ScanSpyware 3.9 (Build 2.

2) =========================== Scan Log created at: April 20, 2011 [05:33:14 PM] (GMT+07:00) Platform: Microsoft Windows XP Professional Service Pack 2 (5.1.2600) MSIE: Internet Explorer 6.0.2900 Unique App Id: 869B4960-9667A3B0-41F298B0-0CD5552A Last Updated: April 20, 2011 (05:10:11 PM) Preferences ~~~~~~~~~~~ [ ] Quick Scan (Fast yet Powerfull) [X] Deep Scan (Recommended) [ ] Custom Scan (Be Selective) [ ] [X] [X] [X] [ ] [ ] [ ] [ ] Remove threats automatically after every scan. Create a 'Restore Point' before removing threats. Always send found threats to quarantine. Create a log-file automatically after every scan. Launch app at Windows startup Start scan when app starts Scan in silent mode Close app after completing scan

Scan Summary ~~~~~~~~~~~~ Processes scanned: 37 Processes detected: 0 Cookies scanned: 2 Cookies detected: 0 Directories scanned: 10763 Directories detected: 1 Files scanned: 136501 Files detected: 7 Registry entries scanned: 174988 Registry entries detected: 3 Total objects scanned: 322291 Total objects detected: 11 Total objects removed: 0 Elapsed Time: 00:14:14 Scan Report ~~~~~~~~~~~ [Object Type : Directory] ------------------------C:\Documents and Settings\All Users\Start Menu\Programs\Actual Spy - (Action to be taken : Remove) - belongs to "ActualSpy"

[Object Type : File] -------------------C:\Documents and Settings\All Users\Start Menu\Programs\actual spy\ActualSpy.exe - (d62e61afec88e87bd11410a36eb0213f) - (Action to be taken : Remove) - belongs to "ActualSpy" C:\Documents and Settings\All Users\Start Menu\Programs\actual spy\Actual Spy He lp.lnk - (5b1645846da3f53d621e3f5b18b1ff50) - (Action to be taken : Remove) - be longs to "ActualSpy" C:\Program Files\microsoft office\office11\OSA.exe - (a4f8e23379d997151a98dc7520 8a1383) - (Action to be taken : Quarantine) - belongs to "Agent.MFA" C:\Documents and Settings\All Users\Start Menu\Programs\actual spy\Readme.lnk (51bda597ee65c6277afef04173f211fe) - (Action to be taken : Remove) - belongs to "ActualSpy" C:\WINDOWS\taskmgr.exe - (fc160ace21c81837692b339d230dd4be) - (Action to be take n : Quarantine) - belongs to "Palevo.X" C:\Documents and Settings\All Users\Start Menu\Programs\actual spy\Uninstall Act ual Spy.lnk - (49f12c83d36fbfba35844592a40717ad) - (Action to be taken : Remove) - belongs to "ActualSpy" C:\Program Files\microsoft\watermark.exe - (Action to be taken : Quarantine) - b elongs to "Zbot.ADH" [Object Type : Registry Value] -----------------------------HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\R UN, application - (Action to be taken : Remove) - belongs to "ActualSpy" [Object Type : Registry Data] ----------------------------HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System, Dis ableRegistryTools [1] - (4,4,0) - (Action to be taken : Quarantine) - belongs to "BLUNE.A" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, Userin it [C:\Program Files\microsoft\watermark.exe] - (1,1,) - (Action to be taken : Q uarantine) - belongs to "Zbot.ADH" ------------------------- End Of File -------------------------