Results of system analysis

Kaspersky Virus Removal Tool 11.0.0.1245 (database released 30/12/2011; 05:49)

List of processes

File name	PID	Description	Copyright	MD5	Information
wmpnetwk.exe Script: Quarantine, Delete, BC delete, Terminate	2028			??	error getting file info Command line:
Detected:39, recognized as trusted 38

Module name	Handle	Description	Copyright	MD5	Used by processes
Modules detected:308, recognized as trusted 308

Kernel Space Modules Viewer

Module	Base address	Size in memory	Description	Manufacturer
C:\Windows\system32\DRIVERS\21786235.sys Script: Quarantine, Delete, BC delete	AA9A000	75F000 (7729152)
C:\Windows\System32\Drivers\dump_atapi.sys Script: Quarantine, Delete, BC delete	5BA4000	009000 (36864)
C:\Windows\System32\Drivers\dump_dumpata.sys Script: Quarantine, Delete, BC delete	5B98000	00C000 (49152)
C:\Windows\System32\Drivers\dump_dumpfve.sys Script: Quarantine, Delete, BC delete	5BAD000	013000 (77824)
C:\Windows\system32\Drivers\PROCEXP113.SYS Script: Quarantine, Delete, BC delete	79B6000	008000 (32768)
Modules detected - 189, recognized as trusted - 184

Services

Service	Description	Status	File	Group	Dependencies
PnkBstrA Service: Stop, Delete, Disable, BC delete	PnkBstrA	Running	C:\Windows\system32\PnkBstrA.exe Script: Quarantine, Delete, BC delete
Detected - 157, recognized as trusted - 156

Drivers

Service	Description	Status	File	Group	Dependencies
21786235 Driver: Unload, Delete, Disable, BC delete	21786235	Running	21786235.sys Script: Quarantine, Delete, BC delete
catchme Driver: Unload, Delete, Disable, BC delete	catchme	Not started	C:\ComboFix\catchme.sys Script: Quarantine, Delete, BC delete	Base
Detected - 249, recognized as trusted - 247

Autoruns

File name	Status	Startup method	Description
C:\Users\DJ\AppData\Local\Temp\_uninst_84137851.bat Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	C:\Users\DJ\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\, C:\Users\DJ\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_uninst_84137851.lnk,
C:\Windows\system32\psxss.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
auditcse.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{f3ccc681-b74c-4060-9f26-cd84525dca2a}, DLLName Delete
lvcod64.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, vidc.i420 Delete
rdpclip Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd, StartupPrograms Delete
xfcodec64.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, VIDC.XFR1 Delete
Autoruns items detected - 645, recognized as trusted - 639

Microsoft Internet Explorer extension modules (BHOs, Toolbars ...)

File name	Type	Description	Manufacturer	CLSID
	Extension module			{2670000A-7350-4f3c-8081-5663EE0C6C49} Delete
	Extension module			{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} Delete
Elements detected - 4, recognized as trusted - 2

Windows Explorer extension modules

File name	Destination	Description	Manufacturer	CLSID
	WinRAR shell extension			{B41DB860-8EE4-11D2-9906-E49FADC173CA} Delete
	ColumnHandler			{F9DB5320-233E-11D1-9F84-707F02C10627} Delete
Elements detected - 24, recognized as trusted - 22

Printing system extensions (print monitors, providers)

File name	Type	Name	Description	Manufacturer
localspl.dll Script: Quarantine, Delete, BC delete	Monitor	Local Port
FXSMON.DLL Script: Quarantine, Delete, BC delete	Monitor	Microsoft Shared Fax Monitor
tcpmon.dll Script: Quarantine, Delete, BC delete	Monitor	Standard TCP/IP Port
usbmon.dll Script: Quarantine, Delete, BC delete	Monitor	USB Monitor
WSDMon.dll Script: Quarantine, Delete, BC delete	Monitor	WSD Port
inetpp.dll Script: Quarantine, Delete, BC delete	Provider	HTTP Print Services
Elements detected - 7, recognized as trusted - 1

Task Scheduler jobs

File name	Job name	Job status	Description	Manufacturer
Elements detected - 4, recognized as trusted - 4

SPI/LSP settings

Namespace providers (NSP)

Provider	Status	EXE file	Description	GUID
Detected - 7, recognized as trusted - 7

Transport protocol providers (TSP, LSP)

Provider EXE file Description
Detected - 10, recognized as trusted - 10
Results of automatic SPI settings check
LSP settings checked. No errors detected

TCP/UDP ports

Port Status Remote Host Remote Port Application Notes
TCP ports
135 LISTENING 0.0.0.0 0 [792] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
139 LISTENING 0.0.0.0 0 [4] System
Script: Quarantine, Delete, BC delete, Terminate
445 LISTENING 0.0.0.0 0 [4] System
Script: Quarantine, Delete, BC delete, Terminate
554 LISTENING 0.0.0.0 0 [2028] wmpnetwk.exe
Script: Quarantine, Delete, BC delete, Terminate
843 LISTENING 0.0.0.0 0 [2540] c:\users\dj\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe
Script: Quarantine, Delete, BC delete, Terminate
2869 LISTENING 0.0.0.0 0 [4] System
Script: Quarantine, Delete, BC delete, Terminate
5354 LISTENING 0.0.0.0 0 [1392] c:\program files (x86)\bonjour\mdnsresponder.exe
Script: Quarantine, Delete, BC delete, Terminate
6498 LISTENING 0.0.0.0 0 [2540] c:\users\dj\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe
Script: Quarantine, Delete, BC delete, Terminate
6499 LISTENING 0.0.0.0 0 [2540] c:\users\dj\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe
Script: Quarantine, Delete, BC delete, Terminate
10243 LISTENING 0.0.0.0 0 [4] System
Script: Quarantine, Delete, BC delete, Terminate
27015 LISTENING 0.0.0.0 0 [1368] c:\program files (x86)\common files\apple\mobile device support\applemobiledeviceservice.exe
Script: Quarantine, Delete, BC delete, Terminate
49152 LISTENING 0.0.0.0 0 [460] wininit.exe
Script: Quarantine, Delete, BC delete, Terminate
49153 LISTENING 0.0.0.0 0 [892] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
49154 LISTENING 0.0.0.0 0 [964] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
49155 LISTENING 0.0.0.0 0 [520] services.exe
Script: Quarantine, Delete, BC delete, Terminate
49156 LISTENING 0.0.0.0 0 [548] lsass.exe
Script: Quarantine, Delete, BC delete, Terminate
49165 ESTABLISHED 127.0.0.1 49166 [2540] c:\users\dj\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe
Script: Quarantine, Delete, BC delete, Terminate
49166 ESTABLISHED 127.0.0.1 49165 [2540] c:\users\dj\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe
Script: Quarantine, Delete, BC delete, Terminate
49167 ESTABLISHED 127.0.0.1 49168 [2540] c:\users\dj\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe
Script: Quarantine, Delete, BC delete, Terminate
49168 ESTABLISHED 127.0.0.1 49167 [2540] c:\users\dj\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe
Script: Quarantine, Delete, BC delete, Terminate
49170 ESTABLISHED 127.0.0.1 49171 [2540] c:\users\dj\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe
Script: Quarantine, Delete, BC delete, Terminate
49171 ESTABLISHED 127.0.0.1 49170 [2540] c:\users\dj\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe
Script: Quarantine, Delete, BC delete, Terminate
49207 ESTABLISHED 127.0.0.1 49208 [1284] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
49208 ESTABLISHED 127.0.0.1 49207 [1284] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
49209 ESTABLISHED 127.0.0.1 49210 [1284] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
49210 ESTABLISHED 127.0.0.1 49209 [1284] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
59605 ESTABLISHED 69.171.228.40 80 [1284] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
59615 TIME_WAIT 24.143.207.210 80 [0]
59616 TIME_WAIT 23.57.68.128 80 [0]
59617 TIME_WAIT 69.171.228.40 80 [0]
59619 TIME_WAIT 69.171.242.62 80 [0]
59621 TIME_WAIT 24.143.207.210 80 [0]
59632 TIME_WAIT 209.18.46.122 80 [0]
59638 TIME_WAIT 24.25.230.17 80 [0]
59639 TIME_WAIT 74.125.224.187 80 [0]
59640 TIME_WAIT 74.125.224.187 80 [0]
59642 TIME_WAIT 23.57.68.57 80 [0]
59644 TIME_WAIT 216.156.213.179 80 [0]
59645 TIME_WAIT 23.57.68.57 80 [0]
59647 TIME_WAIT 195.27.252.18 80 [0]
59649 TIME_WAIT 204.145.81.68 80 [0]
59652 TIME_WAIT 204.145.81.68 80 [0]
59655 ESTABLISHED 173.194.64.95 80 [1284] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
59656 ESTABLISHED 173.194.64.95 80 [1284] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
59658 ESTABLISHED 173.194.64.95 80 [1284] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
59659 ESTABLISHED 74.125.224.169 443 [1284] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
59661 ESTABLISHED 74.125.224.171 80 [1284] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
59662 TIME_WAIT 91.213.143.7 80 [0]
59664 TIME_WAIT 208.94.0.176 80 [0]
59665 TIME_WAIT 204.145.81.75 80 [0]
59672 TIME_WAIT 72.21.91.19 80 [0]
59675 ESTABLISHED 74.125.224.174 443 [1284] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
59676 TIME_WAIT 91.213.143.7 80 [0]
59677 TIME_WAIT 91.213.143.7 80 [0]
59678 ESTABLISHED 74.125.224.233 443 [1284] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
59679 ESTABLISHED 24.25.230.17 80 [1284] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
59680 ESTABLISHED 69.171.228.39 80 [1284] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
59681 ESTABLISHED 69.171.242.62 80 [1284] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
59682 ESTABLISHED 69.171.242.62 80 [1284] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
59683 ESTABLISHED 24.143.207.210 80 [1284] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
59684 ESTABLISHED 24.143.207.210 80 [1284] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
59685 ESTABLISHED 24.143.207.210 80 [1284] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
59686 ESTABLISHED 24.143.207.210 80 [1284] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
59687 ESTABLISHED 24.143.207.210 80 [1284] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
59688 ESTABLISHED 69.171.227.48 80 [1284] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
59690 TIME_WAIT 74.114.168.212 80 [0]
59695 TIME_WAIT 74.114.168.212 80 [0]
59700 TIME_WAIT 74.114.168.212 80 [0]
59702 TIME_WAIT 74.114.168.212 80 [0]
59704 TIME_WAIT 74.114.168.212 80 [0]
59705 TIME_WAIT 74.114.168.212 80 [0]
59706 TIME_WAIT 74.114.168.212 80 [0]
59712 TIME_WAIT 74.114.168.212 80 [0]
59714 TIME_WAIT 74.114.168.212 80 [0]
59717 TIME_WAIT 74.114.168.212 80 [0]
59718 TIME_WAIT 74.114.168.212 80 [0]
59719 TIME_WAIT 74.114.168.212 80 [0]
59722 TIME_WAIT 74.114.168.212 80 [0]
59724 TIME_WAIT 74.114.168.212 80 [0]
59726 TIME_WAIT 74.114.168.212 80 [0]
59727 TIME_WAIT 74.114.168.212 80 [0]
59728 TIME_WAIT 74.114.168.212 80 [0]
59729 TIME_WAIT 74.114.168.212 80 [0]
59732 TIME_WAIT 74.114.168.212 80 [0]
59738 TIME_WAIT 74.114.168.212 80 [0]
59746 TIME_WAIT 74.114.168.212 80 [0]
59748 TIME_WAIT 74.114.168.212 80 [0]
59752 ESTABLISHED 74.125.224.192 80 [1284] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
59753 ESTABLISHED 74.125.224.192 80 [1284] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
59754 ESTABLISHED 74.125.224.231 80 [1284] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
59755 ESTABLISHED 74.125.224.165 80 [1284] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
59756 ESTABLISHED 74.125.224.229 80 [1284] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
59757 ESTABLISHED 208.117.239.93 80 [1284] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
59758 ESTABLISHED 74.125.224.164 80 [1284] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
UDP ports
137 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
138 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
1900 LISTENING -- -- [952] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
1900 LISTENING -- -- [952] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
5004 LISTENING -- -- [2028] wmpnetwk.exe
Script: Quarantine, Delete, BC delete, Terminate
5005 LISTENING -- -- [2028] wmpnetwk.exe
Script: Quarantine, Delete, BC delete, Terminate
5353 LISTENING -- -- [1392] c:\program files (x86)\bonjour\mdnsresponder.exe
Script: Quarantine, Delete, BC delete, Terminate
5355 LISTENING -- -- [1156] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
44301 LISTENING -- -- [1516] c:\windows\syswow64\pnkbstra.exe
Script: Quarantine, Delete, BC delete, Terminate
53477 LISTENING -- -- [2544] c:\program files (x86)\steam\steam.exe
Script: Quarantine, Delete, BC delete, Terminate
54577 LISTENING -- -- [1368] c:\program files (x86)\common files\apple\mobile device support\applemobiledeviceservice.exe
Script: Quarantine, Delete, BC delete, Terminate
54578 LISTENING -- -- [1368] c:\program files (x86)\common files\apple\mobile device support\applemobiledeviceservice.exe
Script: Quarantine, Delete, BC delete, Terminate
54579 LISTENING -- -- [1392] c:\program files (x86)\bonjour\mdnsresponder.exe
Script: Quarantine, Delete, BC delete, Terminate
64573 LISTENING -- -- [952] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
64574 LISTENING -- -- [952] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate

Downloaded Program Files (DPF)

File name Description Manufacturer CLSID Source URL
Elements detected - 0, recognized as trusted - 0

Control Panel Applets (CPL)

File name Description Manufacturer
C:\Windows\system32\FlashPlayerCPLApp.cpl
Script: Quarantine, Delete, BC delete Adobe Flash Player Control Panel Applet Copyright © 1996-2010 Adobe Systems Incorporated. All Rights Reserved. Adobe and Flash are either trademarks or registered trademarks in the United States and/or other countries.
Elements detected - 20, recognized as trusted - 19

Active Setup

File name Description Manufacturer CLSID
Elements detected - 9, recognized as trusted - 9

HOSTS file

Hosts file record
127.0.0.1 localhost
Clear Hosts file

Protocols and handlers

File name Type Description Manufacturer CLSID
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
Elements detected - 14, recognized as trusted - 11

Suspicious objects

File Description Type

Main script of analysis
Windows version: Windows 7 Professional, Build=7601, SP="Service Pack 1"
System Restore: enabled
>> Services: potentially dangerous service allowed: TermService (@%SystemRoot%\System32\termsrv.dll,-268)
>> Services: potentially dangerous service allowed: SSDPSRV (@%systemroot%\system32\ssdpsrv.dll,-100)
>> Services: potentially dangerous service allowed: Schedule (@%SystemRoot%\system32\schedsvc.dll,-100)
> Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)!
>> Security: disk drives' autorun is enabled
>> Security: administrative shares (C$, D$ ...) are enabled
>> Security: anonymous user access is enabled
>> Security: sending Remote Assistant queries is enabled
 >>  Disable HDD autorun
 >>  Disable autorun from network drives
 >>  Disable CD/DVD autorun
 >>  Disable removable media autorun
System Analysis in progress

 System Analysis - complete


Script commands 
Add commands to script:
Blocking hooks using Anti-Rootkit
Enable AVZGuard
Operations with AVZPM (true=enable,false=disable)
BootCleaner - import list of deleted files
BootCleaner - import all
Registry cleanup after deleting files
ExecuteWizard ('TSW',2,3,true) - Running Troubleshooting wizard
BootCleaner - activate
Reboot
Insert template for QuarantineFile() - quarantining file
Insert template for BC_QrFile() - quarantining file via BootCleaner
Insert template for DeleteFile() - deleting file
Insert template for DelCLSID() - deleting CLSID item from registry
Additional operations:Performance tweaking: disable service TermService (@%SystemRoot%\System32\termsrv.dll,-268)
Performance tweaking: disable service SSDPSRV (@%systemroot%\system32\ssdpsrv.dll,-100)
Performance tweaking: disable service Schedule (@%SystemRoot%\system32\schedsvc.dll,-100)
Security tweaking: disable CD autorun
Security tweaking: disable administrative shares
Security tweaking: disable anonymous user access
Security: disable sending Remote Assistant queries

File list

Port	Status	Remote Host	Remote Port	Application	Notes
TCP ports
135	LISTENING	0.0.0.0	0	[792] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
139	LISTENING	0.0.0.0	0	[4] System Script: Quarantine, Delete, BC delete, Terminate
445	LISTENING	0.0.0.0	0	[4] System Script: Quarantine, Delete, BC delete, Terminate
554	LISTENING	0.0.0.0	0	[2028] wmpnetwk.exe Script: Quarantine, Delete, BC delete, Terminate
843	LISTENING	0.0.0.0	0	[2540] c:\users\dj\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe Script: Quarantine, Delete, BC delete, Terminate
2869	LISTENING	0.0.0.0	0	[4] System Script: Quarantine, Delete, BC delete, Terminate
5354	LISTENING	0.0.0.0	0	[1392] c:\program files (x86)\bonjour\mdnsresponder.exe Script: Quarantine, Delete, BC delete, Terminate
6498	LISTENING	0.0.0.0	0	[2540] c:\users\dj\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe Script: Quarantine, Delete, BC delete, Terminate
6499	LISTENING	0.0.0.0	0	[2540] c:\users\dj\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe Script: Quarantine, Delete, BC delete, Terminate
10243	LISTENING	0.0.0.0	0	[4] System Script: Quarantine, Delete, BC delete, Terminate
27015	LISTENING	0.0.0.0	0	[1368] c:\program files (x86)\common files\apple\mobile device support\applemobiledeviceservice.exe Script: Quarantine, Delete, BC delete, Terminate
49152	LISTENING	0.0.0.0	0	[460] wininit.exe Script: Quarantine, Delete, BC delete, Terminate
49153	LISTENING	0.0.0.0	0	[892] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
49154	LISTENING	0.0.0.0	0	[964] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
49155	LISTENING	0.0.0.0	0	[520] services.exe Script: Quarantine, Delete, BC delete, Terminate
49156	LISTENING	0.0.0.0	0	[548] lsass.exe Script: Quarantine, Delete, BC delete, Terminate
49165	ESTABLISHED	127.0.0.1	49166	[2540] c:\users\dj\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe Script: Quarantine, Delete, BC delete, Terminate
49166	ESTABLISHED	127.0.0.1	49165	[2540] c:\users\dj\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe Script: Quarantine, Delete, BC delete, Terminate
49167	ESTABLISHED	127.0.0.1	49168	[2540] c:\users\dj\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe Script: Quarantine, Delete, BC delete, Terminate
49168	ESTABLISHED	127.0.0.1	49167	[2540] c:\users\dj\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe Script: Quarantine, Delete, BC delete, Terminate
49170	ESTABLISHED	127.0.0.1	49171	[2540] c:\users\dj\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe Script: Quarantine, Delete, BC delete, Terminate
49171	ESTABLISHED	127.0.0.1	49170	[2540] c:\users\dj\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe Script: Quarantine, Delete, BC delete, Terminate
49207	ESTABLISHED	127.0.0.1	49208	[1284] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
49208	ESTABLISHED	127.0.0.1	49207	[1284] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
49209	ESTABLISHED	127.0.0.1	49210	[1284] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
49210	ESTABLISHED	127.0.0.1	49209	[1284] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
59605	ESTABLISHED	69.171.228.40	80	[1284] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
59615	TIME_WAIT	24.143.207.210	80	[0]
59616	TIME_WAIT	23.57.68.128	80	[0]
59617	TIME_WAIT	69.171.228.40	80	[0]
59619	TIME_WAIT	69.171.242.62	80	[0]
59621	TIME_WAIT	24.143.207.210	80	[0]
59632	TIME_WAIT	209.18.46.122	80	[0]
59638	TIME_WAIT	24.25.230.17	80	[0]
59639	TIME_WAIT	74.125.224.187	80	[0]
59640	TIME_WAIT	74.125.224.187	80	[0]
59642	TIME_WAIT	23.57.68.57	80	[0]
59644	TIME_WAIT	216.156.213.179	80	[0]
59645	TIME_WAIT	23.57.68.57	80	[0]
59647	TIME_WAIT	195.27.252.18	80	[0]
59649	TIME_WAIT	204.145.81.68	80	[0]
59652	TIME_WAIT	204.145.81.68	80	[0]
59655	ESTABLISHED	173.194.64.95	80	[1284] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
59656	ESTABLISHED	173.194.64.95	80	[1284] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
59658	ESTABLISHED	173.194.64.95	80	[1284] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
59659	ESTABLISHED	74.125.224.169	443	[1284] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
59661	ESTABLISHED	74.125.224.171	80	[1284] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
59662	TIME_WAIT	91.213.143.7	80	[0]
59664	TIME_WAIT	208.94.0.176	80	[0]
59665	TIME_WAIT	204.145.81.75	80	[0]
59672	TIME_WAIT	72.21.91.19	80	[0]
59675	ESTABLISHED	74.125.224.174	443	[1284] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
59676	TIME_WAIT	91.213.143.7	80	[0]
59677	TIME_WAIT	91.213.143.7	80	[0]
59678	ESTABLISHED	74.125.224.233	443	[1284] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
59679	ESTABLISHED	24.25.230.17	80	[1284] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
59680	ESTABLISHED	69.171.228.39	80	[1284] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
59681	ESTABLISHED	69.171.242.62	80	[1284] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
59682	ESTABLISHED	69.171.242.62	80	[1284] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
59683	ESTABLISHED	24.143.207.210	80	[1284] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
59684	ESTABLISHED	24.143.207.210	80	[1284] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
59685	ESTABLISHED	24.143.207.210	80	[1284] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
59686	ESTABLISHED	24.143.207.210	80	[1284] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
59687	ESTABLISHED	24.143.207.210	80	[1284] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
59688	ESTABLISHED	69.171.227.48	80	[1284] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
59690	TIME_WAIT	74.114.168.212	80	[0]
59695	TIME_WAIT	74.114.168.212	80	[0]
59700	TIME_WAIT	74.114.168.212	80	[0]
59702	TIME_WAIT	74.114.168.212	80	[0]
59704	TIME_WAIT	74.114.168.212	80	[0]
59705	TIME_WAIT	74.114.168.212	80	[0]
59706	TIME_WAIT	74.114.168.212	80	[0]
59712	TIME_WAIT	74.114.168.212	80	[0]
59714	TIME_WAIT	74.114.168.212	80	[0]
59717	TIME_WAIT	74.114.168.212	80	[0]
59718	TIME_WAIT	74.114.168.212	80	[0]
59719	TIME_WAIT	74.114.168.212	80	[0]
59722	TIME_WAIT	74.114.168.212	80	[0]
59724	TIME_WAIT	74.114.168.212	80	[0]
59726	TIME_WAIT	74.114.168.212	80	[0]
59727	TIME_WAIT	74.114.168.212	80	[0]
59728	TIME_WAIT	74.114.168.212	80	[0]
59729	TIME_WAIT	74.114.168.212	80	[0]
59732	TIME_WAIT	74.114.168.212	80	[0]
59738	TIME_WAIT	74.114.168.212	80	[0]
59746	TIME_WAIT	74.114.168.212	80	[0]
59748	TIME_WAIT	74.114.168.212	80	[0]
59752	ESTABLISHED	74.125.224.192	80	[1284] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
59753	ESTABLISHED	74.125.224.192	80	[1284] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
59754	ESTABLISHED	74.125.224.231	80	[1284] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
59755	ESTABLISHED	74.125.224.165	80	[1284] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
59756	ESTABLISHED	74.125.224.229	80	[1284] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
59757	ESTABLISHED	208.117.239.93	80	[1284] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
59758	ESTABLISHED	74.125.224.164	80	[1284] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
UDP ports
137	LISTENING	--	--	[4] System Script: Quarantine, Delete, BC delete, Terminate
138	LISTENING	--	--	[4] System Script: Quarantine, Delete, BC delete, Terminate
1900	LISTENING	--	--	[952] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
1900	LISTENING	--	--	[952] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
5004	LISTENING	--	--	[2028] wmpnetwk.exe Script: Quarantine, Delete, BC delete, Terminate
5005	LISTENING	--	--	[2028] wmpnetwk.exe Script: Quarantine, Delete, BC delete, Terminate
5353	LISTENING	--	--	[1392] c:\program files (x86)\bonjour\mdnsresponder.exe Script: Quarantine, Delete, BC delete, Terminate
5355	LISTENING	--	--	[1156] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
44301	LISTENING	--	--	[1516] c:\windows\syswow64\pnkbstra.exe Script: Quarantine, Delete, BC delete, Terminate
53477	LISTENING	--	--	[2544] c:\program files (x86)\steam\steam.exe Script: Quarantine, Delete, BC delete, Terminate
54577	LISTENING	--	--	[1368] c:\program files (x86)\common files\apple\mobile device support\applemobiledeviceservice.exe Script: Quarantine, Delete, BC delete, Terminate
54578	LISTENING	--	--	[1368] c:\program files (x86)\common files\apple\mobile device support\applemobiledeviceservice.exe Script: Quarantine, Delete, BC delete, Terminate
54579	LISTENING	--	--	[1392] c:\program files (x86)\bonjour\mdnsresponder.exe Script: Quarantine, Delete, BC delete, Terminate
64573	LISTENING	--	--	[952] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
64574	LISTENING	--	--	[952] svchost.exe Script: Quarantine, Delete, BC delete, Terminate