Results of system analysis

Process List

File name	PID	Description	Copyright	MD5	Information
c:\users\nele\desktop\avz4\avz.exe Script: Quarantine, Delete, Delete via BC, Terminate	3664	???????????? ??????? AVZ	???????????? ??????? AVZ	6497B6E363DCEBA3685AD960F8B84665	772.00 kb, rsAh, created: 26.06.2015 19:20:39, modified: 23.02.2014 15:04:10 Command line: "C:\Users\Nele\Desktop\avz4\avz.exe"
c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate	5732	Google Chrome	Copyright 2012 Google Inc. All rights reserved.	98FA788238E71D9563D4BF177A4FC22C	794.82 kb, rsAh, created: 11.09.2014 19:56:40, modified: 20.06.2015 07:46:07 Command line: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=en-US --force-fieldtrials="AffiliationBasedMatching/Enabled/AutofillEnabled/Default/BackgroundRendererProcesses/AllowIdleFromBrowser/BrowserBlacklist/Enabled/CTRequiredForEVTrial/RequirementEnforced/CaptivePortalInterstitial/Enabled/ChildAccountDetection/Disabled/ChromeDashboard/Default/ChromeSuggestions/Default/DomRel-Enable/enable/EmbeddedSearch/Group4 pct:10d stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnableSessionCrashedBubbleUI/Disabled/EnhancedBookmarks/Default/ExtensionContentVerification/Enforce/ExtensionInstallVerification/Enforce/GoogleNow/Enable/IconNTP/Default/NewProfileManagement/Enabled/OmniboxBundledExperimentV1/Hivemind_A2_Stable_R7_Postperiod/PasswordGeneration/Disabled/PasswordLinkInSettings/Disabled/PermissionBubbleRollout/Enabled/PrerenderFromOmnibox/OmniboxPrerenderEnabled/QUIC/EnabledNoIdForLargePopulation/RefreshTokenDeviceId/Enabled/RememberCertificateErrorDecisions/OneWeek/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/SRTPromptFieldTrial/On/SafeBrowsingIncidentReportingService/Default/SessionRestoreBackgroundLoading/Restore/SettingsEnforcement/enforce_always_with_extensions_and_dse/SyncBackingDatabase32K/Enabled/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group6/UMA-Population-Restrict/normal/UMA-Uniformity-Trial-1-Percent/group_02/UMA-Uniformity-Trial-10-Percent/group_05/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_03/UMA-Uniformity-Trial-5-Percent/group_17/UMA-Uniformity-Trial-50-Percent/group_01/UseDelayAgnosticAEC/Enabled/VoiceTrigger/Install/WebRTC-IPv6Default/Enabled/WebRTC-UDPSocketNonBlockingIO/Default/Win32kLockdown/Enabled/" --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --font-cache-shared-mem-suffix=4340 --enable-pinch-virtual-viewport --enable-delegated-renderer --num-raster-threads=2 --use-image-texture-target=3553 --channel="4340.82.1870739061\1819217144" /prefetch:673131151
c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate	6860	Google Chrome	Copyright 2012 Google Inc. All rights reserved.	98FA788238E71D9563D4BF177A4FC22C	794.82 kb, rsAh, created: 11.09.2014 19:56:40, modified: 20.06.2015 07:46:07 Command line: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=en-US --force-fieldtrials="AffiliationBasedMatching/Enabled/AutofillEnabled/Default/BackgroundRendererProcesses/AllowIdleFromBrowser/BrowserBlacklist/Enabled/CTRequiredForEVTrial/RequirementEnforced/CaptivePortalInterstitial/Enabled/ChildAccountDetection/Disabled/ChromeDashboard/Default/ChromeSuggestions/Default/DomRel-Enable/enable/EmbeddedSearch/Group4 pct:10d stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnableSessionCrashedBubbleUI/Disabled/EnhancedBookmarks/Default/ExtensionContentVerification/Enforce/ExtensionInstallVerification/Enforce/GoogleNow/Enable/IconNTP/Default/NewProfileManagement/Enabled/OmniboxBundledExperimentV1/Hivemind_A2_Stable_R7_Postperiod/PasswordGeneration/Disabled/PasswordLinkInSettings/Disabled/PermissionBubbleRollout/Enabled/PrerenderFromOmnibox/OmniboxPrerenderEnabled/QUIC/EnabledNoIdForLargePopulation/RefreshTokenDeviceId/Enabled/RememberCertificateErrorDecisions/OneWeek/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/SRTPromptFieldTrial/On/SafeBrowsingIncidentReportingService/Default/SessionRestoreBackgroundLoading/Restore/SettingsEnforcement/enforce_always_with_extensions_and_dse/SyncBackingDatabase32K/Enabled/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group6/UMA-Population-Restrict/normal/UMA-Uniformity-Trial-1-Percent/group_02/UMA-Uniformity-Trial-10-Percent/group_05/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_03/UMA-Uniformity-Trial-5-Percent/group_17/UMA-Uniformity-Trial-50-Percent/group_01/UseDelayAgnosticAEC/Enabled/VoiceTrigger/Install/WebRTC-IPv6Default/Enabled/WebRTC-UDPSocketNonBlockingIO/Default/Win32kLockdown/Enabled/" --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --font-cache-shared-mem-suffix=4340 --enable-pinch-virtual-viewport --enable-delegated-renderer --num-raster-threads=2 --use-image-texture-target=3553 --channel="4340.86.692596980\1169575125" /prefetch:673131151
c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate	6340	Google Chrome	Copyright 2012 Google Inc. All rights reserved.	98FA788238E71D9563D4BF177A4FC22C	794.82 kb, rsAh, created: 11.09.2014 19:56:40, modified: 20.06.2015 07:46:07 Command line: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=en-US --force-fieldtrials="AffiliationBasedMatching/Enabled/AutofillEnabled/Default/BackgroundRendererProcesses/AllowIdleFromBrowser/BrowserBlacklist/Enabled/CTRequiredForEVTrial/RequirementEnforced/CaptivePortalInterstitial/Enabled/ChildAccountDetection/Disabled/ChromeDashboard/Default/ChromeSuggestions/Default/DomRel-Enable/enable/EmbeddedSearch/Group4 pct:10d stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnableSessionCrashedBubbleUI/Disabled/EnhancedBookmarks/Default/ExtensionContentVerification/Enforce/ExtensionInstallVerification/Enforce/GoogleNow/Enable/IconNTP/Default/NewProfileManagement/Enabled/OmniboxBundledExperimentV1/Hivemind_A2_Stable_R7_Postperiod/PasswordGeneration/Disabled/PasswordLinkInSettings/Disabled/PermissionBubbleRollout/Enabled/PrerenderFromOmnibox/OmniboxPrerenderEnabled/QUIC/EnabledNoIdForLargePopulation/RefreshTokenDeviceId/Enabled/RememberCertificateErrorDecisions/OneWeek/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/SRTPromptFieldTrial/On/SafeBrowsingIncidentReportingService/Default/SessionRestoreBackgroundLoading/Restore/SettingsEnforcement/enforce_always_with_extensions_and_dse/SyncBackingDatabase32K/Enabled/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group6/UMA-Population-Restrict/normal/UMA-Uniformity-Trial-1-Percent/group_02/UMA-Uniformity-Trial-10-Percent/group_05/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_03/UMA-Uniformity-Trial-5-Percent/group_17/UMA-Uniformity-Trial-50-Percent/group_01/UseDelayAgnosticAEC/Enabled/VoiceTrigger/Install/WebRTC-IPv6Default/Enabled/WebRTC-UDPSocketNonBlockingIO/Default/Win32kLockdown/Enabled/" --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --font-cache-shared-mem-suffix=4340 --enable-pinch-virtual-viewport --enable-delegated-renderer --num-raster-threads=2 --use-image-texture-target=3553 --channel="4340.88.1855113282\1826427705" /prefetch:673131151
c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate	1204	Google Chrome	Copyright 2012 Google Inc. All rights reserved.	98FA788238E71D9563D4BF177A4FC22C	794.82 kb, rsAh, created: 11.09.2014 19:56:40, modified: 20.06.2015 07:46:07 Command line: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=ppapi --channel="4340.89.1676702093\1251535219" --ppapi-flash-args=enable_hw_video_decode=1 --lang=en-US --ignored=" --type=renderer " /prefetch:-632637702
c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate	3756	Google Chrome	Copyright 2012 Google Inc. All rights reserved.	98FA788238E71D9563D4BF177A4FC22C	794.82 kb, rsAh, created: 11.09.2014 19:56:40, modified: 20.06.2015 07:46:07 Command line: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=en-US --force-fieldtrials="AffiliationBasedMatching/Enabled/AutofillEnabled/Default/BackgroundRendererProcesses/AllowIdleFromBrowser/BrowserBlacklist/Enabled/CTRequiredForEVTrial/RequirementEnforced/CaptivePortalInterstitial/Enabled/ChildAccountDetection/Disabled/ChromeDashboard/Default/ChromeSuggestions/Default/DomRel-Enable/enable/EmbeddedSearch/Group4 pct:10d stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnableSessionCrashedBubbleUI/Disabled/EnhancedBookmarks/Default/ExtensionContentVerification/Enforce/ExtensionInstallVerification/Enforce/GoogleNow/Enable/IconNTP/Default/NewProfileManagement/Enabled/OmniboxBundledExperimentV1/Hivemind_A2_Stable_R7_Postperiod/PasswordGeneration/Disabled/PasswordLinkInSettings/Disabled/PermissionBubbleRollout/Enabled/PrerenderFromOmnibox/OmniboxPrerenderEnabled/QUIC/EnabledNoIdForLargePopulation/RefreshTokenDeviceId/Enabled/RememberCertificateErrorDecisions/OneWeek/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/SRTPromptFieldTrial/On/SafeBrowsingIncidentReportingService/Default/SessionRestoreBackgroundLoading/Restore/SettingsEnforcement/enforce_always_with_extensions_and_dse/SyncBackingDatabase32K/Enabled/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group6/UMA-Population-Restrict/normal/UMA-Uniformity-Trial-1-Percent/group_02/UMA-Uniformity-Trial-10-Percent/group_05/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_03/UMA-Uniformity-Trial-5-Percent/group_17/UMA-Uniformity-Trial-50-Percent/group_01/UseDelayAgnosticAEC/Enabled/VoiceTrigger/Install/WebRTC-IPv6Default/Enabled/WebRTC-UDPSocketNonBlockingIO/Default/Win32kLockdown/Enabled/" --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --font-cache-shared-mem-suffix=4340 --enable-pinch-virtual-viewport --enable-delegated-renderer --num-raster-threads=2 --use-image-texture-target=3553 --channel="4340.90.280064132\1860945650" /prefetch:673131151
c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate	5420	Google Chrome	Copyright 2012 Google Inc. All rights reserved.	98FA788238E71D9563D4BF177A4FC22C	794.82 kb, rsAh, created: 11.09.2014 19:56:40, modified: 20.06.2015 07:46:07 Command line: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=en-US --force-fieldtrials="AffiliationBasedMatching/Enabled/AutofillEnabled/Default/BackgroundRendererProcesses/AllowIdleFromBrowser/BrowserBlacklist/Enabled/CTRequiredForEVTrial/RequirementEnforced/CaptivePortalInterstitial/Enabled/ChildAccountDetection/Disabled/ChromeDashboard/Default/ChromeSuggestions/Default/DomRel-Enable/enable/EmbeddedSearch/Group4 pct:10d stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnableSessionCrashedBubbleUI/Disabled/EnhancedBookmarks/Default/ExtensionContentVerification/Enforce/ExtensionInstallVerification/Enforce/GoogleNow/Enable/IconNTP/Default/NewProfileManagement/Enabled/OmniboxBundledExperimentV1/Hivemind_A2_Stable_R7_Postperiod/PasswordGeneration/Disabled/PasswordLinkInSettings/Disabled/PermissionBubbleRollout/Enabled/PrerenderFromOmnibox/OmniboxPrerenderEnabled/QUIC/EnabledNoIdForLargePopulation/RefreshTokenDeviceId/Enabled/RememberCertificateErrorDecisions/OneWeek/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/SRTPromptFieldTrial/On/SafeBrowsingIncidentReportingService/Default/SessionRestoreBackgroundLoading/Restore/SettingsEnforcement/enforce_always_with_extensions_and_dse/SyncBackingDatabase32K/Enabled/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group6/UMA-Population-Restrict/normal/UMA-Uniformity-Trial-1-Percent/group_02/UMA-Uniformity-Trial-10-Percent/group_05/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_03/UMA-Uniformity-Trial-5-Percent/group_17/UMA-Uniformity-Trial-50-Percent/group_01/UseDelayAgnosticAEC/Enabled/VoiceTrigger/Install/WebRTC-IPv6Default/Enabled/WebRTC-UDPSocketNonBlockingIO/Default/Win32kLockdown/Enabled/" --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --font-cache-shared-mem-suffix=4340 --enable-pinch-virtual-viewport --enable-delegated-renderer --num-raster-threads=2 --use-image-texture-target=3553 --channel="4340.91.1532136979\1971057449" /prefetch:673131151
c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate	6076	Google Chrome	Copyright 2012 Google Inc. All rights reserved.	98FA788238E71D9563D4BF177A4FC22C	794.82 kb, rsAh, created: 11.09.2014 19:56:40, modified: 20.06.2015 07:46:07 Command line: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=en-US --force-fieldtrials="AffiliationBasedMatching/Enabled/AutofillEnabled/Default/BackgroundRendererProcesses/AllowIdleFromBrowser/BrowserBlacklist/Enabled/CTRequiredForEVTrial/RequirementEnforced/CaptivePortalInterstitial/Enabled/ChildAccountDetection/Disabled/ChromeDashboard/Default/ChromeSuggestions/Default/DomRel-Enable/enable/EmbeddedSearch/Group4 pct:10d stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnableSessionCrashedBubbleUI/Disabled/EnhancedBookmarks/Default/ExtensionContentVerification/Enforce/ExtensionInstallVerification/Enforce/GoogleNow/Enable/IconNTP/Default/NewProfileManagement/Enabled/OmniboxBundledExperimentV1/Hivemind_A2_Stable_R7_Postperiod/PasswordGeneration/Disabled/PasswordLinkInSettings/Disabled/PermissionBubbleRollout/Enabled/PrerenderFromOmnibox/OmniboxPrerenderEnabled/QUIC/EnabledNoIdForLargePopulation/RefreshTokenDeviceId/Enabled/RememberCertificateErrorDecisions/OneWeek/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/SRTPromptFieldTrial/On/SafeBrowsingIncidentReportingService/Default/SessionRestoreBackgroundLoading/Restore/SettingsEnforcement/enforce_always_with_extensions_and_dse/SyncBackingDatabase32K/Enabled/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group6/UMA-Population-Restrict/normal/UMA-Uniformity-Trial-1-Percent/group_02/UMA-Uniformity-Trial-10-Percent/group_05/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_03/UMA-Uniformity-Trial-5-Percent/group_17/UMA-Uniformity-Trial-50-Percent/group_01/UseDelayAgnosticAEC/Enabled/VoiceTrigger/Install/WebRTC-IPv6Default/Enabled/WebRTC-UDPSocketNonBlockingIO/Default/Win32kLockdown/Enabled/" --extension-process --enable-webrtc-hw-h264-encoding --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --font-cache-shared-mem-suffix=4340 --enable-pinch-virtual-viewport --enable-delegated-renderer --num-raster-threads=2 --use-image-texture-target=3553 --channel="4340.2.1443226718\1893238848" /prefetch:673131151
c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate	6092	Google Chrome	Copyright 2012 Google Inc. All rights reserved.	98FA788238E71D9563D4BF177A4FC22C	794.82 kb, rsAh, created: 11.09.2014 19:56:40, modified: 20.06.2015 07:46:07 Command line: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=en-US --force-fieldtrials="AffiliationBasedMatching/Enabled/AutofillEnabled/Default/BackgroundRendererProcesses/AllowIdleFromBrowser/BrowserBlacklist/Enabled/CTRequiredForEVTrial/RequirementEnforced/CaptivePortalInterstitial/Enabled/ChildAccountDetection/Disabled/ChromeDashboard/Default/ChromeSuggestions/Default/DomRel-Enable/enable/EmbeddedSearch/Group4 pct:10d stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnableSessionCrashedBubbleUI/Disabled/EnhancedBookmarks/Default/ExtensionContentVerification/Enforce/ExtensionInstallVerification/Enforce/GoogleNow/Enable/IconNTP/Default/NewProfileManagement/Enabled/OmniboxBundledExperimentV1/Hivemind_A2_Stable_R7_Postperiod/PasswordGeneration/Disabled/PasswordLinkInSettings/Disabled/PermissionBubbleRollout/Enabled/PrerenderFromOmnibox/OmniboxPrerenderEnabled/QUIC/EnabledNoIdForLargePopulation/RefreshTokenDeviceId/Enabled/RememberCertificateErrorDecisions/OneWeek/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/SRTPromptFieldTrial/On/SafeBrowsingIncidentReportingService/Default/SessionRestoreBackgroundLoading/Restore/SettingsEnforcement/enforce_always_with_extensions_and_dse/SyncBackingDatabase32K/Enabled/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group6/UMA-Population-Restrict/normal/UMA-Uniformity-Trial-1-Percent/group_02/UMA-Uniformity-Trial-10-Percent/group_05/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_03/UMA-Uniformity-Trial-5-Percent/group_17/UMA-Uniformity-Trial-50-Percent/group_01/UseDelayAgnosticAEC/Enabled/VoiceTrigger/Install/WebRTC-IPv6Default/Enabled/WebRTC-UDPSocketNonBlockingIO/Default/*Win32kLockdown/Enabled/" --extension-process --enable-webrtc-hw-h264-encoding --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --font-cache-shared-mem-suffix=4340 --enable-pinch-virtual-viewport --enable-delegated-renderer --num-raster-threads=2 --use-image-texture-target=3553 --channel="4340.3.1419188008\268402337" /prefetch:673131151
c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate	5412	Google Chrome	Copyright 2012 Google Inc. All rights reserved.	98FA788238E71D9563D4BF177A4FC22C	794.82 kb, rsAh, created: 11.09.2014 19:56:40, modified: 20.06.2015 07:46:07 Command line: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=en-US --force-fieldtrials="AffiliationBasedMatching/Enabled/AutofillEnabled/Default/BackgroundRendererProcesses/AllowIdleFromBrowser/BrowserBlacklist/Enabled/CTRequiredForEVTrial/RequirementEnforced/CaptivePortalInterstitial/Enabled/ChildAccountDetection/Disabled/ChromeDashboard/Default/ChromeSuggestions/Default/DomRel-Enable/enable/EmbeddedSearch/Group4 pct:10d stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnableSessionCrashedBubbleUI/Disabled/EnhancedBookmarks/Default/ExtensionContentVerification/Enforce/ExtensionInstallVerification/Enforce/GoogleNow/Enable/IconNTP/Default/NewProfileManagement/Enabled/OmniboxBundledExperimentV1/Hivemind_A2_Stable_R7_Postperiod/PasswordGeneration/Disabled/PasswordLinkInSettings/Disabled/PermissionBubbleRollout/Enabled/PrerenderFromOmnibox/OmniboxPrerenderEnabled/QUIC/EnabledNoIdForLargePopulation/RefreshTokenDeviceId/Enabled/RememberCertificateErrorDecisions/OneWeek/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/SRTPromptFieldTrial/On/SafeBrowsingIncidentReportingService/Default/SessionRestoreBackgroundLoading/Restore/SettingsEnforcement/enforce_always_with_extensions_and_dse/SyncBackingDatabase32K/Enabled/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group6/UMA-Population-Restrict/normal/UMA-Uniformity-Trial-1-Percent/group_02/UMA-Uniformity-Trial-10-Percent/group_05/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_03/UMA-Uniformity-Trial-5-Percent/group_17/UMA-Uniformity-Trial-50-Percent/group_01/UseDelayAgnosticAEC/Enabled/VoiceTrigger/Install/WebRTC-IPv6Default/Enabled/WebRTC-UDPSocketNonBlockingIO/Default/*Win32kLockdown/Enabled/" --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --font-cache-shared-mem-suffix=4340 --enable-pinch-virtual-viewport --enable-delegated-renderer --num-raster-threads=2 --use-image-texture-target=3553 --channel="4340.7.1147998257\638825753" /prefetch:673131151
c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate	4340	Google Chrome	Copyright 2012 Google Inc. All rights reserved.	98FA788238E71D9563D4BF177A4FC22C	794.82 kb, rsAh, created: 11.09.2014 19:56:40, modified: 20.06.2015 07:46:07 Command line: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate	4168	Google Chrome	Copyright 2012 Google Inc. All rights reserved.	98FA788238E71D9563D4BF177A4FC22C	794.82 kb, rsAh, created: 11.09.2014 19:56:40, modified: 20.06.2015 07:46:07 Command line: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --on-initialized-event-handle=420 --parent-handle=428
c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate	4772	Google Chrome	Copyright 2012 Google Inc. All rights reserved.	98FA788238E71D9563D4BF177A4FC22C	794.82 kb, rsAh, created: 11.09.2014 19:56:40, modified: 20.06.2015 07:46:07 Command line: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --channel="4340.0.178577954\44992803" --disable-d3d11 --supports-dual-gpus=false --gpu-driver-bug-workarounds=2,9,21,44 --gpu-vendor-id=0x1002 --gpu-device-id=0x68c1 --gpu-driver-vendor="ATI Technologies Inc." --gpu-driver-version=8.712.2.1000 --ignored=" --type=renderer " /prefetch:822062411
c:\users\nele\appdata\roaming\dropbox\bin\dropbox.exe Script: Quarantine, Delete, Delete via BC, Terminate	4372	Dropbox	Dropbox, Inc.	A1413E56F0C42D457EFC99088EF75611	42843.34 kb, rsAh, created: 05.05.2015 05:08:32, modified: 10.06.2015 22:36:06 Command line: "C:\Users\Nele\AppData\Roaming\Dropbox\bin\Dropbox.exe" /systemstartup
c:\program files (x86)\myheritage\bin\ftbcheckupdates.exe Script: Quarantine, Delete, Delete via BC, Terminate	4876	MyHeritage Family Tree Builder check for updates	Copyright (C) 2009 MyHeritage.com	010D52338F251D3042B5E4C51B7EE4EC	2475.00 kb, rsAh, created: 25.03.2014 17:32:36, modified: 25.03.2014 17:32:36 Command line: "C:\Program Files (x86)\MyHeritage\Bin\FTBCheckUpdates.exe"
c:\program files (x86)\nero\nero backitup & burn\nero backitup\nbagent.exe Script: Quarantine, Delete, Delete via BC, Terminate	4712	Nero BackItUp	Copyright (c) 2003-2010 Nero AG and its licensors	80A02F5ADDDF2D615B85A4F19424DCBB	1061.29 kb, rsAh, created: 09.03.2010 02:23:22, modified: 09.03.2010 02:23:22 Command line: "C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe" /WinStart
c:\users\nele\appdata\local\akamai\netsession_win.exe Script: Quarantine, Delete, Delete via BC, Terminate	4128	Akamai NetSession Client	Copyright (C) 2007 - 2014 Akamai Technologies, Inc.	D6E2ED7F1F7BE7CCB8676491BF950B57	4563.90 kb, rsAh, created: 30.10.2014 00:25:46, modified: 30.10.2014 00:25:46 Command line: "C:/Users/Nele/AppData/Local/Akamai/netsession_win.exe" --client
c:\users\nele\appdata\local\akamai\netsession_win.exe Script: Quarantine, Delete, Delete via BC, Terminate	1260	Akamai NetSession Client	Copyright (C) 2007 - 2014 Akamai Technologies, Inc.	D6E2ED7F1F7BE7CCB8676491BF950B57	4563.90 kb, rsAh, created: 30.10.2014 00:25:46, modified: 30.10.2014 00:25:46 Command line: "C:\Users\Nele\AppData\Local\Akamai\netsession_win.exe"
c:\users\nele\appdata\roaming\microsoft\systemcertificates\vssvc.exe Script: Quarantine, Delete, Delete via BC, Terminate	3060	Microsoft® Volume Shadow Copy Service	© Microsoft Corporation. All rights reserved.	9782E41CEF5921BFD44A038EB535A3ED	101239.75 kb, rsAh, created: 23.06.2015 10:08:36, modified: 23.06.2015 10:08:45 Command line: C:\Users\Nele\AppData\Roaming\Microsoft\SystemCertificates\VSSVC.exe
Detected:99, recognized as trusted 82

Module name	Handle	Description	Copyright	MD5	Used by processes
C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.130\chrome.dll Script: Quarantine, Delete, Delete via BC	1829830656	Google Chrome	Copyright 2012 Google Inc. All rights reserved.	0C0F5D1428D00DEF0FE16EBA9EDAA4D5	4340
C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.130\chrome_child.dll Script: Quarantine, Delete, Delete via BC	1777860608	Google Chrome	Copyright 2012 Google Inc. All rights reserved.	1BC188B9E6AC2098B46C3A99669E1C96	5732, 6860, 6340, 1204, 3756, 5420, 6076, 6092, 5412, 4772
C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.130\chrome_elf.dll Script: Quarantine, Delete, Delete via BC	1949630464	Google Chrome	Copyright 2012 Google Inc. All rights reserved.	78CE940FD1CCDF6F743EE1A9AED8AAD8	5732, 6860, 6340, 1204, 3756, 5420, 6076, 6092, 5412, 4340, 4168, 4772
C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.130\chrome_watcher.dll Script: Quarantine, Delete, Delete via BC	1940062208	Google Chrome	Copyright 2012 Google Inc. All rights reserved.	12D386850971B9BC1EB998F7A661D3EE	4168
C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.130\ffmpegsumo.dll Script: Quarantine, Delete, Delete via BC	1754791936	Google Chrome	Copyright 2012 Google Inc. All rights reserved.	0CFD4507EDB623CA5DFC4C659BED8393	5732, 6860, 6340, 1204, 3756, 5420, 6076, 6092, 5412
C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.130\libegl.dll Script: Quarantine, Delete, Delete via BC	1920794624	ANGLE libEGL Dynamic Link Library	Copyright (C) 2011 Google Inc.	7334946C594BF3C2A90C639F86EAE7C6	4772
C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.130\libglesv2.dll Script: Quarantine, Delete, Delete via BC	1898577920	ANGLE libGLESv2 Dynamic Link Library	Copyright (C) 2011 Google Inc.	085A050A565E3D557E0BD47A1CC669D7	4772
C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.130\PepperFlash\pepflashplayer.dll Script: Quarantine, Delete, Delete via BC	1659371520			7ACCAB58C70F7B76024BB52B33ADCEF0	1204
C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBRes.dll Script: Quarantine, Delete, Delete via BC	60227584	Nero BackItUp	Copyright (c) 2003-2010 Nero AG and its licensors	85473FACB0E0534CE6F934EF69DB016F	4712
c:\users\nele\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp8_g00z.dll Script: Quarantine, Delete, Delete via BC	82116608			D9348DB92AB4E5B94F005F0F651DE2B1	4372
C:\Users\Nele\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll Script: Quarantine, Delete, Delete via BC	1935278080	Dropbox Shell Extension	(c) Dropbox, Inc. All rights reserved	18FADA10778089203FBED43FB044B208	3664, 4340
Modules found:294, recognized as trusted 283

Kernel Space Modules Viewer

Module	Base address	Size in memory	Description	Manufacturer
C:\Windows\System32\Drivers\dump_dumpfve.sys Script: Quarantine, Delete, Delete via BC	63C7000	013000 (77824)
C:\Windows\System32\Drivers\dump_iaStor.sys Script: Quarantine, Delete, Delete via BC	4463000	208000 (2129920)
C:\Program Files\kprocesshacker.sys Script: Quarantine, Delete, Delete via BC	8FCD000	00C000 (49152)
Modules found - 220, recognized as trusted - 217

Services

Service	Description	Status	File	Group	Dependencies
VSSS Service: Stop, Delete, Disable, Delete via BC	Volume Shadow Copy Service	Running	C:\Users\Nele\AppData\Roaming\Microsoft\SystemCertificates\VSSVC.exe Script: Quarantine, Delete, Delete via BC
AcronisOSSReinstallSvc Service: Stop, Delete, Disable, Delete via BC	Acronis OS Selector Reinstall Service	Not started	C:\Program Files (x86)\Common Files\Acronis\Acronis Disk Director\oss_reinstall_svc.exe Script: Quarantine, Delete, Delete via BC
AdobeFlashPlayerUpdateSvc Service: Stop, Delete, Disable, Delete via BC	Adobe Flash Player Update Service	Not started	C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Script: Quarantine, Delete, Delete via BC
KMService Service: Stop, Delete, Disable, Delete via BC	KMService	Not started	C:\Windows\system32\srvany.exe Script: Quarantine, Delete, Delete via BC
mi-raysat_3dsmax2011_64 Service: Stop, Delete, Disable, Delete via BC	mental ray 3.8 Satellite for Autodesk 3ds Max 2011 64-bit 64-bit	Not started	D:\Autodesk 3ds Max\mentalimages\satellite\raysat_3dsmax2011_64server.exe Script: Quarantine, Delete, Delete via BC
Detected - 180, recognized as trusted - 175

Drivers

Service	Description	Status	File	Group	Dependencies
sptd Driver: Unload, Delete, Disable, Delete via BC	sptd	Running	C:\Windows\SystemRoot\System32\Drivers\sptd.sys Script: Quarantine, Delete, Delete via BC	Boot Bus Extender
ew_hwusbdev Driver: Unload, Delete, Disable, Delete via BC	Huawei MobileBroadband USB PNP Device	Not started	C:\Windows\system32\DRIVERS\ew_hwusbdev.sys Script: Quarantine, Delete, Delete via BC
ew_usbenumfilter Driver: Unload, Delete, Disable, Delete via BC	huawei_CompositeFilter	Not started	C:\Windows\system32\DRIVERS\ew_usbenumfilter.sys Script: Quarantine, Delete, Delete via BC	PNP Filter
huawei_cdcacm Driver: Unload, Delete, Disable, Delete via BC	huawei_cdcacm	Not started	C:\Windows\system32\DRIVERS\ew_jucdcacm.sys Script: Quarantine, Delete, Delete via BC
huawei_enumerator Driver: Unload, Delete, Disable, Delete via BC	huawei_enumerator	Not started	C:\Windows\system32\DRIVERS\ew_jubusenum.sys Script: Quarantine, Delete, Delete via BC	Base
huawei_ext_ctrl Driver: Unload, Delete, Disable, Delete via BC	huawei_ext_ctrl	Not started	C:\Windows\system32\DRIVERS\ew_juextctrl.sys Script: Quarantine, Delete, Delete via BC
huawei_wwanecm Driver: Unload, Delete, Disable, Delete via BC	huawei_wwanecm	Not started	C:\Windows\system32\DRIVERS\ew_juwwanecm.sys Script: Quarantine, Delete, Delete via BC	NDIS
massfilter Driver: Unload, Delete, Disable, Delete via BC	ZTE Mass Storage Filter Driver	Not started	C:\Windows\system32\drivers\massfilter.sys Script: Quarantine, Delete, Delete via BC
SASDIFSV Driver: Unload, Delete, Disable, Delete via BC	SASDIFSV	Not started	C:\Users\Nele\AppData\Local\Temp\SAS_SelfExtract\SASDIFSV64.SYS Script: Quarantine, Delete, Delete via BC
SASKUTIL Driver: Unload, Delete, Disable, Delete via BC	SASKUTIL	Not started	C:\Users\Nele\AppData\Local\Temp\SAS_SelfExtract\SASKUTIL64.SYS Script: Quarantine, Delete, Delete via BC
ZTEusbmdm6k Driver: Unload, Delete, Disable, Delete via BC	ZTE Proprietary USB Driver	Not started	C:\Windows\system32\DRIVERS\ZTEusbmdm6k.sys Script: Quarantine, Delete, Delete via BC
ZTEusbnmea Driver: Unload, Delete, Disable, Delete via BC	ZTE NMEA Port	Not started	C:\Windows\system32\DRIVERS\ZTEusbnmea.sys Script: Quarantine, Delete, Delete via BC
ZTEusbser6k Driver: Unload, Delete, Disable, Delete via BC	ZTE Diagnostic Port	Not started	C:\Windows\system32\DRIVERS\ZTEusbser6k.sys Script: Quarantine, Delete, Delete via BC
Detected - 280, recognized as trusted - 267

Autoruns

File name	Status	Startup method	Description
Alert\TReport.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\THSA, EventMessageFile
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\atiacm64.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {5E2121EE-0300-11D4-8D3B-444553540000} Delete
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\atiama64.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {872A9397-E0D6-4e28-B64D-52B8D0A7EA35} Delete
C:\Program Files (x86)\BearShare Applications\BearShare\BearShare.exe Script: Quarantine, Delete, Delete via BC	Active	Shortcut in Startup folder	C:\Users\Nele\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\, C:\Users\Nele\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\BearShare.lnk,
C:\Program Files (x86)\Common Files\Microsoft Shared\DW\DW.EXE Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft Visual Studio Tools for Applications, EventMessageFile
C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\IPSEventLogMsg.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Handwriting Recognition, EventMessageFile
C:\Program Files (x86)\DVD Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Dvd Maker, EventMessageFile
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Script: Quarantine, Delete, Delete via BC	Active	Shortcut in Startup folder	C:\Users\Nele\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\, C:\Users\Nele\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk,
C:\Program Files (x86)\Internet Explorer\iexplore.exe http://www.istartsurf.com/?type=sc&ts=1410331261&from=epom2&uid=ST9500325AS_5VE7AEFVXXXX5VE7AEFV Script: Quarantine, Delete, Delete via BC	Active	Shortcut in Startup folder	C:\Users\Nele\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\, C:\Users\Nele\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk,
C:\Program Files (x86)\Kepard\Kepard.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, Kepard Delete
C:\Program Files (x86)\MyHeritage\Bin\FTBCheckUpdates.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, Family Tree Builder Update Delete
C:\Program Files (x86)\TOSHIBA\TOSHIBA Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\THSA, EventMessageFile
C:\Program Files (x86)\Windows Defender\MpEvMsg.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\WinDefend, EventMessageFile
C:\Program Files\TOSHIBA\Bluetooth Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, ITSecMng Delete
C:\Users\Nele\AppData\Local\Akamai\netsession_win.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_CURRENT_USER, Software\Microsoft\Windows\CurrentVersion\Run, Akamai NetSession Interface Delete
C:\Users\Nele\AppData\Local\Google\Update\GoogleUpdate.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_CURRENT_USER, Software\Microsoft\Windows\CurrentVersion\Run, Google Update Delete
C:\Users\Nele\AppData\Roaming\Dropbox\bin\Dropbox.exe Script: Quarantine, Delete, Delete via BC	Active	Shortcut in Startup folder	C:\Users\Nele\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\, C:\Users\Nele\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk,
C:\Windows\System32\Audiosrv.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AudioEndpointBuilder\Parameters, ServiceDll Delete
C:\Windows\System32\Audiosrv.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AudioSrv\Parameters, ServiceDll Delete
C:\Windows\System32\AxInstSV.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AxInstSV\Parameters, ServiceDll Delete
C:\Windows\System32\AxInstSv.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-AxInstallService, EventMessageFile
C:\Windows\System32\DFDTS.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Windows Disk Diagnostic, EventMessageFile
C:\Windows\System32\DispCI.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Display, EventMessageFile
C:\Windows\System32\Drivers\L1C62x64.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\L1C, EventMessageFile
C:\Windows\System32\Drivers\Pcmcia.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\pcmcia, EventMessageFile
C:\Windows\System32\Drivers\VolSnap.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Volsnap, EventMessageFile
C:\Windows\System32\Drivers\acpi.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\ACPI, EventMessageFile
C:\Windows\System32\Drivers\hidbth.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\HidBth, EventMessageFile
C:\Windows\System32\MsSpellCheckingFacility.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-Spell-Checking, EventMessageFile
C:\Windows\System32\MsSpellCheckingFacility.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-SpellChecker, EventMessageFile
C:\Windows\System32\MsSpellCheckingFacility.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Spell-Checking, EventMessageFile
C:\Windows\System32\MsSpellCheckingFacility.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-SpellChecker, EventMessageFile
C:\Windows\System32\RpcEpMap.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\RpcEptMapper\Parameters, ServiceDll Delete
C:\Windows\System32\SCardSvr.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\SCardSvr\Parameters, ServiceDll Delete
C:\Windows\System32\SDRSVC.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\SDRSVC\Parameters, ServiceDll Delete
C:\Windows\System32\TabSvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\TabletInputService\Parameters, ServiceDll Delete
C:\Windows\System32\TsUsbRedirectionGroupPolicyExtension.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4bcd6cde-777b-48b6-9804-43568e23545d}, DLLName Delete
C:\Windows\System32\UI0Detect.exe Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Interactive Services detection, EventMessageFile
C:\Windows\System32\VSSVC.EXE Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\VSS, EventMessageFile
C:\Windows\System32\VSSVC.EXE Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Security\VSSAudit, EventMessageFile
C:\Windows\System32\WUDFHost.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WUDF\Services\{193a1820-d9ac-4997-8c55-be817523f6aa}, HostProcessImagePath Delete
C:\Windows\System32\WUDFSvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\wudfsvc\Parameters, ServiceDll Delete
C:\Windows\System32\WerSvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WerSvc\Parameters, ServiceDll Delete
C:\Windows\System32\aelupsvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AeLookupSvc\Parameters, ServiceDll Delete
C:\Windows\System32\aelupsvc.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\AeLookupSvc, EventMessageFile
C:\Windows\System32\appidsvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AppIDSvc\Parameters, ServiceDll Delete
C:\Windows\System32\appinfo.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Appinfo\Parameters, ServiceDll Delete
C:\Windows\System32\bdesvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\BDESVC\Parameters, ServiceDll Delete
C:\Windows\System32\bfe.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\BFE\Parameters, ServiceDll Delete
C:\Windows\System32\browser.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Browser\Parameters, ServiceDll Delete
C:\Windows\System32\certprop.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\CertPropSvc\Parameters, ServiceDll Delete
C:\Windows\System32\certprop.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\SCPolicySvc\Parameters, ServiceDll Delete
C:\Windows\System32\defragsvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\defragsvc\Parameters, ServiceDll Delete
C:\Windows\System32\dnsrslvr.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Dnscache\Parameters, ServiceDll Delete
C:\Windows\System32\dot3svc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\dot3svc\Parameters, ServiceDll Delete
C:\Windows\System32\drivers\HECIx64.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\HECIx64, EventMessageFile
C:\Windows\System32\drivers\MTConfig.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\MTConfig, EventMessageFile
C:\Windows\System32\drivers\SynTP.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\SynTP, EventMessageFile
C:\Windows\System32\drivers\Wdf01000.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\wdf01000, EventMessageFile
C:\Windows\System32\drivers\amdk8.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\AmdK8, EventMessageFile
C:\Windows\System32\drivers\amdppm.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\AmdPPM, EventMessageFile
C:\Windows\System32\drivers\ati2erec.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\ATIeRecord, EventMessageFile
C:\Windows\System32\drivers\ati2erec.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\amdkmdag, EventMessageFile
C:\Windows\System32\drivers\ati2erec.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\amdkmdap, EventMessageFile
C:\Windows\System32\drivers\b57nd60a.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\b57nd60a, EventMessageFile
C:\Windows\System32\drivers\bxvbda.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\b06bdrv, EventMessageFile
C:\Windows\System32\drivers\evbda.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\ebdrv, EventMessageFile
C:\Windows\System32\drivers\ew_jucdcacm.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\huawei_cdcacm, EventMessageFile
C:\Windows\System32\drivers\fltmgr.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\FltMgr, EventMessageFile
C:\Windows\System32\drivers\i8042prt.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\i8042prt, EventMessageFile
C:\Windows\System32\drivers\iaStor.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\iaStor, EventMessageFile
C:\Windows\System32\drivers\iaStorV.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\iaStorV, EventMessageFile
C:\Windows\System32\drivers\intelppm.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\intelppm, EventMessageFile
C:\Windows\System32\drivers\ipmidrv.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPMIDRV, EventMessageFile
C:\Windows\System32\drivers\isapnp.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\isapnp, EventMessageFile
C:\Windows\System32\drivers\kbdclass.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\kbdclass, EventMessageFile
C:\Windows\System32\drivers\kbdhid.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\kbdhid, EventMessageFile
C:\Windows\System32\drivers\mouclass.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\mouclass, EventMessageFile
C:\Windows\System32\drivers\mouhid.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\mouhid, EventMessageFile
C:\Windows\System32\drivers\mpio.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\mpio, EventMessageFile
C:\Windows\System32\drivers\nvstor.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\nvstor, EventMessageFile
C:\Windows\System32\drivers\parport.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Parport, EventMessageFile
C:\Windows\System32\drivers\processr.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Processor, EventMessageFile
C:\Windows\System32\drivers\sbp2port.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\sbp2port, EventMessageFile
C:\Windows\System32\drivers\serial.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Serial, EventMessageFile
C:\Windows\System32\drivers\sermouse.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\sermouse, EventMessageFile
C:\Windows\System32\drivers\tosporte.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\tosporte, EventMessageFile
C:\Windows\System32\drivers\tosrfbd.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\tosrfbd, EventMessageFile
C:\Windows\System32\drivers\tosrfusb.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\tosrfusb, EventMessageFile
C:\Windows\System32\drivers\tsusbflt.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\TsUsbFlt, EventMessageFile
C:\Windows\System32\drivers\vgapnp.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\vga, EventMessageFile
C:\Windows\System32\drivers\wacompen.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\WacomPen, EventMessageFile
C:\Windows\System32\drivers\wd.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Wd, EventMessageFile
C:\Windows\System32\eapsvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\EapHost\Parameters, ServiceDll Delete
C:\Windows\System32\gpsvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\gpsvc\Parameters, ServiceDll Delete
C:\Windows\System32\ikeext.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\IKEEXT\Parameters, ServiceDll Delete
C:\Windows\System32\iphlpsvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters, ServiceDll Delete
C:\Windows\System32\ipnathlp.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters, ServiceDll Delete
C:\Windows\System32\ipsecsvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\PolicyAgent\Parameters, ServiceDll Delete
C:\Windows\System32\iscsiexe.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\MSiSCSI, EventMessageFile
C:\Windows\System32\iscsilog.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\iScsiPrt, EventMessageFile
C:\Windows\System32\lltdsvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\lltdsvc\Parameters, ServiceDll Delete
C:\Windows\System32\lmhsvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\lmhosts\Parameters, ServiceDll Delete
C:\Windows\System32\lsasrv.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\LsaSrv, EventMessageFile
C:\Windows\System32\lsasrv.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Schannel, EventMessageFile
C:\Windows\System32\mctadmin.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_USERS, S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce, mctadmin Delete
C:\Windows\System32\mctadmin.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_USERS, S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce, mctadmin Delete
C:\Windows\System32\mdsched.exe Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-MemoryDiagnostics-Schedule, EventMessageFile
C:\Windows\System32\netman.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Netman\Parameters, ServiceDll Delete
C:\Windows\System32\nlasvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters, ServiceDll Delete
C:\Windows\System32\pcasvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\PcaSvc\Parameters, ServiceDll Delete
C:\Windows\System32\profsvc.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-User Profiles Service, EventMessageFile
C:\Windows\System32\profsvc.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Profsvc, EventMessageFile
C:\Windows\System32\qmgr.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\BITS\Parameters, ServiceDll Delete
C:\Windows\System32\rasauto.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\RasAuto\Parameters, ServiceDll Delete
C:\Windows\System32\rasmans.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\RasMan\Parameters, ServiceDll Delete
C:\Windows\System32\relpost.exe Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-MemoryDiagnostics-Results, EventMessageFile
C:\Windows\System32\samsrv.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Directory-Services-SAM, EventMessageFile
C:\Windows\System32\samsrv.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\SAM, EventMessageFile
C:\Windows\System32\snmptrap.exe Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\SNMPTRAP, EventMessageFile
C:\Windows\System32\ssdpsrv.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\SSDPSRV\Parameters, ServiceDll Delete
C:\Windows\System32\sstpsvc.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-RasSstp, EventMessageFile
C:\Windows\System32\swprv.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\swprv\Parameters, ServiceDll Delete
C:\Windows\System32\tbssvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\TBS\Parameters, ServiceDll Delete
C:\Windows\System32\tcpmon.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\TCPMon, EventMessageFile
C:\Windows\System32\termsrv.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\TermService\Parameters, ServiceDll Delete
C:\Windows\System32\trkwks.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\TrkWks\Parameters, ServiceDll Delete
C:\Windows\System32\umpnpmgr.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PlugPlayManager, EventMessageFile
C:\Windows\System32\umpo.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Power, EventMessageFile
C:\Windows\System32\uxsms.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\UxSms\Parameters, ServiceDll Delete
C:\Windows\System32\vds.exe Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Virtual Disk Service, EventMessageFile
C:\Windows\System32\wbiosrvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WbioSrvc\Parameters, ServiceDll Delete
C:\Windows\System32\wecsvc.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\wecsvc, EventMessageFile
C:\Windows\System32\wercplsupport.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\wercplsupport\Parameters, ServiceDll Delete
C:\Windows\System32\wersvc.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Application Hang, EventMessageFile
C:\Windows\System32\wersvc.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\WerSvc, EventMessageFile
C:\Windows\System32\wevtsvc.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Security\Microsoft-Windows-Eventlog, EventMessageFile
C:\Windows\System32\wevtsvc.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Eventlog, EventMessageFile
C:\Windows\System32\wiaservc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\stisvc\Parameters, ServiceDll Delete
C:\Windows\System32\wiaservc.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\StillImage, EventMessageFile
C:\Windows\System32\win32k.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Kmode
C:\Windows\System32\win32k.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Win32k, EventMessageFile
C:\Windows\System32\winlogon.exe Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Winlogon, EventMessageFile
C:\Windows\System32\winlogon.exe Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Wlclntfy, EventMessageFile
C:\Windows\System32\wkssvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters, ServiceDll Delete
C:\Windows\System32\wlansvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Wlansvc\Parameters, ServiceDll Delete
C:\Windows\System32\wscsvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\wscsvc\Parameters, ServiceDll Delete
C:\Windows\System32\wscsvc.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\SecurityCenter, EventMessageFile
C:\Windows\System32\wwansvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WwanSvc\Parameters, ServiceDll Delete
C:\Windows\system32\AcSignIcon.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {36A21736-36C2-4C11-8ACB-D4136F2B57BD} Delete
C:\Windows\system32\BlbEvents.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-Backup, EventMessageFile
C:\Windows\system32\EventProviders\spcmsg.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Service Pack Installer, EventMessageFile
C:\Windows\system32\FntCache.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\FontCache\Parameters, ServiceDll Delete
C:\Windows\system32\ListSvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\HomeGroupListener\Parameters, ServiceDll Delete
C:\Windows\system32\Mcx2Svc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Mcx2Svc\Parameters, ServiceDll Delete
C:\Windows\system32\WINSAT.EXE Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-WindowsSystemAssessmentTool, EventMessageFile
C:\Windows\system32\WUDFPlatform.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-DriverFrameworks-UserMode, EventMessageFile
C:\Windows\system32\bthserv.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\bthserv\Parameters, ServiceDll Delete
C:\Windows\system32\certprop.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-SCPNP, EventMessageFile
C:\Windows\system32\cofiredm.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-CorruptedFileRecovery-Client, EventMessageFile
C:\Windows\system32\cofiredm.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-CorruptedFileRecovery-Server, EventMessageFile
C:\Windows\system32\csrsrv.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Subsys-SMSS, EventMessageFile
C:\Windows\system32\defragsvc.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-Defrag, EventMessageFile
C:\Windows\system32\dfdts.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-DiskDiagnostic, EventMessageFile
C:\Windows\system32\dps.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\DPS\Parameters, ServiceDll Delete
C:\Windows\system32\drivers\HTTP.SYS Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-HttpEvent, EventMessageFile
C:\Windows\system32\drivers\fltmgr.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-FilterManager, EventMessageFile
C:\Windows\system32\drivers\fvevol.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-BitLocker-Driver, EventMessageFile
C:\Windows\system32\drivers\ntfs.sys Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Ntfs, EventMessageFile
C:\Windows\system32\dwm.exe Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Desktop Window Manager, EventMessageFile
C:\Windows\system32\eapsvc.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-EapHost, EventMessageFile
C:\Windows\system32\fdPHost.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\fdPHost\Parameters, ServiceDll Delete
C:\Windows\system32\fdphost.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-FunctionDiscoveryHost, EventMessageFile
C:\Windows\system32\fdrespub.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\FDResPub\Parameters, ServiceDll Delete
C:\Windows\system32\fdrespub.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-ResourcePublication, EventMessageFile
C:\Windows\system32\fveapi.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-BitLocker-API, EventMessageFile
C:\Windows\system32\fxsevent.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft Fax, EventMessageFile
C:\Windows\system32\gpsvc.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-GroupPolicy, EventMessageFile
C:\Windows\system32\ipbusenum.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\IPBusEnum\Parameters, ServiceDll Delete
C:\Windows\system32\ipbusenum.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-IPBusEnum, EventMessageFile
C:\Windows\system32\iphlpsvc.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Iphlpsvc, EventMessageFile
C:\Windows\system32\iscsiexe.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\MSiSCSI\Parameters, ServiceDll Delete
C:\Windows\system32\kmsvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\hkmsvc\Parameters, ServiceDll Delete
C:\Windows\system32\lpksetup.exe Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-LanguagePackSetup, EventMessageFile
C:\Windows\system32\lsm.exe Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\LSM, EventMessageFile
C:\Windows\system32\lsm.exe Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-TerminalServices-LocalSessionManager, EventMessageFile
C:\Windows\system32\microsoft-windows-hal-events.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-HAL, EventMessageFile
C:\Windows\system32\microsoft-windows-kernel-power-events.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Kernel-Power, EventMessageFile
C:\Windows\system32\microsoft-windows-kernel-processor-power-events.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Kernel-Processor-Power, EventMessageFile
C:\Windows\system32\mmcss.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\MMCSS\Parameters, ServiceDll Delete
C:\Windows\system32\mmcss.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\THREADORDER\Parameters, ServiceDll Delete
C:\Windows\system32\mpssvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\MpsSvc\Parameters, ServiceDll Delete
C:\Windows\system32\mpssvc.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Firewall, EventMessageFile
C:\Windows\system32\msdtckrm.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\KtmRm\Parameters, ServiceDll Delete
C:\Windows\system32\nsisvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\nsi\Parameters, ServiceDll Delete
C:\Windows\system32\oobe\winsetup.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Setup, EventMessageFile
C:\Windows\system32\p2psvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\p2psvc\Parameters, ServiceDll Delete
C:\Windows\system32\pnrpauto.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\PNRPAutoReg\Parameters, ServiceDll Delete
C:\Windows\system32\pnrpsvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\p2pimsvc\Parameters, ServiceDll Delete
C:\Windows\system32\pnrpsvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\PNRPsvc\Parameters, ServiceDll Delete
C:\Windows\system32\profsvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\ProfSvc\Parameters, ServiceDll Delete
C:\Windows\system32\psxss.exe Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
C:\Windows\system32\qagentRT.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\napagent\Parameters, ServiceDll Delete
C:\Windows\system32\qmgr.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Bits-Client, EventMessageFile
C:\Windows\system32\recovery.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Recovery, EventMessageFile
C:\Windows\system32\regsvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\RemoteRegistry\Parameters, ServiceDll Delete
C:\Windows\system32\rpcss.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\DcomLaunch\Parameters, ServiceDll Delete
C:\Windows\system32\rpcss.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\RpcSs\Parameters, ServiceDll Delete
C:\Windows\system32\schedsvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Schedule\Parameters, ServiceDll Delete
C:\Windows\system32\schedsvc.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-TaskScheduler, EventMessageFile
C:\Windows\system32\sdclt.exe Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\BackupPath,
C:\Windows\system32\sdengin2.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Windows Backup, EventMessageFile
C:\Windows\system32\seclogon.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\seclogon\Parameters, ServiceDll Delete
C:\Windows\system32\sensrsvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\SensrSvc\Parameters, ServiceDll Delete
C:\Windows\system32\services.exe Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Service Control Manager, EventMessageFile
C:\Windows\system32\sppsvc.exe Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Software Protection Platform Service, EventMessageFile
C:\Windows\system32\sppsvc.exe Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Key Management Service\KmsRequests, EventMessageFile
C:\Windows\system32\sppuinotify.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\sppuinotify\Parameters, ServiceDll Delete
C:\Windows\system32\srcore.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\System Restore, EventMessageFile
C:\Windows\system32\srvsvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters, ServiceDll Delete
C:\Windows\system32\sstpsvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\SstpSvc\Parameters, ServiceDll Delete
C:\Windows\system32\sstpsvc.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\RasSstp, EventMessageFile
C:\Windows\system32\sysmain.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\SysMain\Parameters, ServiceDll Delete
C:\Windows\system32\sysmain.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\rdyboost\Performance, Library Delete
C:\Windows\system32\tbssvc.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-TBS, EventMessageFile
C:\Windows\system32\termsrv.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-TerminalServices-RemoteConnectionManager, EventMessageFile
C:\Windows\system32\termsrv.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\TermService, EventMessageFile
C:\Windows\system32\themeservice.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Themes\Parameters, ServiceDll Delete
C:\Windows\system32\umpnpmgr.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\PlugPlay\Parameters, ServiceDll Delete
C:\Windows\system32\umpnpmgr.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-UserPnp, EventMessageFile
C:\Windows\system32\umpo.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Power\Parameters, ServiceDll Delete
C:\Windows\system32\w32time.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\W32Time\Parameters, ServiceDll Delete
C:\Windows\system32\w32time.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Time-Service, EventMessageFile
C:\Windows\system32\w32time.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\W32Time, EventMessageFile
C:\Windows\system32\w32time.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient, DllName Delete
C:\Windows\system32\w32time.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer, DllName Delete
C:\Windows\system32\wbem\WMIsvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Winmgmt\Parameters, ServiceDll Delete
C:\Windows\system32\wecsvc.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Wecsvc\Parameters, ServiceDll Delete
C:\Windows\system32\wecsvc.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-EventCollector, EventMessageFile
C:\Windows\system32\wecsvc.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\HardwareEvents, DisplayNameFile
C:\Windows\system32\wecsvc.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-EventCollector, EventMessageFile
C:\Windows\system32\winlogon.exe Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Winlogon, EventMessageFile
C:\Windows\system32\winsrv.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-Winsrv, EventMessageFile
C:\Windows\system32\wlansvc.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-WLAN-AutoConfig, EventMessageFile
C:\Windows\system32\wpdbusenum.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WPDBusEnum\Parameters, ServiceDll Delete
C:\Windows\system32\wsepno.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Windows Search Service Profile Notification, EventMessageFile
C:\Windows\system32\wuaueng.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\wuauserv\Parameters, ServiceDll Delete
C:\Windows\system32\wuaueng.dll Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-WindowsUpdateClient, EventMessageFile
D:\Gimp\GIMP-2.0\bin\gimp-2.6.exe Script: Quarantine, Delete, Delete via BC	Active	Shortcut in Startup folder	C:\Users\Nele\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\, C:\Users\Nele\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\GIMP 2.lnk,
Maker\DVDMaker.exe Script: Quarantine, Delete, Delete via BC	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Dvd Maker, EventMessageFile
Stack\ItSecMng.exe Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, ITSecMng Delete
auditcse.dll Script: Quarantine, Delete, Delete via BC	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{f3ccc681-b74c-4060-9f26-cd84525dca2a}, DLLName Delete
Autoruns items found - 823, recognized as trusted - 571

Internet Explorer extension modules (BHOs, Toolbars ...)

File name	Type	Description	Manufacturer	CLSID
	Extension module			{219C3416-8CB2-491a-A3C7-D9FCDDC9D600} Delete
	Extension module			{2670000A-7350-4f3c-8081-5663EE0C6C49} Delete
	Extension module			{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} Delete
Items found - 13, recognized as trusted - 10

Windows Explorer extension modules

File name	Destination	Description	Manufacturer	CLSID
	Catalyst Context Menu extension			{5E2121EE-0300-11D4-8D3B-444553540000} Delete
	WLMD Message Handler			{0563DB41-F538-4B37-A92D-4659049B7766} Delete
	WebCheck			{E6FB5E20-DE35-11CF-9C87-00AA005127ED} Delete
	ColumnHandler			{8A0BC933-7552-42E2-A228-3BE055777227} Delete
	ColumnHandler			{9F2C5BFD-3CB1-419F-9F5F-90B32ADD5BA8} Delete
Items found - 53, recognized as trusted - 48

Printing system extensions (print monitors, providers)

File name	Type	Name	Description	Manufacturer
localspl.dll Script: Quarantine, Delete, Delete via BC	Monitor	Local Port
FXSMON.DLL Script: Quarantine, Delete, Delete via BC	Monitor	Microsoft Shared Fax Monitor
tcpmon.dll Script: Quarantine, Delete, Delete via BC	Monitor	Standard TCP/IP Port
tbtmon.dll Script: Quarantine, Delete, Delete via BC	Monitor	Toshiba Bluetooth Monitor
usbmon.dll Script: Quarantine, Delete, Delete via BC	Monitor	USB Monitor
WSDMon.dll Script: Quarantine, Delete, Delete via BC	Monitor	WSD Port
inetpp.dll Script: Quarantine, Delete, Delete via BC	Provider	HTTP Print Services
Items found - 9, recognized as trusted - 2

Task Scheduler jobs

File name	Job name	Job state	Description	Manufacturer	Path	Command line
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Script: Quarantine, Delete, Delete via BC	Adobe Flash Player Updater.job Script: Delete	The task is ready to run at its next scheduled time.	Adobe® Flash® Player Update Service 17.0 r0	Copyright © 1996-2015 Adobe Systems Incorporated		C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Users\Nele\AppData\Local\Google\Update\GoogleUpdate.exe Script: Quarantine, Delete, Delete via BC	GoogleUpdateTaskUserS-1-5-21-3458131516-997301713-3897728758-1000Core.job Script: Delete	The task is ready to run at its next scheduled time.				C:\Users\Nele\AppData\Local\Google\Update\GoogleUpdate.exe /c
C:\Users\Nele\AppData\Local\Google\Update\GoogleUpdate.exe Script: Quarantine, Delete, Delete via BC	GoogleUpdateTaskUserS-1-5-21-3458131516-997301713-3897728758-1000UA.job Script: Delete	The task is ready to run at its next scheduled time.				C:\Users\Nele\AppData\Local\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Script: Quarantine, Delete, Delete via BC	Adobe Flash Player Updater Script: Delete	The task is ready to run at its next scheduled time.	Adobe® Flash® Player Update Service 17.0 r0	Copyright © 1996-2015 Adobe Systems Incorporated	C:\Windows\system32\Tasks\	C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Users\Nele\AppData\Local\Google\Update\GoogleUpdate.exe Script: Quarantine, Delete, Delete via BC	GoogleUpdateTaskUserS-1-5-21-3458131516-997301713-3897728758-1000Core Script: Delete	The task is ready to run at its next scheduled time.			C:\Windows\system32\Tasks\	C:\Users\Nele\AppData\Local\Google\Update\GoogleUpdate.exe /c
C:\Users\Nele\AppData\Local\Google\Update\GoogleUpdate.exe Script: Quarantine, Delete, Delete via BC	GoogleUpdateTaskUserS-1-5-21-3458131516-997301713-3897728758-1000UA Script: Delete	The task is ready to run at its next scheduled time.			C:\Windows\system32\Tasks\	C:\Users\Nele\AppData\Local\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
aitagent Script: Quarantine, Delete, Delete via BC	AitAgent Script: Delete	The task is ready to run at its next scheduled time.			C:\Windows\system32\Tasks\Microsoft\Windows\Application Experience\	aitagent
C:\Windows\ehome\mcupdate Script: Quarantine, Delete, Delete via BC	mcupdate Script: Delete	The task is ready to run at its next scheduled time.			C:\Windows\system32\Tasks\Microsoft\Windows\Media Center\	%SystemRoot%\ehome\mcupdate $(Arg0)
C:\Windows\ehome\ehrec Script: Quarantine, Delete, Delete via BC	RecordingRestart Script: Delete	The task is ready to run at its next scheduled time.			C:\Windows\system32\Tasks\Microsoft\Windows\Media Center\	%SystemRoot%\ehome\ehrec /RestartRecording
C:\Windows\ehome\ehrec Script: Quarantine, Delete, Delete via BC	StartRecording Script: Delete	The task is ready to run at its next scheduled time.			C:\Windows\system32\Tasks\Microsoft\Windows\Media Center\	%SystemRoot%\ehome\ehrec /StartRecording
"c:\users\nele\appdata\local\google\chrome\application\chrome.exe" http://ui.skype.com/ui/0/5.1.0.104/en/abandoninstall?page=tsDownload&installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chrome:notoffered;ienotdefaultbrowser2 Script: Quarantine, Delete, Delete via BC	{8DC9882A-DCB2-49C4-994D-6ED61F36DD4C} Script: Delete	The task is ready to run at its next scheduled time.			C:\Windows\system32\Tasks\	"c:\users\nele\appdata\local\google\chrome\application\chrome.exe" http://ui.skype.com/ui/0/5.1.0.104/en/abandoninstall?page=tsDownload&installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chrome:notoffered;ienotdefaultbrowser2
c:\users\nele\appdata\local\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC	{8DC9882A-DCB2-49C4-994D-6ED61F36DD4C} Script: Delete	The task is ready to run at its next scheduled time.			C:\Windows\system32\Tasks\	"c:\users\nele\appdata\local\google\chrome\application\chrome.exe" http://ui.skype.com/ui/0/5.1.0.104/en/abandoninstall?page=tsDownload&installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chrome:notoffered;ienotdefaultbrowser2
"c:\users\nele\appdata\local\google\chrome\application\chrome.exe" http://ui.skype.com/ui/0/5.3.0.111.259/en/abandoninstall?source=lightinstaller&page=tsMain&installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chrome:notoffered;ienotdefaultbrowser2 Script: Quarantine, Delete, Delete via BC	{9C0C9E15-C2F8-41A7-8179-F5050CB98A46} Script: Delete	The task is ready to run at its next scheduled time.			C:\Windows\system32\Tasks\	"c:\users\nele\appdata\local\google\chrome\application\chrome.exe" http://ui.skype.com/ui/0/5.3.0.111.259/en/abandoninstall?source=lightinstaller&page=tsMain&installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chrome:notoffered;ienotdefaultbrowser2
c:\users\nele\appdata\local\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC	{9C0C9E15-C2F8-41A7-8179-F5050CB98A46} Script: Delete	The task is ready to run at its next scheduled time.			C:\Windows\system32\Tasks\	"c:\users\nele\appdata\local\google\chrome\application\chrome.exe" http://ui.skype.com/ui/0/5.3.0.111.259/en/abandoninstall?source=lightinstaller&page=tsMain&installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chrome:notoffered;ienotdefaultbrowser2
D:\INSTAL\DAEMONToolsNet4360310-0089.exe Script: Quarantine, Delete, Delete via BC	{A8EAE3A9-853A-43AA-AA6B-8E55CD69F7F1} Script: Delete	The task is ready to run at its next scheduled time.			C:\Windows\system32\Tasks\	C:\Windows\system32\pcalua.exe -a D:\INSTAL\DAEMONToolsNet4360310-0089.exe -d D:\INSTAL
"c:\users\nele\appdata\local\google\chrome\application\chrome.exe" http://ui.skype.com/ui/0/6.9.0.106/en/abandoninstall?page=tsProgressBar Script: Quarantine, Delete, Delete via BC	{B863F040-19C3-45D2-B3D9-FB88D481DB97} Script: Delete	The task is ready to run at its next scheduled time.			C:\Windows\system32\Tasks\	"c:\users\nele\appdata\local\google\chrome\application\chrome.exe" http://ui.skype.com/ui/0/6.9.0.106/en/abandoninstall?page=tsProgressBar
c:\users\nele\appdata\local\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC	{B863F040-19C3-45D2-B3D9-FB88D481DB97} Script: Delete	The task is ready to run at its next scheduled time.			C:\Windows\system32\Tasks\	"c:\users\nele\appdata\local\google\chrome\application\chrome.exe" http://ui.skype.com/ui/0/6.9.0.106/en/abandoninstall?page=tsProgressBar
Items found - 85, recognized as trusted - 68

SPI/LSP settings

Namespace providers (NSP)

Manufacturer	Status	EXE file	Description	GUID
Detected - 8, recognized as trusted - 8

Transport protocol providers (TSP, LSP)

Manufacturer EXE file Description
Detected - 10, recognized as trusted - 10
Results of automatic SPI settings check
LSP settings checked. No errors detected

TCP/UDP ports

Port Status Remote Host Remote Port Application Notes
TCP ports
139 LISTENING 0.0.0.0 0 [4] System.exe
Script: Quarantine, Delete, Delete via BC, Terminate
445 LISTENING 0.0.0.0 0 [4] System.exe
Script: Quarantine, Delete, Delete via BC, Terminate
554 LISTENING 0.0.0.0 0 [1420] wmpnetwk.exe
Script: Quarantine, Delete, Delete via BC, Terminate
2869 LISTENING 0.0.0.0 0 [4] System.exe
Script: Quarantine, Delete, Delete via BC, Terminate
5357 LISTENING 0.0.0.0 0 [4] System.exe
Script: Quarantine, Delete, Delete via BC, Terminate
9421 LISTENING 0.0.0.0 0 [4128] c:\users\nele\appdata\local\akamai\netsession_win.exe
Script: Quarantine, Delete, Delete via BC, Terminate
10243 LISTENING 0.0.0.0 0 [4] System.exe
Script: Quarantine, Delete, Delete via BC, Terminate
17500 LISTENING 0.0.0.0 0 [4372] c:\users\nele\appdata\roaming\dropbox\bin\dropbox.exe
Script: Quarantine, Delete, Delete via BC, Terminate
17600 LISTENING 0.0.0.0 0 [4372] c:\users\nele\appdata\roaming\dropbox\bin\dropbox.exe
Script: Quarantine, Delete, Delete via BC, Terminate
17603 LISTENING 0.0.0.0 0 [4372] c:\users\nele\appdata\roaming\dropbox\bin\dropbox.exe
Script: Quarantine, Delete, Delete via BC, Terminate
19872 ESTABLISHED 127.0.0.1 49246 [4372] c:\users\nele\appdata\roaming\dropbox\bin\dropbox.exe
Script: Quarantine, Delete, Delete via BC, Terminate
49154 LISTENING 0.0.0.0 0 [784] lsass.exe
Script: Quarantine, Delete, Delete via BC, Terminate
49157 LISTENING 0.0.0.0 0 [752] services.exe
Script: Quarantine, Delete, Delete via BC, Terminate
49161 LISTENING 0.0.0.0 0 [2464] TemproTray.exe
Script: Quarantine, Delete, Delete via BC, Terminate
49173 ESTABLISHED 64.233.166.188 5228 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
49244 CLOSE_WAIT 108.160.172.236 443 [4372] c:\users\nele\appdata\roaming\dropbox\bin\dropbox.exe
Script: Quarantine, Delete, Delete via BC, Terminate
49246 ESTABLISHED 127.0.0.1 19872 [4372] c:\users\nele\appdata\roaming\dropbox\bin\dropbox.exe
Script: Quarantine, Delete, Delete via BC, Terminate
49247 CLOSE_WAIT 54.240.174.173 443 [4372] c:\users\nele\appdata\roaming\dropbox\bin\dropbox.exe
Script: Quarantine, Delete, Delete via BC, Terminate
49248 CLOSE_WAIT 54.240.174.173 443 [4372] c:\users\nele\appdata\roaming\dropbox\bin\dropbox.exe
Script: Quarantine, Delete, Delete via BC, Terminate
49251 ESTABLISHED 127.0.0.1 49252 [4372] c:\users\nele\appdata\roaming\dropbox\bin\dropbox.exe
Script: Quarantine, Delete, Delete via BC, Terminate
49252 ESTABLISHED 127.0.0.1 49251 [4372] c:\users\nele\appdata\roaming\dropbox\bin\dropbox.exe
Script: Quarantine, Delete, Delete via BC, Terminate
49895 CLOSE_WAIT 54.230.217.32 443 [4372] c:\users\nele\appdata\roaming\dropbox\bin\dropbox.exe
Script: Quarantine, Delete, Delete via BC, Terminate
50293 CLOSE_WAIT 54.240.174.173 443 [4372] c:\users\nele\appdata\roaming\dropbox\bin\dropbox.exe
Script: Quarantine, Delete, Delete via BC, Terminate
50415 ESTABLISHED 31.13.84.8 443 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
50918 ESTABLISHED 108.160.169.55 443 [4372] c:\users\nele\appdata\roaming\dropbox\bin\dropbox.exe
Script: Quarantine, Delete, Delete via BC, Terminate
50987 CLOSE_WAIT 54.230.219.96 443 [4372] c:\users\nele\appdata\roaming\dropbox\bin\dropbox.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51682 ESTABLISHED 199.16.156.241 443 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51699 ESTABLISHED 208.117.229.149 443 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51710 ESTABLISHED 208.117.229.155 443 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51715 ESTABLISHED 208.117.229.185 443 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51718 ESTABLISHED 208.117.229.184 443 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51750 ESTABLISHED 64.233.184.94 443 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51753 ESTABLISHED 31.13.84.8 443 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51757 TIME_WAIT 208.117.229.153 443 [0]
51761 ESTABLISHED 92.122.190.80 443 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51762 ESTABLISHED 92.122.190.80 443 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51763 ESTABLISHED 193.170.140.86 443 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51785 ESTABLISHED 23.55.224.95 443 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51786 ESTABLISHED 2.21.104.24 80 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51789 ESTABLISHED 193.170.140.73 80 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51795 TIME_WAIT 216.58.211.45 443 [0]
51797 ESTABLISHED 193.170.140.86 443 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51798 ESTABLISHED 92.122.190.80 443 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51804 ESTABLISHED 77.234.45.69 443 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51805 ESTABLISHED 208.117.229.153 443 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51808 ESTABLISHED 208.117.229.149 443 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51809 ESTABLISHED 173.194.112.11 443 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51811 ESTABLISHED 173.194.113.26 443 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51814 ESTABLISHED 193.170.140.86 443 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51815 ESTABLISHED 2.21.97.238 443 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51822 TIME_WAIT 208.117.254.12 443 [0]
51823 TIME_WAIT 208.117.242.166 443 [0]
51825 TIME_WAIT 208.117.254.216 443 [0]
51826 ESTABLISHED 208.117.229.151 443 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51836 ESTABLISHED 64.233.166.95 80 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51840 ESTABLISHED 192.0.77.2 80 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51841 ESTABLISHED 54.231.96.136 80 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51842 ESTABLISHED 54.231.96.136 80 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51845 ESTABLISHED 54.240.174.65 80 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51846 ESTABLISHED 54.192.219.183 80 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51847 TIME_WAIT 54.192.219.183 80 [0]
51849 ESTABLISHED 192.0.77.2 80 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51850 ESTABLISHED 192.0.77.2 80 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51851 ESTABLISHED 192.0.77.2 80 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51852 ESTABLISHED 192.0.77.2 80 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51853 ESTABLISHED 192.0.77.2 80 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51854 TIME_WAIT 192.0.77.2 80 [0]
51855 ESTABLISHED 192.0.78.26 80 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51857 ESTABLISHED 192.0.77.2 80 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51858 TIME_WAIT 192.0.77.2 80 [0]
51864 ESTABLISHED 93.184.220.111 443 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51865 ESTABLISHED 93.184.220.111 443 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51866 ESTABLISHED 2.21.100.156 80 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51868 ESTABLISHED 192.0.78.22 443 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51874 ESTABLISHED 2.21.109.32 80 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51876 TIME_WAIT 68.232.35.121 80 [0]
51877 ESTABLISHED 185.63.147.10 443 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51879 TIME_WAIT 54.235.202.115 80 [0]
51880 TIME_WAIT 54.231.96.136 80 [0]
51881 ESTABLISHED 54.230.216.11 443 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51882 ESTABLISHED 93.184.220.111 443 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51883 ESTABLISHED 193.170.140.73 443 [4340] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
UDP ports
137 LISTENING -- -- [4] System.exe
Script: Quarantine, Delete, Delete via BC, Terminate
138 LISTENING -- -- [4] System.exe
Script: Quarantine, Delete, Delete via BC, Terminate
5004 LISTENING -- -- [1420] wmpnetwk.exe
Script: Quarantine, Delete, Delete via BC, Terminate
5005 LISTENING -- -- [1420] wmpnetwk.exe
Script: Quarantine, Delete, Delete via BC, Terminate
17500 LISTENING -- -- [4372] c:\users\nele\appdata\roaming\dropbox\bin\dropbox.exe
Script: Quarantine, Delete, Delete via BC, Terminate
51379 LISTENING -- -- [4128] c:\users\nele\appdata\local\akamai\netsession_win.exe
Script: Quarantine, Delete, Delete via BC, Terminate
62851 LISTENING -- -- [4128] c:\users\nele\appdata\local\akamai\netsession_win.exe
Script: Quarantine, Delete, Delete via BC, Terminate

Downloaded Program Files (DPF)

File name Description Manufacturer CLSID Source URL
C:\Windows\SysWOW64\Macromed\Flash\Flash32_17_0_0_190.ocx
Script: Quarantine, Delete, Delete via BC Adobe Flash Player 17.0 r0 Adobe® Flash® Player. Copyright © 1996-2015 Adobe Systems Incorporated. All Rights Reserved. Adobe and Flash are either trademarks or registered trademarks in the United States and/or other countries. {D27CDB6E-AE6D-11CF-96B8-444553540000}
Delete http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Items found - 5, recognized as trusted - 4

Control Panel Applets (CPL)

File name Description Manufacturer
C:\Windows\system32\FlashPlayerCPLApp.cpl
Script: Quarantine, Delete, Delete via BC Adobe Flash Player Control Panel Applet Copyright © 1996-2015 Adobe Systems Incorporated. All Rights Reserved. Adobe and Flash are either trademarks or registered trademarks in the United States and/or other countries.
Items found - 19, recognized as trusted - 18

Active Setup

File name Description Manufacturer CLSID
C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.130\Installer\chrmstp.exe
Script: Quarantine, Delete, Delete via BC Google Chrome Installer Copyright 2012 Google Inc. All rights reserved. {8A69D345-D564-463c-AFF1-A69D9E530F96}
Delete
Items found - 8, recognized as trusted - 7

HOSTS file

Hosts file record
127.0.0.1 activate.adobe.com
127.0.0.1 activate.adobe.com
127.0.0.1 practivate.adobe.com
127.0.0.1 ereg.adobe.com
127.0.0.1 activate.wip3.adobe.com
127.0.0.1 wip3.adobe.com
127.0.0.1 3dns-3.adobe.com
127.0.0.1 3dns-2.adobe.com
127.0.0.1 adobe-dns.adobe.com
127.0.0.1 adobe-dns-2.adobe.com
127.0.0.1 adobe-dns-3.adobe.com
127.0.0.1 ereg.wip3.adobe.com
127.0.0.1 activate-sea.adobe.com
127.0.0.1 wwis-dubc1-vip60.adobe.com
127.0.0.1 activate-sjc0.adobe.com
127.0.0.1 hl2rcv.adobe.com
Clear Hosts file

Protocols and handlers

File name Type Description Manufacturer CLSID
mscoree.dll
Script: Quarantine, Delete, Delete via BC Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, Delete via BC Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, Delete via BC Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
Items found - 21, recognized as trusted - 18

Shared resources

Network name Path Notes
ADMIN$ C:\Windows Remote Admin
C$ C:\ Default share
D$ D:\ Default share
E$ E:\ Default share
G$ G:\ Default share
IPC$ Remote IPC
Users C:\Users

Suspicious objects

File Description Type

AVZ Antiviral Toolkit log; AVZ version is 4.43
Scanning started at 26.06.2015 19:40:05
Database loaded: signatures - 297605, NN profile(s) - 2, malware removal microprograms - 56, signature database released 26.06.2015 16:00
Heuristic microprograms loaded: 410
PVS microprograms loaded: 9
Digital signatures of system files loaded: 745363
Heuristic analyzer mode: Medium heuristics mode
Malware removal mode: enabled
Windows version is: 6.1.7601, Service Pack 1 "Windows 7 Home Premium" ; AVZ is run with administrator rights
System Restore: enabled
1. Searching for Rootkits and other software intercepting API functions
1.1 Searching for user-mode API hooks
 Analysis: kernel32.dll, export table found in section .text
 Analysis: ntdll.dll, export table found in section .text
 Analysis: user32.dll, export table found in section .text
 Analysis: advapi32.dll, export table found in section .text
 Analysis: ws2_32.dll, export table found in section .text
 Analysis: wininet.dll, export table found in section .text
 Analysis: rasapi32.dll, export table found in section .text
 Analysis: urlmon.dll, export table found in section .text
 Analysis: netapi32.dll, export table found in section .text
1.2 Searching for kernel-mode API hooks
 Error loading driver - operation interrupted [C000036B]
1.4 Searching for masking processes and drivers
 Checking not performed: extended monitoring driver (AVZPM) is not installed
1.5 Checking IRP handlers
 Error loading driver - operation interrupted [C000036B]
2. Scanning RAM
 Number of processes found: 30
 Number of modules loaded: 292
Scanning RAM - complete
3. Scanning disks
Direct reading: C:\Users\Nele\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.tmp
4. Checking  Winsock Layered Service Provider (SPI/LSP)
 LSP settings checked. No errors detected
5. Searching for keyboard/mouse/windows events hooks (Keyloggers, Trojan DLLs)
 Checking - disabled by user
6. Searching for opened TCP/UDP ports used by malicious software
 Checking - disabled by user
7. Heuristic system check
Checking - complete
8. Searching for vulnerabilities
>> Services: potentially dangerous service allowed: TermService (Remote Desktop Services)
>> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery)
>> Services: potentially dangerous service allowed: Schedule (Task Scheduler)
> Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)!
>> Security: disk drives' autorun is enabled
>> Security: administrative shares (C$, D$ ...) are enabled
>> Security: anonymous user access is enabled
>> Security: sending Remote Assistant queries is enabled
Checking - complete
9. Troubleshooting wizard
 >>  Abnormal SCR files association
 >>  HDD autorun is allowed
 >>  Network drives autorun is allowed
 >>  Removable media autorun is allowed
Checking - complete
Files scanned: 273600, extracted from archives: 218689, malicious software found 0, suspicions - 0
Scanning finished at 26.06.2015 20:13:34
Time of scanning: 00:33:31
If you have a suspicion on presence of viruses or questions on the suspected objects,
you can address http://forum.kaspersky.com/index.php?showforum=19
For automatic scanning of files from the AVZ quarantine you can use the service http://virusdetector.ru/
Creating archive of files from Quarantine
Creating archive of files from Quarantine - complete
System Analysis in progress
Network diagnostics
 DNS and Ping test
  Host="yandex.ru", IP="77.88.55.66,77.88.55.55,5.255.255.5,5.255.255.55", Ping=OK (0,87,77.88.55.66)
  Host="google.ru", IP="208.117.229.152,208.117.229.151,208.117.229.149,208.117.229.155,208.117.229.148,208.117.229.150,208.117.229.154,208.117.229.153", Ping=OK (0,12,208.117.229.152)
  Host="google.com", IP="208.117.229.150,208.117.229.153,208.117.229.149,208.117.229.148,208.117.229.151,208.117.229.154,208.117.229.152,208.117.229.155", Ping=OK (0,9,208.117.229.150)
  Host="www.kaspersky.com", IP="195.27.252.18", Ping=OK (0,40,195.27.252.18)
  Host="www.kaspersky.ru", IP="195.27.252.110", Ping=OK (0,42,195.27.252.110)
  Host="dnl-03.geo.kaspersky.com", IP="85.12.58.13", Ping=OK (0,37,85.12.58.13)
  Host="dnl-11.geo.kaspersky.com", IP="212.73.221.199", Ping=OK (0,48,212.73.221.199)
  Host="activation-v2.kaspersky.com", IP="195.27.252.50", Ping=Error (11010,0,0.0.0.0)
  Host="odnoklassniki.ru", IP="217.20.147.94,217.20.155.58,217.20.156.159", Ping=OK (0,85,217.20.147.94)
  Host="vk.com", IP="87.240.131.99,87.240.143.241,87.240.131.117", Ping=OK (0,62,87.240.131.99)
  Host="vkontakte.ru", IP="95.213.4.245,95.213.4.246,95.213.4.247", Ping=OK (0,68,95.213.4.245)
  Host="twitter.com", IP="199.16.156.70,199.16.156.38,199.16.156.230,199.16.156.102", Ping=OK (0,150,199.16.156.70)
  Host="facebook.com", IP="173.252.120.6", Ping=OK (0,166,173.252.120.6)
  Host="ru-ru.facebook.com", IP="31.13.84.8", Ping=OK (0,28,31.13.84.8)
 Network IE settings
  IE setting AutoConfigURL=
  IE setting AutoConfigProxy=wininet.dll
  IE setting ProxyOverride=<local>
  IE setting ProxyServer=
  IE setting Internet\ManualProxies=
 Network TCP/IP settings
 Network Persistent Routes

 System Analysis - complete


Script commands 
Add commands to script:
Blocking hooks using Anti-Rootkit
Enable AVZGuard
Operations with AVZPM (true=enable,false=disable)
BootCleaner - import list of deleted files
BootCleaner - import all
Remove traces of deleted files
ExecuteWizard ('TSW',2,3,true) - Running Troubleshooting wizard
BootCleaner - activate
Reboot
Insert template for QuarantineFile() - quarantining a file
Insert template for BC_QrFile() - quarantining file via BootCleaner
Insert template for DeleteFile() - deleting a file
Insert template for DelCLSID() - removing a CLSID item from registry
Additional operations:Performance tweaking: disable service TermService (Remote Desktop Services)
Performance tweaking: disable service SSDPSRV (SSDP Discovery)
Performance tweaking: disable service Schedule (Task Scheduler)
Security tweaking: disable CD autorun
Security tweaking: disable administrative shares
Security tweaking: disable anonymous user access
Security: disable sending Remote Assistant queries

File list

Port	Status	Remote Host	Remote Port	Application	Notes
TCP ports
139	LISTENING	0.0.0.0	0	[4] System.exe Script: Quarantine, Delete, Delete via BC, Terminate
445	LISTENING	0.0.0.0	0	[4] System.exe Script: Quarantine, Delete, Delete via BC, Terminate
554	LISTENING	0.0.0.0	0	[1420] wmpnetwk.exe Script: Quarantine, Delete, Delete via BC, Terminate
2869	LISTENING	0.0.0.0	0	[4] System.exe Script: Quarantine, Delete, Delete via BC, Terminate
5357	LISTENING	0.0.0.0	0	[4] System.exe Script: Quarantine, Delete, Delete via BC, Terminate
9421	LISTENING	0.0.0.0	0	[4128] c:\users\nele\appdata\local\akamai\netsession_win.exe Script: Quarantine, Delete, Delete via BC, Terminate
10243	LISTENING	0.0.0.0	0	[4] System.exe Script: Quarantine, Delete, Delete via BC, Terminate
17500	LISTENING	0.0.0.0	0	[4372] c:\users\nele\appdata\roaming\dropbox\bin\dropbox.exe Script: Quarantine, Delete, Delete via BC, Terminate
17600	LISTENING	0.0.0.0	0	[4372] c:\users\nele\appdata\roaming\dropbox\bin\dropbox.exe Script: Quarantine, Delete, Delete via BC, Terminate
17603	LISTENING	0.0.0.0	0	[4372] c:\users\nele\appdata\roaming\dropbox\bin\dropbox.exe Script: Quarantine, Delete, Delete via BC, Terminate
19872	ESTABLISHED	127.0.0.1	49246	[4372] c:\users\nele\appdata\roaming\dropbox\bin\dropbox.exe Script: Quarantine, Delete, Delete via BC, Terminate
49154	LISTENING	0.0.0.0	0	[784] lsass.exe Script: Quarantine, Delete, Delete via BC, Terminate
49157	LISTENING	0.0.0.0	0	[752] services.exe Script: Quarantine, Delete, Delete via BC, Terminate
49161	LISTENING	0.0.0.0	0	[2464] TemproTray.exe Script: Quarantine, Delete, Delete via BC, Terminate
49173	ESTABLISHED	64.233.166.188	5228	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
49244	CLOSE_WAIT	108.160.172.236	443	[4372] c:\users\nele\appdata\roaming\dropbox\bin\dropbox.exe Script: Quarantine, Delete, Delete via BC, Terminate
49246	ESTABLISHED	127.0.0.1	19872	[4372] c:\users\nele\appdata\roaming\dropbox\bin\dropbox.exe Script: Quarantine, Delete, Delete via BC, Terminate
49247	CLOSE_WAIT	54.240.174.173	443	[4372] c:\users\nele\appdata\roaming\dropbox\bin\dropbox.exe Script: Quarantine, Delete, Delete via BC, Terminate
49248	CLOSE_WAIT	54.240.174.173	443	[4372] c:\users\nele\appdata\roaming\dropbox\bin\dropbox.exe Script: Quarantine, Delete, Delete via BC, Terminate
49251	ESTABLISHED	127.0.0.1	49252	[4372] c:\users\nele\appdata\roaming\dropbox\bin\dropbox.exe Script: Quarantine, Delete, Delete via BC, Terminate
49252	ESTABLISHED	127.0.0.1	49251	[4372] c:\users\nele\appdata\roaming\dropbox\bin\dropbox.exe Script: Quarantine, Delete, Delete via BC, Terminate
49895	CLOSE_WAIT	54.230.217.32	443	[4372] c:\users\nele\appdata\roaming\dropbox\bin\dropbox.exe Script: Quarantine, Delete, Delete via BC, Terminate
50293	CLOSE_WAIT	54.240.174.173	443	[4372] c:\users\nele\appdata\roaming\dropbox\bin\dropbox.exe Script: Quarantine, Delete, Delete via BC, Terminate
50415	ESTABLISHED	31.13.84.8	443	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
50918	ESTABLISHED	108.160.169.55	443	[4372] c:\users\nele\appdata\roaming\dropbox\bin\dropbox.exe Script: Quarantine, Delete, Delete via BC, Terminate
50987	CLOSE_WAIT	54.230.219.96	443	[4372] c:\users\nele\appdata\roaming\dropbox\bin\dropbox.exe Script: Quarantine, Delete, Delete via BC, Terminate
51682	ESTABLISHED	199.16.156.241	443	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51699	ESTABLISHED	208.117.229.149	443	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51710	ESTABLISHED	208.117.229.155	443	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51715	ESTABLISHED	208.117.229.185	443	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51718	ESTABLISHED	208.117.229.184	443	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51750	ESTABLISHED	64.233.184.94	443	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51753	ESTABLISHED	31.13.84.8	443	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51757	TIME_WAIT	208.117.229.153	443	[0]
51761	ESTABLISHED	92.122.190.80	443	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51762	ESTABLISHED	92.122.190.80	443	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51763	ESTABLISHED	193.170.140.86	443	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51785	ESTABLISHED	23.55.224.95	443	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51786	ESTABLISHED	2.21.104.24	80	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51789	ESTABLISHED	193.170.140.73	80	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51795	TIME_WAIT	216.58.211.45	443	[0]
51797	ESTABLISHED	193.170.140.86	443	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51798	ESTABLISHED	92.122.190.80	443	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51804	ESTABLISHED	77.234.45.69	443	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51805	ESTABLISHED	208.117.229.153	443	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51808	ESTABLISHED	208.117.229.149	443	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51809	ESTABLISHED	173.194.112.11	443	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51811	ESTABLISHED	173.194.113.26	443	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51814	ESTABLISHED	193.170.140.86	443	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51815	ESTABLISHED	2.21.97.238	443	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51822	TIME_WAIT	208.117.254.12	443	[0]
51823	TIME_WAIT	208.117.242.166	443	[0]
51825	TIME_WAIT	208.117.254.216	443	[0]
51826	ESTABLISHED	208.117.229.151	443	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51836	ESTABLISHED	64.233.166.95	80	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51840	ESTABLISHED	192.0.77.2	80	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51841	ESTABLISHED	54.231.96.136	80	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51842	ESTABLISHED	54.231.96.136	80	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51845	ESTABLISHED	54.240.174.65	80	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51846	ESTABLISHED	54.192.219.183	80	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51847	TIME_WAIT	54.192.219.183	80	[0]
51849	ESTABLISHED	192.0.77.2	80	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51850	ESTABLISHED	192.0.77.2	80	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51851	ESTABLISHED	192.0.77.2	80	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51852	ESTABLISHED	192.0.77.2	80	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51853	ESTABLISHED	192.0.77.2	80	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51854	TIME_WAIT	192.0.77.2	80	[0]
51855	ESTABLISHED	192.0.78.26	80	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51857	ESTABLISHED	192.0.77.2	80	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51858	TIME_WAIT	192.0.77.2	80	[0]
51864	ESTABLISHED	93.184.220.111	443	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51865	ESTABLISHED	93.184.220.111	443	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51866	ESTABLISHED	2.21.100.156	80	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51868	ESTABLISHED	192.0.78.22	443	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51874	ESTABLISHED	2.21.109.32	80	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51876	TIME_WAIT	68.232.35.121	80	[0]
51877	ESTABLISHED	185.63.147.10	443	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51879	TIME_WAIT	54.235.202.115	80	[0]
51880	TIME_WAIT	54.231.96.136	80	[0]
51881	ESTABLISHED	54.230.216.11	443	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51882	ESTABLISHED	93.184.220.111	443	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
51883	ESTABLISHED	193.170.140.73	443	[4340] c:\program files (x86)\google\chrome\application\chrome.exe Script: Quarantine, Delete, Delete via BC, Terminate
UDP ports
137	LISTENING	--	--	[4] System.exe Script: Quarantine, Delete, Delete via BC, Terminate
138	LISTENING	--	--	[4] System.exe Script: Quarantine, Delete, Delete via BC, Terminate
5004	LISTENING	--	--	[1420] wmpnetwk.exe Script: Quarantine, Delete, Delete via BC, Terminate
5005	LISTENING	--	--	[1420] wmpnetwk.exe Script: Quarantine, Delete, Delete via BC, Terminate
17500	LISTENING	--	--	[4372] c:\users\nele\appdata\roaming\dropbox\bin\dropbox.exe Script: Quarantine, Delete, Delete via BC, Terminate
51379	LISTENING	--	--	[4128] c:\users\nele\appdata\local\akamai\netsession_win.exe Script: Quarantine, Delete, Delete via BC, Terminate
62851	LISTENING	--	--	[4128] c:\users\nele\appdata\local\akamai\netsession_win.exe Script: Quarantine, Delete, Delete via BC, Terminate

Network name	Path	Notes
ADMIN$	C:\Windows	Remote Admin
C$	C:\	Default share
D$	D:\	Default share
E$	E:\	Default share
G$	G:\	Default share
IPC$		Remote IPC
Users	C:\Users