.sys Script: Quarantine, Delete, BC delete
hwpolicy Driver: Unload, Delete, Disable	Hardware Policy Driver	Running	C:\Windows\System32\drivers\hwpolicy.sys Script: Quarantine, Delete, BC delete
igfx Driver: Unload, Delete, Disable	igfx	Running	C:\Windows\system32\DRIVERS\igdkmd64.sys Script: Quarantine, Delete, BC delete	Video
IntcAzAudAddService Driver: Unload, Delete, Disable	Service for Realtek HD Audio (WDM)	Running	C:\Windows\system32\drivers\RTKVHD64.sys Script: Quarantine, Delete, BC delete
IntcDAud Driver: Unload, Delete, Disable	Intel(R) Display Audio	Running	C:\Windows\system32\DRIVERS\IntcDAud.sys Script: Quarantine, Delete, BC delete
intelppm Driver: Unload, Delete, Disable	Intel Processor Driver	Running	C:\Windows\system32\DRIVERS\intelppm.sys Script: Quarantine, Delete, BC delete	Extended Base
k57nd60a Driver: Unload, Delete, Disable	Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0	Running	C:\Windows\system32\DRIVERS\k57nd60a.sys Script: Quarantine, Delete, BC delete	NDIS
kbdclass Driver: Unload, Delete, Disable	Keyboard Class Driver	Running	C:\Windows\system32\DRIVERS\kbdclass.sys Script: Quarantine, Delete, BC delete	Keyboard Class
kbdhid Driver: Unload, Delete, Disable	Keyboard HID Driver	Running	C:\Windows\system32\DRIVERS\kbdhid.sys Script: Quarantine, Delete, BC delete	Keyboard Port
KSecDD Driver: Unload, Delete, Disable	KSecDD	Running	C:\Windows\System32\Drivers\ksecdd.sys Script: Quarantine, Delete, BC delete	Base
KSecPkg Driver: Unload, Delete, Disable	KSecPkg	Running	C:\Windows\System32\Drivers\ksecpkg.sys Script: Quarantine, Delete, BC delete	Cryptography
ksthunk Driver: Unload, Delete, Disable	Kernel Streaming Thunks	Running	C:\Windows\system32\drivers\ksthunk.sys Script: Quarantine, Delete, BC delete	PNP Filter
lltdio Driver: Unload, Delete, Disable	Link-Layer Topology Discovery Mapper I/O Driver	Running	C:\Windows\system32\DRIVERS\lltdio.sys Script: Quarantine, Delete, BC delete	NDIS
luafv Driver: Unload, Delete, Disable	UAC File Virtualization	Running	C:\Windows\system32\drivers\luafv.sys Script: Quarantine, Delete, BC delete	FSFilter Virtualization	FltMgr
mfeapfk Driver: Unload, Delete, Disable	McAfee Inc. mfeapfk	Running	C:\Windows\system32\drivers\mfeapfk.sys Script: Quarantine, Delete, BC delete
mfeavfk Driver: Unload, Delete, Disable	McAfee Inc. mfeavfk	Running	C:\Windows\system32\drivers\mfeavfk.sys Script: Quarantine, Delete, BC delete
mfefirek Driver: Unload, Delete, Disable	McAfee Inc. mfefirek	Running	C:\Windows\system32\drivers\mfefirek.sys Script: Quarantine, Delete, BC delete
mfehidk Driver: Unload, Delete, Disable	McAfee Inc. mfehidk	Running	C:\Windows\system32\drivers\mfehidk.sys Script: Quarantine, Delete, BC delete	FSFilter Anti-Virus
mfenlfk Driver: Unload, Delete, Disable	McAfee NDIS Light Filter	Running	C:\Windows\system32\DRIVERS\mfenlfk.sys Script: Quarantine, Delete, BC delete	NDIS
mfewfpk Driver: Unload, Delete, Disable	McAfee Inc. mfewfpk	Running	C:\Windows\system32\drivers\mfewfpk.sys Script: Quarantine, Delete, BC delete	PNP_TDI	Tcpip
monitor Driver: Unload, Delete, Disable	Microsoft Monitor Class Function Driver Service	Running	C:\Windows\system32\DRIVERS\monitor.sys Script: Quarantine, Delete, BC delete
mouclass Driver: Unload, Delete, Disable	Mouse Class Driver	Running	C:\Windows\system32\DRIVERS\mouclass.sys Script: Quarantine, Delete, BC delete	Pointer Class
mouhid Driver: Unload, Delete, Disable	Mouse HID Driver	Running	C:\Windows\system32\DRIVERS\mouhid.sys Script: Quarantine, Delete, BC delete	Pointer Port
mountmgr Driver: Unload, Delete, Disable	Mount Point Manager	Running	C:\Windows\System32\drivers\mountmgr.sys Script: Quarantine, Delete, BC delete	System Bus Extender
mpsdrv Driver: Unload, Delete, Disable	Windows Firewall Authorization Driver	Running	C:\Windows\system32\drivers\mpsdrv.sys Script: Quarantine, Delete, BC delete	network
mrxsmb Driver: Unload, Delete, Disable	SMB MiniRedirector Wrapper and Engine	Running	C:\Windows\system32\DRIVERS\mrxsmb.sys Script: Quarantine, Delete, BC delete	Network	rdbss
mrxsmb10 Driver: Unload, Delete, Disable	SMB 1.x MiniRedirector	Running	C:\Windows\system32\DRIVERS\mrxsmb10.sys Script: Quarantine, Delete, BC delete	Network	mrxsmb
mrxsmb20 Driver: Unload, Delete, Disable	SMB 2.0 MiniRedirector	Running	C:\Windows\system32\DRIVERS\mrxsmb20.sys Script: Quarantine, Delete, BC delete	Network	mrxsmb
Msfs Driver: Unload, Delete, Disable	Msfs	Running	Msfs.sys Script: Quarantine, Delete, BC delete	File system
msisadrv Driver: Unload, Delete, Disable	msisadrv	Running	C:\Windows\system32\DRIVERS\msisadrv.sys Script: Quarantine, Delete, BC delete	Boot Bus Extender
mssmbios Driver: Unload, Delete, Disable	Microsoft System Management BIOS Driver	Running	C:\Windows\system32\DRIVERS\mssmbios.sys Script: Quarantine, Delete, BC delete
Mup Driver: Unload, Delete, Disable	Mup	Running	C:\Windows\System32\Drivers\mup.sys Script: Quarantine, Delete, BC delete	Network
NativeWifiP Driver: Unload, Delete, Disable	NativeWiFi Filter	Running	C:\Windows\system32\DRIVERS\nwifi.sys Script: Quarantine, Delete, BC delete	NDIS
NDIS Driver: Unload, Delete, Disable	NDIS System Driver	Running	C:\Windows\system32\drivers\ndis.sys Script: Quarantine, Delete, BC delete	NDIS Wrapper
NdisTapi Driver: Unload, Delete, Disable	Remote Access NDIS TAPI Driver	Running	C:\Windows\system32\DRIVERS\ndistapi.sys Script: Quarantine, Delete, BC delete
Ndisuio Driver: Unload, Delete, Disable	NDIS Usermode I/O Protocol	Running	C:\Windows\system32\DRIVERS\ndisuio.sys Script: Quarantine, Delete, BC delete	NDIS
NdisWan Driver: Unload, Delete, Disable	Remote Access NDIS WAN Driver	Running	C:\Windows\system32\DRIVERS\ndiswan.sys Script: Quarantine, Delete, BC delete
NDProxy Driver: Unload, Delete, Disable	NDIS Proxy	Running	NDProxy.sys Script: Quarantine, Delete, BC delete	PNP_TDI
NetBIOS Driver: Unload, Delete, Disable	NetBIOS Interface	Running	C:\Windows\system32\DRIVERS\netbios.sys Script: Quarantine, Delete, BC delete	NetBIOSGroup
NetBT Driver: Unload, Delete, Disable	NetBT	Running	C:\Windows\system32\DRIVERS\netbt.sys Script: Quarantine, Delete, BC delete	PNP_TDI	Tdx
Npfs Driver: Unload, Delete, Disable	Npfs	Running	Npfs.sys Script: Quarantine, Delete, BC delete	File system
nsiproxy Driver: Unload, Delete, Disable	NSI proxy service driver.	Running	C:\Windows\system32\drivers\nsiproxy.sys Script: Quarantine, Delete, BC delete
Ntfs Driver: Unload, Delete, Disable	Ntfs	Running	Ntfs.sys Script: Quarantine, Delete, BC delete	Boot File System
Null Driver: Unload, Delete, Disable	Null	Running	Null.sys Script: Quarantine, Delete, BC delete	Base
partmgr Driver: Unload, Delete, Disable	Partition Manager	Running	C:\Windows\System32\drivers\partmgr.sys Script: Quarantine, Delete, BC delete	Boot Bus Extender
pci Driver: Unload, Delete, Disable	PCI Bus Driver	Running	C:\Windows\system32\DRIVERS\pci.sys Script: Quarantine, Delete, BC delete	Boot Bus Extender
pciide Driver: Unload, Delete, Disable	pciide	Running	C:\Windows\system32\DRIVERS\pciide.sys Script: Quarantine, Delete, BC delete	System Bus Extender
pcw Driver: Unload, Delete, Disable	Performance Counters for Windows Driver	Running	C:\Windows\System32\drivers\pcw.sys Script: Quarantine, Delete, BC delete	Base
PEAUTH Driver: Unload, Delete, Disable	PEAUTH	Running	C:\Windows\system32\drivers\peauth.sys Script: Quarantine, Delete, BC delete
PptpMiniport Driver: Unload, Delete, Disable	WAN Miniport (PPTP)	Running	C:\Windows\system32\DRIVERS\raspptp.sys Script: Quarantine, Delete, BC delete
Psched Driver: Unload, Delete, Disable	QoS Packet Scheduler	Running	C:\Windows\system32\DRIVERS\pacer.sys Script: Quarantine, Delete, BC delete	NDIS
PxHlpa64 Driver: Unload, Delete, Disable	PxHlpa64	Running	C:\Windows\System32\Drivers\PxHlpa64.sys Script: Quarantine, Delete, BC delete	Filter
RasAgileVpn Driver: Unload, Delete, Disable	WAN Miniport (IKEv2)	Running	C:\Windows\system32\DRIVERS\AgileVpn.sys Script: Quarantine, Delete, BC delete
Rasl2tp Driver: Unload, Delete, Disable	WAN Miniport (L2TP)	Running	C:\Windows\system32\DRIVERS\rasl2tp.sys Script: Quarantine, Delete, BC delete
RasPppoe Driver: Unload, Delete, Disable	Remote Access PPPOE Driver	Running	C:\Windows\system32\DRIVERS\raspppoe.sys Script: Quarantine, Delete, BC delete
RasSstp Driver: Unload, Delete, Disable	WAN Miniport (SSTP)	Running	C:\Windows\system32\DRIVERS\rassstp.sys Script: Quarantine, Delete, BC delete
rdbss Driver: Unload, Delete, Disable	Redirected Buffering Sub Sysytem	Running	C:\Windows\system32\DRIVERS\rdbss.sys Script: Quarantine, Delete, BC delete	Network	Mup
RDPCDD Driver: Unload, Delete, Disable	RDPCDD	Running	C:\Windows\system32\DRIVERS\RDPCDD.sys Script: Quarantine, Delete, BC delete	Video Save
RDPENCDD Driver: Unload, Delete, Disable	RDP Encoder Mirror Driver	Running	C:\Windows\system32\drivers\rdpencdd.sys Script: Quarantine, Delete, BC delete	Video Save
RDPREFMP Driver: Unload, Delete, Disable	Reflector Display Driver used to gain access to graphics data	Running	C:\Windows\system32\drivers\rdprefmp.sys Script: Quarantine, Delete, BC delete	Video Save
rdyboost Driver: Unload, Delete, Disable	ReadyBoost	Running	C:\Windows\System32\drivers\rdyboost.sys Script: Quarantine, Delete, BC delete	PnP Filter
rspndr Driver: Unload, Delete, Disable	Link-Layer Topology Discovery Responder	Running	C:\Windows\system32\DRIVERS\rspndr.sys Script: Quarantine, Delete, BC delete	NDIS
secdrv Driver: Unload, Delete, Disable	Security Driver	Running	secdrv.sys Script: Quarantine, Delete, BC delete
setup_9.0.0.722_29.06.2011_01-12drv Driver: Unload, Delete, Disable	setup_9.0.0.722_29.06.2011_01-12drv	Running	C:\Windows\system32\DRIVERS\9020797.sys Script: Quarantine, Delete, BC delete	FSFilter Activity Monitor	FltMgr
spldr Driver: Unload, Delete, Disable	Security Processor Loader Driver	Running	spldr.sys Script: Quarantine, Delete, BC delete
srv Driver: Unload, Delete, Disable	Server SMB 1.xxx Driver	Running	C:\Windows\system32\DRIVERS\srv.sys Script: Quarantine, Delete, BC delete	Network	srv2
srv2 Driver: Unload, Delete, Disable	Server SMB 2.xxx Driver	Running	C:\Windows\system32\DRIVERS\srv2.sys Script: Quarantine, Delete, BC delete	Network	srvnet
srvnet Driver: Unload, Delete, Disable	srvnet	Running	C:\Windows\system32\DRIVERS\srvnet.sys Script: Quarantine, Delete, BC delete	Network
swenum Driver: Unload, Delete, Disable	Software Bus Driver	Running	C:\Windows\system32\DRIVERS\swenum.sys Script: Quarantine, Delete, BC delete
Tcpip Driver: Unload, Delete, Disable	TCP/IP Protocol Driver	Running	C:\Windows\system32\drivers\tcpip.sys Script: Quarantine, Delete, BC delete	PNP_TDI
tcpipreg Driver: Unload, Delete, Disable	TCP/IP Registry Compatibility	Running	C:\Windows\system32\drivers\tcpipreg.sys Script: Quarantine, Delete, BC delete		tcpip
tdx Driver: Unload, Delete, Disable	NetIO Legacy TDI Support Driver	Running	C:\Windows\system32\DRIVERS\tdx.sys Script: Quarantine, Delete, BC delete	PNP_TDI	Tcpip
TermDD Driver: Unload, Delete, Disable	Terminal Device Driver	Running	C:\Windows\system32\DRIVERS\termdd.sys Script: Quarantine, Delete, BC delete
tunnel Driver: Unload, Delete, Disable	Microsoft Tunnel Miniport Adapter Driver	Running	C:\Windows\system32\DRIVERS\tunnel.sys Script: Quarantine, Delete, BC delete	NDIS
umbus Driver: Unload, Delete, Disable	UMBus Enumerator Driver	Running	C:\Windows\system32\DRIVERS\umbus.sys Script: Quarantine, Delete, BC delete	Extended Base
usbehci Driver: Unload, Delete, Disable	Microsoft USB 2.0 Enhanced Host Controller Miniport Driver	Running	C:\Windows\system32\drivers\usbehci.sys Script: Quarantine, Delete, BC delete	Base
usbhub Driver: Unload, Delete, Disable	Microsoft USB Standard Hub Driver	Running	C:\Windows\system32\DRIVERS\usbhub.sys Script: Quarantine, Delete, BC delete	Base
USBSTOR Driver: Unload, Delete, Disable	USB Mass Storage Driver	Running	C:\Windows\system32\DRIVERS\USBSTOR.SYS Script: Quarantine, Delete, BC delete
vdrvroot Driver: Unload, Delete, Disable	Microsoft Virtual Drive Enumerator Driver	Running	C:\Windows\system32\DRIVERS\vdrvroot.sys Script: Quarantine, Delete, BC delete	Boot Bus Extender
VgaSave Driver: Unload, Delete, Disable	VgaSave	Running	C:\Windows\System32\drivers\vga.sys Script: Quarantine, Delete, BC delete	Video Save
volmgr Driver: Unload, Delete, Disable	Volume Manager Driver	Running	C:\Windows\system32\DRIVERS\volmgr.sys Script: Quarantine, Delete, BC delete	System Bus Extender
volmgrx Driver: Unload, Delete, Disable	Dynamic Volume Manager	Running	C:\Windows\System32\drivers\volmgrx.sys Script: Quarantine, Delete, BC delete	System Bus Extender
volsnap Driver: Unload, Delete, Disable	Storage volumes	Running	C:\Windows\system32\DRIVERS\volsnap.sys Script: Quarantine, Delete, BC delete
vwififlt Driver: Unload, Delete, Disable	Virtual WiFi Filter Driver	Running	C:\Windows\system32\DRIVERS\vwififlt.sys Script: Quarantine, Delete, BC delete	NDIS
Wanarpv6 Driver: Unload, Delete, Disable	Remote Access IPv6 ARP Driver	Running	C:\Windows\system32\DRIVERS\wanarp.sys Script: Quarantine, Delete, BC delete
Wdf01000 Driver: Unload, Delete, Disable	Kernel Mode Driver Frameworks service	Running	C:\Windows\system32\drivers\Wdf01000.sys Script: Quarantine, Delete, BC delete	WdfLoadGroup
WfpLwf Driver: Unload, Delete, Disable	WFP Lightweight Filter	Running	C:\Windows\system32\DRIVERS\wfplwf.sys Script: Quarantine, Delete, BC delete	NDIS
WudfPf Driver: Unload, Delete, Disable	User Mode Driver Frameworks Platform Driver	Running	C:\Windows\system32\drivers\WudfPf.sys Script: Quarantine, Delete, BC delete	base
1394ohci Driver: Unload, Delete, Disable	1394 OHCI Compliant Host Controller	Not started	C:\Windows\system32\DRIVERS\1394ohci.sys Script: Quarantine, Delete, BC delete
AcpiPmi Driver: Unload, Delete, Disable	ACPI Power Meter Driver	Not started	C:\Windows\system32\DRIVERS\acpipmi.sys Script: Quarantine, Delete, BC delete
adp94xx Driver: Unload, Delete, Disable	adp94xx	Not started	C:\Windows\system32\DRIVERS\adp94xx.sys Script: Quarantine, Delete, BC delete	SCSI Miniport
adpahci Driver: Unload, Delete, Disable	adpahci	Not started	C:\Windows\system32\DRIVERS\adpahci.sys Script: Quarantine, Delete, BC delete	SCSI Miniport
adpu320 Driver: Unload, Delete, Disable	adpu320	Not started	C:\Windows\system32\DRIVERS\adpu320.sys Script: Quarantine, Delete, BC delete	SCSI Miniport
agp440 Driver: Unload, Delete, Disable	Intel AGP Bus Filter	Not started	C:\Windows\system32\DRIVERS\agp440.sys Script: Quarantine, Delete, BC delete	PnP Filter
aliide Driver: Unload, Delete, Disable	aliide	Not started	C:\Windows\system32\DRIVERS\aliide.sys Script: Quarantine, Delete, BC delete	System Bus Extender
amdide Driver: Unload, Delete, Disable	amdide	Not started	C:\Windows\system32\DRIVERS\amdide.sys Script: Quarantine, Delete, BC delete	System Bus Extender
AmdK8 Driver: Unload, Delete, Disable	AMD K8 Processor Driver	Not started	C:\Windows\system32\DRIVERS\amdk8.sys Script: Quarantine, Delete, BC delete	Extended Base
AmdPPM Driver: Unload, Delete, Disable	AMD Processor Driver	Not started	C:\Windows\system32\DRIVERS\amdppm.sys Script: Quarantine, Delete, BC delete	Extended Base
amdsata Driver: Unload, Delete, Disable	amdsata	Not started	C:\Windows\system32\drivers\amdsata.sys Script: Quarantine, Delete, BC delete	SCSI miniport
amdsbs Driver: Unload, Delete, Disable	amdsbs	Not started	C:\Windows\system32\DRIVERS\amdsbs.sys Script: Quarantine, Delete, BC delete	SCSI Miniport
AppID Driver: Unload, Delete, Disable	AppID Driver	Not started	C:\Windows\system32\drivers\appid.sys Script: Quarantine, Delete, BC delete		FltMgr
arc Driver: Unload, Delete, Disable	arc	Not started	C:\Windows\system32\DRIVERS\arc.sys Script: Quarantine, Delete, BC delete	SCSI Miniport
arcsas Driver: Unload, Delete, Disable	arcsas	Not started	C:\Windows\system32\DRIVERS\arcsas.sys Script: Quarantine, Delete, BC delete	SCSI miniport
AsyncMac Driver: Unload, Delete, Disable	RAS Asynchronous Media Driver	Not started	C:\Windows\system32\DRIVERS\asyncmac.sys Script: Quarantine, Delete, BC delete
b06bdrv Driver: Unload, Delete, Disable	Broadcom NetXtreme II VBD	Not started	C:\Windows\system32\DRIVERS\bxvbda.sys Script: Quarantine, Delete, BC delete	base
b57nd60a Driver: Unload, Delete, Disable	Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0	Not started	C:\Windows\system32\DRIVERS\b57nd60a.sys Script: Quarantine, Delete, BC delete	NDIS
BrFiltLo Driver: Unload, Delete, Disable	Brother USB Mass-Storage Lower Filter Driver	Not started	C:\Windows\system32\DRIVERS\BrFiltLo.sys Script: Quarantine, Delete, BC delete	extended base
BrFiltUp Driver: Unload, Delete, Disable	Brother USB Mass-Storage Upper Filter Driver	Not started	C:\Windows\system32\DRIVERS\BrFiltUp.sys Script: Quarantine, Delete, BC delete	extended base
Brserid Driver: Unload, Delete, Disable	Brother MFC Serial Port Interface Driver (WDM)	Not started	C:\Windows\System32\Drivers\Brserid.sys Script: Quarantine, Delete, BC delete
BrSerWdm Driver: Unload, Delete, Disable	Brother WDM Serial driver	Not started	C:\Windows\System32\Drivers\BrSerWdm.sys Script: Quarantine, Delete, BC delete
BrUsbMdm Driver: Unload, Delete, Disable	Brother MFC USB Fax Only Modem	Not started	C:\Windows\System32\Drivers\BrUsbMdm.sys Script: Quarantine, Delete, BC delete
BrUsbSer Driver: Unload, Delete, Disable	Brother MFC USB Serial WDM Driver	Not started	C:\Windows\System32\Drivers\BrUsbSer.sys Script: Quarantine, Delete, BC delete
BTHMODEM Driver: Unload, Delete, Disable	Bluetooth Serial Communications Driver	Not started	C:\Windows\system32\DRIVERS\bthmodem.sys Script: Quarantine, Delete, BC delete
cdfs Driver: Unload, Delete, Disable	CD/DVD File System Reader	Not started	C:\Windows\system32\DRIVERS\cdfs.sys Script: Quarantine, Delete, BC delete	Boot File System	+SCSI CDROM Class
circlass Driver: Unload, Delete, Disable	Consumer IR Devices	Not started	C:\Windows\system32\DRIVERS\circlass.sys Script: Quarantine, Delete, BC delete	Extended Base
CmBatt Driver: Unload, Delete, Disable	Microsoft ACPI Control Method Battery Driver	Not started	C:\Windows\system32\DRIVERS\CmBatt.sys Script: Quarantine, Delete, BC delete
cmdide Driver: Unload, Delete, Disable	cmdide	Not started	C:\Windows\system32\DRIVERS\cmdide.sys Script: Quarantine, Delete, BC delete	System Bus Extender
Compbatt Driver: Unload, Delete, Disable	Compbatt	Not started	C:\Windows\system32\DRIVERS\compbatt.sys Script: Quarantine, Delete, BC delete	System Bus Extender
crcdisk Driver: Unload, Delete, Disable	Crcdisk Filter Driver	Not started	C:\Windows\system32\DRIVERS\crcdisk.sys Script: Quarantine, Delete, BC delete	Pnp Filter
Dot4 Driver: Unload, Delete, Disable	MS IEEE-1284.4 Driver	Not started	C:\Windows\system32\DRIVERS\Dot4.sys Script: Quarantine, Delete, BC delete
Dot4Print Driver: Unload, Delete, Disable	Print Class Driver for IEEE-1284.4	Not started	C:\Windows\system32\DRIVERS\Dot4Prt.sys Script: Quarantine, Delete, BC delete
dot4usb Driver: Unload, Delete, Disable	MS Dot4USB Filter Dot4USB Filter	Not started	C:\Windows\system32\DRIVERS\dot4usb.sys Script: Quarantine, Delete, BC delete	extended base
drmkaud Driver: Unload, Delete, Disable	Microsoft Trusted Audio Drivers	Not started	C:\Windows\system32\drivers\drmkaud.sys Script: Quarantine, Delete, BC delete
ebdrv Driver: Unload, Delete, Disable	Broadcom NetXtreme II 10 GigE VBD	Not started	C:\Windows\system32\DRIVERS\evbda.sys Script: Quarantine, Delete, BC delete	base
elxstor Driver: Unload, Delete, Disable	elxstor	Not started	C:\Windows\system32\DRIVERS\elxstor.sys Script: Quarantine, Delete, BC delete	SCSI Miniport
ErrDev Driver: Unload, Delete, Disable	Microsoft Hardware Error Device Driver	Not started	C:\Windows\system32\DRIVERS\errdev.sys Script: Quarantine, Delete, BC delete	Extended Base
exfat Driver: Unload, Delete, Disable	exFAT File System Driver	Not started	exfat.sys Script: Quarantine, Delete, BC delete	Boot File System
fdc Driver: Unload, Delete, Disable	Floppy Disk Controller Driver	Not started	C:\Windows\system32\DRIVERS\fdc.sys Script: Quarantine, Delete, BC delete
Filetrace Driver: Unload, Delete, Disable	Filetrace	Not started	C:\Windows\system32\drivers\filetrace.sys Script: Quarantine, Delete, BC delete	FSFilter Activity Monitor	FltMgr
flpydisk Driver: Unload, Delete, Disable	Floppy Disk Driver	Not started	C:\Windows\system32\DRIVERS\flpydisk.sys Script: Quarantine, Delete, BC delete
FsDepends Driver: Unload, Delete, Disable	File System Dependency Minifilter	Not started	C:\Windows\system32\drivers\FsDepends.sys Script: Quarantine, Delete, BC delete	Filter	fltmgr
fssfltr Driver: Unload, Delete, Disable	fssfltr	Not started	C:\Windows\system32\DRIVERS\fssfltr.sys Script: Quarantine, Delete, BC delete	NDIS	tcpip
gagp30kx Driver: Unload, Delete, Disable	Microsoft Generic AGPv3.0 Filter for K8 Processor Platforms	Not started	C:\Windows\system32\DRIVERS\gagp30kx.sys Script: Quarantine, Delete, BC delete	PnP Filter
hcw85cir Driver: Unload, Delete, Disable	Hauppauge Consumer Infrared Receiver	Not started	C:\Windows\system32\drivers\hcw85cir.sys Script: Quarantine, Delete, BC delete	Extended Base
HidBatt Driver: Unload, Delete, Disable	HID UPS Battery Driver	Not started	C:\Windows\system32\DRIVERS\HidBatt.sys Script: Quarantine, Delete, BC delete
HidBth Driver: Unload, Delete, Disable	Microsoft Bluetooth HID Miniport	Not started	C:\Windows\system32\DRIVERS\hidbth.sys Script: Quarantine, Delete, BC delete	extended base
HidIr Driver: Unload, Delete, Disable	Microsoft Infrared HID Driver	Not started	C:\Windows\system32\DRIVERS\hidir.sys Script: Quarantine, Delete, BC delete	extended base
HpSAMD Driver: Unload, Delete, Disable	HpSAMD	Not started	C:\Windows\system32\DRIVERS\HpSAMD.sys Script: Quarantine, Delete, BC delete	SCSI Miniport
i8042prt Driver: Unload, Delete, Disable	i8042 Keyboard and PS/2 Mouse Port Driver	Not started	C:\Windows\system32\DRIVERS\i8042prt.sys Script: Quarantine, Delete, BC delete	Keyboard Port
iaStorV Driver: Unload, Delete, Disable	Intel RAID Controller Windows 7	Not started	C:\Windows\system32\drivers\iaStorV.sys Script: Quarantine, Delete, BC delete	SCSI Miniport
iirsp Driver: Unload, Delete, Disable	iirsp	Not started	C:\Windows\system32\DRIVERS\iirsp.sys Script: Quarantine, Delete, BC delete	SCSI Miniport
intelide Driver: Unload, Delete, Disable	intelide	Not started	C:\Windows\system32\DRIVERS\intelide.sys Script: Quarantine, Delete, BC delete	System Bus Extender
IpFilterDriver Driver: Unload, Delete, Disable	IP Traffic Filter Driver	Not started	C:\Windows\system32\DRIVERS\ipfltdrv.sys Script: Quarantine, Delete, BC delete	PNP_TDI	Tcpip
IPMIDRV Driver: Unload, Delete, Disable	IPMIDRV	Not started	C:\Windows\system32\DRIVERS\IPMIDrv.sys Script: Quarantine, Delete, BC delete
IPNAT Driver: Unload, Delete, Disable	IP Network Address Translator	Not started	C:\Windows\system32\drivers\ipnat.sys Script: Quarantine, Delete, BC delete		Tcpip
IRENUM Driver: Unload, Delete, Disable	IR Bus Enumerator	Not started	C:\Windows\system32\drivers\irenum.sys Script: Quarantine, Delete, BC delete
isapnp Driver: Unload, Delete, Disable	isapnp	Not started	C:\Windows\system32\DRIVERS\isapnp.sys Script: Quarantine, Delete, BC delete	Boot Bus Extender
iScsiPrt Driver: Unload, Delete, Disable	iScsiPort Driver	Not started	C:\Windows\system32\DRIVERS\msiscsi.sys Script: Quarantine, Delete, BC delete
LSI_FC Driver: Unload, Delete, Disable	LSI_FC	Not started	C:\Windows\system32\DRIVERS\lsi_fc.sys Script: Quarantine, Delete, BC delete	SCSI Miniport
LSI_SAS Driver: Unload, Delete, Disable	LSI_SAS	Not started	C:\Windows\system32\DRIVERS\lsi_sas.sys Script: Quarantine, Delete, BC delete	SCSI Miniport
LSI_SAS2 Driver: Unload, Delete, Disable	LSI_SAS2	Not started	C:\Windows\system32\DRIVERS\lsi_sas2.sys Script: Quarantine, Delete, BC delete	SCSI Miniport
LSI_SCSI Driver: Unload, Delete, Disable	LSI_SCSI	Not started	C:\Windows\system32\DRIVERS\lsi_scsi.sys Script: Quarantine, Delete, BC delete	SCSI Miniport
megasas Driver: Unload, Delete, Disable	megasas	Not started	C:\Windows\system32\DRIVERS\megasas.sys Script: Quarantine, Delete, BC delete	SCSI Miniport
MegaSR Driver: Unload, Delete, Disable	MegaSR	Not started	C:\Windows\system32\DRIVERS\MegaSR.sys Script: Quarantine, Delete, BC delete	SCSI Miniport
mferkdet Driver: Unload, Delete, Disable	McAfee Inc. mferkdet	Not started	C:\Windows\system32\drivers\mferkdet.sys Script: Quarantine, Delete, BC delete
Modem Driver: Unload, Delete, Disable	Modem	Not started	C:\Windows\system32\drivers\modem.sys Script: Quarantine, Delete, BC delete	Extended base
mpio Driver: Unload, Delete, Disable	mpio	Not started	C:\Windows\system32\DRIVERS\mpio.sys Script: Quarantine, Delete, BC delete	Boot Bus Extender
MRxDAV Driver: Unload, Delete, Disable	WebDav Client Redirector Driver	Not started	C:\Windows\system32\drivers\mrxdav.sys Script: Quarantine, Delete, BC delete		rdbss
msahci Driver: Unload, Delete, Disable	msahci	Not started	C:\Windows\system32\DRIVERS\msahci.sys Script: Quarantine, Delete, BC delete	SCSI Miniport
msdsm Driver: Unload, Delete, Disable	msdsm	Not started	C:\Windows\system32\DRIVERS\msdsm.sys Script: Quarantine, Delete, BC delete	System Bus Extender
mshidkmdf Driver: Unload, Delete, Disable	Pass-through HID to KMDF Filter Driver	Not started	C:\Windows\System32\drivers\mshidkmdf.sys Script: Quarantine, Delete, BC delete	Base
MSKSSRV Driver: Unload, Delete, Disable	Microsoft Streaming Service Proxy	Not started	C:\Windows\system32\drivers\MSKSSRV.sys Script: Quarantine, Delete, BC delete	Extended Base
MSPCLOCK Driver: Unload, Delete, Disable	Microsoft Streaming Clock Proxy	Not started	C:\Windows\system32\drivers\MSPCLOCK.sys Script: Quarantine, Delete, BC delete	Extended Base
MSPQM Driver: Unload, Delete, Disable	Microsoft Streaming Quality Manager Proxy	Not started	C:\Windows\system32\drivers\MSPQM.sys Script: Quarantine, Delete, BC delete	Extended Base
MsRPC Driver: Unload, Delete, Disable	MsRPC	Not started	MsRPC.sys Script: Quarantine, Delete, BC delete
MSTEE Driver: Unload, Delete, Disable	Microsoft Streaming Tee/Sink-to-Sink Converter	Not started	C:\Windows\system32\drivers\MSTEE.sys Script: Quarantine, Delete, BC delete	Extended Base
MTConfig Driver: Unload, Delete, Disable	Microsoft Input Configuration Driver	Not started	C:\Windows\system32\DRIVERS\MTConfig.sys Script: Quarantine, Delete, BC delete	Extended Base
NdisCap Driver: Unload, Delete, Disable	NDIS Capture LightWeight Filter	Not started	C:\Windows\system32\DRIVERS\ndiscap.sys Script: Quarantine, Delete, BC delete	NDIS
nfrd960 Driver: Unload, Delete, Disable	nfrd960	Not started	C:\Windows\system32\DRIVERS\nfrd960.sys Script: Quarantine, Delete, BC delete	SCSI Miniport
nv_agp Driver: Unload, Delete, Disable	NVIDIA nForce AGP Bus Filter	Not started	C:\Windows\system32\DRIVERS\nv_agp.sys Script: Quarantine, Delete, BC delete	PnP Filter
nvraid Driver: Unload, Delete, Disable	nvraid	Not started	C:\Windows\system32\drivers\nvraid.sys Script: Quarantine, Delete, BC delete	System Bus Extender
nvstor Driver: Unload, Delete, Disable	nvstor	Not started	C:\Windows\system32\drivers\nvstor.sys Script: Quarantine, Delete, BC delete	SCSI Miniport
ohci1394 Driver: Unload, Delete, Disable	1394 OHCI Compliant Host Controller (Legacy)	Not started	C:\Windows\system32\DRIVERS\ohci1394.sys Script: Quarantine, Delete, BC delete
Parport Driver: Unload, Delete, Disable	Parallel port driver	Not started	C:\Windows\system32\DRIVERS\parport.sys Script: Quarantine, Delete, BC delete	Parallel arbitrator
pcmcia Driver: Unload, Delete, Disable	pcmcia	Not started	C:\Windows\system32\DRIVERS\pcmcia.sys Script: Quarantine, Delete, BC delete	System Bus Extender
Processor Driver: Unload, Delete, Disable	Processor Driver	Not started	C:\Windows\system32\DRIVERS\processr.sys Script: Quarantine, Delete, BC delete	Extended Base
ql2300 Driver: Unload, Delete, Disable	ql2300	Not started	C:\Windows\system32\DRIVERS\ql2300.sys Script: Quarantine, Delete, BC delete	SCSI Miniport
ql40xx Driver: Unload, Delete, Disable	ql40xx	Not started	C:\Windows\system32\DRIVERS\ql40xx.sys Script: Quarantine, Delete, BC delete	SCSI Miniport
QWAVEdrv Driver: Unload, Delete, Disable	QWAVE driver	Not started	C:\Windows\system32\drivers\qwavedrv.sys Script: Quarantine, Delete, BC delete
RasAcd Driver: Unload, Delete, Disable	Remote Access Auto Connection Driver	Not started	C:\Windows\system32\DRIVERS\rasacd.sys Script: Quarantine, Delete, BC delete	Streams Drivers
rdpbus Driver: Unload, Delete, Disable	Remote Desktop Device Redirector Bus Driver	Not started	C:\Windows\system32\DRIVERS\rdpbus.sys Script: Quarantine, Delete, BC delete
RDPWD Driver: Unload, Delete, Disable	RDP Winstation Driver	Not started	RDPWD.sys Script: Quarantine, Delete, BC delete
RTL8187B Driver: Unload, Delete, Disable	NETGEAR WG111v3 Wireless-G USB Adapter Win7 Driver	Not started	C:\Windows\system32\DRIVERS\wg111v3.sys Script: Quarantine, Delete, BC delete	NDIS
sbp2port Driver: Unload, Delete, Disable	sbp2port	Not started	C:\Windows\system32\DRIVERS\sbp2port.sys Script: Quarantine, Delete, BC delete
scfilter Driver: Unload, Delete, Disable	Smart card PnP Class Filter Driver	Not started	C:\Windows\system32\DRIVERS\scfilter.sys Script: Quarantine, Delete, BC delete	PnP Filter
Serenum Driver: Unload, Delete, Disable	Serenum Filter Driver	Not started	C:\Windows\system32\DRIVERS\serenum.sys Script: Quarantine, Delete, BC delete	PNP Filter
Serial Driver: Unload, Delete, Disable	Serial	Not started	C:\Windows\system32\DRIVERS\serial.sys Script: Quarantine, Delete, BC delete	Extended base
sermouse Driver: Unload, Delete, Disable	Serial Mouse Driver	Not started	C:\Windows\system32\DRIVERS\sermouse.sys Script: Quarantine, Delete, BC delete	Pointer Port
sffdisk Driver: Unload, Delete, Disable	SFF Storage Class Driver	Not started	C:\Windows\system32\DRIVERS\sffdisk.sys Script: Quarantine, Delete, BC delete
sffp_mmc Driver: Unload, Delete, Disable	SFF Storage Protocol Driver for MMC	Not started	C:\Windows\system32\DRIVERS\sffp_mmc.sys Script: Quarantine, Delete, BC delete
sffp_sd Driver: Unload, Delete, Disable	SFF Storage Protocol Driver for SDBus	Not started	C:\Windows\system32\DRIVERS\sffp_sd.sys Script: Quarantine, Delete, BC delete
sfloppy Driver: Unload, Delete, Disable	High-Capacity Floppy Disk Drive	Not started	C:\Windows\system32\DRIVERS\sfloppy.sys Script: Quarantine, Delete, BC delete
SiSRaid2 Driver: Unload, Delete, Disable	SiSRaid2	Not started	C:\Windows\system32\DRIVERS\SiSRaid2.sys Script: Quarantine, Delete, BC delete	SCSI Miniport
SiSRaid4 Driver: Unload, Delete, Disable	SiSRaid4	Not started	C:\Windows\system32\DRIVERS\sisraid4.sys Script: Quarantine, Delete, BC delete	SCSI Miniport
Smb Driver: Unload, Delete, Disable	Message-oriented TCP/IP and TCP/IPv6 Protocol (SMB session)	Not started	C:\Windows\system32\DRIVERS\smb.sys Script: Quarantine, Delete, BC delete	PNP_TDI	Tcpip
stexstor Driver: Unload, Delete, Disable	stexstor	Not started	C:\Windows\system32\DRIVERS\stexstor.sys Script: Quarantine, Delete, BC delete	SCSI Miniport
TCPIP6 Driver: Unload, Delete, Disable	Microsoft IPv6 Protocol Driver	Not started	C:\Windows\system32\DRIVERS\tcpip.sys Script: Quarantine, Delete, BC delete		Tcpip
TDPIPE Driver: Unload, Delete, Disable	TDPIPE	Not started	C:\Windows\system32\drivers\tdpipe.sys Script: Quarantine, Delete, BC delete
TDTCP Driver: Unload, Delete, Disable	TDTCP	Not started	C:\Windows\system32\drivers\tdtcp.sys Script: Quarantine, Delete, BC delete
tssecsrv Driver: Unload, Delete, Disable	Remote Desktop Services Security Filter Driver	Not started	C:\Windows\system32\DRIVERS\tssecsrv.sys Script: Quarantine, Delete, BC delete
uagp35 Driver: Unload, Delete, Disable	Microsoft AGPv3.5 Filter	Not started	C:\Windows\system32\DRIVERS\uagp35.sys Script: Quarantine, Delete, BC delete	PnP Filter
udfs Driver: Unload, Delete, Disable	udfs	Not started	C:\Windows\system32\DRIVERS\udfs.sys Script: Quarantine, Delete, BC delete	Boot File System
uliagpkx Driver: Unload, Delete, Disable	Uli AGP Bus Filter	Not started	C:\Windows\system32\DRIVERS\uliagpkx.sys Script: Quarantine, Delete, BC delete	PnP Filter
UmPass Driver: Unload, Delete, Disable	Microsoft UMPass Driver	Not started	C:\Windows\system32\DRIVERS\umpass.sys Script: Quarantine, Delete, BC delete	Extended Base
USB28xxBGA Driver: Unload, Delete, Disable	Roxio Video Capture USB	Not started	C:\Windows\system32\DRIVERS\emBDA64.sys Script: Quarantine, Delete, BC delete
USB28xxOEM Driver: Unload, Delete, Disable	USB 28xx OEM Filter	Not started	C:\Windows\system32\DRIVERS\emOEM64.sys Script: Quarantine, Delete, BC delete
USBAAPL64 Driver: Unload, Delete, Disable	Apple Mobile USB Driver	Not started	C:\Windows\system32\Drivers\usbaapl64.sys Script: Quarantine, Delete, BC delete	Base
usbaudio Driver: Unload, Delete, Disable	USB Audio Driver (WDM)	Not started	C:\Windows\system32\drivers\usbaudio.sys Script: Quarantine, Delete, BC delete
usbccgp Driver: Unload, Delete, Disable	Microsoft USB Generic Parent Driver	Not started	C:\Windows\system32\DRIVERS\usbccgp.sys Script: Quarantine, Delete, BC delete	Base
usbcir Driver: Unload, Delete, Disable	eHome Infrared Receiver (USBCIR)	Not started	C:\Windows\system32\DRIVERS\usbcir.sys Script: Quarantine, Delete, BC delete	Extended Base
usbohci Driver: Unload, Delete, Disable	Microsoft USB Open Host Controller Miniport Driver	Not started	C:\Windows\system32\drivers\usbohci.sys Script: Quarantine, Delete, BC delete	Base
usbprint Driver: Unload, Delete, Disable	Microsoft USB PRINTER Class	Not started	C:\Windows\system32\DRIVERS\usbprint.sys Script: Quarantine, Delete, BC delete	extended base
usbscan Driver: Unload, Delete, Disable	USB Scanner Driver	Not started	C:\Windows\system32\DRIVERS\usbscan.sys Script: Quarantine, Delete, BC delete	Base
usbuhci Driver: Unload, Delete, Disable	Microsoft USB Universal Host Controller Miniport Driver	Not started	C:\Windows\system32\drivers\usbuhci.sys Script: Quarantine, Delete, BC delete	Base
vga Driver: Unload, Delete, Disable	vga	Not started	C:\Windows\system32\DRIVERS\vgapnp.sys Script: Quarantine, Delete, BC delete	Video
vhdmp Driver: Unload, Delete, Disable	vhdmp	Not started	C:\Windows\system32\DRIVERS\vhdmp.sys Script: Quarantine, Delete, BC delete	SCSI miniport
viaide Driver: Unload, Delete, Disable	viaide	Not started	C:\Windows\system32\DRIVERS\viaide.sys Script: Quarantine, Delete, BC delete	System Bus Extender
vsmraid Driver: Unload, Delete, Disable	vsmraid	Not started	C:\Windows\system32\DRIVERS\vsmraid.sys Script: Quarantine, Delete, BC delete	SCSI Miniport
vwifibus Driver: Unload, Delete, Disable	Virtual WiFi Bus Driver	Not started	C:\Windows\System32\drivers\vwifibus.sys Script: Quarantine, Delete, BC delete
WacomPen Driver: Unload, Delete, Disable	Wacom Serial Pen HID Driver	Not started	C:\Windows\system32\DRIVERS\wacompen.sys Script: Quarantine, Delete, BC delete	Extended Base
WANARP Driver: Unload, Delete, Disable	Remote Access IP ARP Driver	Not started	C:\Windows\system32\DRIVERS\wanarp.sys Script: Quarantine, Delete, BC delete
Wd Driver: Unload, Delete, Disable	Wd	Not started	C:\Windows\system32\DRIVERS\wd.sys Script: Quarantine, Delete, BC delete
WDC_SAM Driver: Unload, Delete, Disable	WD SCSI Pass Thru driver	Not started	C:\Windows\system32\DRIVERS\wdcsam64.sys Script: Quarantine, Delete, BC delete
WimFltr Driver: Unload, Delete, Disable	WimFltr	Not started	C:\Windows\system32\DRIVERS\wimfltr.sys Script: Quarantine, Delete, BC delete	FSFilter Compression	FltMgr
WinUsb Driver: Unload, Delete, Disable	WinUSB Service	Not started	C:\Windows\system32\DRIVERS\WinUsb.sys Script: Quarantine, Delete, BC delete	Base
WmiAcpi Driver: Unload, Delete, Disable	Microsoft Windows Management Interface for ACPI	Not started	C:\Windows\system32\DRIVERS\wmiacpi.sys Script: Quarantine, Delete, BC delete	Extended Base
ws2ifsl Driver: Unload, Delete, Disable	Winsock IFS Driver	Not started	C:\Windows\system32\drivers\ws2ifsl.sys Script: Quarantine, Delete, BC delete	PNP_TDI
Detected - 263, recognized as trusted - 4

Autoruns

File name	Status	Startup method	Description
C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, AmazonGSDownloaderTray Delete
C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, DellSupportCenter Delete
C:\Program Files (x86)\Dell\DellDock\DellDock.exe Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	C:\Users\Cathy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\, C:\Users\Cathy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk,
C:\Program Files (x86)\\DVD Maker\DVDMaker.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Dvd Maker, EventMessageFile Delete
C:\Program Files (x86)\\Windows Defender\MpEvMsg.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\WinDefend, EventMessageFile Delete
C:\Program Files (x86)\\Windows Defender\mpsvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinDefend\Parameters, ServiceDll Delete
C:\Windows\System32\Audiosrv.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AudioEndpointBuilder\Parameters, ServiceDll Delete
C:\Windows\System32\Audiosrv.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AudioSrv\Parameters, ServiceDll Delete
C:\Windows\System32\AxInstSV.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AxInstSV\Parameters, ServiceDll Delete
C:\Windows\System32\AxInstSv.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-AxInstallService, EventMessageFile Delete
C:\Windows\System32\DFDTS.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Windows Disk Diagnostic, EventMessageFile Delete
C:\Windows\System32\DispCI.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Display, EventMessageFile Delete
C:\Windows\System32\RpcEpMap.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\RpcEptMapper\Parameters, ServiceDll Delete
C:\Windows\System32\SCardSvr.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\SCardSvr\Parameters, ServiceDll Delete
C:\Windows\System32\TabSvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\TabletInputService\Parameters, ServiceDll Delete
C:\Windows\System32\UI0Detect.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Interactive Services detection, EventMessageFile Delete
C:\Windows\System32\VSSVC.EXE Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Security\VSSAudit, EventMessageFile Delete
C:\Windows\System32\WUDFSvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\wudfsvc\Parameters, ServiceDll Delete
C:\Windows\System32\aelupsvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AeLookupSvc\Parameters, ServiceDll Delete
C:\Windows\System32\aelupsvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\AeLookupSvc, EventMessageFile Delete
C:\Windows\System32\appidsvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AppIDSvc\Parameters, ServiceDll Delete
C:\Windows\System32\appinfo.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Appinfo\Parameters, ServiceDll Delete
C:\Windows\System32\bfe.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\BFE\Parameters, ServiceDll Delete
C:\Windows\System32\browser.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Browser\Parameters, ServiceDll Delete
C:\Windows\System32\certprop.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\CertPropSvc\Parameters, ServiceDll Delete
C:\Windows\System32\certprop.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\SCPolicySvc\Parameters, ServiceDll Delete
C:\Windows\System32\dnsrslvr.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Dnscache\Parameters, ServiceDll Delete
C:\Windows\System32\dot3svc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\dot3svc\Parameters, ServiceDll Delete
C:\Windows\System32\drivers\fltmgr.sys;C:\Windows\System32\IoLogMsg.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\FltMgr, EventMessageFile Delete
C:\Windows\System32\drivers\ipmidrv.sys Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPMIDRV, EventMessageFile Delete
C:\Windows\System32\drivers\wd.sys Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Wd, EventMessageFile Delete
C:\Windows\System32\gpsvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\gpsvc\Parameters, ServiceDll Delete
C:\Windows\System32\ikeext.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\IKEEXT\Parameters, ServiceDll Delete
C:\Windows\System32\iphlpsvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters, ServiceDll Delete
C:\Windows\System32\ipnathlp.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters, ServiceDll Delete
C:\Windows\System32\ipsecsvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\PolicyAgent\Parameters, ServiceDll Delete
C:\Windows\System32\iscsiexe.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\MSiSCSI, EventMessageFile Delete
C:\Windows\System32\iscsilog.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\iScsiPrt, EventMessageFile Delete
C:\Windows\System32\lltdsvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\lltdsvc\Parameters, ServiceDll Delete
C:\Windows\System32\lmhsvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\lmhosts\Parameters, ServiceDll Delete
C:\Windows\System32\lsasrv.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\LsaSrv, EventMessageFile Delete
C:\Windows\System32\lsasrv.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Schannel, EventMessageFile Delete
C:\Windows\System32\mctadmin.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce, mctadmin Delete
C:\Windows\System32\mctadmin.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce, mctadmin Delete
C:\Windows\System32\mdsched.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-MemoryDiagnostics-Schedule, EventMessageFile Delete
C:\Windows\System32\netman.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Netman\Parameters, ServiceDll Delete
C:\Windows\System32\nlasvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters, ServiceDll Delete
C:\Windows\System32\pcasvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\PcaSvc\Parameters, ServiceDll Delete
C:\Windows\System32\profsvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-User Profiles Service, EventMessageFile Delete
C:\Windows\System32\profsvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Profsvc, EventMessageFile Delete
C:\Windows\System32\qmgr.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\BITS\Parameters, ServiceDll Delete
C:\Windows\System32\rasauto.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\RasAuto\Parameters, ServiceDll Delete
C:\Windows\System32\rasmans.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\RasMan\Parameters, ServiceDll Delete
C:\Windows\System32\relpost.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-MemoryDiagnostics-Results, EventMessageFile Delete
C:\Windows\System32\samsrv.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Directory-Services-SAM, EventMessageFile Delete
C:\Windows\System32\samsrv.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\SAM, EventMessageFile Delete
C:\Windows\System32\snmptrap.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\SNMPTRAP, EventMessageFile Delete
C:\Windows\System32\ssdpsrv.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\SSDPSRV\Parameters, ServiceDll Delete
C:\Windows\System32\sstpsvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-RasSstp, EventMessageFile Delete
C:\Windows\System32\swprv.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\swprv\Parameters, ServiceDll Delete
C:\Windows\System32\tcpmon.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\TCPMon, EventMessageFile Delete
C:\Windows\System32\termsrv.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\TermService\Parameters, ServiceDll Delete
C:\Windows\System32\trkwks.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\TrkWks\Parameters, ServiceDll Delete
C:\Windows\System32\umpnpmgr.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PlugPlayManager, EventMessageFile Delete
C:\Windows\System32\umpo.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Power, EventMessageFile Delete
C:\Windows\System32\uxsms.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\UxSms\Parameters, ServiceDll Delete
C:\Windows\System32\wbiosrvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WbioSrvc\Parameters, ServiceDll Delete
C:\Windows\System32\wercplsupport.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\wercplsupport\Parameters, ServiceDll Delete
C:\Windows\System32\wersvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Application Hang, EventMessageFile Delete
C:\Windows\System32\wevtsvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Security\Microsoft-Windows-Eventlog, EventMessageFile Delete
C:\Windows\System32\wevtsvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Eventlog, EventMessageFile Delete
C:\Windows\System32\wiaservc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\stisvc\Parameters, ServiceDll Delete
C:\Windows\System32\wiaservc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\StillImage, EventMessageFile Delete
C:\Windows\System32\win32k.sys Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Kmode
C:\Windows\System32\winlogon.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Winlogon, EventMessageFile Delete
C:\Windows\System32\winlogon.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Wlclntfy, EventMessageFile Delete
C:\Windows\System32\wkssvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters, ServiceDll Delete
C:\Windows\System32\wlansvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Wlansvc\Parameters, ServiceDll Delete
C:\Windows\System32\wscsvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\wscsvc\Parameters, ServiceDll Delete
C:\Windows\System32\wscsvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\SecurityCenter, EventMessageFile Delete
C:\Windows\System32\wwansvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WwanSvc\Parameters, ServiceDll Delete
C:\Windows\system32\BlbEvents.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-Backup, EventMessageFile Delete
C:\Windows\system32\FntCache.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\FontCache\Parameters, ServiceDll Delete
C:\Windows\system32\HPZinw12.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Net Driver HPZ12\Parameters, ServiceDll Delete
C:\Windows\system32\HPZipm12.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Pml Driver HPZ12\Parameters, ServiceDll Delete
C:\Windows\system32\ListSvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\HomeGroupListener\Parameters, ServiceDll Delete
C:\Windows\system32\Mcx2Svc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Mcx2Svc\Parameters, ServiceDll Delete
C:\Windows\system32\WINSAT.EXE Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-WindowsSystemAssessmentTool, EventMessageFile Delete
C:\Windows\system32\WUDFPlatform.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-DriverFrameworks-UserMode, EventMessageFile Delete
C:\Windows\system32\Wat\WatUX.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Windows Activation Technologies, EventMessageFile Delete
C:\Windows\system32\bthserv.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\bthserv\Parameters, ServiceDll Delete
C:\Windows\system32\certprop.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-SCPNP, EventMessageFile Delete
C:\Windows\system32\cofiredm.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-CorruptedFileRecovery-Client, EventMessageFile Delete
C:\Windows\system32\cofiredm.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-CorruptedFileRecovery-Server, EventMessageFile Delete
C:\Windows\system32\csrsrv.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Subsys-SMSS, EventMessageFile Delete
C:\Windows\system32\dfdts.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-DiskDiagnostic, EventMessageFile Delete
C:\Windows\system32\drivers\HTTP.SYS Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-HttpEvent, EventMessageFile Delete
C:\Windows\system32\drivers\Wdf01000.sys Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\wdf01000, EventMessageFile Delete
C:\Windows\system32\drivers\fltmgr.sys Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-FilterManager, EventMessageFile Delete
C:\Windows\system32\drivers\fvevol.sys Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-BitLocker-Driver, EventMessageFile Delete
C:\Windows\system32\drivers\ntfs.sys Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Ntfs, EventMessageFile Delete
C:\Windows\system32\dwm.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Desktop Window Manager, EventMessageFile Delete
C:\Windows\system32\eapsvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-EapHost, EventMessageFile Delete
C:\Windows\system32\fdPHost.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\fdPHost\Parameters, ServiceDll Delete
C:\Windows\system32\fdphost.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-FunctionDiscoveryHost, EventMessageFile Delete
C:\Windows\system32\fdrespub.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\FDResPub\Parameters, ServiceDll Delete
C:\Windows\system32\fdrespub.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-ResourcePublication, EventMessageFile Delete
C:\Windows\system32\fveapi.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-BitLocker-API, EventMessageFile Delete
C:\Windows\system32\fxsevent.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft Fax, EventMessageFile Delete
C:\Windows\system32\gpsvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-GroupPolicy, EventMessageFile Delete
C:\Windows\system32\iccvid.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, vidc.cvid Delete
C:\Windows\system32\ipbusenum.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\IPBusEnum\Parameters, ServiceDll Delete
C:\Windows\system32\ipbusenum.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-IPBusEnum, EventMessageFile Delete
C:\Windows\system32\iphlpsvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Iphlpsvc, EventMessageFile Delete
C:\Windows\system32\iscsiexe.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\MSiSCSI\Parameters, ServiceDll Delete
C:\Windows\system32\lpksetup.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-LanguagePackSetup, EventMessageFile Delete
C:\Windows\system32\lsm.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-TerminalServices-LocalSessionManager, EventMessageFile Delete
C:\Windows\system32\microsoft-windows-hal-events.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-HAL, EventMessageFile Delete
C:\Windows\system32\microsoft-windows-kernel-power-events.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Kernel-Power, EventMessageFile Delete
C:\Windows\system32\microsoft-windows-kernel-processor-power-events.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Kernel-Processor-Power, EventMessageFile Delete
C:\Windows\system32\mmcss.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\MMCSS\Parameters, ServiceDll Delete
C:\Windows\system32\mmcss.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\THREADORDER\Parameters, ServiceDll Delete
C:\Windows\system32\mpssvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\MpsSvc\Parameters, ServiceDll Delete
C:\Windows\system32\mpssvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Firewall, EventMessageFile Delete
C:\Windows\system32\msdtckrm.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\KtmRm\Parameters, ServiceDll Delete
C:\Windows\system32\nsisvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\nsi\Parameters, ServiceDll Delete
C:\Windows\system32\oobe\winsetup.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Setup, EventMessageFile Delete
C:\Windows\system32\pnrpsvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\PNRPsvc\Parameters, ServiceDll Delete
C:\Windows\system32\profsvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\ProfSvc\Parameters, ServiceDll Delete
C:\Windows\system32\psxss.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
C:\Windows\system32\qmgr.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Bits-Client, EventMessageFile Delete
C:\Windows\system32\recovery.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Recovery, EventMessageFile Delete
C:\Windows\system32\regsvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\RemoteRegistry\Parameters, ServiceDll Delete
C:\Windows\system32\rpcss.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\DcomLaunch\Parameters, ServiceDll Delete
C:\Windows\system32\rpcss.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\RpcSs\Parameters, ServiceDll Delete
C:\Windows\system32\schedsvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Schedule\Parameters, ServiceDll Delete
C:\Windows\system32\schedsvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-TaskScheduler, EventMessageFile Delete
C:\Windows\system32\sdclt.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\BackupPath,
C:\Windows\system32\seclogon.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\seclogon\Parameters, ServiceDll Delete
C:\Windows\system32\sensrsvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\SensrSvc\Parameters, ServiceDll Delete
C:\Windows\system32\services.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Service Control Manager, EventMessageFile Delete
C:\Windows\system32\sppsvc.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Software Protection Platform Service, EventMessageFile Delete
C:\Windows\system32\sppsvc.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Key Management Service\KmsRequests, EventMessageFile Delete
C:\Windows\system32\sppuinotify.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\sppuinotify\Parameters, ServiceDll Delete
C:\Windows\system32\srvsvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters, ServiceDll Delete
C:\Windows\system32\sstpsvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\SstpSvc\Parameters, ServiceDll Delete
C:\Windows\system32\sysmain.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\SysMain\Parameters, ServiceDll Delete
C:\Windows\system32\sysmain.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\rdyboost\Performance, Library Delete
C:\Windows\system32\tbssvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-TBS, EventMessageFile Delete
C:\Windows\system32\termsrv.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-TerminalServices-RemoteConnectionManager, EventMessageFile Delete
C:\Windows\system32\themeservice.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Themes\Parameters, ServiceDll Delete
C:\Windows\system32\umpnpmgr.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\PlugPlay\Parameters, ServiceDll Delete
C:\Windows\system32\umpnpmgr.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-UserPnp, EventMessageFile Delete
C:\Windows\system32\umpo.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Power\Parameters, ServiceDll Delete
C:\Windows\system32\w32time.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\W32Time\Parameters, ServiceDll Delete
C:\Windows\system32\w32time.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Time-Service, EventMessageFile Delete
C:\Windows\system32\w32time.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\W32Time, EventMessageFile Delete
C:\Windows\system32\w32time.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient, DllName Delete
C:\Windows\system32\w32time.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer, DllName Delete
C:\Windows\system32\wbem\WMIsvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Winmgmt\Parameters, ServiceDll Delete
C:\Windows\system32\wecsvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Wecsvc\Parameters, ServiceDll Delete
C:\Windows\system32\wecsvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-EventCollector, EventMessageFile Delete
C:\Windows\system32\wecsvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\HardwareEvents, DisplayNameFile Delete
C:\Windows\system32\wecsvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-EventCollector, EventMessageFile Delete
C:\Windows\system32\winlogon.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Winlogon, EventMessageFile Delete
C:\Windows\system32\winsrv.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-Winsrv, EventMessageFile Delete
C:\Windows\system32\wlansvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-WLAN-AutoConfig, EventMessageFile Delete
C:\Windows\system32\wpdbusenum.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WPDBusEnum\Parameters, ServiceDll Delete
C:\Windows\system32\wuaueng.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\wuauserv\Parameters, ServiceDll Delete
C:\Windows\system32\wuaueng.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-WindowsUpdateClient, EventMessageFile Delete
rdpclip Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd, StartupPrograms Delete
Autoruns items detected - 559, recognized as trusted - 388

Microsoft Internet Explorer extension modules (BHOs, Toolbars ...)

File name	Type	Description	Manufacturer	CLSID
	BHO			{18DF081C-E8AD-4283-A596-FA578C2EBDC3} Delete
	BHO			{3049C3E9-B461-4BC5-8870-4C09146192CA} Delete
	BHO			{30F9B915-B755-4826-820B-08FBA6BD249D} Delete
	BHO			{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94} Delete
	BHO			{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} Delete
	BHO			{D2C5E510-BE6D-42CC-9F61-E4F939078474} Delete
	BHO			{d2ce3e00-f94a-4740-988e-03dc2f38c34f} Delete
	BHO			{D4027C7F-154A-4066-A1AD-4243D8127440} Delete
	Toolbar			{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94} Delete
	Toolbar			{30F9B915-B755-4826-820B-08FBA6BD249D} Delete
	Toolbar			{8dcb7100-df86-4384-8842-8fa844297b3f} Delete
	Toolbar			{D4027C7F-154A-4066-A1AD-4243D8127440} Delete
	Toolbar			{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} Delete
	Extension module			{219C3416-8CB2-491a-A3C7-D9FCDDC9D600} Delete
	Extension module			{2670000A-7350-4f3c-8081-5663EE0C6C49} Delete
	Extension module			{92780B25-18CC-41C8-B9BE-3C9C571A8263} Delete
	URLSearchHook			{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94} Delete
	URLSearchHook			{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94} Delete
Elements detected - 26, recognized as trusted - 8

Windows Explorer extension modules

File name	Destination	Description	Manufacturer	CLSID
	Microsoft Office OneNote Namespace Extension for Windows Desktop Search			{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} Delete
	Shell Extensions for RealOne Player			{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} Delete
	WLMD Message Handler			{0563DB41-F538-4B37-A92D-4659049B7766} Delete
				{06A2568A-CED6-4187-BB20-400B8C02BE5A} Delete
	Windows Live Photo Gallery Autoplay Drop Target			{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} Delete
	Windows Live Photo Gallery Viewer Drop Target			{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} Delete
	Windows Live Photo Gallery Editor Drop Target			{00F374B7-B390-4884-B372-2FC349F2172B} Delete
	ColumnHandler			{F9DB5320-233E-11D1-9F84-707F02C10627} Delete
Elements detected - 16, recognized as trusted - 8

Printing system extensions (print monitors, providers)

File name	Type	Name	Description	Manufacturer
mimio_printer_monitor.dll Script: Quarantine, Delete, BC delete	Monitor	Black Ice Monitor
EP0SLM01.DLL Script: Quarantine, Delete, BC delete	Monitor	Epson Inbox Language Monitor01
hpinksts8911LM.dll Script: Quarantine, Delete, BC delete	Monitor	HP 8911 Status Monitor
localspl.dll Script: Quarantine, Delete, BC delete	Monitor	Local Port
FXSMON.DLL Script: Quarantine, Delete, BC delete	Monitor	Microsoft Shared Fax Monitor
hpf3l082.dll Script: Quarantine, Delete, BC delete	Monitor	PCL hpf3l082
hpf3lw73.dll Script: Quarantine, Delete, BC delete	Monitor	PCL hpf3lw73
hpz3lw71.dll Script: Quarantine, Delete, BC delete	Monitor	PCL hpz3lw71
tcpmon.dll Script: Quarantine, Delete, BC delete	Monitor	Standard TCP/IP Port
usbmon.dll Script: Quarantine, Delete, BC delete	Monitor	USB Monitor
WSDMon.dll Script: Quarantine, Delete, BC delete	Monitor	WSD Port
inetpp.dll Script: Quarantine, Delete, BC delete	Provider	HTTP Print Services
Elements detected - 14, recognized as trusted - 2

Task Scheduler jobs

File name	Job name	Job status	Description	Manufacturer
Elements detected - 4, recognized as trusted - 4

SPI/LSP settings

Namespace providers (NSP)

Provider	Status	EXE file	Description	GUID
Detected - 9, recognized as trusted - 9

Transport protocol providers (TSP, LSP)

Provider EXE file Description
Detected - 10, recognized as trusted - 10
Results of automatic SPI settings check
LSP settings checked. No errors detected

TCP/UDP ports

Port Status Remote Host Remote Port Application Notes
TCP ports
UDP ports

Downloaded Program Files (DPF)

File name Description Manufacturer CLSID Source URL
Garmin Communicator Plug-In
Delete https://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB
{02BCC737-B171-4746-94C9-0D8A0B2C0089}
Delete http://office.microsoft.com/sites/production/ieawsdc32.cab
{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}
Delete http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
{28B66320-9687-4B13-8757-36F901887AB5}
Delete http://www.seehere.com/ips-opdata/layout/fujius02/objects/canvasx.cab
{34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE}
Delete http://www.seehere.com/ips-opdata/layout/fujius02/objects/jordan.cab
{3528A58B-595D-4AFD-A5F6-B914BD306DC3}
Delete http://dishconnectivity.sling.com/dpit/downloads/pc/SlingHealth.cab
{50647AB5-18FD-4142-82B0-5852478DD0D5}
Delete http://webeffective.keynote.com/applications/pconnector/download/ConnectorLauncher.cab
{A7846ED2-9DE6-4E8A-B116-A8ACEBFA7DB1}
Delete http://rms2.invokesolutions.com/events/bin/6.2.0.1452/MILive.cab
{BEA7310D-06C4-4339-A784-DC3804819809}
Delete http://www.cvsphoto.com/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab
{C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB}
Delete http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab
{D8AA889B-2C65-47C3-8C16-3DCD4EF76A47}
Delete
{E2883E8F-472F-4FB0-9522-AC9BF37916A7}
Delete http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Elements detected - 15, recognized as trusted - 3

Control Panel Applets (CPL)

File name Description Manufacturer
C:\Windows\system32\FlashPlayerCPLApp.cpl
Script: Quarantine, Delete, BC delete Adobe Flash Player Control Panel Applet Copyright © 1996-2010 Adobe Systems Incorporated. All Rights Reserved. Adobe and Flash are either trademarks or registered trademarks in the United States and/or other countries.
Elements detected - 19, recognized as trusted - 18

Active Setup

File name Description Manufacturer CLSID
Elements detected - 9, recognized as trusted - 9

HOSTS file

Hosts file record
яю1

Protocols and handlers

File name Type Description Manufacturer CLSID
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Elements detected - 16, recognized as trusted - 13

Suspicious objects

File Description Type

Main script of analysis Windows version: Windows 7 Home Premium, Build=7600, SP="" System Restore: enabled >> Services: potentially dangerous service allowed: TermService (@%SystemRoot%\System32\termsrv.dll,-268) Error [2, SC_EXT_ADDITEMST] >> Services: potentially dangerous service allowed: SSDPSRV (@%systemroot%\system32\ssdpsrv.dll,-100) Error [2, SC_EXT_ADDITEMST] >> Services: potentially dangerous service allowed: Schedule (@%SystemRoot%\system32\schedsvc.dll,-100) Error [2, SC_EXT_ADDITEMST] > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)! >> Security: disk drives' autorun is enabled Error [2, SC_EXT_ADDITEMST] >> Security: administrative shares (C$, D$ ...) are enabled Error [2, SC_EXT_ADDITEMST] >> Security: anonymous user access is enabled Error [2, SC_EXT_ADDITEMST] Error [2, SC_EXT_ADDITEMST] >> Security: sending Remote Assistant queries is enabled >> Disable HDD autorun >> Disable autorun from network drives >> Disable CD/DVD autorun >> Disable removable media autorun >> Windows Explorer - show extensions of known file types System Analysis in progress
System Analysis - complete
Script commands

Add commands to script:
Blocking hooks using Anti-Rootkit
Enable AVZGuard
Operations with AVZPM (true=enable,false=disable)
BootCleaner - import list of deleted files
Registry cleanup after deleting files
BootCleaner - activate
Reboot
Insert template for QuarantineFile() - quarantining file
Insert template for BC_QrFile() - quarantining file via BootCleaner
Insert template for DeleteFile() - deleting file
Insert template for DelCLSID() - deleting CLSID item from registry
Additional operations:
Performance tweaking: disable service TermService (@%SystemRoot%\System32\termsrv.dll,-268)
Performance tweaking: disable service SSDPSRV (@%systemroot%\system32\ssdpsrv.dll,-100)
Performance tweaking: disable service Schedule (@%SystemRoot%\system32\schedsvc.dll,-100)
Security tweaking: disable CD autorun
Security tweaking: disable administrative shares
Security tweaking: disable anonymous user access
Security: disable sending Remote Assistant queries
File list

Port	Status	Remote Host	Remote Port	Application	Notes
TCP ports
UDP ports