Results of system analysis

Kaspersky Virus Removal Tool 11.0.0.1245 (database released 09/11/2011; 05:35)

List of processes

File name	PID	Description	Copyright	MD5	Information
Detected:39, recognized as trusted 39

Module name	Handle	Description	Copyright	MD5	Used by processes
Modules detected:419, recognized as trusted 419

Kernel Space Modules Viewer

Module	Base address	Size in memory	Description	Manufacturer
C:\WINDOWS\System32\Drivers\dump_atapi.sys Script: Quarantine, Delete, BC delete	A9535000	018000 (98304)
C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Script: Quarantine, Delete, BC delete	F7BD6000	002000 (8192)
Modules detected - 183, recognized as trusted - 181

Services

Service	Description	Status	File	Group	Dependencies
Detected - 109, recognized as trusted - 109

Drivers

Service	Description	Status	File	Group	Dependencies
Abiosdsk Driver: Unload, Delete, Disable, BC delete	Abiosdsk	Not started	Abiosdsk.sys Script: Quarantine, Delete, BC delete	Primary disk
Atdisk Driver: Unload, Delete, Disable, BC delete	Atdisk	Not started	Atdisk.sys Script: Quarantine, Delete, BC delete	Primary disk
catchme Driver: Unload, Delete, Disable, BC delete	catchme	Not started	C:\Combo-Fix\catchme.sys Script: Quarantine, Delete, BC delete	Base
Changer Driver: Unload, Delete, Disable, BC delete	Changer	Not started	Changer.sys Script: Quarantine, Delete, BC delete	Filter
gfppapfa Driver: Unload, Delete, Disable, BC delete	gfppapfa	Not started	C:\WINDOWS\system32\drivers\gfppapfa.sys Script: Quarantine, Delete, BC delete	Boot Bus Extender
lbrtfdc Driver: Unload, Delete, Disable, BC delete	lbrtfdc	Not started	lbrtfdc.sys Script: Quarantine, Delete, BC delete	System Bus Extender
MpKsl33f93f97 Driver: Unload, Delete, Disable, BC delete	MpKsl33f93f97	Not started	C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3E796051-A775-4588-BE59-2B665173A36B}\MpKsl33f93f97.sys Script: Quarantine, Delete, BC delete
MpKsl388355cb Driver: Unload, Delete, Disable, BC delete	MpKsl388355cb	Not started	C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{96CC462F-2D88-4655-A339-A05948C964E9}\MpKsl388355cb.sys Script: Quarantine, Delete, BC delete
MpKsl3d4abc23 Driver: Unload, Delete, Disable, BC delete	MpKsl3d4abc23	Not started	C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F6131274-29A6-4A53-9505-9E2BB1BE6AE4}\MpKsl3d4abc23.sys Script: Quarantine, Delete, BC delete
MpKsl4cfd3d70 Driver: Unload, Delete, Disable, BC delete	MpKsl4cfd3d70	Not started	C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2679BF0B-342A-4181-B461-E4D11D0B1929}\MpKsl4cfd3d70.sys Script: Quarantine, Delete, BC delete
MpKsl54c3dec7 Driver: Unload, Delete, Disable, BC delete	MpKsl54c3dec7	Not started	C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{17041669-C35D-4D96-AAA6-796A6D3438AA}\MpKsl54c3dec7.sys Script: Quarantine, Delete, BC delete
MpKsl677a99d7 Driver: Unload, Delete, Disable, BC delete	MpKsl677a99d7	Not started	C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9886E45A-1361-434E-8BD0-7821AE3D4FC4}\MpKsl677a99d7.sys Script: Quarantine, Delete, BC delete
MpKsl6d2a8641 Driver: Unload, Delete, Disable, BC delete	MpKsl6d2a8641	Not started	C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8DD7EA24-A49B-4312-8370-7A574EAA6CD1}\MpKsl6d2a8641.sys Script: Quarantine, Delete, BC delete
MpKsl7fac141c Driver: Unload, Delete, Disable, BC delete	MpKsl7fac141c	Not started	C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6C529A9D-DCFB-48F8-8206-7A92D8D8D94C}\MpKsl7fac141c.sys Script: Quarantine, Delete, BC delete
MpKsl8b12b195 Driver: Unload, Delete, Disable, BC delete	MpKsl8b12b195	Not started	C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{FF359C3B-261F-4E5F-9C8B-394E4C941F01}\MpKsl8b12b195.sys Script: Quarantine, Delete, BC delete
MpKsla06e061f Driver: Unload, Delete, Disable, BC delete	MpKsla06e061f	Not started	C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F9766469-D6CE-4D35-80F1-36A7362C6470}\MpKsla06e061f.sys Script: Quarantine, Delete, BC delete
MpKsla1e8ec3e Driver: Unload, Delete, Disable, BC delete	MpKsla1e8ec3e	Not started	C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{193580F4-C3FF-4D68-A2D9-A367C46201AD}\MpKsla1e8ec3e.sys Script: Quarantine, Delete, BC delete
MpKsla49e07bd Driver: Unload, Delete, Disable, BC delete	MpKsla49e07bd	Not started	C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{0F20FE75-6411-4141-A5E0-3B0CFBFF8A48}\MpKsla49e07bd.sys Script: Quarantine, Delete, BC delete
MpKslc6364741 Driver: Unload, Delete, Disable, BC delete	MpKslc6364741	Not started	C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{AF2C16D7-8615-4112-A866-EDD1D852F19D}\MpKslc6364741.sys Script: Quarantine, Delete, BC delete
MpKsld241d2f2 Driver: Unload, Delete, Disable, BC delete	MpKsld241d2f2	Not started	C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4E1B0CB4-ED4B-4EF7-8DB6-71C1635E714E}\MpKsld241d2f2.sys Script: Quarantine, Delete, BC delete
MpKsld53b1329 Driver: Unload, Delete, Disable, BC delete	MpKsld53b1329	Not started	C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{61B72680-A348-495B-8638-6C8AE49783F9}\MpKsld53b1329.sys Script: Quarantine, Delete, BC delete
MpKslde2db56c Driver: Unload, Delete, Disable, BC delete	MpKslde2db56c	Not started	C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{5CC03C43-FDF6-4E8C-915E-F2481A146067}\MpKslde2db56c.sys Script: Quarantine, Delete, BC delete
MpKsle42e9b0c Driver: Unload, Delete, Disable, BC delete	MpKsle42e9b0c	Not started	C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6044208F-584B-4DA4-98E1-CFF3518C2A7E}\MpKsle42e9b0c.sys Script: Quarantine, Delete, BC delete
MpKsle8367e5d Driver: Unload, Delete, Disable, BC delete	MpKsle8367e5d	Not started	C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{DF36B1DE-D0A4-4042-AA29-563D801D416C}\MpKsle8367e5d.sys Script: Quarantine, Delete, BC delete
MpKsle93802b1 Driver: Unload, Delete, Disable, BC delete	MpKsle93802b1	Not started	C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3BBF7068-FEE9-443F-9074-CD67BA5B66EC}\MpKsle93802b1.sys Script: Quarantine, Delete, BC delete
MpKslec80f60a Driver: Unload, Delete, Disable, BC delete	MpKslec80f60a	Not started	C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{163EA009-2C21-423E-AE33-55A387D1B8CA}\MpKslec80f60a.sys Script: Quarantine, Delete, BC delete
MpKslf23b2868 Driver: Unload, Delete, Disable, BC delete	MpKslf23b2868	Not started	C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A4F42F6F-A286-4FCF-B8B6-16BD1233507E}\MpKslf23b2868.sys Script: Quarantine, Delete, BC delete
MpKslf43d1c4f Driver: Unload, Delete, Disable, BC delete	MpKslf43d1c4f	Not started	C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{CEA191A3-D4F1-4F8B-A977-A465F7C207D3}\MpKslf43d1c4f.sys Script: Quarantine, Delete, BC delete
MpKslf6f75a62 Driver: Unload, Delete, Disable, BC delete	MpKslf6f75a62	Not started	C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A82D3148-E2E6-4514-A495-7D4B034001C8}\MpKslf6f75a62.sys Script: Quarantine, Delete, BC delete
MpKslf710390a Driver: Unload, Delete, Disable, BC delete	MpKslf710390a	Not started	C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{FAB64744-FC02-4B34-9969-1C7ABBB7BE57}\MpKslf710390a.sys Script: Quarantine, Delete, BC delete
MpKslfea09deb Driver: Unload, Delete, Disable, BC delete	MpKslfea09deb	Not started	C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4220C803-9825-48C5-83F7-A6981C44BAAC}\MpKslfea09deb.sys Script: Quarantine, Delete, BC delete
PCIDump Driver: Unload, Delete, Disable, BC delete	PCIDump	Not started	PCIDump.sys Script: Quarantine, Delete, BC delete	PCI Configuration
PDCOMP Driver: Unload, Delete, Disable, BC delete	PDCOMP	Not started	PDCOMP.sys Script: Quarantine, Delete, BC delete
PDFRAME Driver: Unload, Delete, Disable, BC delete	PDFRAME	Not started	PDFRAME.sys Script: Quarantine, Delete, BC delete
PDRELI Driver: Unload, Delete, Disable, BC delete	PDRELI	Not started	PDRELI.sys Script: Quarantine, Delete, BC delete
PDRFRAME Driver: Unload, Delete, Disable, BC delete	PDRFRAME	Not started	PDRFRAME.sys Script: Quarantine, Delete, BC delete
Simbad Driver: Unload, Delete, Disable, BC delete	Simbad	Not started	Simbad.sys Script: Quarantine, Delete, BC delete	Filter
SNP2STD Driver: Unload, Delete, Disable, BC delete	USB2.0 PC Camera (SNP2STD)	Not started	C:\WINDOWS\system32\DRIVERS\snp2sxp.sys Script: Quarantine, Delete, BC delete
WDICA Driver: Unload, Delete, Disable, BC delete	WDICA	Not started	WDICA.sys Script: Quarantine, Delete, BC delete
Detected - 244, recognized as trusted - 205

Autoruns

File name	Status	Startup method	Description
C:\Documents and Settings\User\Local Settings\temp\_uninst_99208715.bat Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	C:\Documents and Settings\User\Start Menu\Programs\Startup\, C:\Documents and Settings\User\Start Menu\Programs\Startup\_uninst_99208715.lnk,
C:\Program Files\Common Files\Microsoft Shared\DW\DW.EXE Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft Visual Studio Tools for Applications, EventMessageFile
C:\Program Files\Foxit Software\Foxit Reader\Foxit Reader.exe Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Foxit Reader.lnk,
C:\Program Files\Norman\Norman Ad-Aware SE Plus\Ad-Aware.exe Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Internet Explorer\Quick Launch\Ad-Aware SE Plus.lnk,
C:\Program Files\Norman\Norman Ad-Aware SE Plus\Ad-Aware.exe Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Ad-Aware SE Plus.lnk,
C:\WINDOWS\System32\Drivers\lbrtfdc.sys Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\lbrtfdc, EventMessageFile
C:\WINDOWS\System32\PrintFilterPipelineSvc.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PrintFilterPipelineSvc, EventMessageFile
C:\WINDOWS\System32\igmpv2.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile
C:\WINDOWS\System32\ipbootp.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile
C:\WINDOWS\System32\iprip2.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile
C:\WINDOWS\System32\ospf.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPF, EventMessageFile
C:\WINDOWS\System32\ospfmib.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPFMib, EventMessageFile
C:\WINDOWS\System32\polagent.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PolicyAgent, EventMessageFile
C:\WINDOWS\System32\tssdis.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\TermServSessDir, EventMessageFile
C:\WINDOWS\system32\MsSip1.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 1, $DLL Delete
C:\WINDOWS\system32\MsSip2.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 2, $DLL Delete
C:\WINDOWS\system32\MsSip3.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 3, $DLL Delete
C:\WINDOWS\system32\psxss.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
C:\WINDOWS\system32\stisvc.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System, EventMessageFile
SDEvents.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Spybot - Search & Destroy 2, EventMessageFile
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, .DEFAULT\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-19\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-20\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-18\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-21-4025548750-2202908060-4122310945-1005\Control Panel\IOProcs, MVB Delete
vgafix.fon Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon Delete
vgaoem.fon Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon Delete
vgasys.fon Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon Delete
Autoruns items detected - 907, recognized as trusted - 879

Microsoft Internet Explorer extension modules (BHOs, Toolbars ...)

File name	Type	Description	Manufacturer	CLSID
	Extension module			{2670000A-7350-4f3c-8081-5663EE0C6C49} Delete
	Extension module			{92780B25-18CC-41C8-B9BE-3C9C571A8263} Delete
	Extension module			{CD67F990-D8E9-11d2-98FE-00C0F0318AFE} Delete
Elements detected - 10, recognized as trusted - 7

Windows Explorer extension modules

File name	Destination	Description	Manufacturer	CLSID
	Display Panning CPL Extension			{42071714-76d4-11d1-8b24-00a0c9068ff3} Delete
	Shell extensions for file compression			{764BF0E1-F219-11ce-972D-00AA00A14F56} Delete
	Encryption Context Menu			{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} Delete
	Taskbar and Start Menu			{0DF44EAA-FF21-4412-828E-260A8728E7F1} Delete
	User Accounts			{7A9D77BD-5403-11d2-8785-2E0420524153} Delete
	Find and Recover deleted files on you Computer			{0AF221E8-29B6-46EB-B420-DC696F042596} Delete
	PDF-XChange PDF Preview Provider			{CF822AB4-6DB5-4FDA-BC28-E61DF36D2583} Delete
	PDF-XChange PDF Property Handler			{67EB453C-1BE1-48EC-AAF3-23B10277FCC1} Delete
	PDF-XChange PDF Thumbnail Provider			{EBD0B8F4-A9A0-41B7-9695-030CD264D9C8} Delete
	{B2F55D43-C7A4-4B7C-90D7-7A860DFA9F2A}			XCShInfo Delete
	IE User Assist			{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} Delete
Elements detected - 236, recognized as trusted - 225

Printing system extensions (print monitors, providers)

File name	Type	Name	Description	Manufacturer
Elements detected - 10, recognized as trusted - 10

Task Scheduler jobs

File name	Job name	Job status	Description	Manufacturer
Elements detected - 7, recognized as trusted - 7

SPI/LSP settings

Namespace providers (NSP)

Provider	Status	EXE file	Description	GUID
Detected - 5, recognized as trusted - 5

Transport protocol providers (TSP, LSP)

Provider EXE file Description
Detected - 32, recognized as trusted - 32
Results of automatic SPI settings check
LSP settings checked. No errors detected

TCP/UDP ports

Port Status Remote Host Remote Port Application Notes
TCP ports
135 LISTENING 0.0.0.0 2192 [1152] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
139 LISTENING 0.0.0.0 32906 [4] System
Script: Quarantine, Delete, BC delete, Terminate
445 LISTENING 0.0.0.0 16595 [4] System
Script: Quarantine, Delete, BC delete, Terminate
1028 ESTABLISHED 127.0.0.1 5354 [656] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe
Script: Quarantine, Delete, BC delete, Terminate
1036 LISTENING 0.0.0.0 39118 [2732] c:\windows\system32\alg.exe
Script: Quarantine, Delete, BC delete, Terminate
5152 LISTENING 0.0.0.0 38926 [2028] c:\program files\java\jre6\bin\jqs.exe
Script: Quarantine, Delete, BC delete, Terminate
5354 ESTABLISHED 127.0.0.1 1028 [724] c:\program files\bonjour\mdnsresponder.exe
Script: Quarantine, Delete, BC delete, Terminate
5354 LISTENING 0.0.0.0 6214 [724] c:\program files\bonjour\mdnsresponder.exe
Script: Quarantine, Delete, BC delete, Terminate
10004 LISTENING 0.0.0.0 39086 [1132] c:\windows\system32\lxddcoms.exe
Script: Quarantine, Delete, BC delete, Terminate
27015 LISTENING 0.0.0.0 51292 [656] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe
Script: Quarantine, Delete, BC delete, Terminate
32213 LISTENING 0.0.0.0 35004 [3036] c:\program files\last.fm\lastfm.exe
Script: Quarantine, Delete, BC delete, Terminate
33367 LISTENING 0.0.0.0 59413 [3036] c:\program files\last.fm\lastfm.exe
Script: Quarantine, Delete, BC delete, Terminate
UDP ports
123 LISTENING -- -- [1192] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
123 LISTENING -- -- [1192] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
137 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
138 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
445 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
500 LISTENING -- -- [868] c:\windows\system32\lsass.exe
Script: Quarantine, Delete, BC delete, Terminate
1025 LISTENING -- -- [656] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe
Script: Quarantine, Delete, BC delete, Terminate
1026 LISTENING -- -- [656] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe
Script: Quarantine, Delete, BC delete, Terminate
1027 LISTENING -- -- [724] c:\program files\bonjour\mdnsresponder.exe
Script: Quarantine, Delete, BC delete, Terminate
1049 LISTENING -- -- [1192] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
1900 LISTENING -- -- [1436] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
1900 LISTENING -- -- [1436] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
3776 LISTENING -- -- [2100] c:\windows\ehome\mcrdsvc.exe
Script: Quarantine, Delete, BC delete, Terminate
4500 LISTENING -- -- [868] c:\windows\system32\lsass.exe
Script: Quarantine, Delete, BC delete, Terminate
5353 LISTENING -- -- [724] c:\program files\bonjour\mdnsresponder.exe
Script: Quarantine, Delete, BC delete, Terminate

Downloaded Program Files (DPF)

File name Description Manufacturer CLSID Source URL
{E2883E8F-472F-4FB0-9522-AC9BF37916A7}
Delete http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Elements detected - 6, recognized as trusted - 5

Control Panel Applets (CPL)

File name Description Manufacturer
Elements detected - 30, recognized as trusted - 30

Active Setup

File name Description Manufacturer CLSID
Elements detected - 17, recognized as trusted - 17

HOSTS file

Hosts file record
яю1
Clear Hosts file

Protocols and handlers

File name Type Description Manufacturer CLSID
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
Elements detected - 32, recognized as trusted - 29

Suspicious objects

File Description Type
C:\WINDOWS\system32\DRIVERS\5605534drv.sys
Script: Quarantine, Delete, BC delete Suspicion for Rootkit Kernel-mode hook
\SystemRoot\system32\DRIVERS\5605534drv.sys
Script: Quarantine, Delete, BC delete Suspicion for Rootkit Kernel-mode hook
C:\Program Files\kgb\mpk.dll
Script: Quarantine, Delete, BC delete Suspicion by Heuristic analysis HSC: suspicion for File with suspicious name (CH)

Main script of analysis
Windows version: Microsoft Windows XP, Build=2600, SP="Service Pack 3"
System Restore: enabled
1.1 Searching for user-mode API hooks
 Analysis: kernel32.dll, export table found in section .text
IAT modification detected: CreateProcessA - 00B60010<>7C80236B
IAT modification detected: GetModuleFileNameA - 00B60080<>7C80B56F
IAT modification detected: FreeLibrary - 00B600F0<>7C80AC7E
IAT modification detected: GetModuleFileNameW - 00B60160<>7C80B475
IAT modification detected: CreateProcessW - 00B601D0<>7C802336
IAT modification detected: LoadLibraryW - 00B602B0<>7C80AEEB
IAT modification detected: LoadLibraryA - 00B60320<>7C801D7B
IAT modification detected: GetProcAddress - 00B60390<>7C80AE40
 Analysis: ntdll.dll, export table found in section .text
 Analysis: user32.dll, export table found in section .text
 Analysis: advapi32.dll, export table found in section .text
 Analysis: ws2_32.dll, export table found in section .text
 Analysis: wininet.dll, export table found in section .text
 Analysis: rasapi32.dll, export table found in section .text
 Analysis: urlmon.dll, export table found in section .text
 Analysis: netapi32.dll, export table found in section .text
1.2 Searching for kernel-mode API hooks
 Driver loaded successfully
 SDT found (RVA=085700)
 Kernel ntkrnlpa.exe found in memory at address 804D7000
   SDT = 8055C700
   KiST = 80504480 (284)
Function NtAdjustPrivilegesToken (0B) intercepted (805EC464->A8242690), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtClose (19) intercepted (805BC530->A8242F94), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtConnectPort (1F) intercepted (805A45D0->A8243DC8), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateEvent (23) intercepted (8060EF4E->A8244312), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateFile (25) intercepted (805790A8->A8243270), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateKey (29) intercepted (806240F0->A8241500), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateMutant (2B) intercepted (8061769E->A82441F8), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateNamedPipeFile (2C) intercepted (805790E2->A824227E), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreatePort (2E) intercepted (805A50EC->A82440CC), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateSection (32) intercepted (805AB3C8->A8242426), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateSemaphore (33) intercepted (8061504E->A8244432), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateThread (35) intercepted (805D1018->A8242C1C), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateWaitablePort (38) intercepted (805A5110->A8244162), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDebugActiveProcess (39) intercepted (80643B30->A8245B1A), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDeleteKey (3F) intercepted (8062458C->A8241B0A), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDeleteValueKey (41) intercepted (8062475C->A8241EBE), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDeviceIoControlFile (42) intercepted (8057926E->A82436F2), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDuplicateObject (44) intercepted (805BE008->A8246D26), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtEnumerateKey (47) intercepted (8062493C->A824200A), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtEnumerateValueKey (49) intercepted (80624BA6->A82420A2), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtFsControlFile (54) intercepted (805792A2->A8243500), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtLoadDriver (61) intercepted (80584160->A8245C0C), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtLoadKey (62) intercepted (80626314->A82414DC), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtLoadKey2 (63) intercepted (80625F20->A82414EE), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtMapViewOfSection (6C) intercepted (805B203A->A8246374), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtNotifyChangeKey (6F) intercepted (806262DE->A82421CE), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenEvent (72) intercepted (8060F04E->A82443A8), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenFile (74) intercepted (8057A1A6->A8243016), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenKey (77) intercepted (806254CE->A82416C0), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenMutant (78) intercepted (80617776->A8244288), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenProcess (7A) intercepted (805CB440->A82428CC), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenSection (7D) intercepted (805AA3EC->A824610E), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenSemaphore (7E) intercepted (80615148->A82444C8), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenThread (80) intercepted (805CB6CC->A82427BE), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQueryKey (A0) intercepted (80625810->A824213A), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQueryMultipleValueKey (A1) intercepted (8062323E->A8241D72), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQuerySection (A7) intercepted (805B85E0->A82466AE), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQueryValueKey (B1) intercepted (80622314->A824199C), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQueueApcThread (B4) intercepted (805D1276->A8245FA0), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtRenameKey (C0) intercepted (80623B12->A8241C2C), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtReplaceKey (C1) intercepted (806261C4->A8240F16), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtReplyPort (C2) intercepted (805A54EC->A824482C), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtReplyWaitReceivePort (C3) intercepted (805A64B4->A82446F2), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtRequestWaitReplyPort (C8) intercepted (805A2D76->A82458B4), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtRestoreKey (CC) intercepted (80625AD0->A824128E), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtResumeThread (CE) intercepted (805D49BA->A8246BC8), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSaveKey (CF) intercepted (80625BCC->A8240EAE), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSecureConnectPort (D2) intercepted (805A3D64->A8243B0E), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetContextThread (D5) intercepted (805D173A->A8242E38), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetInformationToken (E6) intercepted (805FA7B4->A8245154), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetSecurityObject (ED) intercepted (805C062E->A8245DAA), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetSystemInformation (F0) intercepted (8060FD06->A82467FE), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetValueKey (F7) intercepted (80622662->A8241816), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSuspendProcess (FD) intercepted (805D4A82->A82468F0), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSuspendThread (FE) intercepted (805D48F4->A8246A2A), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSystemDebugControl (FF) intercepted (806180BA->A8245A3E), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtTerminateProcess (101) intercepted (805D29E2->A8242A68), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtTerminateThread (102) intercepted (805D2BDC->A82429C8), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtUnmapViewOfSection (10B) intercepted (805B2E48->A8246552), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtWriteVirtualMemory (115) intercepted (805B43CC->A8242B52), hook C:\WINDOWS\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function FsRtlCheckLockForReadAccess (804EAF84) - machine code modification Method of JmpTo. jmp A8234FD0 \SystemRoot\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
Function IoIsOperationSynchronous (804EF912) - machine code modification Method of JmpTo. jmp A82353AC \SystemRoot\system32\DRIVERS\5605534drv.sys, driver recognized as trusted
>>> Function restored successfully !
Functions checked: 284, intercepted: 60, restored: 62
1.3 Checking IDT and SYSENTER
 Analysis for CPU 1
 Analysis for CPU 2
CmpCallCallBacks = 00093D84
Disable callback OK
 Checking IDT and SYSENTER - complete
1.4 Searching for masking processes and drivers
 Checking not performed: extended monitoring driver (AVZPM) is not installed
1.5 Checking of IRP handlers
 Driver loaded successfully
 Checking - complete
>>> C:\Program Files\kgb\mpk.dll HSC: suspicion for File with suspicious name (CH)
>> Services: potentially dangerous service allowed: RemoteRegistry (Remote Registry)
>> Services: potentially dangerous service allowed: TermService (Terminal Services)
>> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery Service)
>> Services: potentially dangerous service allowed: TlntSvr (Telnet)
>> Services: potentially dangerous service allowed: Schedule (Task Scheduler)
>> Services: potentially dangerous service allowed: mnmsrvc (NetMeeting Remote Desktop Sharing)
>> Services: potentially dangerous service allowed: RDSessMgr (Remote Desktop Help Session Manager)
> Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)!
>> Security: disk drives' autorun is enabled
>> Security: administrative shares (C$, D$ ...) are enabled
>> Security: anonymous user access is enabled
>> Security: sending Remote Assistant queries is enabled
 >>  Disable HDD autorun
 >>  Disable autorun from network drives
 >>  Disable CD/DVD autorun
 >>  Disable removable media autorun
 >>  Windows Explorer - show extensions of known file types
System Analysis in progress

 System Analysis - complete


Script commands 
Add commands to script:
Blocking hooks using Anti-Rootkit
Enable AVZGuard
Operations with AVZPM (true=enable,false=disable)
BootCleaner - import list of deleted files
BootCleaner - import all
Registry cleanup after deleting files
ExecuteWizard ('TSW',2,3,true) - Running Troubleshooting wizard
BootCleaner - activate
Reboot
Insert template for QuarantineFile() - quarantining file
Insert template for BC_QrFile() - quarantining file via BootCleaner
Insert template for DeleteFile() - deleting file
Insert template for DelCLSID() - deleting CLSID item from registry
Additional operations:Performance tweaking: disable service RemoteRegistry (Remote Registry)
Performance tweaking: disable service TermService (Terminal Services)
Performance tweaking: disable service SSDPSRV (SSDP Discovery Service)
Performance tweaking: disable service TlntSvr (Telnet)
Performance tweaking: disable service Schedule (Task Scheduler)
Performance tweaking: disable service mnmsrvc (NetMeeting Remote Desktop Sharing)
Performance tweaking: disable service RDSessMgr (Remote Desktop Help Session Manager)
Security tweaking: disable CD autorun
Security tweaking: disable administrative shares
Security tweaking: disable anonymous user access
Security: disable sending Remote Assistant queries

File list

Port	Status	Remote Host	Remote Port	Application	Notes
TCP ports
135	LISTENING	0.0.0.0	2192	[1152] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
139	LISTENING	0.0.0.0	32906	[4] System Script: Quarantine, Delete, BC delete, Terminate
445	LISTENING	0.0.0.0	16595	[4] System Script: Quarantine, Delete, BC delete, Terminate
1028	ESTABLISHED	127.0.0.1	5354	[656] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe Script: Quarantine, Delete, BC delete, Terminate
1036	LISTENING	0.0.0.0	39118	[2732] c:\windows\system32\alg.exe Script: Quarantine, Delete, BC delete, Terminate
5152	LISTENING	0.0.0.0	38926	[2028] c:\program files\java\jre6\bin\jqs.exe Script: Quarantine, Delete, BC delete, Terminate
5354	ESTABLISHED	127.0.0.1	1028	[724] c:\program files\bonjour\mdnsresponder.exe Script: Quarantine, Delete, BC delete, Terminate
5354	LISTENING	0.0.0.0	6214	[724] c:\program files\bonjour\mdnsresponder.exe Script: Quarantine, Delete, BC delete, Terminate
10004	LISTENING	0.0.0.0	39086	[1132] c:\windows\system32\lxddcoms.exe Script: Quarantine, Delete, BC delete, Terminate
27015	LISTENING	0.0.0.0	51292	[656] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe Script: Quarantine, Delete, BC delete, Terminate
32213	LISTENING	0.0.0.0	35004	[3036] c:\program files\last.fm\lastfm.exe Script: Quarantine, Delete, BC delete, Terminate
33367	LISTENING	0.0.0.0	59413	[3036] c:\program files\last.fm\lastfm.exe Script: Quarantine, Delete, BC delete, Terminate
UDP ports
123	LISTENING	--	--	[1192] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
123	LISTENING	--	--	[1192] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
137	LISTENING	--	--	[4] System Script: Quarantine, Delete, BC delete, Terminate
138	LISTENING	--	--	[4] System Script: Quarantine, Delete, BC delete, Terminate
445	LISTENING	--	--	[4] System Script: Quarantine, Delete, BC delete, Terminate
500	LISTENING	--	--	[868] c:\windows\system32\lsass.exe Script: Quarantine, Delete, BC delete, Terminate
1025	LISTENING	--	--	[656] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe Script: Quarantine, Delete, BC delete, Terminate
1026	LISTENING	--	--	[656] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe Script: Quarantine, Delete, BC delete, Terminate
1027	LISTENING	--	--	[724] c:\program files\bonjour\mdnsresponder.exe Script: Quarantine, Delete, BC delete, Terminate
1049	LISTENING	--	--	[1192] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
1900	LISTENING	--	--	[1436] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
1900	LISTENING	--	--	[1436] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
3776	LISTENING	--	--	[2100] c:\windows\ehome\mcrdsvc.exe Script: Quarantine, Delete, BC delete, Terminate
4500	LISTENING	--	--	[868] c:\windows\system32\lsass.exe Script: Quarantine, Delete, BC delete, Terminate
5353	LISTENING	--	--	[724] c:\program files\bonjour\mdnsresponder.exe Script: Quarantine, Delete, BC delete, Terminate