McAfee(R) Rootkit Detective 1.1 scan report On 01-04-2011 at 11:26:05 OS-Version 5.1.2600 Service Pack 3.0 ==================================== Object-Type: Process Object-Name: System Idle Process Pid: 0 Object-Path: Status: Visible Object-Type: Process Object-Name: svchost.exe Pid: 1612 Object-Path: C:\WINDOWS\system32\svchost.exe Status: Visible Object-Type: Process Object-Name: ctfmon.exe Pid: 2108 Object-Path: C:\WINDOWS\system32\ctfmon.exe Status: Visible Object-Type: Process Object-Name: mstsc.exe Pid: 2232 Object-Path: C:\WINDOWS\system32\mstsc.exe Status: Visible Object-Type: Process Object-Name: lsass.exe Pid: 1024 Object-Path: C:\WINDOWS\system32\lsass.exe Status: Visible Object-Type: Process Object-Name: OUTLOOK.EXE Pid: 3132 Object-Path: C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE Status: Visible Object-Type: Process Object-Name: mrkd.exe Pid: 2420 Object-Path: X:\inetpub\wwwroot\admin\mrkd\mrkd.exe Status: Visible Object-Type: Process Object-Name: svchost.exe Pid: 1460 Object-Path: C:\WINDOWS\system32\svchost.exe Status: Visible Object-Type: Process Object-Name: System Pid: 4 Object-Path: Status: Visible Object-Type: Process Object-Name: UnlockerAssista Pid: 936 Object-Path: C:\Program Files\Unlocker\UnlockerAssistant.exe Status: Visible Object-Type: Process Object-Name: winlogon.exe Pid: 968 Object-Path: C:\WINDOWS\system32\winlogon.exe Status: Visible Object-Type: Process Object-Name: jusched.exe Pid: 1496 Object-Path: C:\Program Files\Common Files\Java\Java Update\jusched.exe Status: Visible Object-Type: Process Object-Name: QBCFMonitorServ Pid: 1900 Object-Path: C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe Status: Visible Object-Type: Process Object-Name: explorer.exe Pid: 660 Object-Path: C:\WINDOWS\Explorer.EXE Status: Visible Object-Type: Process Object-Name: igfxtray.exe Pid: 1280 Object-Path: C:\WINDOWS\system32\igfxtray.exe Status: Visible Object-Type: Process Object-Name: iexplore.exe Pid: 2520 Object-Path: C:\Program Files\Internet Explorer\IEXPLORE.EXE Status: Visible Object-Type: Process Object-Name: smss.exe Pid: 848 Object-Path: C:\WINDOWS\System32\smss.exe Status: Visible Object-Type: Process Object-Name: svchost.exe Pid: 1220 Object-Path: C:\WINDOWS\system32\svchost.exe Status: Visible Object-Type: Process Object-Name: iexplore.exe Pid: 3948 Object-Path: C:\Program Files\Internet Explorer\IEXPLORE.EXE Status: Visible Object-Type: Process Object-Name: gmer.exe Pid: 3824 Object-Path: X:\inetpub\wwwroot\admin\gmer\gmer.exe Status: Visible Object-Type: Process Object-Name: mstsc.exe Pid: 4072 Object-Path: C:\WINDOWS\system32\mstsc.exe Status: Visible Object-Type: Process Object-Name: jqs.exe Pid: 1872 Object-Path: C:\Program Files\Java\jre6\bin\jqs.exe Status: Visible Object-Type: Process Object-Name: svchost.exe Pid: 1780 Object-Path: C:\WINDOWS\system32\svchost.exe Status: Visible Object-Type: Process Object-Name: mstsc.exe Pid: 1656 Object-Path: C:\WINDOWS\system32\mstsc.exe Status: Visible Object-Type: Process Object-Name: csrss.exe Pid: 944 Object-Path: C:\WINDOWS\system32\csrss.exe Status: Visible Object-Type: Process Object-Name: spoolsv.exe Pid: 1688 Object-Path: C:\WINDOWS\system32\spoolsv.exe Status: Visible Object-Type: Process Object-Name: iexplore.exe Pid: 820 Object-Path: C:\Program Files\Internet Explorer\IEXPLORE.EXE Status: Visible Object-Type: Process Object-Name: EXCEL.EXE Pid: 604 Object-Path: C:\Program Files\Microsoft Office\Office12\EXCEL.EXE Status: Visible Object-Type: Process Object-Name: svchost.exe Pid: 1412 Object-Path: C:\WINDOWS\System32\svchost.exe Status: Visible Object-Type: Process Object-Name: services.exe Pid: 1012 Object-Path: C:\WINDOWS\system32\services.exe Status: Visible Object-Type: Process Object-Name: svchost.exe Pid: 268 Object-Path: C:\WINDOWS\system32\svchost.exe Status: Visible Object-Type: Process Object-Name: MagicDisc.exe Pid: 2128 Object-Path: C:\Program Files\MagicDisc\MagicDisc.exe Status: Visible Object-Type: Process Object-Name: QBDBMgrN.exe Pid: 176 Object-Path: C:\PROGRA~1\Intuit\QUICKB~1\QBDBMgrN.exe Status: Visible Object-Type: Process Object-Name: WinVNC.exe Pid: 332 Object-Path: C:\Program Files\ORL\VNC\WinVNC.exe Status: Visible Object-Type: Process Object-Name: hkcmd.exe Pid: 1448 Object-Path: C:\WINDOWS\system32\hkcmd.exe Status: Visible Object-Type: Process Object-Name: exmgmt.exe Pid: 396 Object-Path: C:\Program Files\Exchsrvr\bin\exmgmt.exe Status: Visible Object-Type: Process Object-Name: RTHDCPL.exe Pid: 1668 Object-Path: C:\WINDOWS\RTHDCPL.EXE Status: Visible Object-Type: Process Object-Name: WINWORD.EXE Pid: 1792 Object-Path: C:\Program Files\Microsoft Office\Office12\WINWORD.EXE Status: Visible Object-Type: Process Object-Name: igfxpers.exe Pid: 1576 Object-Path: C:\WINDOWS\system32\igfxpers.exe Status: Visible Object-Type: Process Object-Name: igfxsrvc.exe Pid: 772 Object-Path: C:\WINDOWS\system32\igfxsrvc.exe Status: Visible Object-Type: Process Object-Name: svchost.exe Pid: 1300 Object-Path: C:\WINDOWS\system32\svchost.exe Status: Visible Scan complete. No hidden processes/files found. Total files scanned: 113268