AVZ 4.34 http://z-oleg.com/secur/avz/
File name | PID | Description | Copyright | MD5 | Information
688 | | | ?? | ?,error getting file info | Command line: 1144 | | | ?? | ?,error getting file info | Command line: 1380 | | | ?? | ?,error getting file info | Command line: 396 | | | ?? | ?,error getting file info | Command line: 496 | | | ?? | ?,error getting file info | Command line: 12 | | | ?? | ?,error getting file info | Command line: 2288 | | | ?? | ?,error getting file info | Command line: 2320 | | | ?? | ?,error getting file info | Command line: 2460 | | | ?? | ?,error getting file info | Command line: 2676 | | | ?? | ?,error getting file info | Command line: 2976 | | | ?? | ?,error getting file info | Command line: 3060 | | | ?? | ?,error getting file info | Command line: 3412 | | | ?? | ?,error getting file info | Command line: 3620 | | | ?? | ?,error getting file info | Command line: 3644 | | | ?? | ?,error getting file info | Command line: 3848 | | | ?? | ?,error getting file info | Command line: 3920 | | | ?? | ?,error getting file info | Command line: 1196 | | | ?? | ?,error getting file info | Command line: 2776 | | | ?? | ?,error getting file info | Command line: 1808 | | | ?? | ?,error getting file info | Command line: 3624 | | | ?? | ?,error getting file info | Command line: 3932 | | | ?? | ?,error getting file info | Command line: 3896 | | | ?? | ?,error getting file info | Command line: 1200 | | | ?? | ?,error getting file info | Command line: 2620 | | | ?? | ?,error getting file info | Command line: 3736 | | | ?? | ?,error getting file info | Command line: 4060 | | | ?? | ?,error getting file info | Command line: 2860 | | | ?? | ?,error getting file info | Command line: 1188 | | | ?? | ?,error getting file info | Command line: 3592 | | | ?? | ?,error getting file info | Command line: 1844 | | | ?? | ?,error getting file info | Command line: 4072 | | | ?? | ?,error getting file info | Command line: 1960 | | | ?? | ?,error getting file info | Command line: 1400 | | | ?? | ?,error getting file info | Command line: 2556 | | | ?? | ?,error getting file info | Command line: 3876 | | | ?? | ?,error getting file info | Command line: 2568 | | | ?? | ?,error getting file info | Command line: 1572 | | | ?? | ?,error getting file info | Command line: 2192 | | | ?? | ?,error getting file info | Command line: 1624 | | | ?? | ?,error getting file info | Command line: 2736 | | | ?? | ?,error getting file info | Command line: 640 | | | ?? | ?,error getting file info | Command line: 3440 | | | ?? | ?,error getting file info | Command line: 3408 | | | ?? | ?,error getting file info | Command line: 2224 | | | ?? | ?,error getting file info | Command line: 2796 | | | ?? | ?,error getting file info | Command line: 1984 | | | ?? | ?,error getting file info | Command line: 3672 | | | ?? | ?,error getting file info | Command line: 1008 | | | ?? | ?,error getting file info | Command line: 1884 | | | ?? | ?,error getting file info | Command line: 3500 | | | ?? | ?,error getting file info | Command line: 3288 | | | ?? | ?,error getting file info | Command line: 3280 | | | ?? | ?,error getting file info | Command line: 2384 | | | ?? | ?,error getting file info | Command line: 2172 | | | ?? | ?,error getting file info | Command line: 244 | | | ?? | ?,error getting file info | Command line: 3292 | | | ?? | ?,error getting file info | Command line: 1480 | | | ?? | ?,error getting file info | Command line: 3460 | | | ?? | ?,error getting file info | Command line: 1784 | | | ?? | ?,error getting file info | Command line: 2688 | | | ?? | ?,error getting file info | Command line: 2516 | | | ?? | ?,error getting file info | Command line: 2520 | | | ?? | ?,error getting file info | Command line: 1452 | | | ?? | ?,error getting file info | Command line: 2132 | | | ?? | ?,error getting file info | Command line: 3764 | | | ?? | ?,error getting file info | Command line: 1392 | | | ?? | ?,error getting file info | Command line: 3320 | | | ?? | ?,error getting file info | Command line: 2868 | | | ?? | ?,error getting file info | Command line: 2952 | | | ?? | ?,error getting file info | Command line: 1704 | | | ?? | ?,error getting file info | Command line: 2212 | | | ?? | ?,error getting file info | Command line: 2008 | | | ?? | ?,error getting file info | Command line: 3136 | | | ?? | ?,error getting file info | Command line: 3912 | | | ?? | ?,error getting file info | Command line: 2284 | | | ?? | ?,error getting file info | Command line: 3800 | | | ?? | ?,error getting file info | Command line: 3548 | | | ?? | ?,error getting file info | Command line: 2552 | | | ?? | ?,error getting file info | Command line: 892 | | | ?? | ?,error getting file info | Command line: 2980 | | | ?? | ?,error getting file info | Command line: 2996 | | | ?? | ?,error getting file info | Command line: 1832 | | | ?? | ?,error getting file info | Command line: 1988 | | | ?? | ?,error getting file info | Command line: 3332 | | | ?? | ?,error getting file info | Command line: 628 | | | ?? | ?,error getting file info | Command line: 3608 | | | ?? | ?,error getting file info | Command line: 2220 | | | ?? | ?,error getting file info | Command line: 1824 | | | ?? | ?,error getting file info | Command line: 3780 | | | ?? | ?,error getting file info | Command line: 2380 | | | ?? | ?,error getting file info | Command line: 3652 | | | ?? | ?,error getting file info | Command line: 3564 | | | ?? | ?,error getting file info | Command line: 2632 | | | ?? | ?,error getting file info | Command line: 3116 | | | ?? | ?,error getting file info | Command line: 944 | | | ?? | ?,error getting file info | Command line: 2528 | | | ?? | ?,error getting file info | Command line: 1880 | | | ?? | ?,error getting file info | Command line: 2264 | | | ?? | ?,error getting file info | Command line: 3512 | | | ?? | ?,error getting file info | Command line: 2244 | | | ?? | ?,error getting file info | Command line: 196 | | | ?? | ?,error getting file info | Command line: 2948 | | | ?? | ?,error getting file info | Command line: 1232 | | | ?? | ?,error getting file info | Command line: 436 | | | ?? | ?,error getting file info | Command line: 812 | | | ?? | ?,error getting file info | Command line: 2680 | | | ?? | ?,error getting file info | Command line: 3788 | | | ?? | ?,error getting file info | Command line: 3540 | | | ?? | ?,error getting file info | Command line: 3892 | | | ?? | ?,error getting file info | Command line: 2652 | | | ?? | ?,error getting file info | Command line: 3560 | | | ?? | ?,error getting file info | Command line: 3200 | | | ?? | ?,error getting file info | Command line: 1552 | | | ?? | ?,error getting file info | Command line: 3196 | | | ?? | ?,error getting file info | Command line: 3600 | | | ?? | ?,error getting file info | Command line: 3872 | | | ?? | ?,error getting file info | Command line: 3924 | | | ?? | ?,error getting file info | Command line: 2388 | | | ?? | ?,error getting file info | Command line: 1464 | | | ?? | ?,error getting file info | Command line: 3216 | | | ?? | ?,error getting file info | Command line: 2464 | | | ?? | ?,error getting file info | Command line: 3528 | | | ?? | ?,error getting file info | Command line: 2248 | | | ?? | ?,error getting file info | Command line: 3804 | | | ?? | ?,error getting file info | Command line: 1536 | | | ?? | ?,error getting file info | Command line: 1780 | | | ?? | ?,error getting file info | Command line: 1796 | | | ?? | ?,error getting file info | Command line: 2792 | | | ?? | ?,error getting file info | Command line: 2280 | | | ?? | ?,error getting file info | Command line: 2544 | | | ?? | ?,error getting file info | Command line: 2512 | | | ?? | ?,error getting file info | Command line: 884 | | | ?? | ?,error getting file info | Command line: c:\avz\avz.exe | Script: Quarantine, Delete, Delete via BC, Terminate 2476 | ???????????? ??????? AVZ | ???????????? ??????? AVZ | ?? | 745.00 kb, rsAh, | created: 1-8-2010 1:53:16, modified: 8-7-2010 10:19:08 Command line: "C:\avz\avz.exe" c:\avz\avz.exe | Script: Quarantine, Delete, Delete via BC, Terminate 3416 | ???????????? ??????? AVZ | ???????????? ??????? AVZ | ?? | 745.00 kb, rsAh, | created: 1-8-2010 1:53:16, modified: 8-7-2010 10:19:08 Command line: "C:\avz\avz.exe" c:\program files\ati technologies\ati.ace\core-static\ccc.exe | Script: Quarantine, Delete, Delete via BC, Terminate 1748 | Catalyst Control Centre: Host application | 2002-2009 | ?? | 64.00 kb, rsAh, | created: 22-4-2009 17:37:16, modified: 22-4-2009 17:37:16 Command line: "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe" 0 c:\users\administrator\appdata\local\google\chrome\application\chrome.exe | Script: Quarantine, Delete, Delete via BC, Terminate 2548 | Google Chrome | Copyright (C) 2006-2009 Google Inc. All Rights Reserved. | ?? | 923.55 kb, rsAh, | created: 19-10-2009 10:45:48, modified: 23-7-2010 0:02:16 Command line: "C:\Users\Administrator\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=nl --force-fieldtest=CacheSize/CacheSizeGroup_0/DnsImpact/_default_enabled_prefetch/GlobalSdch/_global_enable_sdch/IPv6_Probe/_IPv6_probe_done/ --channel=3180.048EB900.1309399725 c:\users\administrator\appdata\local\google\chrome\application\chrome.exe | Script: Quarantine, Delete, Delete via BC, Terminate 3180 | Google Chrome | Copyright (C) 2006-2009 Google Inc. All Rights Reserved. | ?? | 923.55 kb, rsAh, | created: 19-10-2009 10:45:48, modified: 23-7-2010 0:02:16 Command line: "C:\Users\Administrator\AppData\Local\Google\Chrome\Application\chrome.exe" c:\users\administrator\appdata\local\google\chrome\application\chrome.exe | Script: Quarantine, Delete, Delete via BC, Terminate 2020 | Google Chrome | Copyright (C) 2006-2009 Google Inc. All Rights Reserved. | ?? | 923.55 kb, rsAh, | created: 19-10-2009 10:45:48, modified: 23-7-2010 0:02:16 Command line: "C:\Users\Administrator\AppData\Local\Google\Chrome\Application\chrome.exe" --type=extension --lang=nl --force-fieldtest=DnsImpact/_default_enabled_prefetch/GlobalSdch/_global_enable_sdch/IPv6_Probe/_IPv6_probe_done/ --channel=3180.0233F780.1812484362 --ignored=" --type=renderer " c:\users\administrator\appdata\local\google\chrome\application\chrome.exe | Script: Quarantine, Delete, Delete via BC, Terminate 1920 | Google Chrome | Copyright (C) 2006-2009 Google Inc. All Rights Reserved. | ?? | 923.55 kb, rsAh, | created: 19-10-2009 10:45:48, modified: 23-7-2010 0:02:16 Command line: "C:\Users\Administrator\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=nl --force-fieldtest=CacheSize/CacheSizeGroup_0/DnsImpact/_default_enabled_prefetch/GlobalSdch/_global_enable_sdch/IPv6_Probe/_IPv6_probe_done/ --channel=3180.071C6900.1171416103 c:\users\administrator\appdata\local\google\chrome\application\chrome.exe | Script: Quarantine, Delete, Delete via BC, Terminate 3816 | Google Chrome | Copyright (C) 2006-2009 Google Inc. All Rights Reserved. | ?? | 923.55 kb, rsAh, | created: 19-10-2009 10:45:48, modified: 23-7-2010 0:02:16 Command line: "C:\Users\Administrator\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=nl --force-fieldtest=CacheSize/CacheSizeGroup_0/DnsImpact/_default_enabled_prefetch/GlobalSdch/_global_enable_sdch/IPv6_Probe/_IPv6_probe_done/ --channel=3180.07200600.1550221657 c:\program files\gnu\gnupg\bin\dbus-daemon.exe | Script: Quarantine, Delete, Delete via BC, Terminate 2004 | | | ?? | 321.72 kb, rsAh, | created: 12-6-2009 8:05:14, modified: 12-6-2009 8:05:14 Command line: "C:\Program Files\GNU\GnuPG\bin\dbus-daemon.exe" --session c:\windows\system32\dwm.exe | Script: Quarantine, Delete, Delete via BC, Terminate 3420 | Desktop Window Manager | © Microsoft Corporation. All rights reserved. | ?? | 80.00 kb, rsAh, | created: 4-4-2008 11:45:22, modified: 4-4-2008 11:45:22 Command line: "C:\Windows\system32\Dwm.exe" c:\windows\ehome\ehtray.exe | Script: Quarantine, Delete, Delete via BC, Terminate 3840 | Media Center Tray Applet | © Microsoft Corporation. All rights reserved. | ?? | 123.00 kb, rsAh, | created: 4-4-2008 11:46:41, modified: 4-4-2008 11:46:41 Command line: "C:\Windows\ehome\ehtray.exe" c:\windows\explorer.exe | Script: Quarantine, Delete, Delete via BC, Terminate 3452 | Windows Explorer | © Microsoft Corporation. All rights reserved. | ?? | 2858.50 kb, rsAh, | created: 16-1-2010 13:45:36, modified: 29-10-2008 8:29:41 Command line: C:\Windows\Explorer.EXE c:\program files\java\jre6\bin\jucheck.exe | Script: Quarantine, Delete, Delete via BC, Terminate 2836 | Java(TM) Update Checker | Copyright © 2004 | ?? | 377.80 kb, rsAh, | created: 26-10-2009 0:19:47, modified: 11-10-2009 5:17:45 Command line: "C:\Program Files\Java\jre6\bin\jucheck.exe" -auto c:\program files\gnu\gnupg\kleopatra.exe | Script: Quarantine, Delete, Delete via BC, Terminate 1412 | | | ?? | 7.00 kb, rsAh, | created: 29-5-2010 12:26:46, modified: 29-5-2010 12:26:46 Command line: "C:\Program Files\GNU\GnuPG\kleopatra.exe" --daemon c:\program files\gnu\gnupg\bin\kleopatra.exe | Script: Quarantine, Delete, Delete via BC, Terminate 3828 | | | ?? | 5884.07 kb, rsAh, | created: 3-3-2010 23:18:48, modified: 3-3-2010 23:18:48 Command line: "C:\\Program Files\\GNU\\GnuPG\\kleopatra.exe" "--daemon" c:\windows\system32\mobsync.exe | Script: Quarantine, Delete, Delete via BC, Terminate 2144 | Microsoft Sync Center | © Microsoft Corporation. All rights reserved. | ?? | 93.50 kb, rsAh, | created: 4-4-2008 11:41:47, modified: 4-4-2008 11:41:47 Command line: C:\Windows\System32\mobsync.exe -Embedding c:\program files\ati technologies\ati.ace\core-static\mom.exe | Script: Quarantine, Delete, Delete via BC, Terminate 3952 | Catalyst Control Center: Monitoring program | 2002-2009 | ?? | 64.00 kb, rsAh, | created: 22-4-2009 17:38:50, modified: 22-4-2009 17:38:50 Command line: "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM" c:\program files\microsoft security essentials\msmpeng.exe | Script: Quarantine, Delete, Delete via BC, Terminate 1132 | AntiMalware Service Executable | © Microsoft Corporation. All rights reserved. | ?? | 17.48 kb, rsAh, | created: 25-3-2010 21:40:44, modified: 25-3-2010 21:40:44 Command line: "C:\Program Files\Microsoft Security Essentials\MsMpEng.exe" c:\program files\microsoft security essentials\msseces.exe | Script: Quarantine, Delete, Delete via BC, Terminate 3632 | Microsoft Security Essentials User Interface | © 2009 Microsoft Corporation. All rights reserved. | ?? | 1067.59 kb, rsAh, | created: 1-6-2010 14:53:46, modified: 1-6-2010 14:53:46 Command line: "C:\Program Files\Microsoft Security Essentials\msseces.exe" -hide -runkey c:\windows\rthdvcpl.exe | Script: Quarantine, Delete, Delete via BC, Terminate 3656 | HD Audio Control Panel | 2006 (c) Realtek Semiconductor. All rights reserved. | ?? | 4608.00 kb, rsAh, | created: 3-8-2008 20:39:12, modified: 17-12-2007 5:02:28 Command line: "C:\Windows\RtHDVCpl.exe" c:\windows\system32\taskeng.exe | Script: Quarantine, Delete, Delete via BC, Terminate 1616 | Task Scheduler Engine | © Microsoft Corporation. All rights reserved. | ?? | 165.50 kb, rsAh, | created: 4-4-2008 11:45:22, modified: 4-4-2008 11:45:22 Command line: taskeng.exe {1DBED943-C166-4ECD-A977-28FE26A26F6E} S-1-5-21-1122999869-1285303633-2407138414-500:HEAVENLY-ONE\Administrator:Interactive:[1] c:\program files\windows media player\wmpnscfg.exe | Script: Quarantine, Delete, Delete via BC, Terminate 4048 | Windows Media Player Network Sharing Service Configuration Application | © Microsoft Corporation. All rights reserved. | ?? | 197.50 kb, rsAh, | created: 4-4-2008 11:47:51, modified: 4-4-2008 11:47:51 Command line: "C:\Program Files\Windows Media Player\wmpnscfg.exe" Detected:198, recognized as trusted 57
| |
Module | Base address | Size in memory | Description | Manufacturer
C:\Windows\System32\Drivers\dump_amdsata.sys | Script: Quarantine, Delete, Delete via BC 93C80000 | 012000 (73728) |
| C:\Windows\System32\Drivers\dump_diskdump.sys | Script: Quarantine, Delete, Delete via BC 93C76000 | 00A000 (40960) |
| C:\Windows\System32\Drivers\dump_dumpfve.sys | Script: Quarantine, Delete, Delete via BC 93C92000 | 011000 (69632) |
| C:\Windows\system32\DRIVERS\tdrpm147.sys | Script: Quarantine, Delete, Delete via BC 88802000 | 0EC000 (966656) | Acronis Try&Decide Volume Filter Driver | Copyright (c) 2008 Acronis
| C:\Windows\System32\Drivers\vnccom.SYS | Script: Quarantine, Delete, Delete via BC A3EFE000 | 002000 (8192) | VNC Communication | RDV Soft. All rights reserved.
| Modules found - 175, recognized as trusted - 170
| |
Service | Description | Status | File | Group | Dependencies
tdrpman147 | Driver: Unload, Delete, Disable, Delete via BC Acronis Try&Decide and Restore Points filter (build 147) | Running | C:\Windows\system32\DRIVERS\tdrpm147.sys | Script: Quarantine, Delete, Delete via BC |
| vnccom | Driver: Unload, Delete, Disable, Delete via BC vnccom | Running | C:\Windows\system32\Drivers\vnccom.SYS | Script: Quarantine, Delete, Delete via BC | vncdrv
| Detected - 259, recognized as trusted - 257
| |
File name | Status | Startup method | Description
C:\PROGRA~1\VSO\IMAGER~1\RSZShell.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {2BB59FC0-31E8-42DA-9D3C-E9A52953853B} | Delete C:\Program Files\AMD\OverDrive\AMD OverDrive.exe | Script: Quarantine, Delete, Delete via BC Active | Shortcut in Startup folder | C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\, C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\AMD OverDrive.lnk,
| C:\Program Files\Acronis\TrueImageHome\tishell.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {C539A15A-3AF9-4c92-B771-50CB78F5C751} | Delete C:\Program Files\Acronis\TrueImageHome\tishell.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {C539A15B-3AF9-4c92-B771-50CB78F5C751} | Delete C:\Program Files\Adobe\Adobe GoLive CS2\GoLive.exe | Script: Quarantine, Delete, Delete via BC Active | Shortcut in Startup folder | C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\, C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Adobe GoLive CS2.lnk,
| C:\Program Files\Common Files\Microsoft Shared\DW\DW.EXE | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft Visual Studio Tools for Applications, EventMessageFile
| C:\Program Files\CoreFTP\coreftp.exe | Script: Quarantine, Delete, Delete via BC Active | Shortcut in Startup folder | C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\, C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Core FTP Lite.lnk,
| C:\Program Files\ERUNT\NTREGOPT.EXE | Script: Quarantine, Delete, Delete via BC Active | Shortcut in Startup folder | C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\, C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\NTREGOPT.lnk,
| C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\tssmpm.cpl | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cpls, TSSMPM | Delete C:\Program Files\Internet Explorer\iexplore.exe | Script: Quarantine, Delete, Delete via BC Active | Shortcut in Startup folder | C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\, C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk,
| C:\Program Files\Playrix Gameplayer\Manager.exe | Script: Quarantine, Delete, Delete via BC Active | Shortcut in Startup folder | C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\, C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Playrix Gameplayer.lnk,
| C:\Program Files\Raxco\PerfectDisk2008\PD91Engine.exe | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\PD91Agent, EventMessageFile
| C:\Program Files\Raxco\PerfectDisk2008\PD91Engine.exe | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\PD91Engine, EventMessageFile
| C:\Program Files\Raxco\PerfectDisk2008\PD91Engine.exe | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\PD91Scanner, EventMessageFile
| C:\Program Files\ThumbView_Lite 1.0\ThumbView_Lite.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {3B52CC4A-19E9-43F5-A626-F89267A5E43F} | Delete C:\Users\Administrator\AppData\Local\Google\Chrome\Application\chrome.exe | Script: Quarantine, Delete, Delete via BC Active | Shortcut in Startup folder | C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\, C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk,
| C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk | Script: Quarantine, Delete, Delete via BC Active | File in Startup folder | C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\, C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk,
| C:\WindowsSystem32\IoLogMsg.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\vsmraid, EventMessageFile
| C:\Windows\System32\Branding\folderbg\VistaFolderBackground.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler, {73526E5A-FD53-4BE7-B5E2-D3C89D7413DC} | Delete C:\Windows\System32\Branding\folderbg\VistaFolderBackground.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {73526E5A-FD53-4BE7-B5E2-D3C89D7413DC} | Delete C:\Windows\System32\igmpv2.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile
| C:\Windows\System32\ipbootp.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile
| C:\Windows\System32\iprip2.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile
| C:\Windows\System32\ws03res.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPNATHLP, EventMessageFile
| C:\Windows\system32\Ati2evxx.exe | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Ati External Event Utility, EventMessageFile
| C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler, {8C7461EF-2B13-11d2-BE35-3078302C2030} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {5E6AB780-7743-11CF-A12B-00AA004AE837} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {7BA4C742-9E81-11CF-99D3-00AA004AE837} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {056440FD-8568-48e7-A632-72157243B55B} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {C4EC38BD-4E9E-4b5e-935A-D1BFF237D980} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {6D8BB3D3-9D87-4a91-AB56-4F30CFFEFE9F} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {21569614-B795-46b1-85F4-E737A8DC09AD} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {169A0691-8DF9-11d1-A1C4-00C04FD75D13} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {AF4F6510-F982-11d0-8595-00AA004CD6D8} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {01E04581-4EEE-11d0-BFE9-00AA005B4383} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {a542e116-8088-4146-a352-b0d06e7f6af6} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {F61FFEC1-754F-11d0-80CA-00AA005B4383} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {00BB2763-6A77-11D0-A535-00C04FD7D062} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {596742A5-1393-4e13-8765-AE1DF71ACAFB} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {6756A641-DE71-11d0-831B-00AA005B4383} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {6935DB93-21E8-4ccc-BEB9-9FE3C77A297A} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {00BB2764-6A77-11D0-A535-00C04FD7D062} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {03C036F1-A186-11D0-824A-00AA005B4383} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {00BB2765-6A77-11D0-A535-00C04FD7D062} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {ECD4FC4E-521C-11D0-B792-00A0C90312E1} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {3CCF8A41-5C85-11d0-9796-00AA00B90ADF} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {ECD4FC4D-521C-11D0-B792-00A0C90312E1} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {DD313E04-FEFF-11d1-8ECD-0000F87A470C} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {EF8AD2D1-AE36-11D1-B2D2-006097DF8C11} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {fccf70c8-f4d7-4d8b-8c17-cd6715e37fff} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {4d5c8c2a-d075-11d0-b416-00c04fb90376} | Delete C:\Windows\system32\ff_vfw.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, VIDC.FFDS | Delete C:\Windows\system32\oobefldr.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {CB1B7F8C-C50A-4176-B604-9E24DEE8D4D1} | Delete C:\Windows\system32\psxss.exe | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
| D:\xampp\xampp-control.exe | Script: Quarantine, Delete, Delete via BC Active | Shortcut in Startup folder | C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\, C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\XAMPP Control Panel.lnk,
| progman.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, shell | Delete vgafix.fon | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon | Delete vgaoem.fon | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon | Delete vgasys.fon | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon | Delete Autoruns items found - 823, recognized as trusted - 764
| |
File name | Type | Description | Manufacturer | CLSID
BHO | AutorunsDisabled | Delete C:\Program Files\Windows Live\Messenger\wlchtc.dll | Script: Quarantine, Delete, Delete via BC BHO | Windows Live Call Click-to-Call BHO | 2008 Microsoft Corporation. All rights reserved. | {5C255C8A-E604-49b4-9D64-90988571CECB} | Delete Extension module | {2670000A-7350-4f3c-8081-5663EE0C6C49} | Delete Extension module | {92780B25-18CC-41C8-B9BE-3C9C571A8263} | Delete Extension module | {E0B8C461-F8FB-49b4-8373-FE32E92528A6} | Delete Items found - 12, recognized as trusted - 7
| |
File name | Destination | Description | Manufacturer | CLSID
IE User Assist | {FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} | Delete Color Control Panel Applet | {b2c761c6-29bc-4f19-9251-e6195265baf1} | Delete Add New Hardware | {7A979262-40CE-46ff-AEEE-7884AC3B6136} | Delete Get Programs Online | {3e7efb4c-faf1-453d-89eb-56026875ef90} | Delete Taskbar and Start Menu | {0DF44EAA-FF21-4412-828E-260A8728E7F1} | Delete ActiveDirectory Folder | {1b24a030-9b20-49bc-97ac-1be4426f9e59} | Delete ActiveDirectory Folder | {34449847-FD14-4fc8-A75A-7432F5181EFB} | Delete Sam Account Folder | {C8494E42-ACDD-4739-B0FB-217361E4894F} | Delete Sam Account Folder | {E29F9716-5C08-4FCD-955A-119FDB5A522D} | Delete Control Panel command object for Start menu | {5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0} | Delete Default Programs command object for Start menu | {E44E5D18-0652-4508-A4E2-8A090067BCB0} | Delete Folder Options | {6dfd7c5c-2451-11d3-a299-00c04f8ef6af} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Microsoft Internet Toolbar | Shell Browser UI Library | © Microsoft Corporation. All rights reserved. | {5E6AB780-7743-11CF-A12B-00AA004AE837} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Microsoft BrowserBand | Shell Browser UI Library | © Microsoft Corporation. All rights reserved. | {7BA4C742-9E81-11CF-99D3-00AA004AE837} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Explorer Navigation Bar | Shell Browser UI Library | © Microsoft Corporation. All rights reserved. | {056440FD-8568-48e7-A632-72157243B55B} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Explorer Travel Band | Shell Browser UI Library | © Microsoft Corporation. All rights reserved. | {C4EC38BD-4E9E-4b5e-935A-D1BFF237D980} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Explorer Search Band | Shell Browser UI Library | © Microsoft Corporation. All rights reserved. | {6D8BB3D3-9D87-4a91-AB56-4F30CFFEFE9F} | Delete Explorer Query Band | {2C2577C2-63A7-40e3-9B7F-586602617ECB} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Search Band | Shell Browser UI Library | © Microsoft Corporation. All rights reserved. | {21569614-B795-46b1-85F4-E737A8DC09AD} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC In-pane search | Shell Browser UI Library | © Microsoft Corporation. All rights reserved. | {169A0691-8DF9-11d1-A1C4-00C04FD75D13} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Registry Tree Options Utility | Shell Browser UI Library | © Microsoft Corporation. All rights reserved. | {AF4F6510-F982-11d0-8595-00AA004CD6D8} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC &Address | Shell Browser UI Library | © Microsoft Corporation. All rights reserved. | {01E04581-4EEE-11d0-BFE9-00AA005B4383} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Address EditBox | Shell Browser UI Library | © Microsoft Corporation. All rights reserved. | {a542e116-8088-4146-a352-b0d06e7f6af6} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC BandProxy | Shell Browser UI Library | © Microsoft Corporation. All rights reserved. | {F61FFEC1-754F-11d0-80CA-00AA005B4383} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Microsoft AutoComplete | Shell Browser UI Library | © Microsoft Corporation. All rights reserved. | {00BB2763-6A77-11D0-A535-00C04FD7D062} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Microsoft Breadcrumb Bar | Shell Browser UI Library | © Microsoft Corporation. All rights reserved. | {596742A5-1393-4e13-8765-AE1DF71ACAFB} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC MRU AutoComplete List | Shell Browser UI Library | © Microsoft Corporation. All rights reserved. | {6756A641-DE71-11d0-831B-00AA005B4383} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Custom MRU AutoCompleted List | Shell Browser UI Library | © Microsoft Corporation. All rights reserved. | {6935DB93-21E8-4ccc-BEB9-9FE3C77A297A} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Microsoft History AutoComplete List | Shell Browser UI Library | © Microsoft Corporation. All rights reserved. | {00BB2764-6A77-11D0-A535-00C04FD7D062} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Microsoft Shell Folder AutoComplete List | Shell Browser UI Library | © Microsoft Corporation. All rights reserved. | {03C036F1-A186-11D0-824A-00AA005B4383} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Microsoft Multiple AutoComplete List Container | Shell Browser UI Library | © Microsoft Corporation. All rights reserved. | {00BB2765-6A77-11D0-A535-00C04FD7D062} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Shell Band Site Menu | Shell Browser UI Library | © Microsoft Corporation. All rights reserved. | {ECD4FC4E-521C-11D0-B792-00A0C90312E1} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Shell DeskBarApp | Shell Browser UI Library | © Microsoft Corporation. All rights reserved. | {3CCF8A41-5C85-11d0-9796-00AA00B90ADF} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Shell Rebar BandSite | Shell Browser UI Library | © Microsoft Corporation. All rights reserved. | {ECD4FC4D-521C-11D0-B792-00A0C90312E1} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC User Assist | Shell Browser UI Library | © Microsoft Corporation. All rights reserved. | {DD313E04-FEFF-11d1-8ECD-0000F87A470C} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Global Folder Settings | Shell Browser UI Library | © Microsoft Corporation. All rights reserved. | {EF8AD2D1-AE36-11D1-B2D2-006097DF8C11} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Search Control | Shell Browser UI Library | © Microsoft Corporation. All rights reserved. | {fccf70c8-f4d7-4d8b-8c17-cd6715e37fff} | Delete C:\Windows\system32\browseui.dll | Script: Quarantine, Delete, Delete via BC Microsoft CommBand | Shell Browser UI Library | © Microsoft Corporation. All rights reserved. | {4d5c8c2a-d075-11d0-b416-00c04fb90376} | Delete View Available Networks | {38a98528-6cbf-4ca9-8dc0-b1e1d10f7b1b} | Delete Contacts folder | {0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} | Delete Windows Firewall | {4026492f-2f69-46b8-b9bf-5654fc07e423} | Delete Problem Reports and Solutions | {fcfeecae-ee1b-4849-ae50-685dcf7717ec} | Delete iSCSI Initiator | {a304259d-52b8-4526-8b1a-a1d6cecc8243} | Delete .cab or .zip files | {911051fa-c21c-4246-b470-070cd8df6dc4} | Delete Windows Search Shell Service | {da67b8ad-e81b-4c70-9b91b417b5e33527} | Delete Microsoft.ScannersAndCameras | {00f2886f-cd64-4fc9-8ec5-30ef6cdbe8c3} | Delete Windows Sidebar Properties | {37efd44d-ef8d-41b1-940d-96973a50e9e0} | Delete Windows Features | {67718415-c450-4f3c-bf8a-b487642dc39b} | Delete Windows Defender | {d8559eb9-20c0-410e-beda-7ed416aecc2a} | Delete Mobility Center Control Panel | {5ea4f148-308c-46d7-98a9-49041b1dd468} | Delete C:\Windows\system32\oobefldr.dll | Script: Quarantine, Delete, Delete via BC Welcome Center | Welcome Center | © Microsoft Corporation. All rights reserved. | {CB1B7F8C-C50A-4176-B604-9E24DEE8D4D1} | Delete User Accounts | {7A9D77BD-5403-11d2-8785-2E0420524153} | Delete StardockDeskscapes.DreamFile | {FA603FF3-D04C-415d-8049-EFE29EEF4B26} | Delete C:\Windows\System32\Branding\folderbg\VistaFolderBackground.dll | Script: Quarantine, Delete, Delete via BC Ave's FolderBg | COM Explorer Injector and HOOK DLL | (c) Andreas Verhoeven. All rights reserved. | {73526E5A-FD53-4BE7-B5E2-D3C89D7413DC} | Delete C:\Program Files\ThumbView_Lite 1.0\ThumbView_Lite.dll | Script: Quarantine, Delete, Delete via BC ThumbView: extended image information | ShellExtension Module | Copyright 2004 | {3B52CC4A-19E9-43F5-A626-F89267A5E43F} | Delete Shell Extension for Malware scanning | {45AC2688-0253-4ED8-97DE-B5370FA7D48A} | Delete C:\PROGRA~1\VSO\IMAGER~1\RSZShell.dll | Script: Quarantine, Delete, Delete via BC ImageResizer Shell Extension | ImageResizer Shell Extension | Copyright © 2006-2008 VSO Software SARL | {2BB59FC0-31E8-42DA-9D3C-E9A52953853B} | Delete HashTab Context Menu | {B1883831-F0D8-4453-8245-EEAAD866DD6E} | Delete C:\Program Files\Acronis\TrueImageHome\tishell.dll | Script: Quarantine, Delete, Delete via BC Acronis True Image Shell Context Menu Extension | Acronis True Image Shell Extensions | Copyright (C) Acronis, 2000-2008. | {C539A15A-3AF9-4c92-B771-50CB78F5C751} | Delete C:\Program Files\Acronis\TrueImageHome\tishell.dll | Script: Quarantine, Delete, Delete via BC Acronis True Image Shell Extension | Acronis True Image Shell Extensions | Copyright (C) Acronis, 2000-2008. | {C539A15B-3AF9-4c92-B771-50CB78F5C751} | Delete C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe | Script: Quarantine, Delete, Delete via BC Windows Live Photo Gallery Autoplay Drop Target | Windows Live Photo Gallery | © 2008 Microsoft Corporation. All rights reserved. | {2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} | Delete C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe | Script: Quarantine, Delete, Delete via BC Windows Live Photo Gallery Viewer Drop Target | Windows Live Photo Gallery | © 2008 Microsoft Corporation. All rights reserved. | {00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} | Delete C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe | Script: Quarantine, Delete, Delete via BC Windows Live Photo Gallery Editor Drop Target | Windows Live Photo Gallery | © 2008 Microsoft Corporation. All rights reserved. | {00F374B7-B390-4884-B372-2FC349F2172B} | Delete ColumnHandler | AutorunsDisabled | Delete Items found - 337, recognized as trusted - 273
| |
File name | Type | Name | Description | Manufacturer
Items found - 10, recognized as trusted - 10
| |
File name | Job name | Job state | Description | Manufacturer
Items found - 5, recognized as trusted - 5
| |
Manufacturer | Status | EXE file | Description | GUID
Detected - 8, recognized as trusted - 8
| |
Manufacturer | EXE file | Description
Detected - 35, recognized as trusted - 35
| |
File name | Description | Manufacturer | CLSID | Source URL
Items found - 6, recognized as trusted - 6
| |
File name | Description | Manufacturer
Items found - 22, recognized as trusted - 22
| |
File name | Description | Manufacturer | CLSID
Items found - 9, recognized as trusted - 9
| |
Hosts file record
|
File name | Type | Description | Manufacturer | CLSID
mscoree.dll | Script: Quarantine, Delete, Delete via BC Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D} | Delete mscoree.dll | Script: Quarantine, Delete, Delete via BC Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D} | Delete mscoree.dll | Script: Quarantine, Delete, Delete via BC Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D} | Delete Items found - 21, recognized as trusted - 18
| |
File | Description | Type
C:\Windows\system32\Drivers\uji3njey.sys | Script: Quarantine, Delete, Delete via BC Suspicion for Rootkit | Kernel-mode hook
| |
Executing standard script: 1. Detect and block UserMode and KernelMode hooks 1.1 Searching for user-mode API hooks Analysis: kernel32.dll, export table found in section .text Analysis: ntdll.dll, export table found in section .text Analysis: user32.dll, export table found in section .text Analysis: advapi32.dll, export table found in section .text Analysis: ws2_32.dll, export table found in section .text Analysis: wininet.dll, export table found in section .text Analysis: rasapi32.dll, export table found in section .text Analysis: urlmon.dll, export table found in section .text Analysis: netapi32.dll, export table found in section .text 1.2 Searching for kernel-mode API hooks Driver loaded successfully SDT found (RVA=137B00) Kernel ntkrnlpa.exe found in memory at address 82417000 SDT = 8254EB00 KiST = 824CF9E0 (391) Function NtCreateFile (3C) intercepted (8263E036->A3F4B130), hook C:\Windows\system32\Drivers\uji3njey.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateKey (40) intercepted (825FEC71->A3F4B370), hook C:\Windows\system32\Drivers\uji3njey.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateProcess (48) intercepted (826AB26F->A3F4B400), hook C:\Windows\system32\Drivers\uji3njey.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateProcessEx (49) intercepted (826AB2BA->A3F4B430), hook C:\Windows\system32\Drivers\uji3njey.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeleteValueKey (7E) intercepted (825C71FF->A3F4B3B0), hook C:\Windows\system32\Drivers\uji3njey.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenFile (BA) intercepted (826276B5->A3F4B530), hook C:\Windows\system32\Drivers\uji3njey.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenKey (BD) intercepted (8262C1F2->A3F4B380), hook C:\Windows\system32\Drivers\uji3njey.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenProcess (C2) intercepted (82628BBE->A3F4B3D0), hook C:\Windows\system32\Drivers\uji3njey.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenSection (C5) intercepted (8263F872->A3F4B460), hook C:\Windows\system32\Drivers\uji3njey.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetValueKey (144) intercepted (825FFA9D->A3F4B390), hook C:\Windows\system32\Drivers\uji3njey.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtTerminateJobObject (14D) intercepted (825EC2D8->A3F4B6D0), hook C:\Windows\system32\Drivers\uji3njey.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtWriteVirtualMemory (166) intercepted (82624CFF->A3F4B6C0), hook C:\Windows\system32\Drivers\uji3njey.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Functions checked: 391, intercepted: 12, restored: 12 1.3 Checking IDT and SYSENTER Analyzing CPU 1 Analyzing CPU 2 Analyzing CPU 3 CmpCallCallBacks = 00000000 Checking IDT and SYSENTER - complete 1.4 Searching for masking processes and drivers Masking process with PID=688, name = "" >> PID substitution detected (current PID is=0, real = 688) Masking process with PID=1144, name = "" >> PID substitution detected (current PID is=0, real = 1144) Masking process with PID=1380, name = "" >> PID substitution detected (current PID is=0, real = 1380) Masking process with PID=396, name = "" >> PID substitution detected (current PID is=0, real = 396) Masking process with PID=496, name = "" >> PID substitution detected (current PID is=0, real = 496) Masking process with PID=12, name = "" >> PID substitution detected (current PID is=0, real = 12) Masking process with PID=2288, name = "" >> PID substitution detected (current PID is=0, real = 2288) Masking process with PID=2320, name = "" >> PID substitution detected (current PID is=0, real = 2320) Masking process with PID=2460, name = "" >> PID substitution detected (current PID is=0, real = 2460) Masking process with PID=2676, name = "" >> PID substitution detected (current PID is=0, real = 2676) Masking process with PID=2976, name = "" >> PID substitution detected (current PID is=0, real = 2976) Masking process with PID=3060, name = "" >> PID substitution detected (current PID is=0, real = 3060) Masking process with PID=3412, name = "" >> PID substitution detected (current PID is=0, real = 3412) Masking process with PID=3620, name = "" >> PID substitution detected (current PID is=0, real = 3620) Masking process with PID=3644, name = "" >> PID substitution detected (current PID is=0, real = 3644) Masking process with PID=3848, name = "" >> PID substitution detected (current PID is=0, real = 3848) Masking process with PID=3920, name = "" >> PID substitution detected (current PID is=0, real = 3920) Masking process with PID=1196, name = "" >> PID substitution detected (current PID is=0, real = 1196) Masking process with PID=2776, name = "" >> PID substitution detected (current PID is=0, real = 2776) Masking process with PID=1808, name = "" >> PID substitution detected (current PID is=0, real = 1808) Masking process with PID=3624, name = "" >> PID substitution detected (current PID is=0, real = 3624) Masking process with PID=3932, name = "" >> PID substitution detected (current PID is=0, real = 3932) Masking process with PID=3896, name = "" >> PID substitution detected (current PID is=0, real = 3896) Masking process with PID=1200, name = "" >> PID substitution detected (current PID is=0, real = 1200) Masking process with PID=2620, name = "" >> PID substitution detected (current PID is=0, real = 2620) Masking process with PID=3736, name = "" >> PID substitution detected (current PID is=0, real = 3736) Masking process with PID=4060, name = "" >> PID substitution detected (current PID is=0, real = 4060) Masking process with PID=2860, name = "" >> PID substitution detected (current PID is=0, real = 2860) Masking process with PID=1188, name = "" >> PID substitution detected (current PID is=0, real = 1188) Masking process with PID=3592, name = "" >> PID substitution detected (current PID is=0, real = 3592) Masking process with PID=1844, name = "" >> PID substitution detected (current PID is=0, real = 1844) Masking process with PID=4072, name = "" >> PID substitution detected (current PID is=0, real = 4072) Masking process with PID=3848, name = "" >> PID substitution detected (current PID is=0, real = 3848) Masking process with PID=1960, name = "" >> PID substitution detected (current PID is=0, real = 1960) Masking process with PID=1400, name = "" >> PID substitution detected (current PID is=0, real = 1400) Masking process with PID=2556, name = "" >> PID substitution detected (current PID is=0, real = 2556) Masking process with PID=3876, name = "" >> PID substitution detected (current PID is=0, real = 3876) Masking process with PID=2568, name = "" >> PID substitution detected (current PID is=0, real = 2568) Masking process with PID=1572, name = "" >> PID substitution detected (current PID is=0, real = 1572) Masking process with PID=1400, name = "" >> PID substitution detected (current PID is=0, real = 1400) Masking process with PID=2192, name = "" >> PID substitution detected (current PID is=0, real = 2192) Masking process with PID=1624, name = "" >> PID substitution detected (current PID is=0, real = 1624) Masking process with PID=2736, name = "" >> PID substitution detected (current PID is=0, real = 2736) Masking process with PID=640, name = "" >> PID substitution detected (current PID is=0, real = 640) Masking process with PID=3440, name = "" >> PID substitution detected (current PID is=0, real = 3440) Masking process with PID=3408, name = "" >> PID substitution detected (current PID is=0, real = 3408) Masking process with PID=2224, name = "" >> PID substitution detected (current PID is=0, real = 2224) Masking process with PID=2796, name = "" >> PID substitution detected (current PID is=0, real = 2796) Masking process with PID=3932, name = "" >> PID substitution detected (current PID is=0, real = 3932) Masking process with PID=1984, name = "" >> PID substitution detected (current PID is=0, real = 1984) Masking process with PID=3672, name = "" >> PID substitution detected (current PID is=0, real = 3672) Masking process with PID=2860, name = "" >> PID substitution detected (current PID is=0, real = 2860) Masking process with PID=1008, name = "" >> PID substitution detected (current PID is=0, real = 1008) Masking process with PID=1884, name = "" >> PID substitution detected (current PID is=0, real = 1884) Masking process with PID=396, name = "" >> PID substitution detected (current PID is=0, real = 396) Masking process with PID=3180, name = "" >> PID substitution detected (current PID is=0, real = 3180) Masking process with PID=3500, name = "" >> PID substitution detected (current PID is=0, real = 3500) Masking process with PID=3288, name = "" >> PID substitution detected (current PID is=0, real = 3288) Masking process with PID=3620, name = "" >> PID substitution detected (current PID is=0, real = 3620) Masking process with PID=3280, name = "" >> PID substitution detected (current PID is=0, real = 3280) Masking process with PID=4072, name = "" >> PID substitution detected (current PID is=0, real = 4072) Masking process with PID=1188, name = "" >> PID substitution detected (current PID is=0, real = 1188) Masking process with PID=2384, name = "" >> PID substitution detected (current PID is=0, real = 2384) Masking process with PID=1984, name = "" >> PID substitution detected (current PID is=0, real = 1984) Masking process with PID=2172, name = "" >> PID substitution detected (current PID is=0, real = 2172) Masking process with PID=244, name = "" >> PID substitution detected (current PID is=0, real = 244) Masking process with PID=3292, name = "" >> PID substitution detected (current PID is=0, real = 3292) Masking process with PID=2004, name = "" >> PID substitution detected (current PID is=0, real = 2004) Masking process with PID=1480, name = "" >> PID substitution detected (current PID is=0, real = 1480) Masking process with PID=3460, name = "" >> PID substitution detected (current PID is=0, real = 3460) Masking process with PID=1784, name = "" >> PID substitution detected (current PID is=0, real = 1784) Masking process with PID=2688, name = "" >> PID substitution detected (current PID is=0, real = 2688) Masking process with PID=2516, name = "" >> PID substitution detected (current PID is=0, real = 2516) Masking process with PID=1380, name = "" >> PID substitution detected (current PID is=0, real = 1380) Masking process with PID=2520, name = "" >> PID substitution detected (current PID is=0, real = 2520) Masking process with PID=1784, name = "" >> PID substitution detected (current PID is=0, real = 1784) Masking process with PID=1452, name = "" >> PID substitution detected (current PID is=0, real = 1452) Masking process with PID=2132, name = "" >> PID substitution detected (current PID is=0, real = 2132) Masking process with PID=3764, name = "" >> PID substitution detected (current PID is=0, real = 3764) Masking process with PID=1392, name = "" >> PID substitution detected (current PID is=0, real = 1392) Masking process with PID=3320, name = "" >> PID substitution detected (current PID is=0, real = 3320) Masking process with PID=2868, name = "" >> PID substitution detected (current PID is=0, real = 2868) Masking process with PID=2952, name = "" >> PID substitution detected (current PID is=0, real = 2952) Masking process with PID=3624, name = "" >> PID substitution detected (current PID is=0, real = 3624) Masking process with PID=2548, name = "" >> PID substitution detected (current PID is=0, real = 2548) Masking process with PID=1704, name = "" >> PID substitution detected (current PID is=0, real = 1704) Masking process with PID=2212, name = "" >> PID substitution detected (current PID is=0, real = 2212) Masking process with PID=2008, name = "" >> PID substitution detected (current PID is=0, real = 2008) Masking process with PID=2224, name = "" >> PID substitution detected (current PID is=0, real = 2224) Masking process with PID=3136, name = "" >> PID substitution detected (current PID is=0, real = 3136) Masking process with PID=3912, name = "" >> PID substitution detected (current PID is=0, real = 3912) Masking process with PID=2284, name = "" >> PID substitution detected (current PID is=0, real = 2284) Masking process with PID=3280, name = "" >> PID substitution detected (current PID is=0, real = 3280) Masking process with PID=3800, name = "" >> PID substitution detected (current PID is=0, real = 3800) Masking process with PID=3548, name = "" >> PID substitution detected (current PID is=0, real = 3548) Searching for masking processes and drivers - complete 1.5 Checking IRP handlers Driver loaded successfully Checking - complete Executing standard script: 1. Detect and block UserMode and KernelMode hooks 1.1 Searching for user-mode API hooks Analysis: kernel32.dll, export table found in section .text Analysis: ntdll.dll, export table found in section .text Analysis: user32.dll, export table found in section .text Analysis: advapi32.dll, export table found in section .text Analysis: ws2_32.dll, export table found in section .text Analysis: wininet.dll, export table found in section .text Analysis: rasapi32.dll, export table found in section .text Analysis: urlmon.dll, export table found in section .text Analysis: netapi32.dll, export table found in section .text 1.2 Searching for kernel-mode API hooks Driver loaded successfully SDT found (RVA=137B00) Kernel ntkrnlpa.exe found in memory at address 82417000 SDT = 8254EB00 KiST = 824CF9E0 (391) Functions checked: 391, intercepted: 0, restored: 0 1.3 Checking IDT and SYSENTER Analyzing CPU 1 Analyzing CPU 2 Analyzing CPU 3 CmpCallCallBacks = 00000000 Checking IDT and SYSENTER - complete 1.4 Searching for masking processes and drivers Masking process with PID=688, name = "" >> PID substitution detected (current PID is=0, real = 688) Masking process with PID=1144, name = "" >> PID substitution detected (current PID is=0, real = 1144) Masking process with PID=1380, name = "" >> PID substitution detected (current PID is=0, real = 1380) Masking process with PID=396, name = "" >> PID substitution detected (current PID is=0, real = 396) Masking process with PID=496, name = "" >> PID substitution detected (current PID is=0, real = 496) Masking process with PID=12, name = "" >> PID substitution detected (current PID is=0, real = 12) Masking process with PID=2288, name = "" >> PID substitution detected (current PID is=0, real = 2288) Masking process with PID=2320, name = "" >> PID substitution detected (current PID is=0, real = 2320) Masking process with PID=2460, name = "" >> PID substitution detected (current PID is=0, real = 2460) Masking process with PID=2676, name = "" >> PID substitution detected (current PID is=0, real = 2676) Masking process with PID=2976, name = "" >> PID substitution detected (current PID is=0, real = 2976) Masking process with PID=3060, name = "" >> PID substitution detected (current PID is=0, real = 3060) Masking process with PID=3412, name = "" >> PID substitution detected (current PID is=0, real = 3412) Masking process with PID=3620, name = "" >> PID substitution detected (current PID is=0, real = 3620) Masking process with PID=3644, name = "" >> PID substitution detected (current PID is=0, real = 3644) Masking process with PID=3848, name = "" >> PID substitution detected (current PID is=0, real = 3848) Masking process with PID=3920, name = "" >> PID substitution detected (current PID is=0, real = 3920) Masking process with PID=1196, name = "" >> PID substitution detected (current PID is=0, real = 1196) Masking process with PID=2776, name = "" >> PID substitution detected (current PID is=0, real = 2776) Masking process with PID=1808, name = "" >> PID substitution detected (current PID is=0, real = 1808) Masking process with PID=3624, name = "" >> PID substitution detected (current PID is=0, real = 3624) Masking process with PID=3932, name = "" >> PID substitution detected (current PID is=0, real = 3932) Masking process with PID=3896, name = "" >> PID substitution detected (current PID is=0, real = 3896) Masking process with PID=1200, name = "" >> PID substitution detected (current PID is=0, real = 1200) Masking process with PID=2620, name = "" >> PID substitution detected (current PID is=0, real = 2620) Masking process with PID=3736, name = "" >> PID substitution detected (current PID is=0, real = 3736) Masking process with PID=4060, name = "" >> PID substitution detected (current PID is=0, real = 4060) Masking process with PID=2860, name = "" >> PID substitution detected (current PID is=0, real = 2860) Masking process with PID=1188, name = "" >> PID substitution detected (current PID is=0, real = 1188) Masking process with PID=3592, name = "" >> PID substitution detected (current PID is=0, real = 3592) Masking process with PID=1844, name = "" >> PID substitution detected (current PID is=0, real = 1844) Masking process with PID=4072, name = "" >> PID substitution detected (current PID is=0, real = 4072) Masking process with PID=3848, name = "" >> PID substitution detected (current PID is=0, real = 3848) Masking process with PID=1960, name = "" >> PID substitution detected (current PID is=0, real = 1960) Masking process with PID=1400, name = "" >> PID substitution detected (current PID is=0, real = 1400) Masking process with PID=2556, name = "" >> PID substitution detected (current PID is=0, real = 2556) Masking process with PID=3876, name = "" >> PID substitution detected (current PID is=0, real = 3876) Masking process with PID=2568, name = "" >> PID substitution detected (current PID is=0, real = 2568) Masking process with PID=1572, name = "" >> PID substitution detected (current PID is=0, real = 1572) Masking process with PID=1400, name = "" >> PID substitution detected (current PID is=0, real = 1400) Masking process with PID=2192, name = "" >> PID substitution detected (current PID is=0, real = 2192) Masking process with PID=1624, name = "" >> PID substitution detected (current PID is=0, real = 1624) Masking process with PID=2736, name = "" >> PID substitution detected (current PID is=0, real = 2736) Masking process with PID=640, name = "" >> PID substitution detected (current PID is=0, real = 640) Masking process with PID=3440, name = "" >> PID substitution detected (current PID is=0, real = 3440) Masking process with PID=3408, name = "" >> PID substitution detected (current PID is=0, real = 3408) Masking process with PID=2224, name = "" >> PID substitution detected (current PID is=0, real = 2224) Masking process with PID=2796, name = "" >> PID substitution detected (current PID is=0, real = 2796) Masking process with PID=3932, name = "" >> PID substitution detected (current PID is=0, real = 3932) Masking process with PID=1984, name = "" >> PID substitution detected (current PID is=0, real = 1984) Masking process with PID=3672, name = "" >> PID substitution detected (current PID is=0, real = 3672) Masking process with PID=2860, name = "" >> PID substitution detected (current PID is=0, real = 2860) Masking process with PID=1008, name = "" >> PID substitution detected (current PID is=0, real = 1008) Masking process with PID=1884, name = "" >> PID substitution detected (current PID is=0, real = 1884) Masking process with PID=396, name = "" >> PID substitution detected (current PID is=0, real = 396) Masking process with PID=3180, name = "" >> PID substitution detected (current PID is=0, real = 3180) Masking process with PID=3500, name = "" >> PID substitution detected (current PID is=0, real = 3500) Masking process with PID=3288, name = "" >> PID substitution detected (current PID is=0, real = 3288) Masking process with PID=3620, name = "" >> PID substitution detected (current PID is=0, real = 3620) Masking process with PID=3280, name = "" >> PID substitution detected (current PID is=0, real = 3280) Masking process with PID=4072, name = "" >> PID substitution detected (current PID is=0, real = 4072) Masking process with PID=1188, name = "" >> PID substitution detected (current PID is=0, real = 1188) Masking process with PID=2384, name = "" >> PID substitution detected (current PID is=0, real = 2384) Masking process with PID=1984, name = "" >> PID substitution detected (current PID is=0, real = 1984) Masking process with PID=2172, name = "" >> PID substitution detected (current PID is=0, real = 2172) Masking process with PID=244, name = "" >> PID substitution detected (current PID is=0, real = 244) Masking process with PID=3292, name = "" >> PID substitution detected (current PID is=0, real = 3292) Masking process with PID=2004, name = "" >> PID substitution detected (current PID is=0, real = 2004) Masking process with PID=1480, name = "" >> PID substitution detected (current PID is=0, real = 1480) Masking process with PID=3460, name = "" >> PID substitution detected (current PID is=0, real = 3460) Masking process with PID=1784, name = "" >> PID substitution detected (current PID is=0, real = 1784) Masking process with PID=2688, name = "" >> PID substitution detected (current PID is=0, real = 2688) Masking process with PID=2516, name = "" >> PID substitution detected (current PID is=0, real = 2516) Masking process with PID=1380, name = "" >> PID substitution detected (current PID is=0, real = 1380) Masking process with PID=2520, name = "" >> PID substitution detected (current PID is=0, real = 2520) Masking process with PID=1784, name = "" >> PID substitution detected (current PID is=0, real = 1784) Masking process with PID=1452, name = "" >> PID substitution detected (current PID is=0, real = 1452) Masking process with PID=2132, name = "" >> PID substitution detected (current PID is=0, real = 2132) Masking process with PID=3764, name = "" >> PID substitution detected (current PID is=0, real = 3764) Masking process with PID=1392, name = "" >> PID substitution detected (current PID is=0, real = 1392) Masking process with PID=3320, name = "" >> PID substitution detected (current PID is=0, real = 3320) Masking process with PID=2868, name = "" >> PID substitution detected (current PID is=0, real = 2868) Masking process with PID=2952, name = "" >> PID substitution detected (current PID is=0, real = 2952) Masking process with PID=3624, name = "" >> PID substitution detected (current PID is=0, real = 3624) Masking process with PID=2548, name = "" >> PID substitution detected (current PID is=0, real = 2548) Masking process with PID=1704, name = "" >> PID substitution detected (current PID is=0, real = 1704) Masking process with PID=2212, name = "" >> PID substitution detected (current PID is=0, real = 2212) Masking process with PID=2008, name = "" >> PID substitution detected (current PID is=0, real = 2008) Masking process with PID=2224, name = "" >> PID substitution detected (current PID is=0, real = 2224) Masking process with PID=3136, name = "" >> PID substitution detected (current PID is=0, real = 3136) Masking process with PID=3912, name = "" >> PID substitution detected (current PID is=0, real = 3912) Masking process with PID=2284, name = "" >> PID substitution detected (current PID is=0, real = 2284) Masking process with PID=3280, name = "" >> PID substitution detected (current PID is=0, real = 3280) Masking process with PID=3800, name = "" >> PID substitution detected (current PID is=0, real = 3800) Masking process with PID=3548, name = "" >> PID substitution detected (current PID is=0, real = 3548) Searching for masking processes and drivers - complete 1.5 Checking IRP handlers Driver loaded successfully Checking - completeAdd commands to script:
System Analysis - complete
Script commands