Results of system analysis

Kaspersky Virus Removal Tool 2010 9.0.0.722 (database released 02/06/2011; 12:18)

List of processes

File name	PID	Description	Copyright	MD5	Information
c:\program files\acer display\edisplay management\dthtml.exe Script: Quarantine, Delete, BC delete, Terminate	2232	eDisplay Management	(C) 1993-2009 Portrait Displays, Inc. All rights reserved.	??	1234.61 kb, rsAh, created: 1/04/2011 2:53:06 PM, modified: 26/10/2010 10:24:20 AM Command line: "C:\Program Files\Acer Display\eDisplay Management\DTHtml.exe" -Customer=ACR -startup_folder -DT_Startup
c:\windows\system32\spool\drivers\w32x86\3\e_s4i3f2.exe Script: Quarantine, Delete, BC delete, Terminate	776	EPSON Status Monitor 3	Copyright (C) SEIKO EPSON CORP. 2003	??	97.50 kb, rsAh, created: 29/12/2009 2:48:55 PM, modified: 11/09/2003 1:00:00 PM Command line: "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3F2.EXE" /P30 "EPSON Stylus Photo R310 Series" /O6 "USB001" /M "Stylus Photo R310"
c:\program files\pantone\huey\hueytray.exe Script: Quarantine, Delete, BC delete, Terminate	2380	huey Room Lighting Adjustment Application	Copyright © 2005-2006 GretagMacbeth LLC	??	880.00 kb, rsAh, created: 29/12/2009 3:48:34 PM, modified: 4/12/2006 9:41:54 AM Command line: "C:\Program Files\Pantone\huey\hueyTray.exe"
c:\windows\system32\spoolsv.exe Script: Quarantine, Delete, BC delete, Terminate	1124	Spooler SubSystem App	© Microsoft Corporation. All rights reserved.	??	57.50 kb, rsAh, created: 26/11/2008 6:47:53 PM, modified: 17/08/2010 11:17:06 PM Command line: C:\WINDOWS\system32\spoolsv.exe
c:\program files\clarus\samsung secretzone\szassistsvc.exe Script: Quarantine, Delete, BC delete, Terminate	1580	Samsung SecretZone Assist	Copyright (c) 2001-2010 by Clarus, Inc.	??	88.00 kb, rsAh, created: 14/01/2011 3:58:51 PM, modified: 30/08/2010 10:17:50 AM Command line: "C:\Program Files\Clarus\Samsung SecretZone\SZAssistSVC.exe"
c:\windows\system32\tablet.exe Script: Quarantine, Delete, BC delete, Terminate	1644	WacomService	Copyright © 1997,1998,1999,2000,2001,2002,2003 Wacom Technology, Corp.	??	604.00 kb, rsAh, created: 29/05/2003 11:26:06 PM, modified: 29/05/2003 11:26:06 PM Command line: C:\WINDOWS\system32\Tablet.exe
c:\windows\system32\wtablet\tabuserw.exe Script: Quarantine, Delete, BC delete, Terminate	2404	TABUSERW	Copyright © 1997,1998,1999,2000,2001,2002,2003 Wacom Technology, Corp.	??	76.00 kb, rsAh, created: 29/05/2003 11:33:34 PM, modified: 29/05/2003 11:33:34 PM Command line: "C:\WINDOWS\system32\Wtablet\TabUserW.exe"
Detected:46, recognized as trusted 41

Module name	Handle	Description	Copyright	MD5	Used by processes
C:\Program Files\Clarus\Samsung SecretZone\SZAssistSVC.exe Script: Quarantine, Delete, BC delete	4194304	Samsung SecretZone Assist	Copyright (c) 2001-2010 by Clarus, Inc.	??	1580
C:\Program Files\Common Files\Portrait Displays\Shared\PresetsCOM.dll Script: Quarantine, Delete, BC delete	12451840			--	2232
C:\Program Files\Pantone\huey\hueyTray.exe Script: Quarantine, Delete, BC delete	4194304	huey Room Lighting Adjustment Application	Copyright © 2005-2006 GretagMacbeth LLC	??	2380
C:\Program Files\Pantone\huey\hueyTray_09.dll Script: Quarantine, Delete, BC delete	11993088	huey Room Lighting Adjustment Application	Copyright © 2005-2006 GretagMacbeth LLC	--	2380
C:\Program Files\Pantone\huey\SipCal.dll Script: Quarantine, Delete, BC delete	268435456	SipCal Calibrator Library	Copyright © 2006 GretagMacbeth, LLC	--	2380
C:\WINDOWS\system32\redmonnt.dll Script: Quarantine, Delete, BC delete	14155776			--	1124
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3F2.EXE Script: Quarantine, Delete, BC delete	4194304	EPSON Status Monitor 3	Copyright (C) SEIKO EPSON CORP. 2003	??	776
C:\WINDOWS\system32\Tablet.exe Script: Quarantine, Delete, BC delete	4194304	WacomService	Copyright © 1997,1998,1999,2000,2001,2002,2003 Wacom Technology, Corp.	??	1644
C:\WINDOWS\system32\Wtablet\TabUserW.exe Script: Quarantine, Delete, BC delete	4194304	TABUSERW	Copyright © 1997,1998,1999,2000,2001,2002,2003 Wacom Technology, Corp.	??	2404
Modules detected:504, recognized as trusted 495

Kernel Space Modules Viewer

Module	Base address	Size in memory	Description	Manufacturer
C:\WINDOWS\System32\Drivers\dump_atapi.sys Script: Quarantine, Delete, BC delete	A97C1000	018000 (98304)
C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Script: Quarantine, Delete, BC delete	F7AD6000	002000 (8192)
SYMDS.SYS Script: Quarantine, Delete, BC delete	F739A000	057000 (356352)
SYMEFA.SYS Script: Quarantine, Delete, BC delete	F72CD000	0BB000 (765952)
Modules detected - 129, recognized as trusted - 125

Services

Service	Description	Status	File	Group	Dependencies
SZASSIST Service: Stop, Delete, Disable	SecretZone Assist Service	Running	C:\Program Files\Clarus\Samsung SecretZone\SZAssistSVC.exe Script: Quarantine, Delete, BC delete
TabletService Service: Stop, Delete, Disable	TabletService	Running	C:\WINDOWS\system32\Tablet.exe Script: Quarantine, Delete, BC delete
NBService Service: Stop, Delete, Disable	NBService	Not started	C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe Script: Quarantine, Delete, BC delete		RPCSS
Detected - 99, recognized as trusted - 96

Drivers

Service	Description	Status	File	Group	Dependencies
sym_hi Driver: Unload, Delete, Disable	sym_hi	Not started	sym_hi.sys Script: Quarantine, Delete, BC delete	SCSI miniport
sym_u3 Driver: Unload, Delete, Disable	sym_u3	Not started	sym_u3.sys Script: Quarantine, Delete, BC delete	SCSI miniport
Abiosdsk Driver: Unload, Delete, Disable	Abiosdsk	Not started	Abiosdsk.sys Script: Quarantine, Delete, BC delete	Primary disk
abp480n5 Driver: Unload, Delete, Disable	abp480n5	Not started	abp480n5.sys Script: Quarantine, Delete, BC delete	SCSI miniport
adpu160m Driver: Unload, Delete, Disable	adpu160m	Not started	adpu160m.sys Script: Quarantine, Delete, BC delete	SCSI miniport
Aha154x Driver: Unload, Delete, Disable	Aha154x	Not started	Aha154x.sys Script: Quarantine, Delete, BC delete	SCSI miniport
aic78u2 Driver: Unload, Delete, Disable	aic78u2	Not started	aic78u2.sys Script: Quarantine, Delete, BC delete	SCSI miniport
aic78xx Driver: Unload, Delete, Disable	aic78xx	Not started	aic78xx.sys Script: Quarantine, Delete, BC delete	SCSI miniport
AliIde Driver: Unload, Delete, Disable	AliIde	Not started	AliIde.sys Script: Quarantine, Delete, BC delete	System Bus Extender
amsint Driver: Unload, Delete, Disable	amsint	Not started	amsint.sys Script: Quarantine, Delete, BC delete	SCSI miniport
asc Driver: Unload, Delete, Disable	asc	Not started	asc.sys Script: Quarantine, Delete, BC delete	SCSI miniport
asc3350p Driver: Unload, Delete, Disable	asc3350p	Not started	asc3350p.sys Script: Quarantine, Delete, BC delete	SCSI miniport
asc3550 Driver: Unload, Delete, Disable	asc3550	Not started	asc3550.sys Script: Quarantine, Delete, BC delete	SCSI miniport
Atdisk Driver: Unload, Delete, Disable	Atdisk	Not started	Atdisk.sys Script: Quarantine, Delete, BC delete	Primary disk
cd20xrnt Driver: Unload, Delete, Disable	cd20xrnt	Not started	cd20xrnt.sys Script: Quarantine, Delete, BC delete	SCSI miniport
Changer Driver: Unload, Delete, Disable	Changer	Not started	Changer.sys Script: Quarantine, Delete, BC delete	Filter
CmdIde Driver: Unload, Delete, Disable	CmdIde	Not started	CmdIde.sys Script: Quarantine, Delete, BC delete	System Bus Extender
Cpqarray Driver: Unload, Delete, Disable	Cpqarray	Not started	Cpqarray.sys Script: Quarantine, Delete, BC delete	SCSI miniport
dac960nt Driver: Unload, Delete, Disable	dac960nt	Not started	dac960nt.sys Script: Quarantine, Delete, BC delete	SCSI miniport
dpti2o Driver: Unload, Delete, Disable	dpti2o	Not started	dpti2o.sys Script: Quarantine, Delete, BC delete	SCSI miniport
hpn Driver: Unload, Delete, Disable	hpn	Not started	hpn.sys Script: Quarantine, Delete, BC delete	SCSI miniport
i2omgmt Driver: Unload, Delete, Disable	i2omgmt	Not started	i2omgmt.sys Script: Quarantine, Delete, BC delete	SCSI Class
i2omp Driver: Unload, Delete, Disable	i2omp	Not started	i2omp.sys Script: Quarantine, Delete, BC delete	SCSI miniport
ini910u Driver: Unload, Delete, Disable	ini910u	Not started	ini910u.sys Script: Quarantine, Delete, BC delete	SCSI miniport
IntelIde Driver: Unload, Delete, Disable	IntelIde	Not started	IntelIde.sys Script: Quarantine, Delete, BC delete	System Bus Extender
lbrtfdc Driver: Unload, Delete, Disable	lbrtfdc	Not started	lbrtfdc.sys Script: Quarantine, Delete, BC delete	System Bus Extender
mraid35x Driver: Unload, Delete, Disable	mraid35x	Not started	mraid35x.sys Script: Quarantine, Delete, BC delete	SCSI miniport
PCIDump Driver: Unload, Delete, Disable	PCIDump	Not started	PCIDump.sys Script: Quarantine, Delete, BC delete	PCI Configuration
PDCOMP Driver: Unload, Delete, Disable	PDCOMP	Not started	PDCOMP.sys Script: Quarantine, Delete, BC delete
PDFRAME Driver: Unload, Delete, Disable	PDFRAME	Not started	PDFRAME.sys Script: Quarantine, Delete, BC delete
PDRELI Driver: Unload, Delete, Disable	PDRELI	Not started	PDRELI.sys Script: Quarantine, Delete, BC delete
PDRFRAME Driver: Unload, Delete, Disable	PDRFRAME	Not started	PDRFRAME.sys Script: Quarantine, Delete, BC delete
perc2 Driver: Unload, Delete, Disable	perc2	Not started	perc2.sys Script: Quarantine, Delete, BC delete	SCSI miniport
perc2hib Driver: Unload, Delete, Disable	perc2hib	Not started	perc2hib.sys Script: Quarantine, Delete, BC delete	Filter
Pivot Driver: Unload, Delete, Disable	Pivot	Not started	C:\WINDOWS\system32\drivers\pivot.sys Script: Quarantine, Delete, BC delete	PivotDrivers
pivotmou Driver: Unload, Delete, Disable	Pivot Mouse/Pointers Filter Driver	Not started	C:\WINDOWS\System32\drivers\pivotmou.sys Script: Quarantine, Delete, BC delete	Pointer Port
ql1080 Driver: Unload, Delete, Disable	ql1080	Not started	ql1080.sys Script: Quarantine, Delete, BC delete	SCSI miniport
Ql10wnt Driver: Unload, Delete, Disable	Ql10wnt	Not started	Ql10wnt.sys Script: Quarantine, Delete, BC delete	SCSI miniport
ql12160 Driver: Unload, Delete, Disable	ql12160	Not started	ql12160.sys Script: Quarantine, Delete, BC delete	SCSI miniport
ql1240 Driver: Unload, Delete, Disable	ql1240	Not started	ql1240.sys Script: Quarantine, Delete, BC delete	SCSI miniport
ql1280 Driver: Unload, Delete, Disable	ql1280	Not started	ql1280.sys Script: Quarantine, Delete, BC delete	SCSI miniport
Simbad Driver: Unload, Delete, Disable	Simbad	Not started	Simbad.sys Script: Quarantine, Delete, BC delete	Filter
Sparrow Driver: Unload, Delete, Disable	Sparrow	Not started	Sparrow.sys Script: Quarantine, Delete, BC delete	SCSI miniport
symc810 Driver: Unload, Delete, Disable	symc810	Not started	symc810.sys Script: Quarantine, Delete, BC delete	SCSI miniport
symc8xx Driver: Unload, Delete, Disable	symc8xx	Not started	symc8xx.sys Script: Quarantine, Delete, BC delete	SCSI miniport
TosIde Driver: Unload, Delete, Disable	TosIde	Not started	TosIde.sys Script: Quarantine, Delete, BC delete	System Bus Extender
ultra Driver: Unload, Delete, Disable	ultra	Not started	ultra.sys Script: Quarantine, Delete, BC delete	SCSI miniport
vcdrom Driver: Unload, Delete, Disable	Virtual CD-ROM Device Driver	Not started	C:\WINDOWS\system32\drivers\VCdRom.sys Script: Quarantine, Delete, BC delete
ViaIde Driver: Unload, Delete, Disable	ViaIde	Not started	ViaIde.sys Script: Quarantine, Delete, BC delete	System Bus Extender
WDICA Driver: Unload, Delete, Disable	WDICA	Not started	WDICA.sys Script: Quarantine, Delete, BC delete
Detected - 200, recognized as trusted - 150

Autoruns

File name	Status	Startup method	Description
C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Local Area Connection.lnk Script: Quarantine, Delete, BC delete	Active	File in Autoruns folder	C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Local Area Connection.lnk,
C:\Program Files\Bonjour\mDNSResponder.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Bonjour Service, EventMessageFile Delete
C:\Program Files\Genie-Soft\GBMHome8\XEventMessage.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Genie Backup Manager Home Edition 8.0, EventMessageFile Delete
C:\Program Files\Norton Internet Security\MUI\16.0.0.125\09\01\rcSvcHst.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Norton Internet Security, EventMessageFile Delete
C:\Program Files\Novosoft\Handy Backup\HBPlugins\esebcli2.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\ESE BACKUP, EventMessageFile Delete
C:\Program Files\Pantone\huey\hueyTray.exe Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	C:\Documents and Settings\All Users\Start Menu\Programs\Startup\, C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hueyTray.lnk,
C:\WINDOWS\System32\PrintFilterPipelineSvc.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PrintFilterPipelineSvc, EventMessageFile Delete
C:\WINDOWS\System32\appmgmts.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters, ServiceDll Delete
C:\WINDOWS\System32\appmgmts.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Application Management, EventMessageFile Delete
C:\WINDOWS\System32\appmgr.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Software Installation, EventMessageFile Delete
C:\WINDOWS\System32\fdeploy.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\File Deployment, EventMessageFile Delete
C:\WINDOWS\System32\fdeploy.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Folder Redirection, EventMessageFile Delete
C:\WINDOWS\System32\igmpv2.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile Delete
C:\WINDOWS\System32\ipbootp.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile Delete
C:\WINDOWS\System32\iprip2.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile Delete
C:\WINDOWS\System32\ntbackup.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\ntbackup, EventMessageFile Delete
C:\WINDOWS\System32\ospf.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPF, EventMessageFile Delete
C:\WINDOWS\System32\ospfmib.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPFMib, EventMessageFile Delete
C:\WINDOWS\System32\polagent.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PolicyAgent, EventMessageFile Delete
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3F2.EXE Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, EPSON Stylus Photo R310 Series Delete
C:\WINDOWS\System32\tssdis.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\TermServSessDir, EventMessageFile Delete
C:\WINDOWS\system32\MsSip1.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 1, $DLL Delete
C:\WINDOWS\system32\MsSip2.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 2, $DLL Delete
C:\WINDOWS\system32\MsSip3.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 3, $DLL Delete
C:\WINDOWS\system32\Wtablet\TabUserW.exe Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	C:\Documents and Settings\All Users\Start Menu\Programs\Startup\, C:\Documents and Settings\All Users\Start Menu\Programs\Startup\TabUserW.exe.lnk,
C:\WINDOWS\system32\asr_fmt.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR format utility for volumes Delete
C:\WINDOWS\system32\asr_ldm.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR utility for Logical Disk Manager Delete
C:\WINDOWS\system32\asr_pfu.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR protected file utility Delete
C:\WINDOWS\system32\drivers\pivot.sys Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\pivot, EventMessageFile Delete
C:\WINDOWS\system32\psxss.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
C:\WINDOWS\system32\stisvc.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System, EventMessageFile Delete
SDEvents.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Spybot - Search & Destroy 2, EventMessageFile Delete
appmgmts.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}, DLLName Delete
kbd101.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver JPN Delete
kbd101a.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver KOR Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, .DEFAULT\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-19\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-20\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-18\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-21-854546202-2644002386-3012357816-1006\Control Panel\IOProcs, MVB Delete
vgafix.fon Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon Delete
vgaoem.fon Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon Delete
vgasys.fon Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon Delete
Autoruns items detected - 603, recognized as trusted - 560

Microsoft Internet Explorer extension modules (BHOs, Toolbars ...)

File name	Type	Description	Manufacturer	CLSID
C:\Program Files\MyAshampoo\prxtbMyAs.dll Script: Quarantine, Delete, BC delete	BHO			{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} Delete
	Extension module			{2670000A-7350-4f3c-8081-5663EE0C6C49} Delete
	Extension module			{92780B25-18CC-41C8-B9BE-3C9C571A8263} Delete
C:\Program Files\MyAshampoo\prxtbMyAs.dll Script: Quarantine, Delete, BC delete	URLSearchHook			{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} Delete
Elements detected - 16, recognized as trusted - 12

Windows Explorer extension modules

File name	Destination	Description	Manufacturer	CLSID
deskpan.dll Script: Quarantine, Delete, BC delete	Display Panning CPL Extension			{42071714-76d4-11d1-8b24-00a0c9068ff3} Delete
	Shell extensions for file compression			{764BF0E1-F219-11ce-972D-00AA00A14F56} Delete
	Encryption Context Menu			{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} Delete
	Taskbar and Start Menu			{0DF44EAA-FF21-4412-828E-260A8728E7F1} Delete
rundll32.exe C:\WINDOWS\system32\shimgvw.dll,ImageView_COMServer {00E7B358-F65B-4dcf-83DF-CD026B94BFD4} Script: Quarantine, Delete, BC delete	Autoplay for SlideShow			{00E7B358-F65B-4dcf-83DF-CD026B94BFD4} Delete
	User Accounts			{7A9D77BD-5403-11d2-8785-2E0420524153} Delete
	Windows Search Shell Service			{da67b8ad-e81b-4c70-9b91b417b5e33527} Delete
	IE User Assist			{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} Delete
	IZArc Shell Context Menu			{BC593DF5-466F-44EC-8FFD-C4DBC603B917} Delete
	IZArc DragDrop Menu			{CA5FEE26-14C1-4B5A-86E9-233FC0EE2682} Delete
C:\Program Files\Common Files\Portrait Displays\Shared\HtmlEngine.dll Script: Quarantine, Delete, BC delete	PDI GUI Engine COM Obj	HTML UI Engine	(c) 2003 Portrait Displays, Inc. All rights reserved.	{654D0431-C930-43C4-B8DA-9AA01BA5B486} Delete
Elements detected - 234, recognized as trusted - 223

Printing system extensions (print monitors, providers)

File name	Type	Name	Description	Manufacturer
C:\WINDOWS\system32\redmonnt.dll Script: Quarantine, Delete, BC delete	Monitor	Redirected Port
Elements detected - 11, recognized as trusted - 10

Task Scheduler jobs

File name	Job name	Job status	Description	Manufacturer
Elements detected - 1, recognized as trusted - 1

SPI/LSP settings

Namespace providers (NSP)

Provider	Status	EXE file	Description	GUID
Detected - 3, recognized as trusted - 3

Transport protocol providers (TSP, LSP)

Provider EXE file Description
Detected - 11, recognized as trusted - 11
Results of automatic SPI settings check
LSP settings checked. No errors detected

TCP/UDP ports

Port Status Remote Host Remote Port Application Notes
TCP ports
135 LISTENING 0.0.0.0 8250 [848] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
445 LISTENING 0.0.0.0 24644 [4] System
Script: Quarantine, Delete, BC delete, Terminate
1025 LISTENING 0.0.0.0 222 [1480] c:\program files\norton internet security\engine\18.6.0.29\ccsvchst.exe
Script: Quarantine, Delete, BC delete, Terminate
1029 LISTENING 0.0.0.0 39118 [2100] c:\windows\system32\alg.exe
Script: Quarantine, Delete, BC delete, Terminate
5152 LISTENING 0.0.0.0 41037 [1432] c:\program files\java\jre6\bin\jqs.exe
Script: Quarantine, Delete, BC delete, Terminate
UDP ports
123 LISTENING -- -- [900] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
445 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
500 LISTENING -- -- [596] c:\windows\system32\lsass.exe
Script: Quarantine, Delete, BC delete, Terminate
1900 LISTENING -- -- [1012] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
4500 LISTENING -- -- [596] c:\windows\system32\lsass.exe
Script: Quarantine, Delete, BC delete, Terminate

Downloaded Program Files (DPF)

File name Description Manufacturer CLSID Source URL
C:\PROGRA~1\MICROS~2\Office12\IEAWSDC.DLL
Script: Quarantine, Delete, BC delete {02BCC737-B171-4746-94C9-0D8A0B2C0089}
Delete http://office.microsoft.com/sites/production/ieawsdc32.cab
{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}
Delete http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
{E2883E8F-472F-4FB0-9522-AC9BF37916A7}
Delete http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Elements detected - 14, recognized as trusted - 11

Control Panel Applets (CPL)

File name Description Manufacturer
C:\WINDOWS\system32\pentablet.cpl
Script: Quarantine, Delete, BC delete LLC Copyright © 1997,1998,1999,2000,2001,2002,2003 Wacom Technology, Corp.
Elements detected - 28, recognized as trusted - 27

Active Setup

File name Description Manufacturer CLSID
Elements detected - 14, recognized as trusted - 14

HOSTS file

Hosts file record
яю1

Protocols and handlers

File name Type Description Manufacturer CLSID
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Elements detected - 31, recognized as trusted - 28

Suspicious objects

File Description Type
C:\WINDOWS\system32\Drivers\SYMEVENT.SYS
Script: Quarantine, Delete, BC delete Suspicion for Rootkit Kernel-mode hook

Main script of analysis Windows version: Microsoft Windows XP, Build=2600, SP="Service Pack 3" System Restore: enabled 1.1 Searching for user-mode API hooks Analysis: kernel32.dll, export table found in section .text IAT modification detected: CreateProcessA - 00DA0010<>7C80236B IAT modification detected: GetModuleFileNameA - 00DA0080<>7C80B56F IAT modification detected: GetModuleFileNameW - 00DA00F0<>7C80B475 IAT modification detected: CreateProcessW - 00DA0160<>7C802336 IAT modification detected: LoadLibraryW - 00DA0240<>7C80AEEB IAT modification detected: LoadLibraryA - 00DA0320<>7C801D7B IAT modification detected: GetProcAddress - 00DA0390<>7C80AE40 IAT modification detected: FreeLibrary - 00DA0400<>7C80AC7E Analysis: ntdll.dll, export table found in section .text Analysis: user32.dll, export table found in section .text Analysis: advapi32.dll, export table found in section .text Analysis: ws2_32.dll, export table found in section .text Analysis: wininet.dll, export table found in section .text Analysis: rasapi32.dll, export table found in section .text Analysis: urlmon.dll, export table found in section .text Analysis: netapi32.dll, export table found in section .text >> Danger ! Process masking detected 1.2 Searching for kernel-mode API hooks Driver loaded successfully SDT found (RVA=085700) Kernel ntkrnlpa.exe found in memory at address 804D7000 SDT = 8055C700 KiST = 80504480 (284) Function NtAlertResumeThread (0C) intercepted (805D4B1E->85EBA118), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtAlertThread (0D) intercepted (805D4ACE->85EBA008), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtAllocateVirtualMemory (11) intercepted (805A8A80->8589F1A8), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtAssignProcessToJobObject (13) intercepted (805D65E2->85EE2670), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtConnectPort (1F) intercepted (805A4596->85FB4680), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtCreateKey (29) intercepted (806237C8->A9FDC710), hook C:\WINDOWS\system32\Drivers\SYMEVENT.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateMutant (2B) intercepted (80616D76->85EE11B0), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtCreateSymbolicLinkObject (34) intercepted (805C39A6->85EAB1B8), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtCreateThread (35) intercepted (805D0FD2->85EC3AC8), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtDebugActiveProcess (39) intercepted (8064320E->85EE2730), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtDeleteKey (3F) intercepted (80623C64->A9FDC990), hook C:\WINDOWS\system32\Drivers\SYMEVENT.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeleteValueKey (41) intercepted (80623E34->A9FDCEF0), hook C:\WINDOWS\system32\Drivers\SYMEVENT.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDuplicateObject (44) intercepted (805BDFB4->85EE21A8), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtFreeVirtualMemory (53) intercepted (805B2F5E->858211A8), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtImpersonateAnonymousToken (59) intercepted (805F8A50->85EF5138), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtImpersonateThread (5B) intercepted (805D77A2->85EF5008), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtLoadDriver (61) intercepted (8058413A->85F36528), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtMapViewOfSection (6C) intercepted (805B1FE6->858210C8), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtOpenEvent (72) intercepted (8060E734->85E779F0), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtOpenProcess (7A) intercepted (805CB3FA->85E901A8), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtOpenProcessToken (7B) intercepted (805ED706->85EE20E8), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtOpenSection (7D) intercepted (805AA3B2->8589D180), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtOpenThread (80) intercepted (805CB686->85E900D8), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtProtectVirtualMemory (89) intercepted (805B83CA->85E887E0), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtResumeThread (CE) intercepted (805D495A->85ECD100), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtSetContextThread (D5) intercepted (805D16F4->85EC11C0), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtSetInformationProcess (E4) intercepted (805CDE44->85EA90C8), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtSetSystemInformation (F0) intercepted (8060F3EC->85EF50C0), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtSetValueKey (F7) intercepted (80621D3A->A9FDD140), hook C:\WINDOWS\system32\Drivers\SYMEVENT.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSuspendProcess (FD) intercepted (805D4A22->85F001C0), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtSuspendThread (FE) intercepted (805D4894->85ECD1C0), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtTerminateProcess (101) intercepted (805D2982->85F0AF90), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtTerminateThread (102) intercepted (805D2B7C->85EC10E0), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtUnmapViewOfSection (10B) intercepted (805B2DF4->85EA91B8), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtWriteVirtualMemory (115) intercepted (805B4378->8589F0D8), hook not defined >>> Function restored successfully ! >>> Hook code blocked Functions checked: 284, intercepted: 35, restored: 35 1.3 Checking IDT and SYSENTER Analysis for CPU 1 Analysis for CPU 2 CmpCallCallBacks = 00093D84 Disable callback OK Checking IDT and SYSENTER - complete 1.4 Searching for masking processes and drivers Searching for masking processes and drivers - complete Driver loaded successfully 1.5 Checking of IRP handlers Checking - complete >> Services: potentially dangerous service allowed: TermService (Terminal Services) Error [2, SC_EXT_ADDITEMST] >> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery Service) Error [2, SC_EXT_ADDITEMST] >> Services: potentially dangerous service allowed: Schedule (Task Scheduler) Error [2, SC_EXT_ADDITEMST] >> Services: potentially dangerous service allowed: mnmsrvc (NetMeeting Remote Desktop Sharing) Error [2, SC_EXT_ADDITEMST] >> Services: potentially dangerous service allowed: RDSessMgr (Remote Desktop Help Session Manager) Error [2, SC_EXT_ADDITEMST] > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)! >> Security: disk drives' autorun is enabled Error [2, SC_EXT_ADDITEMST] >> Security: administrative shares (C$, D$ ...) are enabled Error [2, SC_EXT_ADDITEMST] >> Security: anonymous user access is enabled Error [2, SC_EXT_ADDITEMST] Error [2, SC_EXT_ADDITEMST] >> Security: sending Remote Assistant queries is enabled >> Disable HDD autorun >> Disable autorun from network drives >> Disable CD/DVD autorun >> Disable removable media autorun >> Windows Explorer - show extensions of known file types System Analysis in progress
System Analysis - complete
Script commands

Add commands to script:
Blocking hooks using Anti-Rootkit
Enable AVZGuard
Operations with AVZPM (true=enable,false=disable)
BootCleaner - import list of deleted files
Registry cleanup after deleting files
BootCleaner - activate
Reboot
Insert template for QuarantineFile() - quarantining file
Insert template for BC_QrFile() - quarantining file via BootCleaner
Insert template for DeleteFile() - deleting file
Insert template for DelCLSID() - deleting CLSID item from registry
Additional operations:
Performance tweaking: disable service TermService (Terminal Services)
Performance tweaking: disable service SSDPSRV (SSDP Discovery Service)
Performance tweaking: disable service Schedule (Task Scheduler)
Performance tweaking: disable service mnmsrvc (NetMeeting Remote Desktop Sharing)
Performance tweaking: disable service RDSessMgr (Remote Desktop Help Session Manager)
Security tweaking: disable CD autorun
Security tweaking: disable administrative shares
Security tweaking: disable anonymous user access
Security: disable sending Remote Assistant queries
File list

Port	Status	Remote Host	Remote Port	Application	Notes
TCP ports
135	LISTENING	0.0.0.0	8250	[848] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
445	LISTENING	0.0.0.0	24644	[4] System Script: Quarantine, Delete, BC delete, Terminate
1025	LISTENING	0.0.0.0	222	[1480] c:\program files\norton internet security\engine\18.6.0.29\ccsvchst.exe Script: Quarantine, Delete, BC delete, Terminate
1029	LISTENING	0.0.0.0	39118	[2100] c:\windows\system32\alg.exe Script: Quarantine, Delete, BC delete, Terminate
5152	LISTENING	0.0.0.0	41037	[1432] c:\program files\java\jre6\bin\jqs.exe Script: Quarantine, Delete, BC delete, Terminate
UDP ports
123	LISTENING	--	--	[900] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
445	LISTENING	--	--	[4] System Script: Quarantine, Delete, BC delete, Terminate
500	LISTENING	--	--	[596] c:\windows\system32\lsass.exe Script: Quarantine, Delete, BC delete, Terminate
1900	LISTENING	--	--	[1012] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
4500	LISTENING	--	--	[596] c:\windows\system32\lsass.exe Script: Quarantine, Delete, BC delete, Terminate