Results of system analysis

Kaspersky Virus Removal Tool 11.0.0.1245 (database released 28/11/2011; 07:04)

List of processes

File name	PID	Description	Copyright	MD5	Information
c:\windows\explorer.exe Script: Quarantine, Delete, BC delete, Terminate	32248	Windows Explorer	© Microsoft Corporation. All rights reserved.	??	2579.00 kb, rsAh, created: 27.05.2011 04:35:33, modified: 20.11.2010 16:29:20 Command line: C:\WINDOWS\EXPLORER.EXE
c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate	1200	Host Process for Windows Services	© Microsoft Corporation. All rights reserved.	??	44.50 kb, rsAh, created: 13.07.2009 18:19:28, modified: 20.11.2010 16:29:20 Command line: C:\Windows\system32\svchost.exe -k netsvcs
c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate	944	Host Process for Windows Services	© Microsoft Corporation. All rights reserved.	??	44.50 kb, rsAh, created: 13.07.2009 18:19:28, modified: 20.11.2010 16:29:20 Command line: C:\Windows\system32\svchost.exe -k SDRSVC
c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate	1344	Host Process for Windows Services	© Microsoft Corporation. All rights reserved.	??	44.50 kb, rsAh, created: 13.07.2009 18:19:28, modified: 20.11.2010 16:29:20 Command line: C:\Windows\system32\svchost.exe -k LocalService
c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate	904	Host Process for Windows Services	© Microsoft Corporation. All rights reserved.	??	44.50 kb, rsAh, created: 13.07.2009 18:19:28, modified: 20.11.2010 16:29:20 Command line: C:\Windows\system32\svchost.exe -k DcomLaunch
c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate	1480	Host Process for Windows Services	© Microsoft Corporation. All rights reserved.	??	44.50 kb, rsAh, created: 13.07.2009 18:19:28, modified: 20.11.2010 16:29:20 Command line: C:\Windows\system32\svchost.exe -k NetworkService
c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate	1004	Host Process for Windows Services	© Microsoft Corporation. All rights reserved.	??	44.50 kb, rsAh, created: 13.07.2009 18:19:28, modified: 20.11.2010 16:29:20 Command line: C:\Windows\system32\svchost.exe -k RPCSS
c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate	1708	Host Process for Windows Services	© Microsoft Corporation. All rights reserved.	??	44.50 kb, rsAh, created: 13.07.2009 18:19:28, modified: 20.11.2010 16:29:20 Command line: C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate	1080	Host Process for Windows Services	© Microsoft Corporation. All rights reserved.	??	44.50 kb, rsAh, created: 13.07.2009 18:19:28, modified: 20.11.2010 16:29:20 Command line: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate	1148	Host Process for Windows Services	© Microsoft Corporation. All rights reserved.	??	44.50 kb, rsAh, created: 13.07.2009 18:19:28, modified: 20.11.2010 16:29:20 Command line: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate	1988	Host Process for Windows Services	© Microsoft Corporation. All rights reserved.	??	44.50 kb, rsAh, created: 13.07.2009 18:19:28, modified: 20.11.2010 16:29:20 Command line: C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate	2044	Host Process for Windows Services	© Microsoft Corporation. All rights reserved.	??	44.50 kb, rsAh, created: 13.07.2009 18:19:28, modified: 20.11.2010 16:29:20 Command line: C:\Windows\system32\svchost.exe -k imgsvc
c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate	3540	Host Process for Windows Services	© Microsoft Corporation. All rights reserved.	??	44.50 kb, rsAh, created: 13.07.2009 18:19:28, modified: 20.11.2010 16:29:20 Command line: C:\Windows\System32\svchost.exe -k LocalServicePeerNet
c:\windows\system32\winlogon.exe Script: Quarantine, Delete, BC delete, Terminate	796	Windows Logon Application	© Microsoft Corporation. All rights reserved.	??	304.00 kb, rsAh, created: 20.11.2010 16:29:06, modified: 20.11.2010 16:29:20 Command line: winlogon.exe
Detected:68, recognized as trusted 54

Module name	Handle	Description	Copyright	MD5	Used by processes
Modules detected:574, recognized as trusted 574

Kernel Space Modules Viewer

Module	Base address	Size in memory	Description	Manufacturer
C:\Windows\System32\Drivers\dump_diskdump.sys Script: Quarantine, Delete, BC delete	92C63000	00A000 (40960)
C:\Windows\System32\Drivers\dump_dumpfve.sys Script: Quarantine, Delete, BC delete	92C83000	011000 (69632)
C:\Windows\System32\Drivers\dump_SI3112.sys Script: Quarantine, Delete, BC delete	92C6D000	016000 (90112)
Modules detected - 173, recognized as trusted - 170

Services

Service	Description	Status	File	Group	Dependencies
AudioEndpointBuilder Service: Stop, Delete, Disable, BC delete	Windows Audio Endpoint Builder	Running	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete	AudioGroup	PlugPlay
Audiosrv Service: Stop, Delete, Disable, BC delete	Windows Audio	Running	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete	AudioGroup	AudioEndpointBuilder
BFE Service: Stop, Delete, Disable, BC delete	Base Filtering Engine	Running	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete	NetworkProvider	RpcSs
BITS Service: Stop, Delete, Disable, BC delete	Background Intelligent Transfer Service	Running	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete		RpcSs
Browser Service: Stop, Delete, Disable, BC delete	Computer Browser	Running	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete	NetworkProvider	LanmanWorkstation
CryptSvc Service: Stop, Delete, Disable, BC delete	Cryptographic Services	Running	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete		RpcSs
DcomLaunch Service: Stop, Delete, Disable, BC delete	DCOM Server Process Launcher	Running	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete	COM Infrastructure
Dhcp Service: Stop, Delete, Disable, BC delete	DHCP Client	Running	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete	TDI	NSI
Dnscache Service: Stop, Delete, Disable, BC delete	DNS Client	Running	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete	TDI	Tdx
DPS Service: Stop, Delete, Disable, BC delete	Diagnostic Policy Service	Running	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete
eventlog Service: Stop, Delete, Disable, BC delete	Windows Event Log	Running	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete	Event Log
EventSystem Service: Stop, Delete, Disable, BC delete	COM+ Event System	Running	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete		rpcss
fdPHost Service: Stop, Delete, Disable, BC delete	Function Discovery Provider Host	Running	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete		RpcSs
FDResPub Service: Stop, Delete, Disable, BC delete	Function Discovery Resource Publication	Running	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete		RpcSs
FontCache Service: Stop, Delete, Disable, BC delete	Windows Font Cache Service	Running	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete
gpsvc Service: Stop, Delete, Disable, BC delete	Group Policy Client	Running	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete	ProfSvc_Group	RPCSS
HomeGroupListener Service: Stop, Delete, Disable, BC delete	HomeGroup Listener	Running	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete		LanmanServer
HomeGroupProvider Service: Stop, Delete, Disable, BC delete	HomeGroup Provider	Running	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete		netprofm
LanmanServer Service: Stop, Delete, Disable, BC delete	Server	Running	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete		SamSS
LanmanWorkstation Service: Stop, Delete, Disable, BC delete	Workstation	Running	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete	NetworkProvider	Bowser
lmhosts Service: Stop, Delete, Disable, BC delete	TCP/IP NetBIOS Helper	Running	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete	TDI	NetBT
MpsSvc Service: Stop, Delete, Disable, BC delete	Windows Firewall	Running	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete	NetworkProvider	mpsdrv
Netman Service: Stop, Delete, Disable, BC delete	Network Connections	Running	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete		RpcSs
netprofm Service: Stop, Delete, Disable, BC delete	Network List Service	Running	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete		RpcSs
NlaSvc Service: Stop, Delete, Disable, BC delete	Network Location Awareness	Running	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete		NSI
nsi Service: Stop, Delete, Disable, BC delete	Network Store Interface Service	Running	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete		nsiproxy
p2pimsvc Service: Stop, Delete, Disable, BC delete	Peer Networking Identity Manager	Running	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete
p2psvc Service: Stop, Delete, Disable, BC delete	Peer Networking Grouping	Running	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete		p2pimsvc
PcaSvc Service: Stop, Delete, Disable, BC delete	Program Compatibility Assistant Service	Running	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete		RpcSs
PlugPlay Service: Stop, Delete, Disable, BC delete	Plug and Play	Running	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete	PlugPlay
PNRPsvc Service: Stop, Delete, Disable, BC delete	Peer Name Resolution Protocol	Running	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete		p2pimsvc
Power Service: Stop, Delete, Disable, BC delete	Power	Running	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete	Plugplay
ProfSvc Service: Stop, Delete, Disable, BC delete	User Profile Service	Running	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete	profsvc_group	RpcSs
RpcEptMapper Service: Stop, Delete, Disable, BC delete	RPC Endpoint Mapper	Running	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete	COM Infrastructure
RpcSs Service: Stop, Delete, Disable, BC delete	Remote Procedure Call (RPC)	Running	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete	COM Infrastructure	RpcEptMapper
Schedule Service: Stop, Delete, Disable, BC delete	Task Scheduler	Running	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete	SchedulerGroup	RPCSS
SDRSVC Service: Stop, Delete, Disable, BC delete	Windows Backup	Running	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete		RPCSS
seclogon Service: Stop, Delete, Disable, BC delete	Secondary Logon	Running	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete
SENS Service: Stop, Delete, Disable, BC delete	System Event Notification Service	Running	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete	ProfSvc_Group	EventSystem
ShellHWDetection Service: Stop, Delete, Disable, BC delete	Shell Hardware Detection	Running	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete	ShellSvcGroup	RpcSs
sppuinotify Service: Stop, Delete, Disable, BC delete	SPP Notification Service	Running	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete		EventSystem
SSDPSRV Service: Stop, Delete, Disable, BC delete	SSDP Discovery	Running	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete		HTTP
StiSvc Service: Stop, Delete, Disable, BC delete	Windows Image Acquisition (WIA)	Running	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete		RpcSs
SysMain Service: Stop, Delete, Disable, BC delete	Superfetch	Running	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete		rpcss
Themes Service: Stop, Delete, Disable, BC delete	Themes	Running	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete	ProfSvc_Group
WdiServiceHost Service: Stop, Delete, Disable, BC delete	Diagnostic Service Host	Running	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete
Winmgmt Service: Stop, Delete, Disable, BC delete	Windows Management Instrumentation	Running	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete		RPCSS
wscsvc Service: Stop, Delete, Disable, BC delete	Security Center	Running	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete		RpcSs
wuauserv Service: Stop, Delete, Disable, BC delete	Windows Update	Running	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete		rpcss
wudfsvc Service: Stop, Delete, Disable, BC delete	Windows Driver Foundation - User-mode Driver Framework	Running	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete	PlugPlay	PlugPlay
AeLookupSvc Service: Stop, Delete, Disable, BC delete	Application Experience	Not started	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete
AppIDSvc Service: Stop, Delete, Disable, BC delete	Application Identity	Not started	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete	ProfSvc_Group	RpcSs
Appinfo Service: Stop, Delete, Disable, BC delete	Application Information	Not started	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete		RpcSs
AppMgmt Service: Stop, Delete, Disable, BC delete	Application Management	Not started	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete
AxInstSV Service: Stop, Delete, Disable, BC delete	ActiveX Installer (AxInstSV)	Not started	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete		rpcss
BDESVC Service: Stop, Delete, Disable, BC delete	BitLocker Drive Encryption Service	Not started	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete
bthserv Service: Stop, Delete, Disable, BC delete	Bluetooth Support Service	Not started	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete		RpcSs
CertPropSvc Service: Stop, Delete, Disable, BC delete	Certificate Propagation	Not started	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete		RpcSs
CscService Service: Stop, Delete, Disable, BC delete	Offline Files	Not started	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete	ProfSvc_Group	RpcSs
defragsvc Service: Stop, Delete, Disable, BC delete	Disk Defragmenter	Not started	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete		RPCSS
dot3svc Service: Stop, Delete, Disable, BC delete	Wired AutoConfig	Not started	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete	TDI	RpcSs
EapHost Service: Stop, Delete, Disable, BC delete	Extensible Authentication Protocol	Not started	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete		RPCSS
hidserv Service: Stop, Delete, Disable, BC delete	Human Interface Device Access	Not started	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete
hkmsvc Service: Stop, Delete, Disable, BC delete	Health Key and Certificate Management	Not started	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete		RpcSs
IKEEXT Service: Stop, Delete, Disable, BC delete	IKE and AuthIP IPsec Keying Modules	Not started	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete		BFE
IPBusEnum Service: Stop, Delete, Disable, BC delete	PnP-X IP Bus Enumerator	Not started	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete		RpcSs
iphlpsvc Service: Stop, Delete, Disable, BC delete	IP Helper	Not started	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete		RpcSS
KtmRm Service: Stop, Delete, Disable, BC delete	KtmRm for Distributed Transaction Coordinator	Not started	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete		RPCSS
lltdsvc Service: Stop, Delete, Disable, BC delete	Link-Layer Topology Discovery Mapper	Not started	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete		rpcss
MMCSS Service: Stop, Delete, Disable, BC delete	Multimedia Class Scheduler	Not started	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete
MSiSCSI Service: Stop, Delete, Disable, BC delete	Microsoft iSCSI Initiator Service	Not started	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete	iSCSI
napagent Service: Stop, Delete, Disable, BC delete	Network Access Protection Agent	Not started	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete		RpcSs
PeerDistSvc Service: Stop, Delete, Disable, BC delete	BranchCache	Not started	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete		http
pla Service: Stop, Delete, Disable, BC delete	Performance Logs & Alerts	Not started	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete		RPCSS
PNRPAutoReg Service: Stop, Delete, Disable, BC delete	PNRP Machine Name Publication Service	Not started	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete		pnrpsvc
PolicyAgent Service: Stop, Delete, Disable, BC delete	IPsec Policy Agent	Not started	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete		Tcpip
QWAVE Service: Stop, Delete, Disable, BC delete	Quality Windows Audio Video Experience	Not started	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete		rpcss
RasAuto Service: Stop, Delete, Disable, BC delete	Remote Access Auto Connection Manager	Not started	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete		RasMan
RasMan Service: Stop, Delete, Disable, BC delete	Remote Access Connection Manager	Not started	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete		Tapisrv
RemoteAccess Service: Stop, Delete, Disable, BC delete	Routing and Remote Access	Not started	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete		RpcSS
RemoteRegistry Service: Stop, Delete, Disable, BC delete	Remote Registry	Not started	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete		RPCSS
SCardSvr Service: Stop, Delete, Disable, BC delete	Smart Card	Not started	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete	SmartCardGroup	PlugPlay
SCPolicySvc Service: Stop, Delete, Disable, BC delete	Smart Card Removal Policy	Not started	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete		RpcSs
SensrSvc Service: Stop, Delete, Disable, BC delete	Adaptive Brightness	Not started	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete
SessionEnv Service: Stop, Delete, Disable, BC delete	Remote Desktop Configuration	Not started	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete		RPCSS
SharedAccess Service: Stop, Delete, Disable, BC delete	Internet Connection Sharing (ICS)	Not started	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete		Netman
SstpSvc Service: Stop, Delete, Disable, BC delete	Secure Socket Tunneling Protocol Service	Not started	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete
StorSvc Service: Stop, Delete, Disable, BC delete	Storage Service	Not started	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete
swprv Service: Stop, Delete, Disable, BC delete	Microsoft Software Shadow Copy Provider	Not started	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete		RPCSS
TabletInputService Service: Stop, Delete, Disable, BC delete	Tablet PC Input Service	Not started	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete	PlugPlay	PlugPlay
TapiSrv Service: Stop, Delete, Disable, BC delete	Telephony	Not started	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete		PlugPlay
TBS Service: Stop, Delete, Disable, BC delete	TPM Base Services	Not started	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete
TermService Service: Stop, Delete, Disable, BC delete	Remote Desktop Services	Not started	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete		RPCSS
THREADORDER Service: Stop, Delete, Disable, BC delete	Thread Ordering Server	Not started	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete
TrkWks Service: Stop, Delete, Disable, BC delete	Distributed Link Tracking Client	Not started	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete		RpcSs
UmRdpService Service: Stop, Delete, Disable, BC delete	Remote Desktop Services UserMode Port Redirector	Not started	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete		TermService
upnphost Service: Stop, Delete, Disable, BC delete	UPnP Device Host	Not started	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete		SSDPSRV
UxSms Service: Stop, Delete, Disable, BC delete	Desktop Window Manager Session Manager	Not started	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete	UIGroup
W32Time Service: Stop, Delete, Disable, BC delete	Windows Time	Not started	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete
WbioSrvc Service: Stop, Delete, Disable, BC delete	Windows Biometric Service	Not started	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete	SmartCardGroup	RpcSs
wcncsvc Service: Stop, Delete, Disable, BC delete	Windows Connect Now - Config Registrar	Not started	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete		rpcss
WcsPlugInService Service: Stop, Delete, Disable, BC delete	Windows Color System	Not started	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete		RpcSs
WdiSystemHost Service: Stop, Delete, Disable, BC delete	Diagnostic System Host	Not started	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete
WebClient Service: Stop, Delete, Disable, BC delete	WebClient	Not started	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete	NetworkProvider	MRxDAV
Wecsvc Service: Stop, Delete, Disable, BC delete	Windows Event Collector	Not started	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete		HTTP
wercplsupport Service: Stop, Delete, Disable, BC delete	Problem Reports and Solutions Control Panel Support	Not started	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete
WerSvc Service: Stop, Delete, Disable, BC delete	Windows Error Reporting Service	Not started	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete
WinDefend Service: Stop, Delete, Disable, BC delete	Windows Defender	Not started	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete		RpcSs
WinHttpAutoProxySvc Service: Stop, Delete, Disable, BC delete	WinHTTP Web Proxy Auto-Discovery Service	Not started	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete		Dhcp
WinRM Service: Stop, Delete, Disable, BC delete	Windows Remote Management (WS-Management)	Not started	C:\Windows\System32\svchost.exe Script: Quarantine, Delete, BC delete		RPCSS
Wlansvc Service: Stop, Delete, Disable, BC delete	WLAN AutoConfig	Not started	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete	TDI	nativewifip
WPCSvc Service: Stop, Delete, Disable, BC delete	Parental Controls	Not started	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete		RpcSs
WPDBusEnum Service: Stop, Delete, Disable, BC delete	Portable Device Enumerator Service	Not started	C:\Windows\system32\svchost.exe Script: Quarantine, Delete, BC delete		RpcSs
Detected - 147, recognized as trusted - 34

Drivers

Service	Description	Status	File	Group	Dependencies
VGPU Driver: Unload, Delete, Disable, BC delete	VGPU	Not started	C:\Windows\system32\drivers\rdvgkmd.sys Script: Quarantine, Delete, BC delete
Detected - 271, recognized as trusted - 270

Autoruns

File name	Status	Startup method	Description
C:\Perl\bin\PerlMsg.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\PerlMsg, EventMessageFile
C:\Program Files\TightVNC\WinVNC.exe Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	C:\Users\oh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\, C:\Users\oh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Launch TightVNC Server.lnk,
C:\Users\oh\AppData\Local\Temp\_uninst_35891284.bat Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	C:\Users\oh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\, C:\Users\oh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_uninst_35891284.lnk,
C:\Windows\System32\winlogon.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Winlogon, EventMessageFile
C:\Windows\System32\winlogon.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Wlclntfy, EventMessageFile
C:\Windows\system32\psxss.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
C:\Windows\system32\winlogon.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Winlogon, EventMessageFile
progman.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, shell Delete
vgafix.fon Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon Delete
vgaoem.fon Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon Delete
vgasys.fon Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon Delete
Autoruns items detected - 598, recognized as trusted - 587

Microsoft Internet Explorer extension modules (BHOs, Toolbars ...)

File name	Type	Description	Manufacturer	CLSID
Elements detected - 2, recognized as trusted - 2

Windows Explorer extension modules

File name	Destination	Description	Manufacturer	CLSID
	WebCheck			{E6FB5E20-DE35-11CF-9C87-00AA005127ED} Delete
	AVG Find Extension			{9F97547E-460A-42C5-AE0C-81C61FFAEBC3} Delete
Elements detected - 19, recognized as trusted - 17

Printing system extensions (print monitors, providers)

File name	Type	Name	Description	Manufacturer
Elements detected - 7, recognized as trusted - 7

Task Scheduler jobs

File name	Job name	Job status	Description	Manufacturer
Elements detected - 2, recognized as trusted - 2

SPI/LSP settings

Namespace providers (NSP)

Provider	Status	EXE file	Description	GUID
Detected - 6, recognized as trusted - 6

Transport protocol providers (TSP, LSP)

Provider EXE file Description
Detected - 20, recognized as trusted - 20
Results of automatic SPI settings check
LSP settings checked. No errors detected

TCP/UDP ports

Port Status Remote Host Remote Port Application Notes
TCP ports
135 LISTENING 0.0.0.0 0 [1004] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
139 LISTENING 0.0.0.0 0 [4] System
Script: Quarantine, Delete, BC delete, Terminate
445 LISTENING 0.0.0.0 0 [4] System
Script: Quarantine, Delete, BC delete, Terminate
445 ESTABLISHED 68.167.161.182 56610 [4] System
Script: Quarantine, Delete, BC delete, Terminate
445 ESTABLISHED 68.167.161.182 64480 [4] System
Script: Quarantine, Delete, BC delete, Terminate
5357 LISTENING 0.0.0.0 0 [4] System
Script: Quarantine, Delete, BC delete, Terminate
5800 LISTENING 0.0.0.0 0 [568] c:\program files\realvnc\vnc4\winvnc4.exe
Script: Quarantine, Delete, BC delete, Terminate
5900 LISTENING 0.0.0.0 0 [568] c:\program files\realvnc\vnc4\winvnc4.exe
Script: Quarantine, Delete, BC delete, Terminate
10000 LISTENING 0.0.0.0 0 [2716] c:\program files\utorrent\utorrent.exe
Script: Quarantine, Delete, BC delete, Terminate
10370 LISTENING 0.0.0.0 0 [2716] c:\program files\utorrent\utorrent.exe
Script: Quarantine, Delete, BC delete, Terminate
49152 LISTENING 0.0.0.0 0 [656] c:\windows\system32\wininit.exe
Script: Quarantine, Delete, BC delete, Terminate
49153 LISTENING 0.0.0.0 0 [1080] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
49154 LISTENING 0.0.0.0 0 [1200] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
49155 LISTENING 0.0.0.0 0 [720] c:\windows\system32\lsass.exe
Script: Quarantine, Delete, BC delete, Terminate
49156 ESTABLISHED 68.167.161.182 64657 [1648] c:\windows\system32\spoolsv.exe
Script: Quarantine, Delete, BC delete, Terminate
49156 LISTENING 0.0.0.0 0 [1648] c:\windows\system32\spoolsv.exe
Script: Quarantine, Delete, BC delete, Terminate
49157 LISTENING 0.0.0.0 0 [712] c:\windows\system32\services.exe
Script: Quarantine, Delete, BC delete, Terminate
54440 TIME_WAIT 85.17.156.78 80 [0]
54515 ESTABLISHED 72.14.204.83 443 [960] c:\users\oh\appdata\local\google\chrome\application\chrome.exe
Script: Quarantine, Delete, BC delete, Terminate
54557 ESTABLISHED 68.167.161.182 445 [4] System
Script: Quarantine, Delete, BC delete, Terminate
54558 ESTABLISHED 68.167.161.182 139 [4] System
Script: Quarantine, Delete, BC delete, Terminate
56957 ESTABLISHED 68.167.161.182 445 [4] System
Script: Quarantine, Delete, BC delete, Terminate
60033 LISTENING 0.0.0.0 0 [2296] c:\users\oh\appdata\local\google\google talk plugin\googletalkplugin.exe
Script: Quarantine, Delete, BC delete, Terminate
60033 ESTABLISHED 127.0.0.1 60037 [2296] c:\users\oh\appdata\local\google\google talk plugin\googletalkplugin.exe
Script: Quarantine, Delete, BC delete, Terminate
60037 ESTABLISHED 127.0.0.1 60033 [24752] c:\users\oh\appdata\local\google\chrome\application\chrome.exe
Script: Quarantine, Delete, BC delete, Terminate
UDP ports
137 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
138 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
1900 LISTENING -- -- [1988] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
1900 LISTENING -- -- [2716] c:\program files\utorrent\utorrent.exe
Script: Quarantine, Delete, BC delete, Terminate
1900 LISTENING -- -- [1988] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
3702 LISTENING -- -- [1344] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
3702 LISTENING -- -- [1344] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
3702 LISTENING -- -- [1988] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
3702 LISTENING -- -- [1988] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
5355 LISTENING -- -- [1480] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
10370 LISTENING -- -- [2716] c:\program files\utorrent\utorrent.exe
Script: Quarantine, Delete, BC delete, Terminate
51565 LISTENING -- -- [1988] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
51633 LISTENING -- -- [31464] c:\program files\internet explorer\iexplore.exe
Script: Quarantine, Delete, BC delete, Terminate
51634 LISTENING -- -- [29260] c:\program files\internet explorer\iexplore.exe
Script: Quarantine, Delete, BC delete, Terminate
56978 LISTENING -- -- [1344] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
61251 LISTENING -- -- [31152] c:\program files\internet explorer\iexplore.exe
Script: Quarantine, Delete, BC delete, Terminate
61252 LISTENING -- -- [30264] c:\program files\internet explorer\iexplore.exe
Script: Quarantine, Delete, BC delete, Terminate
61760 LISTENING -- -- [1988] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
61761 LISTENING -- -- [1988] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate

Downloaded Program Files (DPF)

File name Description Manufacturer CLSID Source URL
Elements detected - 3, recognized as trusted - 3

Control Panel Applets (CPL)

File name Description Manufacturer
Elements detected - 22, recognized as trusted - 22

Active Setup

File name Description Manufacturer CLSID
Elements detected - 9, recognized as trusted - 9

HOSTS file

Hosts file record
яю#
Clear Hosts file

Protocols and handlers

File name Type Description Manufacturer CLSID
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
Elements detected - 14, recognized as trusted - 11

Suspicious objects

File Description Type
C:\Windows\system32\DRIVERS\AVGIDSShim.Sys
Script: Quarantine, Delete, BC delete Suspicion for Rootkit Kernel-mode hook

Main script of analysis
Windows version: Windows 7 Enterprise, Build=7601, SP="Service Pack 1"
System Restore: enabled
1.1 Searching for user-mode API hooks
 Analysis: kernel32.dll, export table found in section .text
IAT modification detected: CreateProcessA - 003C0010<>76102082
IAT modification detected: GetModuleFileNameA - 003C0080<>7614D75A
IAT modification detected: FreeLibrary - 003C00F0<>7614EF67
IAT modification detected: GetModuleFileNameW - 003C0160<>7614EF35
IAT modification detected: CreateProcessW - 003C01D0<>7610204D
IAT modification detected: LoadLibraryW - 003C02B0<>7614EF42
IAT modification detected: LoadLibraryA - 003C0320<>7614DC65
IAT modification detected: GetProcAddress - 003C0390<>7614CC94
 Analysis: ntdll.dll, export table found in section .text
 Analysis: user32.dll, export table found in section .text
 Analysis: advapi32.dll, export table found in section .text
 Analysis: ws2_32.dll, export table found in section .text
 Analysis: wininet.dll, export table found in section .text
 Analysis: rasapi32.dll, export table found in section .text
 Analysis: urlmon.dll, export table found in section .text
 Analysis: netapi32.dll, export table found in section .text
1.2 Searching for kernel-mode API hooks
 Driver loaded successfully
 SDT found (RVA=15FA80)
 Kernel ntoskrnl.exe found in memory at address 8284C000
   SDT = 829ABA80
   KiST = 828A870C (401)
Function NtOpenProcess (BE) intercepted (82A64E27->92E31F3C), hook C:\Windows\system32\DRIVERS\AVGIDSShim.Sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtTerminateProcess (172) intercepted (82A65306->92E31FE4), hook C:\Windows\system32\DRIVERS\AVGIDSShim.Sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtTerminateThread (173) intercepted (82A7C7C4->92E32080), hook C:\Windows\system32\DRIVERS\AVGIDSShim.Sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtWriteVirtualMemory (18F) intercepted (82A95123->92E3211C), hook C:\Windows\system32\DRIVERS\AVGIDSShim.Sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Functions checked: 401, intercepted: 4, restored: 4
1.3 Checking IDT and SYSENTER
 Analysis for CPU 1
 Analysis for CPU 2
CmpCallCallBacks = 00000000
 Checking IDT and SYSENTER - complete
1.4 Searching for masking processes and drivers
 Checking not performed: extended monitoring driver (AVZPM) is not installed
1.5 Checking of IRP handlers
 Driver loaded successfully
 Checking - complete
>> Services: potentially dangerous service allowed: TermService (Remote Desktop Services)
>> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery)
>> Services: potentially dangerous service allowed: Schedule (Task Scheduler)
> Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)!
>> Security: disk drives' autorun is enabled
>> Security: administrative shares (C$, D$ ...) are enabled
>> Security: anonymous user access is enabled
>> Security: sending Remote Assistant queries is enabled
>> Security: automatic logon is enabled
 >>  Disable HDD autorun
 >>  Disable autorun from network drives
 >>  Disable CD/DVD autorun
 >>  Disable removable media autorun
 >>  Windows Explorer - show extensions of known file types
System Analysis in progress

 System Analysis - complete


Script commands 
Add commands to script:
Blocking hooks using Anti-Rootkit
Enable AVZGuard
Operations with AVZPM (true=enable,false=disable)
BootCleaner - import list of deleted files
BootCleaner - import all
Registry cleanup after deleting files
ExecuteWizard ('TSW',2,3,true) - Running Troubleshooting wizard
BootCleaner - activate
Reboot
Insert template for QuarantineFile() - quarantining file
Insert template for BC_QrFile() - quarantining file via BootCleaner
Insert template for DeleteFile() - deleting file
Insert template for DelCLSID() - deleting CLSID item from registry
Additional operations:Performance tweaking: disable service TermService (Remote Desktop Services)
Performance tweaking: disable service SSDPSRV (SSDP Discovery)
Performance tweaking: disable service Schedule (Task Scheduler)
Security tweaking: disable CD autorun
Security tweaking: disable administrative shares
Security tweaking: disable anonymous user access
Security: disable sending Remote Assistant queries
Security tweaking: disable automatic logon

File list

Port	Status	Remote Host	Remote Port	Application	Notes
TCP ports
135	LISTENING	0.0.0.0	0	[1004] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
139	LISTENING	0.0.0.0	0	[4] System Script: Quarantine, Delete, BC delete, Terminate
445	LISTENING	0.0.0.0	0	[4] System Script: Quarantine, Delete, BC delete, Terminate
445	ESTABLISHED	68.167.161.182	56610	[4] System Script: Quarantine, Delete, BC delete, Terminate
445	ESTABLISHED	68.167.161.182	64480	[4] System Script: Quarantine, Delete, BC delete, Terminate
5357	LISTENING	0.0.0.0	0	[4] System Script: Quarantine, Delete, BC delete, Terminate
5800	LISTENING	0.0.0.0	0	[568] c:\program files\realvnc\vnc4\winvnc4.exe Script: Quarantine, Delete, BC delete, Terminate
5900	LISTENING	0.0.0.0	0	[568] c:\program files\realvnc\vnc4\winvnc4.exe Script: Quarantine, Delete, BC delete, Terminate
10000	LISTENING	0.0.0.0	0	[2716] c:\program files\utorrent\utorrent.exe Script: Quarantine, Delete, BC delete, Terminate
10370	LISTENING	0.0.0.0	0	[2716] c:\program files\utorrent\utorrent.exe Script: Quarantine, Delete, BC delete, Terminate
49152	LISTENING	0.0.0.0	0	[656] c:\windows\system32\wininit.exe Script: Quarantine, Delete, BC delete, Terminate
49153	LISTENING	0.0.0.0	0	[1080] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
49154	LISTENING	0.0.0.0	0	[1200] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
49155	LISTENING	0.0.0.0	0	[720] c:\windows\system32\lsass.exe Script: Quarantine, Delete, BC delete, Terminate
49156	ESTABLISHED	68.167.161.182	64657	[1648] c:\windows\system32\spoolsv.exe Script: Quarantine, Delete, BC delete, Terminate
49156	LISTENING	0.0.0.0	0	[1648] c:\windows\system32\spoolsv.exe Script: Quarantine, Delete, BC delete, Terminate
49157	LISTENING	0.0.0.0	0	[712] c:\windows\system32\services.exe Script: Quarantine, Delete, BC delete, Terminate
54440	TIME_WAIT	85.17.156.78	80	[0]
54515	ESTABLISHED	72.14.204.83	443	[960] c:\users\oh\appdata\local\google\chrome\application\chrome.exe Script: Quarantine, Delete, BC delete, Terminate
54557	ESTABLISHED	68.167.161.182	445	[4] System Script: Quarantine, Delete, BC delete, Terminate
54558	ESTABLISHED	68.167.161.182	139	[4] System Script: Quarantine, Delete, BC delete, Terminate
56957	ESTABLISHED	68.167.161.182	445	[4] System Script: Quarantine, Delete, BC delete, Terminate
60033	LISTENING	0.0.0.0	0	[2296] c:\users\oh\appdata\local\google\google talk plugin\googletalkplugin.exe Script: Quarantine, Delete, BC delete, Terminate
60033	ESTABLISHED	127.0.0.1	60037	[2296] c:\users\oh\appdata\local\google\google talk plugin\googletalkplugin.exe Script: Quarantine, Delete, BC delete, Terminate
60037	ESTABLISHED	127.0.0.1	60033	[24752] c:\users\oh\appdata\local\google\chrome\application\chrome.exe Script: Quarantine, Delete, BC delete, Terminate
UDP ports
137	LISTENING	--	--	[4] System Script: Quarantine, Delete, BC delete, Terminate
138	LISTENING	--	--	[4] System Script: Quarantine, Delete, BC delete, Terminate
1900	LISTENING	--	--	[1988] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
1900	LISTENING	--	--	[2716] c:\program files\utorrent\utorrent.exe Script: Quarantine, Delete, BC delete, Terminate
1900	LISTENING	--	--	[1988] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
3702	LISTENING	--	--	[1344] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
3702	LISTENING	--	--	[1344] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
3702	LISTENING	--	--	[1988] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
3702	LISTENING	--	--	[1988] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
5355	LISTENING	--	--	[1480] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
10370	LISTENING	--	--	[2716] c:\program files\utorrent\utorrent.exe Script: Quarantine, Delete, BC delete, Terminate
51565	LISTENING	--	--	[1988] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
51633	LISTENING	--	--	[31464] c:\program files\internet explorer\iexplore.exe Script: Quarantine, Delete, BC delete, Terminate
51634	LISTENING	--	--	[29260] c:\program files\internet explorer\iexplore.exe Script: Quarantine, Delete, BC delete, Terminate
56978	LISTENING	--	--	[1344] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
61251	LISTENING	--	--	[31152] c:\program files\internet explorer\iexplore.exe Script: Quarantine, Delete, BC delete, Terminate
61252	LISTENING	--	--	[30264] c:\program files\internet explorer\iexplore.exe Script: Quarantine, Delete, BC delete, Terminate
61760	LISTENING	--	--	[1988] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
61761	LISTENING	--	--	[1988] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate