Results of system analysis

AVZ 4.34 http://z-oleg.com/secur/avz/

Process List

File namePIDDescriptionCopyrightMD5Information
688  ???,error getting file info
Command line:
1144  ???,error getting file info
Command line:
1380  ???,error getting file info
Command line:
396  ???,error getting file info
Command line:
496  ???,error getting file info
Command line:
12  ???,error getting file info
Command line:
2288  ???,error getting file info
Command line:
2320  ???,error getting file info
Command line:
2460  ???,error getting file info
Command line:
2676  ???,error getting file info
Command line:
2976  ???,error getting file info
Command line:
3060  ???,error getting file info
Command line:
3412  ???,error getting file info
Command line:
3620  ???,error getting file info
Command line:
3644  ???,error getting file info
Command line:
3848  ???,error getting file info
Command line:
3920  ???,error getting file info
Command line:
1196  ???,error getting file info
Command line:
2776  ???,error getting file info
Command line:
1808  ???,error getting file info
Command line:
3624  ???,error getting file info
Command line:
3932  ???,error getting file info
Command line:
3896  ???,error getting file info
Command line:
1200  ???,error getting file info
Command line:
2620  ???,error getting file info
Command line:
3736  ???,error getting file info
Command line:
4060  ???,error getting file info
Command line:
2860  ???,error getting file info
Command line:
1188  ???,error getting file info
Command line:
3592  ???,error getting file info
Command line:
1844  ???,error getting file info
Command line:
4072  ???,error getting file info
Command line:
1960  ???,error getting file info
Command line:
1400  ???,error getting file info
Command line:
2556  ???,error getting file info
Command line:
3876  ???,error getting file info
Command line:
2568  ???,error getting file info
Command line:
1572  ???,error getting file info
Command line:
2192  ???,error getting file info
Command line:
1624  ???,error getting file info
Command line:
2736  ???,error getting file info
Command line:
640  ???,error getting file info
Command line:
3440  ???,error getting file info
Command line:
3408  ???,error getting file info
Command line:
2224  ???,error getting file info
Command line:
2796  ???,error getting file info
Command line:
1984  ???,error getting file info
Command line:
3672  ???,error getting file info
Command line:
1008  ???,error getting file info
Command line:
1884  ???,error getting file info
Command line:
3500  ???,error getting file info
Command line:
3288  ???,error getting file info
Command line:
3280  ???,error getting file info
Command line:
2384  ???,error getting file info
Command line:
2172  ???,error getting file info
Command line:
244  ???,error getting file info
Command line:
3292  ???,error getting file info
Command line:
1480  ???,error getting file info
Command line:
3460  ???,error getting file info
Command line:
1784  ???,error getting file info
Command line:
2688  ???,error getting file info
Command line:
2516  ???,error getting file info
Command line:
2520  ???,error getting file info
Command line:
1452  ???,error getting file info
Command line:
2132  ???,error getting file info
Command line:
3764  ???,error getting file info
Command line:
1392  ???,error getting file info
Command line:
3320  ???,error getting file info
Command line:
2868  ???,error getting file info
Command line:
2952  ???,error getting file info
Command line:
1704  ???,error getting file info
Command line:
2212  ???,error getting file info
Command line:
2008  ???,error getting file info
Command line:
3136  ???,error getting file info
Command line:
3912  ???,error getting file info
Command line:
2284  ???,error getting file info
Command line:
3800  ???,error getting file info
Command line:
3548  ???,error getting file info
Command line:
2552  ???,error getting file info
Command line:
892  ???,error getting file info
Command line:
2980  ???,error getting file info
Command line:
2996  ???,error getting file info
Command line:
1832  ???,error getting file info
Command line:
1988  ???,error getting file info
Command line:
3332  ???,error getting file info
Command line:
628  ???,error getting file info
Command line:
3608  ???,error getting file info
Command line:
2220  ???,error getting file info
Command line:
1824  ???,error getting file info
Command line:
3780  ???,error getting file info
Command line:
2380  ???,error getting file info
Command line:
3652  ???,error getting file info
Command line:
3564  ???,error getting file info
Command line:
2632  ???,error getting file info
Command line:
3116  ???,error getting file info
Command line:
944  ???,error getting file info
Command line:
2528  ???,error getting file info
Command line:
1880  ???,error getting file info
Command line:
2264  ???,error getting file info
Command line:
3512  ???,error getting file info
Command line:
2244  ???,error getting file info
Command line:
196  ???,error getting file info
Command line:
2948  ???,error getting file info
Command line:
1232  ???,error getting file info
Command line:
436  ???,error getting file info
Command line:
812  ???,error getting file info
Command line:
2680  ???,error getting file info
Command line:
3788  ???,error getting file info
Command line:
3540  ???,error getting file info
Command line:
3892  ???,error getting file info
Command line:
2652  ???,error getting file info
Command line:
3560  ???,error getting file info
Command line:
3200  ???,error getting file info
Command line:
1552  ???,error getting file info
Command line:
3196  ???,error getting file info
Command line:
3600  ???,error getting file info
Command line:
3872  ???,error getting file info
Command line:
3924  ???,error getting file info
Command line:
2388  ???,error getting file info
Command line:
1464  ???,error getting file info
Command line:
3216  ???,error getting file info
Command line:
2464  ???,error getting file info
Command line:
3528  ???,error getting file info
Command line:
2248  ???,error getting file info
Command line:
3804  ???,error getting file info
Command line:
1536  ???,error getting file info
Command line:
1780  ???,error getting file info
Command line:
1796  ???,error getting file info
Command line:
2792  ???,error getting file info
Command line:
2280  ???,error getting file info
Command line:
2544  ???,error getting file info
Command line:
2512  ???,error getting file info
Command line:
884  ???,error getting file info
Command line:
c:\avz\avz.exe
Script: Quarantine, Delete, Delete via BC, Terminate
2476???????????? ??????? AVZ???????????? ??????? AVZ??745.00 kb, rsAh,
created: 1-8-2010 1:53:16,
modified: 8-7-2010 10:19:08
Command line:
"C:\avz\avz.exe"
c:\avz\avz.exe
Script: Quarantine, Delete, Delete via BC, Terminate
3416???????????? ??????? AVZ???????????? ??????? AVZ??745.00 kb, rsAh,
created: 1-8-2010 1:53:16,
modified: 8-7-2010 10:19:08
Command line:
"C:\avz\avz.exe"
c:\program files\ati technologies\ati.ace\core-static\ccc.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1748Catalyst Control Centre: Host application2002-2009??64.00 kb, rsAh,
created: 22-4-2009 17:37:16,
modified: 22-4-2009 17:37:16
Command line:
"C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe" 0
c:\users\administrator\appdata\local\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
2548Google ChromeCopyright (C) 2006-2009 Google Inc. All Rights Reserved.??923.55 kb, rsAh,
created: 19-10-2009 10:45:48,
modified: 23-7-2010 0:02:16
Command line:
"C:\Users\Administrator\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=nl --force-fieldtest=CacheSize/CacheSizeGroup_0/DnsImpact/_default_enabled_prefetch/GlobalSdch/_global_enable_sdch/IPv6_Probe/_IPv6_probe_done/ --channel=3180.048EB900.1309399725
c:\users\administrator\appdata\local\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
3180Google ChromeCopyright (C) 2006-2009 Google Inc. All Rights Reserved.??923.55 kb, rsAh,
created: 19-10-2009 10:45:48,
modified: 23-7-2010 0:02:16
Command line:
"C:\Users\Administrator\AppData\Local\Google\Chrome\Application\chrome.exe"
c:\users\administrator\appdata\local\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
2020Google ChromeCopyright (C) 2006-2009 Google Inc. All Rights Reserved.??923.55 kb, rsAh,
created: 19-10-2009 10:45:48,
modified: 23-7-2010 0:02:16
Command line:
"C:\Users\Administrator\AppData\Local\Google\Chrome\Application\chrome.exe" --type=extension --lang=nl --force-fieldtest=DnsImpact/_default_enabled_prefetch/GlobalSdch/_global_enable_sdch/IPv6_Probe/_IPv6_probe_done/ --channel=3180.0233F780.1812484362 --ignored=" --type=renderer "
c:\users\administrator\appdata\local\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1920Google ChromeCopyright (C) 2006-2009 Google Inc. All Rights Reserved.??923.55 kb, rsAh,
created: 19-10-2009 10:45:48,
modified: 23-7-2010 0:02:16
Command line:
"C:\Users\Administrator\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=nl --force-fieldtest=CacheSize/CacheSizeGroup_0/DnsImpact/_default_enabled_prefetch/GlobalSdch/_global_enable_sdch/IPv6_Probe/_IPv6_probe_done/ --channel=3180.071C6900.1171416103
c:\users\administrator\appdata\local\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
3816Google ChromeCopyright (C) 2006-2009 Google Inc. All Rights Reserved.??923.55 kb, rsAh,
created: 19-10-2009 10:45:48,
modified: 23-7-2010 0:02:16
Command line:
"C:\Users\Administrator\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=nl --force-fieldtest=CacheSize/CacheSizeGroup_0/DnsImpact/_default_enabled_prefetch/GlobalSdch/_global_enable_sdch/IPv6_Probe/_IPv6_probe_done/ --channel=3180.07200600.1550221657
c:\program files\gnu\gnupg\bin\dbus-daemon.exe
Script: Quarantine, Delete, Delete via BC, Terminate
2004  ??321.72 kb, rsAh,
created: 12-6-2009 8:05:14,
modified: 12-6-2009 8:05:14
Command line:
"C:\Program Files\GNU\GnuPG\bin\dbus-daemon.exe" --session
c:\windows\system32\dwm.exe
Script: Quarantine, Delete, Delete via BC, Terminate
3420Desktop Window Manager© Microsoft Corporation. All rights reserved.??80.00 kb, rsAh,
created: 4-4-2008 11:45:22,
modified: 4-4-2008 11:45:22
Command line:
"C:\Windows\system32\Dwm.exe"
c:\windows\ehome\ehtray.exe
Script: Quarantine, Delete, Delete via BC, Terminate
3840Media Center Tray Applet© Microsoft Corporation. All rights reserved.??123.00 kb, rsAh,
created: 4-4-2008 11:46:41,
modified: 4-4-2008 11:46:41
Command line:
"C:\Windows\ehome\ehtray.exe"
c:\windows\explorer.exe
Script: Quarantine, Delete, Delete via BC, Terminate
3452Windows Explorer© Microsoft Corporation. All rights reserved.??2858.50 kb, rsAh,
created: 16-1-2010 13:45:36,
modified: 29-10-2008 8:29:41
Command line:
C:\Windows\Explorer.EXE
c:\program files\java\jre6\bin\jucheck.exe
Script: Quarantine, Delete, Delete via BC, Terminate
2836Java(TM) Update CheckerCopyright © 2004??377.80 kb, rsAh,
created: 26-10-2009 0:19:47,
modified: 11-10-2009 5:17:45
Command line:
"C:\Program Files\Java\jre6\bin\jucheck.exe" -auto
c:\program files\gnu\gnupg\kleopatra.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1412  ??7.00 kb, rsAh,
created: 29-5-2010 12:26:46,
modified: 29-5-2010 12:26:46
Command line:
"C:\Program Files\GNU\GnuPG\kleopatra.exe" --daemon
c:\program files\gnu\gnupg\bin\kleopatra.exe
Script: Quarantine, Delete, Delete via BC, Terminate
3828  ??5884.07 kb, rsAh,
created: 3-3-2010 23:18:48,
modified: 3-3-2010 23:18:48
Command line:
"C:\\Program Files\\GNU\\GnuPG\\kleopatra.exe" "--daemon"
c:\windows\system32\mobsync.exe
Script: Quarantine, Delete, Delete via BC, Terminate
2144Microsoft Sync Center© Microsoft Corporation. All rights reserved.??93.50 kb, rsAh,
created: 4-4-2008 11:41:47,
modified: 4-4-2008 11:41:47
Command line:
C:\Windows\System32\mobsync.exe -Embedding
c:\program files\ati technologies\ati.ace\core-static\mom.exe
Script: Quarantine, Delete, Delete via BC, Terminate
3952Catalyst Control Center: Monitoring program2002-2009??64.00 kb, rsAh,
created: 22-4-2009 17:38:50,
modified: 22-4-2009 17:38:50
Command line:
"C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM"
c:\program files\microsoft security essentials\msmpeng.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1132AntiMalware Service Executable© Microsoft Corporation. All rights reserved.??17.48 kb, rsAh,
created: 25-3-2010 21:40:44,
modified: 25-3-2010 21:40:44
Command line:
"C:\Program Files\Microsoft Security Essentials\MsMpEng.exe"
c:\program files\microsoft security essentials\msseces.exe
Script: Quarantine, Delete, Delete via BC, Terminate
3632Microsoft Security Essentials User Interface© 2009 Microsoft Corporation. All rights reserved.??1067.59 kb, rsAh,
created: 1-6-2010 14:53:46,
modified: 1-6-2010 14:53:46
Command line:
"C:\Program Files\Microsoft Security Essentials\msseces.exe" -hide -runkey
c:\windows\rthdvcpl.exe
Script: Quarantine, Delete, Delete via BC, Terminate
3656HD Audio Control Panel2006 (c) Realtek Semiconductor. All rights reserved.??4608.00 kb, rsAh,
created: 3-8-2008 20:39:12,
modified: 17-12-2007 5:02:28
Command line:
"C:\Windows\RtHDVCpl.exe"
c:\windows\system32\taskeng.exe
Script: Quarantine, Delete, Delete via BC, Terminate
1616Task Scheduler Engine© Microsoft Corporation. All rights reserved.??165.50 kb, rsAh,
created: 4-4-2008 11:45:22,
modified: 4-4-2008 11:45:22
Command line:
taskeng.exe {1DBED943-C166-4ECD-A977-28FE26A26F6E}S-1-5-21-1122999869-1285303633-2407138414-500:HEAVENLY-ONE\Administrator:Interactive:[1]
c:\program files\windows media player\wmpnscfg.exe
Script: Quarantine, Delete, Delete via BC, Terminate
4048Windows Media Player Network Sharing Service Configuration Application© Microsoft Corporation. All rights reserved.??197.50 kb, rsAh,
created: 4-4-2008 11:47:51,
modified: 4-4-2008 11:47:51
Command line:
"C:\Program Files\Windows Media Player\wmpnscfg.exe"
Detected:198, recognized as trusted 57
Module nameHandleDescriptionCopyrightMD5Used by processes
C:\Program Files\Acronis\TrueImageHome\tishell.dll
Script: Quarantine, Delete, Delete via BC
187564032Acronis True Image Shell ExtensionsCopyright (C) Acronis, 2000-2008.--3452
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiamenu.dll
Script: Quarantine, Delete, Delete via BC
64552960AMD Desktop Control Panel© 2007-2008 Advanced Micro Devices, Inc.--3452
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceCV.Graphics.Dashboard.dll
Script: Quarantine, Delete, Delete via BC
151977984Dashboard Graphics Caste CV Aspect2002-2010--1748
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceCV.Graphics.Wizard.dll
Script: Quarantine, Delete, Delete via BC
136904704Wizard DeviceCV Aspect2002-2010--1748
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceTV.Graphics.Dashboard.dll
Script: Quarantine, Delete, Delete via BC
152633344Dashboard Graphics Caste TV Aspect2002-2010--1748
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceTV.Graphics.Wizard.dll
Script: Quarantine, Delete, Delete via BC
1690107904Wizard DeviceTV Aspect2002-2010--1748
C:\Program Files\GNU\GnuPG\iconv.dll
Script: Quarantine, Delete, Delete via BC
2949120LGPLed libiconv for Windows NT/2000/XP and Windows 95/98/MECopyright (C) 1999-2003--3828
C:\Program Files\GNU\GnuPG\INTL.DLL
Script: Quarantine, Delete, Delete via BC
268435456LGPLed libintl for Windows NT/2000/XP and Windows 95/98/MECopyright (C) 1995-2003--3828
C:\Program Files\GNU\GnuPG\libdbus-1.dll
Script: Quarantine, Delete, Delete via BC
1742471168  --2004, 3828
C:\Program Files\GNU\GnuPG\LIBEXPAT.dll
Script: Quarantine, Delete, Delete via BC
268435456  --2004
C:\Program Files\GNU\GnuPG\libgpg-error-0.dll
Script: Quarantine, Delete, Delete via BC
3866624  --3828
C:\Program Files\GNU\GnuPG\libgpgme++.dll
Script: Quarantine, Delete, Delete via BC
1889009664  --3828
C:\Program Files\GNU\GnuPG\libgpgme-11.dll
Script: Quarantine, Delete, Delete via BC
8257536  --3828
C:\Program Files\GNU\GnuPG\libkcmutils.dll
Script: Quarantine, Delete, Delete via BC
1777860608  --3828
C:\Program Files\GNU\GnuPG\libkdecore.dll
Script: Quarantine, Delete, Delete via BC
1670119424  --3828
C:\Program Files\GNU\GnuPG\libkdeui.dll
Script: Quarantine, Delete, Delete via BC
1852047360  --3828
C:\Program Files\GNU\GnuPG\libkdewin32.dll
Script: Quarantine, Delete, Delete via BC
1686110208  --3828
C:\Program Files\GNU\GnuPG\libkleo.dll
Script: Quarantine, Delete, Delete via BC
1757675520  --3828
C:\Program Files\GNU\GnuPG\libkmime.dll
Script: Quarantine, Delete, Delete via BC
8519680  --3828
C:\Program Files\GNU\GnuPG\libqgpgme.dll
Script: Quarantine, Delete, Delete via BC
1747976192  --3828
C:\Program Files\GNU\GnuPG\mingwm10.dll
Script: Quarantine, Delete, Delete via BC
1874591744  --3828
C:\Program Files\GNU\GnuPG\Qt3Support4.dll
Script: Quarantine, Delete, Delete via BC
1858338816  --3828
C:\Program Files\GNU\GnuPG\QtCore4.dll
Script: Quarantine, Delete, Delete via BC
1780219904  --3828
C:\Program Files\GNU\GnuPG\QtDBus4.dll
Script: Quarantine, Delete, Delete via BC
1675100160  --3828
C:\Program Files\GNU\GnuPG\QtGui4.dll
Script: Quarantine, Delete, Delete via BC
1695547392  --3828
C:\Program Files\GNU\GnuPG\QtNetwork4.dll
Script: Quarantine, Delete, Delete via BC
1877999616  --3828
C:\Program Files\GNU\GnuPG\QtSql4.dll
Script: Quarantine, Delete, Delete via BC
1643118592  --3828
C:\Program Files\GNU\GnuPG\QtSvg4.dll
Script: Quarantine, Delete, Delete via BC
1895825408  --3828
C:\Program Files\GNU\GnuPG\QtXml4.dll
Script: Quarantine, Delete, Delete via BC
2359296  --3828
C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{0FD3D5A9-449A-4AA7-B4AC-8E4D7263A0B5}\mpengine.dll
Script: Quarantine, Delete, Delete via BC
1933377536Microsoft Malware Protection Engine© Microsoft Corporation. All rights reserved.--1132
C:\PROGRA~1\MID86E~1\shellext.dll
Script: Quarantine, Delete, Delete via BC
1853816832Microsoft Security Essentials Shell Extension© 2009 Microsoft Corporation. All rights reserved.--3452
C:\PROGRA~1\VSO\IMAGER~1\RSZShell.dll
Script: Quarantine, Delete, Delete via BC
170524672ImageResizer Shell ExtensionCopyright © 2006-2008 VSO Software SARL--3452
C:\Users\Administrator\AppData\Local\Google\Chrome\Application\5.0.375.125\avcodec-52.dll
Script: Quarantine, Delete, Delete via BC
1658912768  --2548, 2020, 1920, 3816
C:\Users\Administrator\AppData\Local\Google\Chrome\Application\5.0.375.125\avformat-52.dll
Script: Quarantine, Delete, Delete via BC
1905131520  --2548, 2020, 1920, 3816
C:\Users\Administrator\AppData\Local\Google\Chrome\Application\5.0.375.125\avutil-50.dll
Script: Quarantine, Delete, Delete via BC
1946615808  --2548, 2020, 1920, 3816
C:\Users\Administrator\AppData\Local\Google\Chrome\Application\5.0.375.125\chrome.dll
Script: Quarantine, Delete, Delete via BC
1636827136Google ChromeCopyright (C) 2006-2009 Google Inc. All Rights Reserved.--2548, 3180, 2020, 1920, 3816
C:\Users\Administrator\AppData\Local\Google\Chrome\Application\5.0.375.125\gears.dll
Script: Quarantine, Delete, Delete via BC
1633550336These are the Gears that power the tubes! :-)Copyright 2006-2008 Google Inc. All Rights Reserved.--3180
C:\Users\Administrator\AppData\Local\Google\Chrome\Application\5.0.375.125\icudt42.dll
Script: Quarantine, Delete, Delete via BC
1663238144ICU Data DLL Copyright (C) 2009, International Business Machines Corporation and others. All Rights Reserved. --2548, 3180, 2020, 1920, 3816
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\e14b5b54564ad576dd249e7e8762366d\System.Configuration.ni.dll
Script: Quarantine, Delete, Delete via BC
1772158976System.Configuration.dll© Microsoft Corporation. All rights reserved.--1748
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\00478454bac66cb3abbaeaf90b03c53d\System.Runtime.Remoting.ni.dll
Script: Quarantine, Delete, Delete via BC
1854341120Microsoft .NET Runtime Object Remoting© Microsoft Corporation. All rights reserved.--1748, 3952
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\792dcc29f3d031147565b1eb60831845\System.Web.ni.dll
Script: Quarantine, Delete, Delete via BC
1692008448System.Web.dll© Microsoft Corporation. All rights reserved.--1748, 3952
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\0bb2a8e2374c59943da54078b609e38b\System.Windows.Forms.ni.dll
Script: Quarantine, Delete, Delete via BC
1703870464.NET Framework© Microsoft Corporation. All rights reserved.--1748, 3952
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\0279340aa3f1bcbf2d8ee1b0cd438f86\System.Xml.ni.dll
Script: Quarantine, Delete, Delete via BC
1718353920.NET Framework© Microsoft Corporation. All rights reserved.--1748
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\5177b93dac897c12b12167fa786bbdd0\System.ni.dll
Script: Quarantine, Delete, Delete via BC
1749876736.NET Framework© Microsoft Corporation. All rights reserved.--1748, 3952
C:\Windows\system32\authui.dll
Script: Quarantine, Delete, Delete via BC
1955201024Windows Authentication UI© Microsoft Corporation. All rights reserved.--3452
C:\Windows\System32\Branding\folderbg\VistaFolderBackground.dll
Script: Quarantine, Delete, Delete via BC
39976960COM Explorer Injector and HOOK DLL(c) Andreas Verhoeven. All rights reserved.--2476, 3416, 1748, 3180, 3420, 3840, 3452, 2836, 3828, 2144, 3952, 3632, 3656, 1616, 4048
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
1876623360Shell Browser UI Library© Microsoft Corporation. All rights reserved.--3416, 3452
Modules found:631, recognized as trusted 584

Kernel Space Modules Viewer

ModuleBase addressSize in memoryDescriptionManufacturer
C:\Windows\System32\Drivers\dump_amdsata.sys
Script: Quarantine, Delete, Delete via BC
93C80000012000 (73728)
C:\Windows\System32\Drivers\dump_diskdump.sys
Script: Quarantine, Delete, Delete via BC
93C7600000A000 (40960)
C:\Windows\System32\Drivers\dump_dumpfve.sys
Script: Quarantine, Delete, Delete via BC
93C92000011000 (69632)
C:\Windows\system32\DRIVERS\tdrpm147.sys
Script: Quarantine, Delete, Delete via BC
888020000EC000 (966656)Acronis Try&Decide Volume Filter DriverCopyright (c) 2008 Acronis
C:\Windows\System32\Drivers\vnccom.SYS
Script: Quarantine, Delete, Delete via BC
A3EFE000002000 (8192)VNC CommunicationRDV Soft. All rights reserved.
Modules found - 175, recognized as trusted - 170

Services

ServiceDescriptionStatusFileGroupDependencies
AcronisOSSReinstallSvc
Service: Stop, Delete, Disable, Delete via BC
Acronis OS Selector Reinstall ServiceNot startedC:\Program Files\Common Files\Acronis\Acronis Disk Director\oss_reinstall_svc.exe
Script: Quarantine, Delete, Delete via BC
  
AcrSch2Svc
Service: Stop, Delete, Disable, Delete via BC
Acronis Scheduler2 ServiceNot startedC:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
Script: Quarantine, Delete, Delete via BC
 RpcSs
AODService
Service: Stop, Delete, Disable, Delete via BC
AODServiceNot startedC:\Program Files\AMD\OverDrive\AODAssist
Script: Quarantine, Delete, Delete via BC
  
FLEXnet Licensing Service
Service: Stop, Delete, Disable, Delete via BC
FLEXnet Licensing ServiceNot startedC:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
Script: Quarantine, Delete, Delete via BC
  
PD91Engine
Service: Stop, Delete, Disable, Delete via BC
PD91EngineNot startedC:\Program Files\Raxco\PerfectDisk2008\PD91Engine.exe
Script: Quarantine, Delete, Delete via BC
  
Roxio UPnP Renderer 9
Service: Stop, Delete, Disable, Delete via BC
Roxio UPnP Renderer 9Not startedC:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
Script: Quarantine, Delete, Delete via BC
  
Roxio Upnp Server 9
Service: Stop, Delete, Disable, Delete via BC
Roxio Upnp Server 9Not startedC:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
Script: Quarantine, Delete, Delete via BC
  
RoxLiveShare9
Service: Stop, Delete, Disable, Delete via BC
LiveShare P2P Server 9Not startedC:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
Script: Quarantine, Delete, Delete via BC
 RPCSS
RoxMediaDB9
Service: Stop, Delete, Disable, Delete via BC
RoxMediaDB9Not startedC:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
Script: Quarantine, Delete, Delete via BC
  
RoxWatch9
Service: Stop, Delete, Disable, Delete via BC
Roxio Hard Drive Watcher 9Not startedC:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
Script: Quarantine, Delete, Delete via BC
  
SandraAgentSrv
Service: Stop, Delete, Disable, Delete via BC
SiSoftware Deployment Agent ServiceNot startedC:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP2c\RpcAgentSrv.exe
Script: Quarantine, Delete, Delete via BC
 RPCSS
SBSDWSCService
Service: Stop, Delete, Disable, Delete via BC
SBSD Security Center ServiceNot startedC:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
Script: Quarantine, Delete, Delete via BC
 wscsvc
Detected - 162, recognized as trusted - 150

Drivers

ServiceDescriptionStatusFileGroupDependencies
tdrpman147
Driver: Unload, Delete, Disable, Delete via BC
Acronis Try&Decide and Restore Points filter (build 147)RunningC:\Windows\system32\DRIVERS\tdrpm147.sys
Script: Quarantine, Delete, Delete via BC
  
vnccom
Driver: Unload, Delete, Disable, Delete via BC
vnccomRunningC:\Windows\system32\Drivers\vnccom.SYS
Script: Quarantine, Delete, Delete via BC
 vncdrv
Detected - 259, recognized as trusted - 257

Autoruns

File nameStatusStartup methodDescription
C:\PROGRA~1\VSO\IMAGER~1\RSZShell.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {2BB59FC0-31E8-42DA-9D3C-E9A52953853B}
Delete
C:\Program Files\AMD\OverDrive\AMD OverDrive.exe
Script: Quarantine, Delete, Delete via BC
ActiveShortcut in Startup folderC:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\, C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\AMD OverDrive.lnk,
C:\Program Files\Acronis\TrueImageHome\tishell.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {C539A15A-3AF9-4c92-B771-50CB78F5C751}
Delete
C:\Program Files\Acronis\TrueImageHome\tishell.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {C539A15B-3AF9-4c92-B771-50CB78F5C751}
Delete
C:\Program Files\Adobe\Adobe GoLive CS2\GoLive.exe
Script: Quarantine, Delete, Delete via BC
ActiveShortcut in Startup folderC:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\, C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Adobe GoLive CS2.lnk,
C:\Program Files\Common Files\Microsoft Shared\DW\DW.EXE
Script: Quarantine, Delete, Delete via BC
--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft Visual Studio Tools for Applications, EventMessageFile
C:\Program Files\CoreFTP\coreftp.exe
Script: Quarantine, Delete, Delete via BC
ActiveShortcut in Startup folderC:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\, C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Core FTP Lite.lnk,
C:\Program Files\ERUNT\NTREGOPT.EXE
Script: Quarantine, Delete, Delete via BC
ActiveShortcut in Startup folderC:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\, C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\NTREGOPT.lnk,
C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\tssmpm.cpl
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cpls, TSSMPM
Delete
C:\Program Files\Internet Explorer\iexplore.exe
Script: Quarantine, Delete, Delete via BC
ActiveShortcut in Startup folderC:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\, C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk,
C:\Program Files\Playrix Gameplayer\Manager.exe
Script: Quarantine, Delete, Delete via BC
ActiveShortcut in Startup folderC:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\, C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Playrix Gameplayer.lnk,
C:\Program Files\Raxco\PerfectDisk2008\PD91Engine.exe
Script: Quarantine, Delete, Delete via BC
--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\PD91Agent, EventMessageFile
C:\Program Files\Raxco\PerfectDisk2008\PD91Engine.exe
Script: Quarantine, Delete, Delete via BC
--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\PD91Engine, EventMessageFile
C:\Program Files\Raxco\PerfectDisk2008\PD91Engine.exe
Script: Quarantine, Delete, Delete via BC
--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\PD91Scanner, EventMessageFile
C:\Program Files\ThumbView_Lite 1.0\ThumbView_Lite.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {3B52CC4A-19E9-43F5-A626-F89267A5E43F}
Delete
C:\Users\Administrator\AppData\Local\Google\Chrome\Application\chrome.exe
Script: Quarantine, Delete, Delete via BC
ActiveShortcut in Startup folderC:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\, C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk,
C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
Script: Quarantine, Delete, Delete via BC
ActiveFile in Startup folderC:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\, C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk,
C:\WindowsSystem32\IoLogMsg.dll
Script: Quarantine, Delete, Delete via BC
--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\vsmraid, EventMessageFile
C:\Windows\System32\Branding\folderbg\VistaFolderBackground.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler, {73526E5A-FD53-4BE7-B5E2-D3C89D7413DC}
Delete
C:\Windows\System32\Branding\folderbg\VistaFolderBackground.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {73526E5A-FD53-4BE7-B5E2-D3C89D7413DC}
Delete
C:\Windows\System32\igmpv2.dll
Script: Quarantine, Delete, Delete via BC
--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile
C:\Windows\System32\ipbootp.dll
Script: Quarantine, Delete, Delete via BC
--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile
C:\Windows\System32\iprip2.dll
Script: Quarantine, Delete, Delete via BC
--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile
C:\Windows\System32\ws03res.dll
Script: Quarantine, Delete, Delete via BC
--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPNATHLP, EventMessageFile
C:\Windows\system32\Ati2evxx.exe
Script: Quarantine, Delete, Delete via BC
--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Ati External Event Utility, EventMessageFile
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler, {8C7461EF-2B13-11d2-BE35-3078302C2030}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {5E6AB780-7743-11CF-A12B-00AA004AE837}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {7BA4C742-9E81-11CF-99D3-00AA004AE837}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {056440FD-8568-48e7-A632-72157243B55B}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {C4EC38BD-4E9E-4b5e-935A-D1BFF237D980}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {6D8BB3D3-9D87-4a91-AB56-4F30CFFEFE9F}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {21569614-B795-46b1-85F4-E737A8DC09AD}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {169A0691-8DF9-11d1-A1C4-00C04FD75D13}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {AF4F6510-F982-11d0-8595-00AA004CD6D8}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {01E04581-4EEE-11d0-BFE9-00AA005B4383}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {a542e116-8088-4146-a352-b0d06e7f6af6}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {F61FFEC1-754F-11d0-80CA-00AA005B4383}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {00BB2763-6A77-11D0-A535-00C04FD7D062}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {596742A5-1393-4e13-8765-AE1DF71ACAFB}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {6756A641-DE71-11d0-831B-00AA005B4383}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {00BB2764-6A77-11D0-A535-00C04FD7D062}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {03C036F1-A186-11D0-824A-00AA005B4383}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {00BB2765-6A77-11D0-A535-00C04FD7D062}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {ECD4FC4E-521C-11D0-B792-00A0C90312E1}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {3CCF8A41-5C85-11d0-9796-00AA00B90ADF}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {ECD4FC4D-521C-11D0-B792-00A0C90312E1}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {DD313E04-FEFF-11d1-8ECD-0000F87A470C}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {fccf70c8-f4d7-4d8b-8c17-cd6715e37fff}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {4d5c8c2a-d075-11d0-b416-00c04fb90376}
Delete
C:\Windows\system32\ff_vfw.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, VIDC.FFDS
Delete
C:\Windows\system32\oobefldr.dll
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {CB1B7F8C-C50A-4176-B604-9E24DEE8D4D1}
Delete
C:\Windows\system32\psxss.exe
Script: Quarantine, Delete, Delete via BC
--Registry keyHKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
D:\xampp\xampp-control.exe
Script: Quarantine, Delete, Delete via BC
ActiveShortcut in Startup folderC:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\, C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\XAMPP Control Panel.lnk,
progman.exe
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, shell
Delete
vgafix.fon
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon
Delete
vgaoem.fon
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon
Delete
vgasys.fon
Script: Quarantine, Delete, Delete via BC
ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon
Delete
Autoruns items found - 823, recognized as trusted - 764

Internet Explorer extension modules (BHOs, Toolbars ...)

File nameTypeDescriptionManufacturerCLSID
BHOAutorunsDisabled
Delete
C:\Program Files\Windows Live\Messenger\wlchtc.dll
Script: Quarantine, Delete, Delete via BC
BHOWindows Live Call Click-to-Call BHO2008 Microsoft Corporation. All rights reserved.{5C255C8A-E604-49b4-9D64-90988571CECB}
Delete
Extension module{2670000A-7350-4f3c-8081-5663EE0C6C49}
Delete
Extension module{92780B25-18CC-41C8-B9BE-3C9C571A8263}
Delete
Extension module{E0B8C461-F8FB-49b4-8373-FE32E92528A6}
Delete
Items found - 12, recognized as trusted - 7

Windows Explorer extension modules

File nameDestinationDescriptionManufacturerCLSID
IE User Assist{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75}
Delete
Color Control Panel Applet{b2c761c6-29bc-4f19-9251-e6195265baf1}
Delete
Add New Hardware{7A979262-40CE-46ff-AEEE-7884AC3B6136}
Delete
Get Programs Online{3e7efb4c-faf1-453d-89eb-56026875ef90}
Delete
Taskbar and Start Menu{0DF44EAA-FF21-4412-828E-260A8728E7F1}
Delete
ActiveDirectory Folder{1b24a030-9b20-49bc-97ac-1be4426f9e59}
Delete
ActiveDirectory Folder{34449847-FD14-4fc8-A75A-7432F5181EFB}
Delete
Sam Account Folder{C8494E42-ACDD-4739-B0FB-217361E4894F}
Delete
Sam Account Folder{E29F9716-5C08-4FCD-955A-119FDB5A522D}
Delete
Control Panel command object for Start menu{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}
Delete
Default Programs command object for Start menu{E44E5D18-0652-4508-A4E2-8A090067BCB0}
Delete
Folder Options{6dfd7c5c-2451-11d3-a299-00c04f8ef6af}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
Microsoft Internet ToolbarShell Browser UI Library© Microsoft Corporation. All rights reserved.{5E6AB780-7743-11CF-A12B-00AA004AE837}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
Microsoft BrowserBandShell Browser UI Library© Microsoft Corporation. All rights reserved.{7BA4C742-9E81-11CF-99D3-00AA004AE837}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
Explorer Navigation BarShell Browser UI Library© Microsoft Corporation. All rights reserved.{056440FD-8568-48e7-A632-72157243B55B}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
Explorer Travel BandShell Browser UI Library© Microsoft Corporation. All rights reserved.{C4EC38BD-4E9E-4b5e-935A-D1BFF237D980}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
Explorer Search BandShell Browser UI Library© Microsoft Corporation. All rights reserved.{6D8BB3D3-9D87-4a91-AB56-4F30CFFEFE9F}
Delete
Explorer Query Band{2C2577C2-63A7-40e3-9B7F-586602617ECB}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
Search BandShell Browser UI Library© Microsoft Corporation. All rights reserved.{21569614-B795-46b1-85F4-E737A8DC09AD}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
In-pane searchShell Browser UI Library© Microsoft Corporation. All rights reserved.{169A0691-8DF9-11d1-A1C4-00C04FD75D13}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
Registry Tree Options UtilityShell Browser UI Library© Microsoft Corporation. All rights reserved.{AF4F6510-F982-11d0-8595-00AA004CD6D8}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
&AddressShell Browser UI Library© Microsoft Corporation. All rights reserved.{01E04581-4EEE-11d0-BFE9-00AA005B4383}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
Address EditBoxShell Browser UI Library© Microsoft Corporation. All rights reserved.{a542e116-8088-4146-a352-b0d06e7f6af6}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
BandProxyShell Browser UI Library© Microsoft Corporation. All rights reserved.{F61FFEC1-754F-11d0-80CA-00AA005B4383}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
Microsoft AutoCompleteShell Browser UI Library© Microsoft Corporation. All rights reserved.{00BB2763-6A77-11D0-A535-00C04FD7D062}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
Microsoft Breadcrumb BarShell Browser UI Library© Microsoft Corporation. All rights reserved.{596742A5-1393-4e13-8765-AE1DF71ACAFB}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
MRU AutoComplete ListShell Browser UI Library© Microsoft Corporation. All rights reserved.{6756A641-DE71-11d0-831B-00AA005B4383}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
Custom MRU AutoCompleted ListShell Browser UI Library© Microsoft Corporation. All rights reserved.{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
Microsoft History AutoComplete ListShell Browser UI Library© Microsoft Corporation. All rights reserved.{00BB2764-6A77-11D0-A535-00C04FD7D062}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
Microsoft Shell Folder AutoComplete ListShell Browser UI Library© Microsoft Corporation. All rights reserved.{03C036F1-A186-11D0-824A-00AA005B4383}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
Microsoft Multiple AutoComplete List ContainerShell Browser UI Library© Microsoft Corporation. All rights reserved.{00BB2765-6A77-11D0-A535-00C04FD7D062}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
Shell Band Site MenuShell Browser UI Library© Microsoft Corporation. All rights reserved.{ECD4FC4E-521C-11D0-B792-00A0C90312E1}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
Shell DeskBarAppShell Browser UI Library© Microsoft Corporation. All rights reserved.{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
Shell Rebar BandSiteShell Browser UI Library© Microsoft Corporation. All rights reserved.{ECD4FC4D-521C-11D0-B792-00A0C90312E1}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
User AssistShell Browser UI Library© Microsoft Corporation. All rights reserved.{DD313E04-FEFF-11d1-8ECD-0000F87A470C}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
Global Folder SettingsShell Browser UI Library© Microsoft Corporation. All rights reserved.{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
Search ControlShell Browser UI Library© Microsoft Corporation. All rights reserved.{fccf70c8-f4d7-4d8b-8c17-cd6715e37fff}
Delete
C:\Windows\system32\browseui.dll
Script: Quarantine, Delete, Delete via BC
Microsoft CommBandShell Browser UI Library© Microsoft Corporation. All rights reserved.{4d5c8c2a-d075-11d0-b416-00c04fb90376}
Delete
View Available Networks{38a98528-6cbf-4ca9-8dc0-b1e1d10f7b1b}
Delete
Contacts folder{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48}
Delete
Windows Firewall{4026492f-2f69-46b8-b9bf-5654fc07e423}
Delete
Problem Reports and Solutions{fcfeecae-ee1b-4849-ae50-685dcf7717ec}
Delete
iSCSI Initiator{a304259d-52b8-4526-8b1a-a1d6cecc8243}
Delete
.cab or .zip files{911051fa-c21c-4246-b470-070cd8df6dc4}
Delete
Windows Search Shell Service{da67b8ad-e81b-4c70-9b91b417b5e33527}
Delete
Microsoft.ScannersAndCameras{00f2886f-cd64-4fc9-8ec5-30ef6cdbe8c3}
Delete
Windows Sidebar Properties{37efd44d-ef8d-41b1-940d-96973a50e9e0}
Delete
Windows Features{67718415-c450-4f3c-bf8a-b487642dc39b}
Delete
Windows Defender{d8559eb9-20c0-410e-beda-7ed416aecc2a}
Delete
Mobility Center Control Panel{5ea4f148-308c-46d7-98a9-49041b1dd468}
Delete
C:\Windows\system32\oobefldr.dll
Script: Quarantine, Delete, Delete via BC
Welcome CenterWelcome Center© Microsoft Corporation. All rights reserved.{CB1B7F8C-C50A-4176-B604-9E24DEE8D4D1}
Delete
User Accounts{7A9D77BD-5403-11d2-8785-2E0420524153}
Delete
StardockDeskscapes.DreamFile{FA603FF3-D04C-415d-8049-EFE29EEF4B26}
Delete
C:\Windows\System32\Branding\folderbg\VistaFolderBackground.dll
Script: Quarantine, Delete, Delete via BC
Ave's FolderBgCOM Explorer Injector and HOOK DLL(c) Andreas Verhoeven. All rights reserved.{73526E5A-FD53-4BE7-B5E2-D3C89D7413DC}
Delete
C:\Program Files\ThumbView_Lite 1.0\ThumbView_Lite.dll
Script: Quarantine, Delete, Delete via BC
ThumbView: extended image informationShellExtension ModuleCopyright 2004{3B52CC4A-19E9-43F5-A626-F89267A5E43F}
Delete
Shell Extension for Malware scanning{45AC2688-0253-4ED8-97DE-B5370FA7D48A}
Delete
C:\PROGRA~1\VSO\IMAGER~1\RSZShell.dll
Script: Quarantine, Delete, Delete via BC
ImageResizer Shell ExtensionImageResizer Shell ExtensionCopyright © 2006-2008 VSO Software SARL{2BB59FC0-31E8-42DA-9D3C-E9A52953853B}
Delete
HashTab Context Menu{B1883831-F0D8-4453-8245-EEAAD866DD6E}
Delete
C:\Program Files\Acronis\TrueImageHome\tishell.dll
Script: Quarantine, Delete, Delete via BC
Acronis True Image Shell Context Menu ExtensionAcronis True Image Shell ExtensionsCopyright (C) Acronis, 2000-2008.{C539A15A-3AF9-4c92-B771-50CB78F5C751}
Delete
C:\Program Files\Acronis\TrueImageHome\tishell.dll
Script: Quarantine, Delete, Delete via BC
Acronis True Image Shell ExtensionAcronis True Image Shell ExtensionsCopyright (C) Acronis, 2000-2008.{C539A15B-3AF9-4c92-B771-50CB78F5C751}
Delete
C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
Script: Quarantine, Delete, Delete via BC
Windows Live Photo Gallery Autoplay Drop TargetWindows Live Photo Gallery© 2008 Microsoft Corporation. All rights reserved.{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C}
Delete
C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
Script: Quarantine, Delete, Delete via BC
Windows Live Photo Gallery Viewer Drop TargetWindows Live Photo Gallery© 2008 Microsoft Corporation. All rights reserved.{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C}
Delete
C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
Script: Quarantine, Delete, Delete via BC
Windows Live Photo Gallery Editor Drop TargetWindows Live Photo Gallery© 2008 Microsoft Corporation. All rights reserved.{00F374B7-B390-4884-B372-2FC349F2172B}
Delete
ColumnHandlerAutorunsDisabled
Delete
Items found - 337, recognized as trusted - 273

Printing system extensions (print monitors, providers)

File nameTypeNameDescriptionManufacturer
Items found - 10, recognized as trusted - 10

Task Scheduler jobs

File nameJob nameJob stateDescriptionManufacturer
Items found - 5, recognized as trusted - 5

SPI/LSP settings

Namespace providers (NSP)
ManufacturerStatusEXE fileDescriptionGUID
Detected - 8, recognized as trusted - 8
Transport protocol providers (TSP, LSP)
ManufacturerEXE fileDescription
Detected - 35, recognized as trusted - 35
Results of automatic SPI settings check
LSP settings checked. No errors detected

TCP/UDP ports

PortStatusRemote HostRemote PortApplicationNotes
TCP ports
135LISTENING0.0.0.00[1068] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
139LISTENING0.0.0.00[4] System
Script: Quarantine, Delete, Delete via BC, Terminate
 
445LISTENING0.0.0.00[4] System
Script: Quarantine, Delete, Delete via BC, Terminate
 
554LISTENING0.0.0.00[4084] c:\program files\windows media player\wmpnetwk.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
2869LISTENING0.0.0.00[4] System
Script: Quarantine, Delete, Delete via BC, Terminate
 
3389LISTENING0.0.0.00[1684] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
5354LISTENING0.0.0.00[2404] c:\program files\bonjour\mdnsresponder.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
5357LISTENING0.0.0.00[4] System
Script: Quarantine, Delete, Delete via BC, Terminate
 
10243LISTENING0.0.0.00[4] System
Script: Quarantine, Delete, Delete via BC, Terminate
 
27015LISTENING0.0.0.00[2364] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
37568LISTENING0.0.0.00[2004] c:\program files\gnu\gnupg\bin\dbus-daemon.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
49152LISTENING0.0.0.00[772] c:\windows\system32\wininit.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
49153LISTENING0.0.0.00[1236] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
49154LISTENING0.0.0.00[1296] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
49156LISTENING0.0.0.00[764] c:\windows\system32\spoolsv.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
49157LISTENING0.0.0.00[828] c:\windows\system32\lsass.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
49158LISTENING0.0.0.00[816] c:\windows\system32\services.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
49163CLOSE_WAIT92.123.65.17980[2836] c:\program files\java\jre6\bin\jucheck.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
49299ESTABLISHED127.0.0.149300[2004] c:\program files\gnu\gnupg\bin\dbus-daemon.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
49300ESTABLISHED127.0.0.149299[2004] c:\program files\gnu\gnupg\bin\dbus-daemon.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
49303LISTENING0.0.0.00[3828] c:\program files\gnu\gnupg\bin\kleopatra.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
49311ESTABLISHED92.122.216.17180[3180] c:\users\administrator\appdata\local\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
49317TIME_WAIT192.168.15.100139[0]   
49319ESTABLISHED92.122.216.15480[3180] c:\users\administrator\appdata\local\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
49320ESTABLISHED74.125.79.10180[3180] c:\users\administrator\appdata\local\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
49321ESTABLISHED74.125.8.9680[3180] c:\users\administrator\appdata\local\google\chrome\application\chrome.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
UDP ports
123LISTENING----[1560] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
137LISTENING----[4] System
Script: Quarantine, Delete, Delete via BC, Terminate
 
138LISTENING----[4] System
Script: Quarantine, Delete, Delete via BC, Terminate
 
500LISTENING----[1296] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
1900LISTENING----[1560] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
1900LISTENING----[1560] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
3702LISTENING----[1560] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
3702LISTENING----[1560] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
4500LISTENING----[1296] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
5004LISTENING----[4084] c:\program files\windows media player\wmpnetwk.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
5005LISTENING----[4084] c:\program files\windows media player\wmpnetwk.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
5353LISTENING----[2404] c:\program files\bonjour\mdnsresponder.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
5355LISTENING----[1684] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
53305LISTENING----[2404] c:\program files\bonjour\mdnsresponder.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
53312LISTENING----[1560] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
63684LISTENING----[1560] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
63685LISTENING----[1560] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 
64661LISTENING----[1296] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, Delete via BC, Terminate
 

Downloaded Program Files (DPF)

File nameDescriptionManufacturerCLSIDSource URL
Items found - 6, recognized as trusted - 6

Control Panel Applets (CPL)

File nameDescriptionManufacturer
Items found - 22, recognized as trusted - 22

Active Setup

File nameDescriptionManufacturerCLSID
Items found - 9, recognized as trusted - 9

HOSTS file

Hosts file record
ÿþ1
Clear Hosts file

Protocols and handlers

File nameTypeDescriptionManufacturerCLSID
mscoree.dll
Script: Quarantine, Delete, Delete via BC
ProtocolMicrosoft .NET Runtime Execution Engine ()© Microsoft Corporation. All rights reserved.{1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, Delete via BC
ProtocolMicrosoft .NET Runtime Execution Engine ()© Microsoft Corporation. All rights reserved.{1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, Delete via BC
ProtocolMicrosoft .NET Runtime Execution Engine ()© Microsoft Corporation. All rights reserved.{1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
Items found - 21, recognized as trusted - 18

Suspicious objects

FileDescriptionType
C:\Windows\system32\Drivers\uji3njey.sys
Script: Quarantine, Delete, Delete via BC
Suspicion for RootkitKernel-mode hook


Executing standard script: 1. Detect and block UserMode and KernelMode hooks
1.1 Searching for user-mode API hooks
 Analysis: kernel32.dll, export table found in section .text
 Analysis: ntdll.dll, export table found in section .text
 Analysis: user32.dll, export table found in section .text
 Analysis: advapi32.dll, export table found in section .text
 Analysis: ws2_32.dll, export table found in section .text
 Analysis: wininet.dll, export table found in section .text
 Analysis: rasapi32.dll, export table found in section .text
 Analysis: urlmon.dll, export table found in section .text
 Analysis: netapi32.dll, export table found in section .text
1.2 Searching for kernel-mode API hooks
 Driver loaded successfully
 SDT found (RVA=137B00)
 Kernel ntkrnlpa.exe found in memory at address 82417000
   SDT = 8254EB00
   KiST = 824CF9E0 (391)
Function NtCreateFile (3C) intercepted (8263E036->A3F4B130), hook C:\Windows\system32\Drivers\uji3njey.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateKey (40) intercepted (825FEC71->A3F4B370), hook C:\Windows\system32\Drivers\uji3njey.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateProcess (48) intercepted (826AB26F->A3F4B400), hook C:\Windows\system32\Drivers\uji3njey.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateProcessEx (49) intercepted (826AB2BA->A3F4B430), hook C:\Windows\system32\Drivers\uji3njey.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDeleteValueKey (7E) intercepted (825C71FF->A3F4B3B0), hook C:\Windows\system32\Drivers\uji3njey.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenFile (BA) intercepted (826276B5->A3F4B530), hook C:\Windows\system32\Drivers\uji3njey.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenKey (BD) intercepted (8262C1F2->A3F4B380), hook C:\Windows\system32\Drivers\uji3njey.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenProcess (C2) intercepted (82628BBE->A3F4B3D0), hook C:\Windows\system32\Drivers\uji3njey.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenSection (C5) intercepted (8263F872->A3F4B460), hook C:\Windows\system32\Drivers\uji3njey.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetValueKey (144) intercepted (825FFA9D->A3F4B390), hook C:\Windows\system32\Drivers\uji3njey.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtTerminateJobObject (14D) intercepted (825EC2D8->A3F4B6D0), hook C:\Windows\system32\Drivers\uji3njey.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtWriteVirtualMemory (166) intercepted (82624CFF->A3F4B6C0), hook C:\Windows\system32\Drivers\uji3njey.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Functions checked: 391, intercepted: 12, restored: 12
1.3 Checking IDT and SYSENTER
 Analyzing CPU 1
 Analyzing CPU 2
 Analyzing CPU 3
CmpCallCallBacks = 00000000
 Checking IDT and SYSENTER - complete
1.4 Searching for masking processes and drivers
Masking process with PID=688, name = ""
 >> PID substitution detected (current PID is=0, real = 688)
Masking process with PID=1144, name = ""
 >> PID substitution detected (current PID is=0, real = 1144)
Masking process with PID=1380, name = ""
 >> PID substitution detected (current PID is=0, real = 1380)
Masking process with PID=396, name = ""
 >> PID substitution detected (current PID is=0, real = 396)
Masking process with PID=496, name = ""
 >> PID substitution detected (current PID is=0, real = 496)
Masking process with PID=12, name = ""
 >> PID substitution detected (current PID is=0, real = 12)
Masking process with PID=2288, name = ""
 >> PID substitution detected (current PID is=0, real = 2288)
Masking process with PID=2320, name = ""
 >> PID substitution detected (current PID is=0, real = 2320)
Masking process with PID=2460, name = ""
 >> PID substitution detected (current PID is=0, real = 2460)
Masking process with PID=2676, name = ""
 >> PID substitution detected (current PID is=0, real = 2676)
Masking process with PID=2976, name = ""
 >> PID substitution detected (current PID is=0, real = 2976)
Masking process with PID=3060, name = ""
 >> PID substitution detected (current PID is=0, real = 3060)
Masking process with PID=3412, name = ""
 >> PID substitution detected (current PID is=0, real = 3412)
Masking process with PID=3620, name = ""
 >> PID substitution detected (current PID is=0, real = 3620)
Masking process with PID=3644, name = ""
 >> PID substitution detected (current PID is=0, real = 3644)
Masking process with PID=3848, name = ""
 >> PID substitution detected (current PID is=0, real = 3848)
Masking process with PID=3920, name = ""
 >> PID substitution detected (current PID is=0, real = 3920)
Masking process with PID=1196, name = ""
 >> PID substitution detected (current PID is=0, real = 1196)
Masking process with PID=2776, name = ""
 >> PID substitution detected (current PID is=0, real = 2776)
Masking process with PID=1808, name = ""
 >> PID substitution detected (current PID is=0, real = 1808)
Masking process with PID=3624, name = ""
 >> PID substitution detected (current PID is=0, real = 3624)
Masking process with PID=3932, name = ""
 >> PID substitution detected (current PID is=0, real = 3932)
Masking process with PID=3896, name = ""
 >> PID substitution detected (current PID is=0, real = 3896)
Masking process with PID=1200, name = ""
 >> PID substitution detected (current PID is=0, real = 1200)
Masking process with PID=2620, name = ""
 >> PID substitution detected (current PID is=0, real = 2620)
Masking process with PID=3736, name = ""
 >> PID substitution detected (current PID is=0, real = 3736)
Masking process with PID=4060, name = ""
 >> PID substitution detected (current PID is=0, real = 4060)
Masking process with PID=2860, name = ""
 >> PID substitution detected (current PID is=0, real = 2860)
Masking process with PID=1188, name = ""
 >> PID substitution detected (current PID is=0, real = 1188)
Masking process with PID=3592, name = ""
 >> PID substitution detected (current PID is=0, real = 3592)
Masking process with PID=1844, name = ""
 >> PID substitution detected (current PID is=0, real = 1844)
Masking process with PID=4072, name = ""
 >> PID substitution detected (current PID is=0, real = 4072)
Masking process with PID=3848, name = ""
 >> PID substitution detected (current PID is=0, real = 3848)
Masking process with PID=1960, name = ""
 >> PID substitution detected (current PID is=0, real = 1960)
Masking process with PID=1400, name = ""
 >> PID substitution detected (current PID is=0, real = 1400)
Masking process with PID=2556, name = ""
 >> PID substitution detected (current PID is=0, real = 2556)
Masking process with PID=3876, name = ""
 >> PID substitution detected (current PID is=0, real = 3876)
Masking process with PID=2568, name = ""
 >> PID substitution detected (current PID is=0, real = 2568)
Masking process with PID=1572, name = ""
 >> PID substitution detected (current PID is=0, real = 1572)
Masking process with PID=1400, name = ""
 >> PID substitution detected (current PID is=0, real = 1400)
Masking process with PID=2192, name = ""
 >> PID substitution detected (current PID is=0, real = 2192)
Masking process with PID=1624, name = ""
 >> PID substitution detected (current PID is=0, real = 1624)
Masking process with PID=2736, name = ""
 >> PID substitution detected (current PID is=0, real = 2736)
Masking process with PID=640, name = ""
 >> PID substitution detected (current PID is=0, real = 640)
Masking process with PID=3440, name = ""
 >> PID substitution detected (current PID is=0, real = 3440)
Masking process with PID=3408, name = ""
 >> PID substitution detected (current PID is=0, real = 3408)
Masking process with PID=2224, name = ""
 >> PID substitution detected (current PID is=0, real = 2224)
Masking process with PID=2796, name = ""
 >> PID substitution detected (current PID is=0, real = 2796)
Masking process with PID=3932, name = ""
 >> PID substitution detected (current PID is=0, real = 3932)
Masking process with PID=1984, name = ""
 >> PID substitution detected (current PID is=0, real = 1984)
Masking process with PID=3672, name = ""
 >> PID substitution detected (current PID is=0, real = 3672)
Masking process with PID=2860, name = ""
 >> PID substitution detected (current PID is=0, real = 2860)
Masking process with PID=1008, name = ""
 >> PID substitution detected (current PID is=0, real = 1008)
Masking process with PID=1884, name = ""
 >> PID substitution detected (current PID is=0, real = 1884)
Masking process with PID=396, name = ""
 >> PID substitution detected (current PID is=0, real = 396)
Masking process with PID=3180, name = ""
 >> PID substitution detected (current PID is=0, real = 3180)
Masking process with PID=3500, name = ""
 >> PID substitution detected (current PID is=0, real = 3500)
Masking process with PID=3288, name = ""
 >> PID substitution detected (current PID is=0, real = 3288)
Masking process with PID=3620, name = ""
 >> PID substitution detected (current PID is=0, real = 3620)
Masking process with PID=3280, name = ""
 >> PID substitution detected (current PID is=0, real = 3280)
Masking process with PID=4072, name = ""
 >> PID substitution detected (current PID is=0, real = 4072)
Masking process with PID=1188, name = ""
 >> PID substitution detected (current PID is=0, real = 1188)
Masking process with PID=2384, name = ""
 >> PID substitution detected (current PID is=0, real = 2384)
Masking process with PID=1984, name = ""
 >> PID substitution detected (current PID is=0, real = 1984)
Masking process with PID=2172, name = ""
 >> PID substitution detected (current PID is=0, real = 2172)
Masking process with PID=244, name = ""
 >> PID substitution detected (current PID is=0, real = 244)
Masking process with PID=3292, name = ""
 >> PID substitution detected (current PID is=0, real = 3292)
Masking process with PID=2004, name = ""
 >> PID substitution detected (current PID is=0, real = 2004)
Masking process with PID=1480, name = ""
 >> PID substitution detected (current PID is=0, real = 1480)
Masking process with PID=3460, name = ""
 >> PID substitution detected (current PID is=0, real = 3460)
Masking process with PID=1784, name = ""
 >> PID substitution detected (current PID is=0, real = 1784)
Masking process with PID=2688, name = ""
 >> PID substitution detected (current PID is=0, real = 2688)
Masking process with PID=2516, name = ""
 >> PID substitution detected (current PID is=0, real = 2516)
Masking process with PID=1380, name = ""
 >> PID substitution detected (current PID is=0, real = 1380)
Masking process with PID=2520, name = ""
 >> PID substitution detected (current PID is=0, real = 2520)
Masking process with PID=1784, name = ""
 >> PID substitution detected (current PID is=0, real = 1784)
Masking process with PID=1452, name = ""
 >> PID substitution detected (current PID is=0, real = 1452)
Masking process with PID=2132, name = ""
 >> PID substitution detected (current PID is=0, real = 2132)
Masking process with PID=3764, name = ""
 >> PID substitution detected (current PID is=0, real = 3764)
Masking process with PID=1392, name = ""
 >> PID substitution detected (current PID is=0, real = 1392)
Masking process with PID=3320, name = ""
 >> PID substitution detected (current PID is=0, real = 3320)
Masking process with PID=2868, name = ""
 >> PID substitution detected (current PID is=0, real = 2868)
Masking process with PID=2952, name = ""
 >> PID substitution detected (current PID is=0, real = 2952)
Masking process with PID=3624, name = ""
 >> PID substitution detected (current PID is=0, real = 3624)
Masking process with PID=2548, name = ""
 >> PID substitution detected (current PID is=0, real = 2548)
Masking process with PID=1704, name = ""
 >> PID substitution detected (current PID is=0, real = 1704)
Masking process with PID=2212, name = ""
 >> PID substitution detected (current PID is=0, real = 2212)
Masking process with PID=2008, name = ""
 >> PID substitution detected (current PID is=0, real = 2008)
Masking process with PID=2224, name = ""
 >> PID substitution detected (current PID is=0, real = 2224)
Masking process with PID=3136, name = ""
 >> PID substitution detected (current PID is=0, real = 3136)
Masking process with PID=3912, name = ""
 >> PID substitution detected (current PID is=0, real = 3912)
Masking process with PID=2284, name = ""
 >> PID substitution detected (current PID is=0, real = 2284)
Masking process with PID=3280, name = ""
 >> PID substitution detected (current PID is=0, real = 3280)
Masking process with PID=3800, name = ""
 >> PID substitution detected (current PID is=0, real = 3800)
Masking process with PID=3548, name = ""
 >> PID substitution detected (current PID is=0, real = 3548)
 Searching for masking processes and drivers - complete
1.5 Checking IRP handlers
 Driver loaded successfully
 Checking - complete
Executing standard script: 1. Detect and block UserMode and KernelMode hooks
1.1 Searching for user-mode API hooks
 Analysis: kernel32.dll, export table found in section .text
 Analysis: ntdll.dll, export table found in section .text
 Analysis: user32.dll, export table found in section .text
 Analysis: advapi32.dll, export table found in section .text
 Analysis: ws2_32.dll, export table found in section .text
 Analysis: wininet.dll, export table found in section .text
 Analysis: rasapi32.dll, export table found in section .text
 Analysis: urlmon.dll, export table found in section .text
 Analysis: netapi32.dll, export table found in section .text
1.2 Searching for kernel-mode API hooks
 Driver loaded successfully
 SDT found (RVA=137B00)
 Kernel ntkrnlpa.exe found in memory at address 82417000
   SDT = 8254EB00
   KiST = 824CF9E0 (391)
Functions checked: 391, intercepted: 0, restored: 0
1.3 Checking IDT and SYSENTER
 Analyzing CPU 1
 Analyzing CPU 2
 Analyzing CPU 3
CmpCallCallBacks = 00000000
 Checking IDT and SYSENTER - complete
1.4 Searching for masking processes and drivers
Masking process with PID=688, name = ""
 >> PID substitution detected (current PID is=0, real = 688)
Masking process with PID=1144, name = ""
 >> PID substitution detected (current PID is=0, real = 1144)
Masking process with PID=1380, name = ""
 >> PID substitution detected (current PID is=0, real = 1380)
Masking process with PID=396, name = ""
 >> PID substitution detected (current PID is=0, real = 396)
Masking process with PID=496, name = ""
 >> PID substitution detected (current PID is=0, real = 496)
Masking process with PID=12, name = ""
 >> PID substitution detected (current PID is=0, real = 12)
Masking process with PID=2288, name = ""
 >> PID substitution detected (current PID is=0, real = 2288)
Masking process with PID=2320, name = ""
 >> PID substitution detected (current PID is=0, real = 2320)
Masking process with PID=2460, name = ""
 >> PID substitution detected (current PID is=0, real = 2460)
Masking process with PID=2676, name = ""
 >> PID substitution detected (current PID is=0, real = 2676)
Masking process with PID=2976, name = ""
 >> PID substitution detected (current PID is=0, real = 2976)
Masking process with PID=3060, name = ""
 >> PID substitution detected (current PID is=0, real = 3060)
Masking process with PID=3412, name = ""
 >> PID substitution detected (current PID is=0, real = 3412)
Masking process with PID=3620, name = ""
 >> PID substitution detected (current PID is=0, real = 3620)
Masking process with PID=3644, name = ""
 >> PID substitution detected (current PID is=0, real = 3644)
Masking process with PID=3848, name = ""
 >> PID substitution detected (current PID is=0, real = 3848)
Masking process with PID=3920, name = ""
 >> PID substitution detected (current PID is=0, real = 3920)
Masking process with PID=1196, name = ""
 >> PID substitution detected (current PID is=0, real = 1196)
Masking process with PID=2776, name = ""
 >> PID substitution detected (current PID is=0, real = 2776)
Masking process with PID=1808, name = ""
 >> PID substitution detected (current PID is=0, real = 1808)
Masking process with PID=3624, name = ""
 >> PID substitution detected (current PID is=0, real = 3624)
Masking process with PID=3932, name = ""
 >> PID substitution detected (current PID is=0, real = 3932)
Masking process with PID=3896, name = ""
 >> PID substitution detected (current PID is=0, real = 3896)
Masking process with PID=1200, name = ""
 >> PID substitution detected (current PID is=0, real = 1200)
Masking process with PID=2620, name = ""
 >> PID substitution detected (current PID is=0, real = 2620)
Masking process with PID=3736, name = ""
 >> PID substitution detected (current PID is=0, real = 3736)
Masking process with PID=4060, name = ""
 >> PID substitution detected (current PID is=0, real = 4060)
Masking process with PID=2860, name = ""
 >> PID substitution detected (current PID is=0, real = 2860)
Masking process with PID=1188, name = ""
 >> PID substitution detected (current PID is=0, real = 1188)
Masking process with PID=3592, name = ""
 >> PID substitution detected (current PID is=0, real = 3592)
Masking process with PID=1844, name = ""
 >> PID substitution detected (current PID is=0, real = 1844)
Masking process with PID=4072, name = ""
 >> PID substitution detected (current PID is=0, real = 4072)
Masking process with PID=3848, name = ""
 >> PID substitution detected (current PID is=0, real = 3848)
Masking process with PID=1960, name = ""
 >> PID substitution detected (current PID is=0, real = 1960)
Masking process with PID=1400, name = ""
 >> PID substitution detected (current PID is=0, real = 1400)
Masking process with PID=2556, name = ""
 >> PID substitution detected (current PID is=0, real = 2556)
Masking process with PID=3876, name = ""
 >> PID substitution detected (current PID is=0, real = 3876)
Masking process with PID=2568, name = ""
 >> PID substitution detected (current PID is=0, real = 2568)
Masking process with PID=1572, name = ""
 >> PID substitution detected (current PID is=0, real = 1572)
Masking process with PID=1400, name = ""
 >> PID substitution detected (current PID is=0, real = 1400)
Masking process with PID=2192, name = ""
 >> PID substitution detected (current PID is=0, real = 2192)
Masking process with PID=1624, name = ""
 >> PID substitution detected (current PID is=0, real = 1624)
Masking process with PID=2736, name = ""
 >> PID substitution detected (current PID is=0, real = 2736)
Masking process with PID=640, name = ""
 >> PID substitution detected (current PID is=0, real = 640)
Masking process with PID=3440, name = ""
 >> PID substitution detected (current PID is=0, real = 3440)
Masking process with PID=3408, name = ""
 >> PID substitution detected (current PID is=0, real = 3408)
Masking process with PID=2224, name = ""
 >> PID substitution detected (current PID is=0, real = 2224)
Masking process with PID=2796, name = ""
 >> PID substitution detected (current PID is=0, real = 2796)
Masking process with PID=3932, name = ""
 >> PID substitution detected (current PID is=0, real = 3932)
Masking process with PID=1984, name = ""
 >> PID substitution detected (current PID is=0, real = 1984)
Masking process with PID=3672, name = ""
 >> PID substitution detected (current PID is=0, real = 3672)
Masking process with PID=2860, name = ""
 >> PID substitution detected (current PID is=0, real = 2860)
Masking process with PID=1008, name = ""
 >> PID substitution detected (current PID is=0, real = 1008)
Masking process with PID=1884, name = ""
 >> PID substitution detected (current PID is=0, real = 1884)
Masking process with PID=396, name = ""
 >> PID substitution detected (current PID is=0, real = 396)
Masking process with PID=3180, name = ""
 >> PID substitution detected (current PID is=0, real = 3180)
Masking process with PID=3500, name = ""
 >> PID substitution detected (current PID is=0, real = 3500)
Masking process with PID=3288, name = ""
 >> PID substitution detected (current PID is=0, real = 3288)
Masking process with PID=3620, name = ""
 >> PID substitution detected (current PID is=0, real = 3620)
Masking process with PID=3280, name = ""
 >> PID substitution detected (current PID is=0, real = 3280)
Masking process with PID=4072, name = ""
 >> PID substitution detected (current PID is=0, real = 4072)
Masking process with PID=1188, name = ""
 >> PID substitution detected (current PID is=0, real = 1188)
Masking process with PID=2384, name = ""
 >> PID substitution detected (current PID is=0, real = 2384)
Masking process with PID=1984, name = ""
 >> PID substitution detected (current PID is=0, real = 1984)
Masking process with PID=2172, name = ""
 >> PID substitution detected (current PID is=0, real = 2172)
Masking process with PID=244, name = ""
 >> PID substitution detected (current PID is=0, real = 244)
Masking process with PID=3292, name = ""
 >> PID substitution detected (current PID is=0, real = 3292)
Masking process with PID=2004, name = ""
 >> PID substitution detected (current PID is=0, real = 2004)
Masking process with PID=1480, name = ""
 >> PID substitution detected (current PID is=0, real = 1480)
Masking process with PID=3460, name = ""
 >> PID substitution detected (current PID is=0, real = 3460)
Masking process with PID=1784, name = ""
 >> PID substitution detected (current PID is=0, real = 1784)
Masking process with PID=2688, name = ""
 >> PID substitution detected (current PID is=0, real = 2688)
Masking process with PID=2516, name = ""
 >> PID substitution detected (current PID is=0, real = 2516)
Masking process with PID=1380, name = ""
 >> PID substitution detected (current PID is=0, real = 1380)
Masking process with PID=2520, name = ""
 >> PID substitution detected (current PID is=0, real = 2520)
Masking process with PID=1784, name = ""
 >> PID substitution detected (current PID is=0, real = 1784)
Masking process with PID=1452, name = ""
 >> PID substitution detected (current PID is=0, real = 1452)
Masking process with PID=2132, name = ""
 >> PID substitution detected (current PID is=0, real = 2132)
Masking process with PID=3764, name = ""
 >> PID substitution detected (current PID is=0, real = 3764)
Masking process with PID=1392, name = ""
 >> PID substitution detected (current PID is=0, real = 1392)
Masking process with PID=3320, name = ""
 >> PID substitution detected (current PID is=0, real = 3320)
Masking process with PID=2868, name = ""
 >> PID substitution detected (current PID is=0, real = 2868)
Masking process with PID=2952, name = ""
 >> PID substitution detected (current PID is=0, real = 2952)
Masking process with PID=3624, name = ""
 >> PID substitution detected (current PID is=0, real = 3624)
Masking process with PID=2548, name = ""
 >> PID substitution detected (current PID is=0, real = 2548)
Masking process with PID=1704, name = ""
 >> PID substitution detected (current PID is=0, real = 1704)
Masking process with PID=2212, name = ""
 >> PID substitution detected (current PID is=0, real = 2212)
Masking process with PID=2008, name = ""
 >> PID substitution detected (current PID is=0, real = 2008)
Masking process with PID=2224, name = ""
 >> PID substitution detected (current PID is=0, real = 2224)
Masking process with PID=3136, name = ""
 >> PID substitution detected (current PID is=0, real = 3136)
Masking process with PID=3912, name = ""
 >> PID substitution detected (current PID is=0, real = 3912)
Masking process with PID=2284, name = ""
 >> PID substitution detected (current PID is=0, real = 2284)
Masking process with PID=3280, name = ""
 >> PID substitution detected (current PID is=0, real = 3280)
Masking process with PID=3800, name = ""
 >> PID substitution detected (current PID is=0, real = 3800)
Masking process with PID=3548, name = ""
 >> PID substitution detected (current PID is=0, real = 3548)
 Searching for masking processes and drivers - complete
1.5 Checking IRP handlers
 Driver loaded successfully
 Checking - complete

System Analysis - complete
Script commands
Add commands to script:

File list