Results of system analysis

Kaspersky Virus Removal Tool 11.0.0.1245 (database released 11/09/2011; 18:06)

List of processes

File name	PID	Description	Copyright	MD5	Information
c:\program files\intel\intel application accelerator\iaanotif.exe Script: Quarantine, Delete, BC delete, Terminate	3084	IAA Event Monitor User Notification Tool	Copyright(C) Intel Corporation 2003-04	??	132.00 kb, rsAh, created: 25.05.2005 11:50:01, modified: 23.03.2004 13:16:16 Command line: "C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe"
c:\program files\intel\modem event monitor\intelmem.exe Script: Quarantine, Delete, BC delete, Terminate	3056	Modem Event Monitor Application	Copyright (C) 2003	??	216.00 kb, rsAh, created: 25.05.2005 11:50:39, modified: 03.09.2003 21:12:44 Command line: "C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe"
Detected:50, recognized as trusted 50

Module name	Handle	Description	Copyright	MD5	Used by processes
C:\Program Files\Intel\Intel Application Accelerator\IAAMon_ENU.dll Script: Quarantine, Delete, BC delete	268435456	IAA Event Monitor User Notification Tool	Copyright(C) Intel Corporation 2003-04	--	3084
C:\WINDOWS\system32\IntelMPM.dll Script: Quarantine, Delete, BC delete	268435456	Intel Modem Performance Monitor API	Copyright © 2003	--	3056
Modules detected:572, recognized as trusted 570

Kernel Space Modules Viewer

Module	Base address	Size in memory	Description	Manufacturer
C:\WINDOWS\System32\Drivers\dump_iaStor.sys Script: Quarantine, Delete, BC delete	AF259000	073000 (471040)
SYMDS.SYS Script: Quarantine, Delete, BC delete	B9DEB000	056000 (352256)
SYMEFA.SYS Script: Quarantine, Delete, BC delete	B9DAC000	02D000 (184320)
Modules detected - 195, recognized as trusted - 192

Services

Service	Description	Status	File	Group	Dependencies
Detected - 114, recognized as trusted - 114

Drivers

Service	Description	Status	File	Group	Dependencies
Abiosdsk Driver: Unload, Delete, Disable, BC delete	Abiosdsk	Not started	Abiosdsk.sys Script: Quarantine, Delete, BC delete	Primary disk
Atdisk Driver: Unload, Delete, Disable, BC delete	Atdisk	Not started	Atdisk.sys Script: Quarantine, Delete, BC delete	Primary disk
bvrp_pci Driver: Unload, Delete, Disable, BC delete	bvrp_pci	Not started	bvrp_pci.sys Script: Quarantine, Delete, BC delete
Changer Driver: Unload, Delete, Disable, BC delete	Changer	Not started	Changer.sys Script: Quarantine, Delete, BC delete	Filter
cpuz132 Driver: Unload, Delete, Disable, BC delete	cpuz132	Not started	C:\DOCUME~1\Eric\LOCALS~1\Temp\cpuz132\cpuz132_x32.sys Script: Quarantine, Delete, BC delete
lbrtfdc Driver: Unload, Delete, Disable, BC delete	lbrtfdc	Not started	lbrtfdc.sys Script: Quarantine, Delete, BC delete	System Bus Extender
npkcrypt Driver: Unload, Delete, Disable, BC delete	npkcrypt	Not started	C:\Program Files\Wizet\MapleStory\npkcrypt.sys Script: Quarantine, Delete, BC delete	Keyboard
PCIDump Driver: Unload, Delete, Disable, BC delete	PCIDump	Not started	PCIDump.sys Script: Quarantine, Delete, BC delete	PCI Configuration
PDCOMP Driver: Unload, Delete, Disable, BC delete	PDCOMP	Not started	PDCOMP.sys Script: Quarantine, Delete, BC delete
PDFRAME Driver: Unload, Delete, Disable, BC delete	PDFRAME	Not started	PDFRAME.sys Script: Quarantine, Delete, BC delete
PDRELI Driver: Unload, Delete, Disable, BC delete	PDRELI	Not started	PDRELI.sys Script: Quarantine, Delete, BC delete
PDRFRAME Driver: Unload, Delete, Disable, BC delete	PDRFRAME	Not started	PDRFRAME.sys Script: Quarantine, Delete, BC delete
Simbad Driver: Unload, Delete, Disable, BC delete	Simbad	Not started	Simbad.sys Script: Quarantine, Delete, BC delete	Filter
wanatw Driver: Unload, Delete, Disable, BC delete	WAN Miniport (ATW)	Not started	C:\WINDOWS\system32\DRIVERS\wanatw4.sys Script: Quarantine, Delete, BC delete	NDIS
WDICA Driver: Unload, Delete, Disable, BC delete	WDICA	Not started	WDICA.sys Script: Quarantine, Delete, BC delete
Detected - 216, recognized as trusted - 201

Autoruns

File name	Status	Startup method	Description
C:\Documents and Settings\Todd\Local Settings\Temp\_uninst_24907412.bat Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	C:\Documents and Settings\Todd\Start Menu\Programs\Startup\, C:\Documents and Settings\Todd\Start Menu\Programs\Startup\_uninst_24907412.lnk,
C:\PROGRA~1\Grisoft\AVGFRE~1\avglog.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\AVG7, EventMessageFile
C:\Program Files\America Online 9.0\aol.exe Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Internet Explorer\Quick Launch\America Online 9.0.lnk,
C:\Program Files\Intel\Intel Application Accelerator\cpl\iaa.cpl Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cpls, IAA Delete
C:\Program Files\Java\jre6\bin\jusched.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, SunJavaUpdateSched Delete
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mmjb.exe Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Internet Explorer\Quick Launch\Musicmatch Jukebox.lnk,
C:\Program Files\McAfee\VirusScan\NAIEvent.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\McLogEvent, EventMessageFile
C:\Program Files\NOS\bin\getPlus_Helper.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\getPlusHelper\Parameters, ServiceDll Delete
C:\Program Files\Sonic\RecordNow!\shlext.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {DEE12703-6333-4D4E-8F34-738C4DCC2E04} Delete
C:\WINDOWS\System32\Drivers\lbrtfdc.sys Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\lbrtfdc, EventMessageFile
C:\WINDOWS\System32\PrintFilterPipelineSvc.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PrintFilterPipelineSvc, EventMessageFile
C:\WINDOWS\System32\appmgmts.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters, ServiceDll Delete
C:\WINDOWS\System32\appmgmts.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Application Management, EventMessageFile
C:\WINDOWS\System32\appmgr.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Software Installation, EventMessageFile
C:\WINDOWS\System32\fdeploy.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\File Deployment, EventMessageFile
C:\WINDOWS\System32\fdeploy.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Folder Redirection, EventMessageFile
C:\WINDOWS\System32\hidserv.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\HidServ\Parameters, ServiceDll Delete
C:\WINDOWS\System32\igmpv2.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile
C:\WINDOWS\System32\ipbootp.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile
C:\WINDOWS\System32\iprip2.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile
C:\WINDOWS\System32\ntbackup.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\ntbackup, EventMessageFile
C:\WINDOWS\System32\ospf.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPF, EventMessageFile
C:\WINDOWS\System32\ospfmib.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPFMib, EventMessageFile
C:\WINDOWS\System32\polagent.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PolicyAgent, EventMessageFile
C:\WINDOWS\System32\tssdis.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\TermServSessDir, EventMessageFile
C:\WINDOWS\system32\DRIVERS\NaiFiltr.sys Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\NaiFiltr, EventMessageFile
C:\WINDOWS\system32\MsSip1.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 1, $DLL Delete
C:\WINDOWS\system32\MsSip2.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 2, $DLL Delete
C:\WINDOWS\system32\MsSip3.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 3, $DLL Delete
C:\WINDOWS\system32\asr_fmt.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR format utility for volumes Delete
C:\WINDOWS\system32\asr_ldm.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR utility for Logical Disk Manager Delete
C:\WINDOWS\system32\asr_pfu.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR protected file utility Delete
C:\WINDOWS\system32\psxss.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
C:\WINDOWS\system32\stisvc.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System, EventMessageFile
LCODCCMP.DLL Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, vidc.LEAD Delete
SDEvents.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Spybot - Search & Destroy 2, EventMessageFile
appmgmts.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}, DLLName Delete
kbd101.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver JPN Delete
kbd101a.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver KOR Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, .DEFAULT\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-19\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-20\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-18\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-21-233194558-870154993-683978915-1006\Control Panel\IOProcs, MVB Delete
vgafix.fon Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon Delete
vgaoem.fon Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon Delete
vgasys.fon Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon Delete
Autoruns items detected - 921, recognized as trusted - 874

Microsoft Internet Explorer extension modules (BHOs, Toolbars ...)

File name	Type	Description	Manufacturer	CLSID
	Extension module			{000002a3-84fe-43f1-b958-f2c3ca804f1a} Delete
	Extension module			{0026439F-A980-4f18-8C95-4F1CBBF9C1D8} Delete
	Extension module			{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} Delete
Elements detected - 25, recognized as trusted - 22

Windows Explorer extension modules

File name	Destination	Description	Manufacturer	CLSID
	Display Panning CPL Extension			{42071714-76d4-11d1-8b24-00a0c9068ff3} Delete
	Shell extensions for file compression			{764BF0E1-F219-11ce-972D-00AA00A14F56} Delete
	Encryption Context Menu			{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} Delete
	Taskbar and Start Menu			{0DF44EAA-FF21-4412-828E-260A8728E7F1} Delete
	User Accounts			{7A9D77BD-5403-11d2-8785-2E0420524153} Delete
C:\Program Files\Sonic\RecordNow!\shlext.dll Script: Quarantine, Delete, BC delete	RecordNow! SendToExt	Shell Extensions	(c) Sonic Solutions. All rights reserved.	{DEE12703-6333-4D4E-8F34-738C4DCC2E04} Delete
	Shell Extensions for RealOne Player			{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} Delete
Elements detected - 217, recognized as trusted - 210

Printing system extensions (print monitors, providers)

File name	Type	Name	Description	Manufacturer
Elements detected - 14, recognized as trusted - 14

Task Scheduler jobs

File name	Job name	Job status	Description	Manufacturer
c:\program files\mcafee.com\vso\mcmnhdlr.exe Script: Quarantine, Delete, BC delete	McAfee.com Scan for Viruses - My Computer (1) (DELL8400-Todd).job	The task has not yet run.
Elements detected - 7, recognized as trusted - 6

SPI/LSP settings

Namespace providers (NSP)

Provider	Status	EXE file	Description	GUID
Detected - 4, recognized as trusted - 4

Transport protocol providers (TSP, LSP)

Provider EXE file Description
Detected - 11, recognized as trusted - 11
Results of automatic SPI settings check
LSP settings checked. No errors detected

TCP/UDP ports

Port Status Remote Host Remote Port Application Notes
TCP ports
7 LISTENING 0.0.0.0 83 [1144] c:\windows\system32\tcpsvcs.exe
Script: Quarantine, Delete, BC delete, Terminate
9 LISTENING 0.0.0.0 22645 [1144] c:\windows\system32\tcpsvcs.exe
Script: Quarantine, Delete, BC delete, Terminate
13 LISTENING 0.0.0.0 39166 [1144] c:\windows\system32\tcpsvcs.exe
Script: Quarantine, Delete, BC delete, Terminate
17 LISTENING 0.0.0.0 2080 [1144] c:\windows\system32\tcpsvcs.exe
Script: Quarantine, Delete, BC delete, Terminate
19 LISTENING 0.0.0.0 2064 [1144] c:\windows\system32\tcpsvcs.exe
Script: Quarantine, Delete, BC delete, Terminate
135 LISTENING 0.0.0.0 2048 [1060] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
139 LISTENING 0.0.0.0 40968 [4] System
Script: Quarantine, Delete, BC delete, Terminate
445 LISTENING 0.0.0.0 6328 [4] System
Script: Quarantine, Delete, BC delete, Terminate
1025 LISTENING 0.0.0.0 22618 [1584] c:\windows\system32\lexpps.exe
Script: Quarantine, Delete, BC delete, Terminate
1029 LISTENING 0.0.0.0 14437 [1836] c:\program files\norton security suite\engine\4.3.0.5\ccsvchst.exe
Script: Quarantine, Delete, BC delete, Terminate
1031 ESTABLISHED 127.0.0.1 27015 [3532] c:\program files\itunes\ituneshelper.exe
Script: Quarantine, Delete, BC delete, Terminate
1040 LISTENING 0.0.0.0 2240 [3900] c:\windows\system32\alg.exe
Script: Quarantine, Delete, BC delete, Terminate
3420 ESTABLISHED 127.0.0.1 3421 [3732] c:\program files\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
3421 ESTABLISHED 127.0.0.1 3420 [3732] c:\program files\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
3422 ESTABLISHED 127.0.0.1 3423 [3732] c:\program files\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
3423 ESTABLISHED 127.0.0.1 3422 [3732] c:\program files\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
3599 ESTABLISHED 204.145.81.68 80 [3732] c:\program files\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
5152 LISTENING 0.0.0.0 28866 [1776] c:\program files\java\jre6\bin\jqs.exe
Script: Quarantine, Delete, BC delete, Terminate
5354 LISTENING 0.0.0.0 20519 [892] c:\program files\bonjour\mdnsresponder.exe
Script: Quarantine, Delete, BC delete, Terminate
27015 LISTENING 0.0.0.0 43125 [632] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe
Script: Quarantine, Delete, BC delete, Terminate
27015 ESTABLISHED 127.0.0.1 1031 [632] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe
Script: Quarantine, Delete, BC delete, Terminate
UDP ports
7 LISTENING -- -- [1144] c:\windows\system32\tcpsvcs.exe
Script: Quarantine, Delete, BC delete, Terminate
9 LISTENING -- -- [1144] c:\windows\system32\tcpsvcs.exe
Script: Quarantine, Delete, BC delete, Terminate
13 LISTENING -- -- [1144] c:\windows\system32\tcpsvcs.exe
Script: Quarantine, Delete, BC delete, Terminate
17 LISTENING -- -- [1144] c:\windows\system32\tcpsvcs.exe
Script: Quarantine, Delete, BC delete, Terminate
19 LISTENING -- -- [1144] c:\windows\system32\tcpsvcs.exe
Script: Quarantine, Delete, BC delete, Terminate
123 LISTENING -- -- [1156] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
123 LISTENING -- -- [1156] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
137 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
138 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
445 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
500 LISTENING -- -- [760] c:\windows\system32\lsass.exe
Script: Quarantine, Delete, BC delete, Terminate
1026 LISTENING -- -- [632] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe
Script: Quarantine, Delete, BC delete, Terminate
1027 LISTENING -- -- [632] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe
Script: Quarantine, Delete, BC delete, Terminate
1028 LISTENING -- -- [892] c:\program files\bonjour\mdnsresponder.exe
Script: Quarantine, Delete, BC delete, Terminate
1032 LISTENING -- -- [3532] c:\program files\itunes\ituneshelper.exe
Script: Quarantine, Delete, BC delete, Terminate
1033 LISTENING -- -- [3532] c:\program files\itunes\ituneshelper.exe
Script: Quarantine, Delete, BC delete, Terminate
1900 LISTENING -- -- [1448] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
1900 LISTENING -- -- [1448] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
2951 LISTENING -- -- [3760] c:\program files\viewpoint\viewpoint manager\viewmgr.exe
Script: Quarantine, Delete, BC delete, Terminate
4120 LISTENING -- -- [1156] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
4500 LISTENING -- -- [760] c:\windows\system32\lsass.exe
Script: Quarantine, Delete, BC delete, Terminate
5353 LISTENING -- -- [892] c:\program files\bonjour\mdnsresponder.exe
Script: Quarantine, Delete, BC delete, Terminate
44301 LISTENING -- -- [336] c:\windows\system32\pnkbstra.exe
Script: Quarantine, Delete, BC delete, Terminate

Downloaded Program Files (DPF)

File name Description Manufacturer CLSID Source URL
{0000000A-0000-0010-8000-00AA00389B71}
Delete http://download.microsoft.com/download/d/4/4/d446e8a9-3a86-4b59-bb19-f5bd11b40367/wmavax.CAB
{33564D57-0000-0010-8000-00AA00389B71}
Delete http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
{40F576AD-8680-4F9E-9490-99D069CD665F}
Delete http://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab
{4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21}
Delete http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab
{67A5F8DC-1A4B-4D66-9F24-A704AD929EEE}
Delete http://www.systemrequirementslab.com/sysreqlab2.cab
{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
Delete http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
{BCC0FF27-31D9-4614-A68E-C18E1ADA4389}
Delete http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab
{DBA230D1-8467-4e69-987E-5FAE815A3B45}
Delete
Elements detected - 32, recognized as trusted - 24

Control Panel Applets (CPL)

File name Description Manufacturer
Elements detected - 28, recognized as trusted - 28

Active Setup

File name Description Manufacturer CLSID
Elements detected - 16, recognized as trusted - 16

HOSTS file

Hosts file record
яю1
Clear Hosts file

Protocols and handlers

File name Type Description Manufacturer CLSID
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
Elements detected - 31, recognized as trusted - 28

Suspicious objects

File Description Type
C:\WINDOWS\system32\DRIVERS\4483576drv.sys
Script: Quarantine, Delete, BC delete Suspicion for Rootkit Kernel-mode hook
\SystemRoot\system32\DRIVERS\4483576drv.sys
Script: Quarantine, Delete, BC delete Suspicion for Rootkit Kernel-mode hook

Main script of analysis
Windows version: Microsoft Windows XP, Build=2600, SP="Service Pack 3"
System Restore: enabled
1.1 Searching for user-mode API hooks
 Analysis: kernel32.dll, export table found in section .text
IAT modification detected: CreateProcessA - 00E50010<>7C80236B
IAT modification detected: GetModuleFileNameA - 00E50080<>7C80B56F
IAT modification detected: FreeLibrary - 00E500F0<>7C80AC7E
IAT modification detected: GetModuleFileNameW - 00E50160<>7C80B475
IAT modification detected: CreateProcessW - 00E501D0<>7C802336
IAT modification detected: LoadLibraryW - 00E502B0<>7C80AEEB
IAT modification detected: LoadLibraryA - 00E50320<>7C801D7B
IAT modification detected: GetProcAddress - 00E50390<>7C80AE40
 Analysis: ntdll.dll, export table found in section .text
 Analysis: user32.dll, export table found in section .text
 Analysis: advapi32.dll, export table found in section .text
 Analysis: ws2_32.dll, export table found in section .text
 Analysis: wininet.dll, export table found in section .text
 Analysis: rasapi32.dll, export table found in section .text
 Analysis: urlmon.dll, export table found in section .text
 Analysis: netapi32.dll, export table found in section .text
1.2 Searching for kernel-mode API hooks
 Driver loaded successfully
 SDT found (RVA=085700)
 Kernel ntkrnlpa.exe found in memory at address 804D7000
   SDT = 8055C700
   KiST = 80504480 (284)
Function NtAdjustPrivilegesToken (0B) intercepted (805EC464->A9878690), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtAlertResumeThread (0C) intercepted (805D4B7E->89EFB050), hook not defined
>>> Function restored successfully !
>>> Hook code blocked
Function NtAlertThread (0D) intercepted (805D4B2E->89EFC050), hook not defined
>>> Function restored successfully !
>>> Hook code blocked
Function NtAllocateVirtualMemory (11) intercepted (805A8ABA->89F3DE78), hook not defined
>>> Function restored successfully !
>>> Hook code blocked
Function NtAssignProcessToJobObject (13) intercepted (805D6642->89F34050), hook not defined
>>> Function restored successfully !
>>> Hook code blocked
Function NtClose (19) intercepted (805BC530->A9878F94), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtConnectPort (1F) intercepted (805A45D0->A9879DC8), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateEvent (23) intercepted (8060EF4E->A987A312), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateFile (25) intercepted (805790A8->A9879270), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateKey (29) intercepted (806240F0->A9877500), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateMutant (2B) intercepted (8061769E->A987A1F8), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateNamedPipeFile (2C) intercepted (805790E2->A987827E), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreatePort (2E) intercepted (805A50EC->A987A0CC), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateSection (32) intercepted (805AB3C8->A9878426), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateSemaphore (33) intercepted (8061504E->A987A432), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateSymbolicLinkObject (34) intercepted (805C39FA->898574B0), hook not defined
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateThread (35) intercepted (805D1018->A9878C1C), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateWaitablePort (38) intercepted (805A5110->A987A162), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDebugActiveProcess (39) intercepted (80643B30->A987BB1A), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDeleteKey (3F) intercepted (8062458C->A9877B0A), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDeleteValueKey (41) intercepted (8062475C->A9877EBE), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDeviceIoControlFile (42) intercepted (8057926E->A98796F2), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDuplicateObject (44) intercepted (805BE008->A987CD26), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtEnumerateKey (47) intercepted (8062493C->A987800A), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtEnumerateValueKey (49) intercepted (80624BA6->A98780A2), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtFreeVirtualMemory (53) intercepted (805B2FB2->8989B798), hook not defined
>>> Function restored successfully !
>>> Hook code blocked
Function NtFsControlFile (54) intercepted (805792A2->A9879500), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtImpersonateAnonymousToken (59) intercepted (805F9386->89F37050), hook not defined
>>> Function restored successfully !
>>> Hook code blocked
Function NtImpersonateThread (5B) intercepted (805D7802->89897050), hook not defined
>>> Function restored successfully !
>>> Hook code blocked
Function NtLoadDriver (61) intercepted (80584160->A987BC0C), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtLoadKey (62) intercepted (80626314->A98774DC), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtLoadKey2 (63) intercepted (80625F20->A98774EE), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtMapViewOfSection (6C) intercepted (805B203A->A987C374), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtNotifyChangeKey (6F) intercepted (806262DE->A98781CE), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenEvent (72) intercepted (8060F04E->A987A3A8), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenFile (74) intercepted (8057A1A6->A9879016), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenKey (77) intercepted (806254CE->A98776C0), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenMutant (78) intercepted (80617776->A987A288), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenProcess (7A) intercepted (805CB440->A98788CC), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenProcessToken (7B) intercepted (805EE054->89F01050), hook not defined
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenSection (7D) intercepted (805AA3EC->A987C10E), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenSemaphore (7E) intercepted (80615148->A987A4C8), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenThread (80) intercepted (805CB6CC->A98787BE), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtProtectVirtualMemory (89) intercepted (805B841E->89857B80), hook not defined
>>> Function restored successfully !
>>> Hook code blocked
Function NtQueryKey (A0) intercepted (80625810->A987813A), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQueryMultipleValueKey (A1) intercepted (8062323E->A9877D72), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQuerySection (A7) intercepted (805B85E0->A987C6AE), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQueryValueKey (B1) intercepted (80622314->A987799C), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQueueApcThread (B4) intercepted (805D1276->A987BFA0), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtRenameKey (C0) intercepted (80623B12->A9877C2C), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtReplaceKey (C1) intercepted (806261C4->A9876F16), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtReplyPort (C2) intercepted (805A54EC->A987A82C), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtReplyWaitReceivePort (C3) intercepted (805A64B4->A987A6F2), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtRequestWaitReplyPort (C8) intercepted (805A2D76->A987B8B4), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtRestoreKey (CC) intercepted (80625AD0->A987728E), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtResumeThread (CE) intercepted (805D49BA->A987CBC8), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSaveKey (CF) intercepted (80625BCC->A9876EAE), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSecureConnectPort (D2) intercepted (805A3D64->A9879B0E), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetContextThread (D5) intercepted (805D173A->A9878E38), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetInformationProcess (E4) intercepted (805CDE8A->89F3B8E0), hook not defined
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetInformationToken (E6) intercepted (805FA7B4->A987B154), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetSecurityObject (ED) intercepted (805C062E->A987BDAA), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetSystemInformation (F0) intercepted (8060FD06->A987C7FE), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetValueKey (F7) intercepted (80622662->A9877816), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSuspendProcess (FD) intercepted (805D4A82->A987C8F0), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSuspendThread (FE) intercepted (805D48F4->A987CA2A), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSystemDebugControl (FF) intercepted (806180BA->A987BA3E), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtTerminateProcess (101) intercepted (805D29E2->A9878A68), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtTerminateThread (102) intercepted (805D2BDC->A98789C8), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtUnmapViewOfSection (10B) intercepted (805B2E48->A987C552), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtWriteVirtualMemory (115) intercepted (805B43CC->A9878B52), hook C:\WINDOWS\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function FsRtlCheckLockForReadAccess (804EAF84) - machine code modification Method of JmpTo. jmp A986AFD0 \SystemRoot\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
Function IoIsOperationSynchronous (804EF912) - machine code modification Method of JmpTo. jmp A986B3AC \SystemRoot\system32\DRIVERS\4483576drv.sys, driver recognized as trusted
>>> Function restored successfully !
Functions checked: 284, intercepted: 71, restored: 73
1.3 Checking IDT and SYSENTER
 Analysis for CPU 1
 Analysis for CPU 2
CmpCallCallBacks = 00093D84
Disable callback OK
 Checking IDT and SYSENTER - complete
1.4 Searching for masking processes and drivers
 Checking not performed: extended monitoring driver (AVZPM) is not installed
1.5 Checking of IRP handlers
 Driver loaded successfully
 Checking - complete
>> Services: potentially dangerous service allowed: TermService (Terminal Services)
>> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery Service)
>> Services: potentially dangerous service allowed: Schedule (Task Scheduler)
>> Services: potentially dangerous service allowed: mnmsrvc (NetMeeting Remote Desktop Sharing)
>> Services: potentially dangerous service allowed: RDSessMgr (Remote Desktop Help Session Manager)
> Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)!
>> Security: disk drives' autorun is enabled
>> Security: administrative shares (C$, D$ ...) are enabled
>> Security: anonymous user access is enabled
>> Security: sending Remote Assistant queries is enabled
 >>  Disable HDD autorun
 >>  Disable autorun from network drives
 >>  Disable CD/DVD autorun
 >>  Disable removable media autorun
 >>  Windows Explorer - show extensions of known file types
System Analysis in progress

 System Analysis - complete


Script commands 
Add commands to script:
Blocking hooks using Anti-Rootkit
Enable AVZGuard
Operations with AVZPM (true=enable,false=disable)
BootCleaner - import list of deleted files
BootCleaner - import all
Registry cleanup after deleting files
ExecuteWizard ('TSW',2,3,true) - Running Troubleshooting wizard
BootCleaner - activate
Reboot
Insert template for QuarantineFile() - quarantining file
Insert template for BC_QrFile() - quarantining file via BootCleaner
Insert template for DeleteFile() - deleting file
Insert template for DelCLSID() - deleting CLSID item from registry
Additional operations:Performance tweaking: disable service TermService (Terminal Services)
Performance tweaking: disable service SSDPSRV (SSDP Discovery Service)
Performance tweaking: disable service Schedule (Task Scheduler)
Performance tweaking: disable service mnmsrvc (NetMeeting Remote Desktop Sharing)
Performance tweaking: disable service RDSessMgr (Remote Desktop Help Session Manager)
Security tweaking: disable CD autorun
Security tweaking: disable administrative shares
Security tweaking: disable anonymous user access
Security: disable sending Remote Assistant queries

File list

Port	Status	Remote Host	Remote Port	Application	Notes
TCP ports
7	LISTENING	0.0.0.0	83	[1144] c:\windows\system32\tcpsvcs.exe Script: Quarantine, Delete, BC delete, Terminate
9	LISTENING	0.0.0.0	22645	[1144] c:\windows\system32\tcpsvcs.exe Script: Quarantine, Delete, BC delete, Terminate
13	LISTENING	0.0.0.0	39166	[1144] c:\windows\system32\tcpsvcs.exe Script: Quarantine, Delete, BC delete, Terminate
17	LISTENING	0.0.0.0	2080	[1144] c:\windows\system32\tcpsvcs.exe Script: Quarantine, Delete, BC delete, Terminate
19	LISTENING	0.0.0.0	2064	[1144] c:\windows\system32\tcpsvcs.exe Script: Quarantine, Delete, BC delete, Terminate
135	LISTENING	0.0.0.0	2048	[1060] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
139	LISTENING	0.0.0.0	40968	[4] System Script: Quarantine, Delete, BC delete, Terminate
445	LISTENING	0.0.0.0	6328	[4] System Script: Quarantine, Delete, BC delete, Terminate
1025	LISTENING	0.0.0.0	22618	[1584] c:\windows\system32\lexpps.exe Script: Quarantine, Delete, BC delete, Terminate
1029	LISTENING	0.0.0.0	14437	[1836] c:\program files\norton security suite\engine\4.3.0.5\ccsvchst.exe Script: Quarantine, Delete, BC delete, Terminate
1031	ESTABLISHED	127.0.0.1	27015	[3532] c:\program files\itunes\ituneshelper.exe Script: Quarantine, Delete, BC delete, Terminate
1040	LISTENING	0.0.0.0	2240	[3900] c:\windows\system32\alg.exe Script: Quarantine, Delete, BC delete, Terminate
3420	ESTABLISHED	127.0.0.1	3421	[3732] c:\program files\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
3421	ESTABLISHED	127.0.0.1	3420	[3732] c:\program files\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
3422	ESTABLISHED	127.0.0.1	3423	[3732] c:\program files\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
3423	ESTABLISHED	127.0.0.1	3422	[3732] c:\program files\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
3599	ESTABLISHED	204.145.81.68	80	[3732] c:\program files\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
5152	LISTENING	0.0.0.0	28866	[1776] c:\program files\java\jre6\bin\jqs.exe Script: Quarantine, Delete, BC delete, Terminate
5354	LISTENING	0.0.0.0	20519	[892] c:\program files\bonjour\mdnsresponder.exe Script: Quarantine, Delete, BC delete, Terminate
27015	LISTENING	0.0.0.0	43125	[632] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe Script: Quarantine, Delete, BC delete, Terminate
27015	ESTABLISHED	127.0.0.1	1031	[632] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe Script: Quarantine, Delete, BC delete, Terminate
UDP ports
7	LISTENING	--	--	[1144] c:\windows\system32\tcpsvcs.exe Script: Quarantine, Delete, BC delete, Terminate
9	LISTENING	--	--	[1144] c:\windows\system32\tcpsvcs.exe Script: Quarantine, Delete, BC delete, Terminate
13	LISTENING	--	--	[1144] c:\windows\system32\tcpsvcs.exe Script: Quarantine, Delete, BC delete, Terminate
17	LISTENING	--	--	[1144] c:\windows\system32\tcpsvcs.exe Script: Quarantine, Delete, BC delete, Terminate
19	LISTENING	--	--	[1144] c:\windows\system32\tcpsvcs.exe Script: Quarantine, Delete, BC delete, Terminate
123	LISTENING	--	--	[1156] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
123	LISTENING	--	--	[1156] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
137	LISTENING	--	--	[4] System Script: Quarantine, Delete, BC delete, Terminate
138	LISTENING	--	--	[4] System Script: Quarantine, Delete, BC delete, Terminate
445	LISTENING	--	--	[4] System Script: Quarantine, Delete, BC delete, Terminate
500	LISTENING	--	--	[760] c:\windows\system32\lsass.exe Script: Quarantine, Delete, BC delete, Terminate
1026	LISTENING	--	--	[632] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe Script: Quarantine, Delete, BC delete, Terminate
1027	LISTENING	--	--	[632] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe Script: Quarantine, Delete, BC delete, Terminate
1028	LISTENING	--	--	[892] c:\program files\bonjour\mdnsresponder.exe Script: Quarantine, Delete, BC delete, Terminate
1032	LISTENING	--	--	[3532] c:\program files\itunes\ituneshelper.exe Script: Quarantine, Delete, BC delete, Terminate
1033	LISTENING	--	--	[3532] c:\program files\itunes\ituneshelper.exe Script: Quarantine, Delete, BC delete, Terminate
1900	LISTENING	--	--	[1448] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
1900	LISTENING	--	--	[1448] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
2951	LISTENING	--	--	[3760] c:\program files\viewpoint\viewpoint manager\viewmgr.exe Script: Quarantine, Delete, BC delete, Terminate
4120	LISTENING	--	--	[1156] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
4500	LISTENING	--	--	[760] c:\windows\system32\lsass.exe Script: Quarantine, Delete, BC delete, Terminate
5353	LISTENING	--	--	[892] c:\program files\bonjour\mdnsresponder.exe Script: Quarantine, Delete, BC delete, Terminate
44301	LISTENING	--	--	[336] c:\windows\system32\pnkbstra.exe Script: Quarantine, Delete, BC delete, Terminate