Results of system analysis

Kaspersky Virus Removal Tool 11.0.0.1245 (database released 18/02/2012; 22:47)

List of processes

File name	PID	Description	Copyright	MD5	Information
c:\program files\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate	3220	Firefox	©Firefox and Mozilla Developers, according to the MPL 1.1/GPL 2.0/LGPL 2.1 licenses, as applicable.	??	902.96 kb, rsAh, created: 03.10.2011 13:25:08, modified: 17.02.2012 11:44:47 Command line: "C:\Program Files\Mozilla Firefox\firefox.exe"
c:\program files\hp\digital imaging\bin\hpqimzone.exe Script: Quarantine, Delete, BC delete, Terminate	2548	HP Photosmart Premier	Copyright (C) Hewlett-Packard Development Company, L.P. 1995-2005	??	468.00 kb, rsAh, created: 10.02.2006 07:56:12, modified: 10.02.2006 07:56:12 Command line: "C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe" -s
c:\program files\mozilla firefox\plugin-container.exe Script: Quarantine, Delete, BC delete, Terminate	3972	Plugin Container for Firefox	License: MPL 1.1/GPL 2.0/LGPL 2.1	??	16.46 kb, rsAh, created: 23.06.2010 12:36:28, modified: 17.02.2012 11:44:22 Command line: "C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel=3220.54977a0.783970977 "C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll" - -greomni "C:\Program Files\Mozilla Firefox\omni.ja" 3220 "\\.\pipe\gecko-crash-server-pipe.3220" plugin
c:\program files\mozilla firefox\plugin-container.exe Script: Quarantine, Delete, BC delete, Terminate	2132	Plugin Container for Firefox	License: MPL 1.1/GPL 2.0/LGPL 2.1	??	16.46 kb, rsAh, created: 23.06.2010 12:36:28, modified: 17.02.2012 11:44:22 Command line: "C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel=3220.5497890.627027360 "C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll" - -greomni "C:\Program Files\Mozilla Firefox\omni.ja" 3220 "\\.\pipe\gecko-crash-server-pipe.3220" plugin
c:\program files\mozilla firefox\plugin-container.exe Script: Quarantine, Delete, BC delete, Terminate	2332	Plugin Container for Firefox	License: MPL 1.1/GPL 2.0/LGPL 2.1	??	16.46 kb, rsAh, created: 23.06.2010 12:36:28, modified: 17.02.2012 11:44:22 Command line: "C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel=3220.5497a70.68983879 "C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll" - -greomni "C:\Program Files\Mozilla Firefox\omni.ja" 3220 "\\.\pipe\gecko-crash-server-pipe.3220" plugin
c:\program files\mozilla firefox\plugin-container.exe Script: Quarantine, Delete, BC delete, Terminate	2268	Plugin Container for Firefox	License: MPL 1.1/GPL 2.0/LGPL 2.1	??	16.46 kb, rsAh, created: 23.06.2010 12:36:28, modified: 17.02.2012 11:44:22 Command line: "C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel=3220.5498100.1724044285 "C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll" - -greomni "C:\Program Files\Mozilla Firefox\omni.ja" 3220 "\\.\pipe\gecko-crash-server-pipe.3220" plugin
c:\program files\mozilla firefox\plugin-container.exe Script: Quarantine, Delete, BC delete, Terminate	2932	Plugin Container for Firefox	License: MPL 1.1/GPL 2.0/LGPL 2.1	??	16.46 kb, rsAh, created: 23.06.2010 12:36:28, modified: 17.02.2012 11:44:22 Command line: "C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel=3220.54981f0.1133074715 "C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll" - -greomni "C:\Program Files\Mozilla Firefox\omni.ja" 3220 "\\.\pipe\gecko-crash-server-pipe.3220" plugin
c:\program files\mozilla firefox\plugin-container.exe Script: Quarantine, Delete, BC delete, Terminate	2108	Plugin Container for Firefox	License: MPL 1.1/GPL 2.0/LGPL 2.1	??	16.46 kb, rsAh, created: 23.06.2010 12:36:28, modified: 17.02.2012 11:44:22 Command line: "C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel=3220.54982e0.134750701 "C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll" - -greomni "C:\Program Files\Mozilla Firefox\omni.ja" 3220 "\\.\pipe\gecko-crash-server-pipe.3220" plugin
c:\program files\mozilla firefox\plugin-container.exe Script: Quarantine, Delete, BC delete, Terminate	2120	Plugin Container for Firefox	License: MPL 1.1/GPL 2.0/LGPL 2.1	??	16.46 kb, rsAh, created: 23.06.2010 12:36:28, modified: 17.02.2012 11:44:22 Command line: "C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel=3220.54975c0.874852219 "C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll" - -greomni "C:\Program Files\Mozilla Firefox\omni.ja" 3220 "\\.\pipe\gecko-crash-server-pipe.3220" plugin
c:\program files\western digital\wd smartware\front parlor\wdfme\wdfme.exe Script: Quarantine, Delete, BC delete, Terminate	596	WD File Management Engine	Copyright (C) 2010	??	1814.50 kb, rsAh, created: 10.05.2010 10:32:36, modified: 10.05.2010 10:32:36 Command line: "C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe"
c:\program files\western digital\wd smartware\front parlor\wdsc.exe Script: Quarantine, Delete, BC delete, Terminate	2360	WD Shadow Copy	Copyright (C) 2010	??	471.00 kb, rsAh, created: 10.05.2010 10:32:06, modified: 10.05.2010 10:32:06 Command line: "C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe"
Detected:69, recognized as trusted 69

Module name	Handle	Description	Copyright	MD5	Used by processes
C:\Documents and Settings\Millar\Application Data\Mozilla\plugins\npcoolirisplugin.dll Script: Quarantine, Delete, BC delete	96665600			--	3220
C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll Script: Quarantine, Delete, BC delete	19202048	The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.	Copyright Apple Inc. 1989-2011	--	2108
C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll Script: Quarantine, Delete, BC delete	19202048	The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.	Copyright Apple Inc. 1989-2011	--	2932
C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll Script: Quarantine, Delete, BC delete	19202048	The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.	Copyright Apple Inc. 1989-2011	--	2268
C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll Script: Quarantine, Delete, BC delete	19202048	The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.	Copyright Apple Inc. 1989-2011	--	2332
C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll Script: Quarantine, Delete, BC delete	19202048	The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.	Copyright Apple Inc. 1989-2011	--	2132
C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll Script: Quarantine, Delete, BC delete	19202048	The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.	Copyright Apple Inc. 1989-2011	--	3972
C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll Script: Quarantine, Delete, BC delete	19202048	The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.	Copyright Apple Inc. 1989-2011	--	2120
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFMEIPC.dll Script: Quarantine, Delete, BC delete	268435456	WD File Management Engine IPC Module	Copyright (C) 2010	--	596
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDFMEIPC.dll Script: Quarantine, Delete, BC delete	268435456	WD File Management Engine IPC Module	Copyright (C) 2010	--	2360
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\XP\Shadow.dll Script: Quarantine, Delete, BC delete	17956864	WD File Management Engine Shadow Copy Module	Copyright (C) 2010	--	2360
c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_301215ba\mscorlib.dll Script: Quarantine, Delete, BC delete	2040070144			--	2548
c:\windows\assembly\nativeimages1_v1.1.4322\system.drawing\1.0.5000.0__b03f5f7f11d50a3a_35232345\system.drawing.dll Script: Quarantine, Delete, BC delete	2068905984			--	2548
c:\windows\assembly\nativeimages1_v1.1.4322\system.windows.forms\1.0.5000.0__b77a5c561934e089_b3a714e9\system.windows.forms.dll Script: Quarantine, Delete, BC delete	2072051712			--	2548
c:\windows\assembly\nativeimages1_v1.1.4322\system.xml\1.0.5000.0__b77a5c561934e089_4904afa9\system.xml.dll Script: Quarantine, Delete, BC delete	2077622272			--	2548
c:\windows\assembly\nativeimages1_v1.1.4322\system\1.0.5000.0__b77a5c561934e089_b73bfa67\system.dll Script: Quarantine, Delete, BC delete	2065498112			--	2548
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\64bf8d2f963138ede81700b9fd525547\System.Configuration.ni.dll Script: Quarantine, Delete, BC delete	1686700032	System.Configuration.dll	© Microsoft Corporation. All rights reserved.	--	596
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Data\0aacf518f032079557bc36a2eef2ccea\System.Data.ni.dll Script: Quarantine, Delete, BC delete	1695875072	.NET Framework	© Microsoft Corporation. All rights reserved.	--	596
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\d0908fdd3b9f4abd0ded7727be80f764\System.EnterpriseServices.ni.dll Script: Quarantine, Delete, BC delete	1732182016	Microsoft .NET Services Support Infrastructure	© Microsoft Corporation. All rights reserved.	--	596
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Management\acc5ec6c04f1eff1029f88e339c98e47\System.Management.ni.dll Script: Quarantine, Delete, BC delete	1733361664	.NET Framework	© Microsoft Corporation. All rights reserved.	--	596
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\d4a5aced0ec83076368bad3f7277da5f\System.ServiceProcess.ni.dll Script: Quarantine, Delete, BC delete	1738670080	.NET Framework	© Microsoft Corporation. All rights reserved.	--	596, 2360
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Transactions\c1fcd30108fc02b92b78745458fe330c\System.Transactions.ni.dll Script: Quarantine, Delete, BC delete	1739522048	.NET Framework	© Microsoft Corporation. All rights reserved.	--	596
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\9cf4a4fdd044bf3f033ae4fa26bdd796\System.Xml.ni.dll Script: Quarantine, Delete, BC delete	1668939776	.NET Framework	© Microsoft Corporation. All rights reserved.	--	596
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\12637de2619ee65d57c529f6c786dce1\System.ni.dll Script: Quarantine, Delete, BC delete	2051276800	.NET Framework	© Microsoft Corporation. All rights reserved.	--	596, 2360
Modules detected:658, recognized as trusted 634

Kernel Space Modules Viewer

Module	Base address	Size in memory	Description	Manufacturer
C:\WINDOWS\System32\Drivers\dump_atapi.sys Script: Quarantine, Delete, BC delete	9FC07000	018000 (98304)
C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Script: Quarantine, Delete, BC delete	BA650000	002000 (8192)
C:\WINDOWS\system32\Drivers\nhcDriver.sys Script: Quarantine, Delete, BC delete	B9DCB000	012000 (73728)	Notebook Hardware Control Device Driver	Copyright (c) 2005-2010 by Manfred Jaider
C:\WINDOWS\system32\Drivers\ute5mzi2.sys Script: Quarantine, Delete, BC delete	B13A7000	007000 (28672)
Modules detected - 140, recognized as trusted - 136

Services

Service	Description	Status	File	Group	Dependencies
Detected - 115, recognized as trusted - 115

Drivers

Service	Description	Status	File	Group	Dependencies
nhcDriverDevice Driver: Unload, Delete, Disable, BC delete	Notebook Hardware Control Driver	Running	C:\WINDOWS\system32\drivers\nhcDriver.sys Script: Quarantine, Delete, BC delete
Abiosdsk Driver: Unload, Delete, Disable, BC delete	Abiosdsk	Not started	Abiosdsk.sys Script: Quarantine, Delete, BC delete	Primary disk
Atdisk Driver: Unload, Delete, Disable, BC delete	Atdisk	Not started	Atdisk.sys Script: Quarantine, Delete, BC delete	Primary disk
Changer Driver: Unload, Delete, Disable, BC delete	Changer	Not started	Changer.sys Script: Quarantine, Delete, BC delete	Filter
cpuz134 Driver: Unload, Delete, Disable, BC delete	cpuz134	Not started	C:\DOCUME~1\Millar\LOCALS~1\Temp\cpuz134\cpuz134_x32.sys Script: Quarantine, Delete, BC delete
esgiguard Driver: Unload, Delete, Disable, BC delete	esgiguard	Not started	C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys Script: Quarantine, Delete, BC delete
Lbd Driver: Unload, Delete, Disable, BC delete	Lbd	Not started	Lbd.sys Script: Quarantine, Delete, BC delete	FSFilter Activity Monitor	FltMgr
lbrtfdc Driver: Unload, Delete, Disable, BC delete	lbrtfdc	Not started	lbrtfdc.sys Script: Quarantine, Delete, BC delete	System Bus Extender
PCIDump Driver: Unload, Delete, Disable, BC delete	PCIDump	Not started	PCIDump.sys Script: Quarantine, Delete, BC delete	PCI Configuration
PDCOMP Driver: Unload, Delete, Disable, BC delete	PDCOMP	Not started	PDCOMP.sys Script: Quarantine, Delete, BC delete
PDFRAME Driver: Unload, Delete, Disable, BC delete	PDFRAME	Not started	PDFRAME.sys Script: Quarantine, Delete, BC delete
PDRELI Driver: Unload, Delete, Disable, BC delete	PDRELI	Not started	PDRELI.sys Script: Quarantine, Delete, BC delete
PDRFRAME Driver: Unload, Delete, Disable, BC delete	PDRFRAME	Not started	PDRFRAME.sys Script: Quarantine, Delete, BC delete
Simbad Driver: Unload, Delete, Disable, BC delete	Simbad	Not started	Simbad.sys Script: Quarantine, Delete, BC delete	Filter
UIUSys Driver: Unload, Delete, Disable, BC delete	Conexant Setup API	Not started	C:\WINDOWS\system32\DRIVERS\UIUSYS.SYS Script: Quarantine, Delete, BC delete
wanatw Driver: Unload, Delete, Disable, BC delete	WAN Miniport (ATW)	Not started	wanatw.sys Script: Quarantine, Delete, BC delete	NDIS
WDICA Driver: Unload, Delete, Disable, BC delete	WDICA	Not started	WDICA.sys Script: Quarantine, Delete, BC delete
Detected - 228, recognized as trusted - 211

Autoruns

File name	Status	Startup method	Description
C:\Documents and Settings\Millar\Local Settings\Temp\_uninst_24588405.bat Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	C:\Documents and Settings\Millar\Start Menu\Programs\Startup\, C:\Documents and Settings\Millar\Start Menu\Programs\Startup\_uninst_24588405.lnk,
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mmjb.exe Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Internet Explorer\Quick Launch\Musicmatch Jukebox.lnk,
C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\TuneUp\TuneUp.UtilitiesSvc, EventMessageFile
C:\WINDOWS\System32\Drivers\lbrtfdc.sys Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\lbrtfdc, EventMessageFile
C:\WINDOWS\System32\PrintFilterPipelineSvc.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PrintFilterPipelineSvc, EventMessageFile
C:\WINDOWS\System32\drivers\avipbb.sys Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\avipbb, EventMessageFile
C:\WINDOWS\System32\drivers\avkmgr.sys Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\avkmgr, EventMessageFile
C:\WINDOWS\System32\igmpv2.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile
C:\WINDOWS\System32\ipbootp.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile
C:\WINDOWS\System32\iprip2.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile
C:\WINDOWS\System32\ospf.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPF, EventMessageFile
C:\WINDOWS\System32\ospfmib.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPFMib, EventMessageFile
C:\WINDOWS\System32\polagent.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PolicyAgent, EventMessageFile
C:\WINDOWS\System32\tssdis.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\TermServSessDir, EventMessageFile
C:\WINDOWS\system32\MsSip1.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 1, $DLL Delete
C:\WINDOWS\system32\MsSip2.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 2, $DLL Delete
C:\WINDOWS\system32\MsSip3.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 3, $DLL Delete
C:\WINDOWS\system32\fxsevent.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft Fax, EventMessageFile
C:\WINDOWS\system32\stisvc.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System, EventMessageFile
SDEvents.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Spybot - Search & Destroy 2, EventMessageFile
TPSvc.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\TPSvc, DLLName Delete
kbd101.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver JPN Delete
kbd101a.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver KOR Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, .DEFAULT\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-19\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-20\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-18\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-21-3646809158-1913639779-2902646448-1005\Control Panel\IOProcs, MVB Delete
vgafix.fon Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon Delete
vgaoem.fon Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon Delete
vgasys.fon Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon Delete
Autoruns items detected - 927, recognized as trusted - 896

Microsoft Internet Explorer extension modules (BHOs, Toolbars ...)

File name	Type	Description	Manufacturer	CLSID
Elements detected - 13, recognized as trusted - 13

Windows Explorer extension modules

File name	Destination	Description	Manufacturer	CLSID
	Display Panning CPL Extension			{42071714-76d4-11d1-8b24-00a0c9068ff3} Delete
	Shell extensions for file compression			{764BF0E1-F219-11ce-972D-00AA00A14F56} Delete
	Encryption Context Menu			{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} Delete
	HyperTerminal Icon Ext			{88895560-9AA2-1069-930E-00AA0030EBC8} Delete
	Taskbar and Start Menu			{0DF44EAA-FF21-4412-828E-260A8728E7F1} Delete
	User Accounts			{7A9D77BD-5403-11d2-8785-2E0420524153} Delete
	Uw Shell Extension			{00e72351-c3bd-48cd-b090-77ea0d87a10a} Delete
	Window Washer Shredding Utility			{6EE51AA0-77A0-11D7-B4E1-000347126E46} Delete
	Shell Extension for Malware scanning			{45AC2688-0253-4ED8-97DE-B5370FA7D48A} Delete
"C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll" Script: Quarantine, Delete, BC delete	ColumnHandler			{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} Delete
Elements detected - 225, recognized as trusted - 215

Printing system extensions (print monitors, providers)

File name	Type	Name	Description	Manufacturer
LEXLMPM.DLL Script: Quarantine, Delete, BC delete	Monitor	Dell Network Port
Elements detected - 14, recognized as trusted - 13

Task Scheduler jobs

File name	Job name	Job status	Description	Manufacturer
C:\Program Files\NCH Software\Doxillion\doxillion.exe Script: Quarantine, Delete, BC delete	doxillionShakeIcon.job	The task has not yet run.	Doxillion Document Converter	NCH Software
C:\Program Files\NCH Software\ExpressZip\expresszip.exe Script: Quarantine, Delete, BC delete	expresszipShakeIcon.job	The task has not yet run.	Express Zip File Compression Software	NCH Software
Elements detected - 16, recognized as trusted - 14

SPI/LSP settings

Namespace providers (NSP)

Provider	Status	EXE file	Description	GUID
Detected - 3, recognized as trusted - 3

Transport protocol providers (TSP, LSP)

Provider EXE file Description
Detected - 19, recognized as trusted - 19
Results of automatic SPI settings check
LSP settings checked. No errors detected

TCP/UDP ports

Port Status Remote Host Remote Port Application Notes
TCP ports
135 LISTENING 0.0.0.0 39118 [1580] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
139 LISTENING 0.0.0.0 39118 [4] System
Script: Quarantine, Delete, BC delete, Terminate
445 LISTENING 0.0.0.0 39006 [4] System
Script: Quarantine, Delete, BC delete, Terminate
1031 LISTENING 0.0.0.0 63497 [4048] c:\windows\system32\alg.exe
Script: Quarantine, Delete, BC delete, Terminate
1043 ESTABLISHED 127.0.0.1 1044 [3220] c:\program files\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
1044 ESTABLISHED 127.0.0.1 1043 [3220] c:\program files\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
1046 ESTABLISHED 127.0.0.1 1047 [3220] c:\program files\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
1047 ESTABLISHED 127.0.0.1 1046 [3220] c:\program files\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
4750 TIME_WAIT 209.18.41.65 80 [0]
4751 TIME_WAIT 24.143.206.16 80 [0]
4752 TIME_WAIT 74.125.47.132 80 [0]
5152 LISTENING 0.0.0.0 18538 [1432] c:\program files\java\jre7\bin\jqs.exe
Script: Quarantine, Delete, BC delete, Terminate
UDP ports
123 LISTENING -- -- [1664] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
123 LISTENING -- -- [1664] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
137 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
138 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
445 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
1029 LISTENING -- -- [892] c:\program files\skype\phone\skype.exe
Script: Quarantine, Delete, BC delete, Terminate
1037 LISTENING -- -- [892] c:\program files\skype\phone\skype.exe
Script: Quarantine, Delete, BC delete, Terminate
1900 LISTENING -- -- [1196] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
1900 LISTENING -- -- [1196] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
3776 LISTENING -- -- [2832] c:\windows\ehome\mcrdsvc.exe
Script: Quarantine, Delete, BC delete, Terminate
10316 LISTENING -- -- [1080] c:\program files\singleclick systems\homenet manager\hnm_svc.exe
Script: Quarantine, Delete, BC delete, Terminate

Downloaded Program Files (DPF)

File name Description Manufacturer CLSID Source URL
Garmin Communicator Plug-In
Delete https://my.garmin.com/static/m/cab/2.8.3/GarminAxControl.CAB
{4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21}
Delete http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
Elements detected - 15, recognized as trusted - 13

Control Panel Applets (CPL)

File name Description Manufacturer
Elements detected - 32, recognized as trusted - 32

Active Setup

File name Description Manufacturer CLSID
Elements detected - 11, recognized as trusted - 11

HOSTS file

Hosts file record
127.0.0.1 localhost
яю1 2 7 . 0 . 0 . 1 l o c a l h o s t
: : 1 l o c a l h o s t
Clear Hosts file

Protocols and handlers

File name Type Description Manufacturer CLSID
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
Elements detected - 31, recognized as trusted - 28

Suspicious objects

File Description Type
C:\WINDOWS\system32\DRIVERS\3707420drv.sys
Script: Quarantine, Delete, BC delete Suspicion for Rootkit Kernel-mode hook
\SystemRoot\system32\DRIVERS\3707420drv.sys
Script: Quarantine, Delete, BC delete Suspicion for Rootkit Kernel-mode hook

Main script of analysis
Windows version: Microsoft Windows XP, Build=2600, SP="Service Pack 3"
System Restore: enabled
1.1 Searching for user-mode API hooks
 Analysis: kernel32.dll, export table found in section .text
IAT modification detected: CreateProcessA - 00CA0010<>7C80236B
IAT modification detected: GetModuleFileNameA - 00CA0080<>7C80B56F
IAT modification detected: FreeLibrary - 00CA00F0<>7C80AC7E
IAT modification detected: GetModuleFileNameW - 00CA0160<>7C80B475
IAT modification detected: CreateProcessW - 00CA01D0<>7C802336
IAT modification detected: LoadLibraryW - 00CA02B0<>7C80AEEB
IAT modification detected: LoadLibraryA - 00CA0320<>7C801D7B
IAT modification detected: GetProcAddress - 00CA0390<>7C80AE40
 Analysis: ntdll.dll, export table found in section .text
 Analysis: user32.dll, export table found in section .text
 Analysis: advapi32.dll, export table found in section .text
 Analysis: ws2_32.dll, export table found in section .text
 Analysis: wininet.dll, export table found in section .text
 Analysis: rasapi32.dll, export table found in section .text
 Analysis: urlmon.dll, export table found in section .text
 Analysis: netapi32.dll, export table found in section .text
1.2 Searching for kernel-mode API hooks
 Driver loaded successfully
 SDT found (RVA=085700)
 Kernel ntkrnlpa.exe found in memory at address 804D7000
   SDT = 8055C700
   KiST = 80504480 (284)
Function NtAdjustPrivilegesToken (0B) intercepted (805EC464->9E2F2690), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtClose (19) intercepted (805BC530->9E2F2F94), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtConnectPort (1F) intercepted (805A45D0->9E2F3DC8), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateEvent (23) intercepted (8060EF4E->9E2F4312), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateFile (25) intercepted (805790A8->9E2F3270), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateKey (29) intercepted (806240F0->9E2F1500), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateMutant (2B) intercepted (8061769E->9E2F41F8), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateNamedPipeFile (2C) intercepted (805790E2->9E2F227E), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreatePort (2E) intercepted (805A50EC->9E2F40CC), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateSection (32) intercepted (805AB3C8->9E2F2426), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateSemaphore (33) intercepted (8061504E->9E2F4432), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateThread (35) intercepted (805D1018->9E2F2C1C), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateWaitablePort (38) intercepted (805A5110->9E2F4162), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDebugActiveProcess (39) intercepted (80643B30->9E2F5B1A), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDeleteKey (3F) intercepted (8062458C->9E2F1B0A), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDeleteValueKey (41) intercepted (8062475C->9E2F1EBE), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDeviceIoControlFile (42) intercepted (8057926E->9E2F36F2), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDuplicateObject (44) intercepted (805BE008->9E2F6D26), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtEnumerateKey (47) intercepted (8062493C->9E2F200A), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtEnumerateValueKey (49) intercepted (80624BA6->9E2F20A2), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtFsControlFile (54) intercepted (805792A2->9E2F3500), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtLoadDriver (61) intercepted (80584160->9E2F5C0C), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtLoadKey (62) intercepted (80626314->9E2F14DC), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtLoadKey2 (63) intercepted (80625F20->9E2F14EE), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtMapViewOfSection (6C) intercepted (805B203A->9E2F6374), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtNotifyChangeKey (6F) intercepted (806262DE->9E2F21CE), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenEvent (72) intercepted (8060F04E->9E2F43A8), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenFile (74) intercepted (8057A1A6->9E2F3016), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenKey (77) intercepted (806254CE->9E2F16C0), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenMutant (78) intercepted (80617776->9E2F4288), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenProcess (7A) intercepted (805CB440->9E2F28CC), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenSection (7D) intercepted (805AA3EC->9E2F610E), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenSemaphore (7E) intercepted (80615148->9E2F44C8), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenThread (80) intercepted (805CB6CC->9E2F27BE), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQueryKey (A0) intercepted (80625810->9E2F213A), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQueryMultipleValueKey (A1) intercepted (8062323E->9E2F1D72), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQuerySection (A7) intercepted (805B85E0->9E2F66AE), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQueryValueKey (B1) intercepted (80622314->9E2F199C), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQueueApcThread (B4) intercepted (805D1276->9E2F5FA0), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtRenameKey (C0) intercepted (80623B12->9E2F1C2C), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtReplaceKey (C1) intercepted (806261C4->9E2F0F16), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtReplyPort (C2) intercepted (805A54EC->9E2F482C), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtReplyWaitReceivePort (C3) intercepted (805A64B4->9E2F46F2), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtRequestWaitReplyPort (C8) intercepted (805A2D76->9E2F58B4), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtRestoreKey (CC) intercepted (80625AD0->9E2F128E), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtResumeThread (CE) intercepted (805D49BA->9E2F6BC8), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSaveKey (CF) intercepted (80625BCC->9E2F0EAE), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSecureConnectPort (D2) intercepted (805A3D64->9E2F3B0E), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetContextThread (D5) intercepted (805D173A->9E2F2E38), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetInformationToken (E6) intercepted (805FA7B4->9E2F5154), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetSecurityObject (ED) intercepted (805C062E->9E2F5DAA), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetSystemInformation (F0) intercepted (8060FD06->9E2F67FE), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetValueKey (F7) intercepted (80622662->9E2F1816), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSuspendProcess (FD) intercepted (805D4A82->9E2F68F0), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSuspendThread (FE) intercepted (805D48F4->9E2F6A2A), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSystemDebugControl (FF) intercepted (806180BA->9E2F5A3E), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtTerminateProcess (101) intercepted (805D29E2->9E2F2A68), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtTerminateThread (102) intercepted (805D2BDC->9E2F29C8), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtUnmapViewOfSection (10B) intercepted (805B2E48->9E2F6552), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtWriteVirtualMemory (115) intercepted (805B43CC->9E2F2B52), hook C:\WINDOWS\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function FsRtlCheckLockForReadAccess (804EAF84) - machine code modification Method of JmpTo. jmp 9E2E4FD0 \SystemRoot\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
Function IoIsOperationSynchronous (804EF912) - machine code modification Method of JmpTo. jmp 9E2E53AC \SystemRoot\system32\DRIVERS\3707420drv.sys, driver recognized as trusted
>>> Function restored successfully !
Functions checked: 284, intercepted: 60, restored: 62
1.3 Checking IDT and SYSENTER
 Analysis for CPU 1
 Analysis for CPU 2
CmpCallCallBacks = 00093D84
Disable callback OK
 Checking IDT and SYSENTER - complete
1.4 Searching for masking processes and drivers
 Checking not performed: extended monitoring driver (AVZPM) is not installed
1.5 Checking of IRP handlers
 Driver loaded successfully
 Checking - complete
Latent loading of libraries through AppInit_DLLs suspected: "C:\WINDOWS\system32\wbsys.dll"
>> Services: potentially dangerous service allowed: TermService (Terminal Services)
>> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery Service)
>> Services: potentially dangerous service allowed: Schedule (Task Scheduler)
>> Services: potentially dangerous service allowed: RDSessMgr (Remote Desktop Help Session Manager)
> Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)!
>> Security: anonymous user access is enabled
 >>  Disable HDD autorun
 >>  Disable autorun from network drives
 >>  Disable CD/DVD autorun
 >>  Disable removable media autorun
 >>  Windows Explorer - show extensions of known file types
System Analysis in progress

 System Analysis - complete


Script commands 
Add commands to script:
Blocking hooks using Anti-Rootkit
Enable AVZGuard
Operations with AVZPM (true=enable,false=disable)
BootCleaner - import list of deleted files
BootCleaner - import all
Registry cleanup after deleting files
ExecuteWizard ('TSW',2,3,true) - Running Troubleshooting wizard
BootCleaner - activate
Reboot
Insert template for QuarantineFile() - quarantining file
Insert template for BC_QrFile() - quarantining file via BootCleaner
Insert template for DeleteFile() - deleting file
Insert template for DelCLSID() - deleting CLSID item from registry
Additional operations:Performance tweaking: disable service TermService (Terminal Services)
Performance tweaking: disable service SSDPSRV (SSDP Discovery Service)
Performance tweaking: disable service Schedule (Task Scheduler)
Performance tweaking: disable service RDSessMgr (Remote Desktop Help Session Manager)
Security tweaking: disable anonymous user access

File list

Port	Status	Remote Host	Remote Port	Application	Notes
TCP ports
135	LISTENING	0.0.0.0	39118	[1580] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
139	LISTENING	0.0.0.0	39118	[4] System Script: Quarantine, Delete, BC delete, Terminate
445	LISTENING	0.0.0.0	39006	[4] System Script: Quarantine, Delete, BC delete, Terminate
1031	LISTENING	0.0.0.0	63497	[4048] c:\windows\system32\alg.exe Script: Quarantine, Delete, BC delete, Terminate
1043	ESTABLISHED	127.0.0.1	1044	[3220] c:\program files\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
1044	ESTABLISHED	127.0.0.1	1043	[3220] c:\program files\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
1046	ESTABLISHED	127.0.0.1	1047	[3220] c:\program files\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
1047	ESTABLISHED	127.0.0.1	1046	[3220] c:\program files\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
4750	TIME_WAIT	209.18.41.65	80	[0]
4751	TIME_WAIT	24.143.206.16	80	[0]
4752	TIME_WAIT	74.125.47.132	80	[0]
5152	LISTENING	0.0.0.0	18538	[1432] c:\program files\java\jre7\bin\jqs.exe Script: Quarantine, Delete, BC delete, Terminate
UDP ports
123	LISTENING	--	--	[1664] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
123	LISTENING	--	--	[1664] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
137	LISTENING	--	--	[4] System Script: Quarantine, Delete, BC delete, Terminate
138	LISTENING	--	--	[4] System Script: Quarantine, Delete, BC delete, Terminate
445	LISTENING	--	--	[4] System Script: Quarantine, Delete, BC delete, Terminate
1029	LISTENING	--	--	[892] c:\program files\skype\phone\skype.exe Script: Quarantine, Delete, BC delete, Terminate
1037	LISTENING	--	--	[892] c:\program files\skype\phone\skype.exe Script: Quarantine, Delete, BC delete, Terminate
1900	LISTENING	--	--	[1196] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
1900	LISTENING	--	--	[1196] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
3776	LISTENING	--	--	[2832] c:\windows\ehome\mcrdsvc.exe Script: Quarantine, Delete, BC delete, Terminate
10316	LISTENING	--	--	[1080] c:\program files\singleclick systems\homenet manager\hnm_svc.exe Script: Quarantine, Delete, BC delete, Terminate