Symptoms:
Presence of files *twain.exe *twain.dll ( where * is one or more random letters, so the files might be qweatwain.dll, qtwain.exe etc.), cfg.dat and, possibly, ??twain.dat ( where ?? are two random letters ) in %WinDir%.

Presence of registry key: HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunwinupd = Rundll32.exe %WinDir%*twain.dll, _mainRD.
Again, the * stands for one or more random letters.