Created by anti-spyware software WinDetect:

• Version: 2.10.0

Possible suspicious files:

• %win_dir%\system32\drivers\a347bus.sys
• %win_dir%\system32\drivers\imagedrv.sys
• %win_dir%\system32\drivers\imagesrv.sys
• c:\recycler\r-1-5-21-1482476501-1644491937-682003330-1013\scleaner.exe
• %win_dir%\system32\drivers\a347scsi.sys

%win_dir%\system32\drivers\a347bus.sys

• Company is (3.47.0.0 built by: WinDDK).
• File checksum is 1F61CACACB521215F39061789147968C.
• Starts at system boot.
• Registered as a347bus.
more info ...

%win_dir%\system32\drivers\imagedrv.sys

• Company is Ahead Software AG(2.27.0.0 built by: WinDDK).
• File checksum is 0A7C49B48C772591A2D362DAA00246C8.
• Starts at system boot.
• Registered as imagedrv.
more info ...

%win_dir%\system32\drivers\imagesrv.sys

• Company is Ahead Software AG(2.27.0.0 built by: WinDDK).
• File checksum is 549BA4F539E7B8D8129500B96DD7B27A.
• Starts at system boot.
• Registered as imagesrv.
more info ...

c:\recycler\r-1-5-21-1482476501-1644491937-682003330-1013\scleaner.exe

• The file does not contain company name.
• The file was created short time ago. Spywares very often re-creates new files after system login.
• File checksum is 860C0AEF68E375E192846EADA3DB29F2.
• Spoofs the system process.
• Windows Explorer starts it automatically.
• Registered as Firewall Security Service.
• Was not detected by anti-viruses.
more info ...

%win_dir%\system32\drivers\a347scsi.sys

• Company is (3.47.0.0 built by: WinDDK).
• File checksum is 113E4B318BBAA7483CA4E582A4D63F49.
• Starts at system boot.
• Registered as a347scsi.
more info ...