Kaspersky Virus Removal Tool 2010 9.0.0.722 (database released 02/07/2011; 13:53)
| File name | PID | Description | Copyright | MD5 | Information
| c:\program files\t-mobile mobile broadband manager\assistantservices.exe | Script: Quarantine, Delete, BC delete, Terminate 1204 | | | ?? | 236.00 kb, rsAh, | created: 10/08/2010 19:26:32, modified: 16/07/2009 14:43:04 Command line: "C:\Program Files\T-Mobile Mobile Broadband Manager\AssistantServices.exe" c:\program files\alwil software\avast5\avastsvc.exe | Script: Quarantine, Delete, BC delete, Terminate 1920 | avast! Service | Copyright (c) 2011 AVAST Software | ?? | 41.20 kb, rsAh, | created: 02/08/2010 21:21:50, modified: 10/05/2011 13:10:57 Command line: "C:\Program Files\Alwil Software\Avast5\AvastSvc.exe" c:\windows\system\hpsysdrv.exe | Script: Quarantine, Delete, BC delete, Terminate 2644 | hpsysdrv | Copyright © 1998 | ?? | 51.50 kb, rsAh, | created: 07/04/2003 14:43:46, modified: 19/07/2001 14:50:04 Command line: "C:\windows\system\hpsysdrv.exe" c:\program files\hpq\notebook utilities\hpwirelessmgr.exe | Script: Quarantine, Delete, BC delete, Terminate 528 | HPWirelessMgr Module | Hewlett-Packard Copyright 2002 | ?? | 52.00 kb, rsAh, | created: 07/04/2003 14:34:13, modified: 17/07/2002 10:12:20 Command line: "C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe" c:\program files\t-mobile mobile broadband manager\uiexec.exe | Script: Quarantine, Delete, BC delete, Terminate 2764 | | | ?? | 129.50 kb, rsAh, | created: 10/08/2010 19:26:36, modified: 16/07/2009 14:42:20 Command line: "C:\Program Files\T-Mobile Mobile Broadband Manager\UIExec.exe" Detected:35, recognized as trusted 31
| | |||||
| Module name | Handle | Description | Copyright | MD5 | Used by processes
| C:\Program Files\Alwil Software\Avast5\defs\11070100\algo.dll | Script: Quarantine, Delete, BC delete 1665138688 | | | -- | 1920
| C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe | Script: Quarantine, Delete, BC delete 4194304 | HPWirelessMgr Module | Hewlett-Packard Copyright 2002 | ?? | 528
| C:\Program Files\T-Mobile Mobile Broadband Manager\AssistantServices.exe | Script: Quarantine, Delete, BC delete 4194304 | | | ?? | 1204
| C:\Program Files\T-Mobile Mobile Broadband Manager\UIExec.exe | Script: Quarantine, Delete, BC delete 4194304 | | | ?? | 2764
| C:\windows\system\hpsysdrv.exe | Script: Quarantine, Delete, BC delete 4194304 | hpsysdrv | Copyright © 1998 | ?? | 2644
| Modules detected:497, recognized as trusted 492
| | |||||
| Module | Base address | Size in memory | Description | Manufacturer
| C:\WINDOWS\system32\Drivers\atisgkaf.sys | Script: Quarantine, Delete, BC delete F81B1000 | 006000 (24576) | ATI AGP driver | Copyright (C) Microsoft Corp. 1981-1999
| C:\WINDOWS\system32\Drivers\BMLoad.sys | Script: Quarantine, Delete, BC delete F81B9000 | 006000 (24576) | Bytemobile Kernel Driver Loader | Copyright (C) 2000-2008 Bytemobile, Inc.
| C:\WINDOWS\System32\Drivers\tcpipBM.SYS | Script: Quarantine, Delete, BC delete F82B1000 | 005000 (20480) | Bytemobile Kernel Network Provider | Copyright (C) 2000-2008 Bytemobile, Inc.
| Modules detected - 150, recognized as trusted - 147
| | ||||
| Service | Description | Status | File | Group | Dependencies
| HPWirelessMgr | Service: Stop, Delete, Disable HPWirelessMgr | Running | C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe | Script: Quarantine, Delete, BC delete | RPCSS
| UI Assistant Service | Service: Stop, Delete, Disable UI Assistant Service | Running | C:\Program Files\T-Mobile Mobile Broadband Manager\AssistantServices.exe | Script: Quarantine, Delete, BC delete |
| iPod Service | Service: Stop, Delete, Disable iPod Service | Not started | C:\Program Files\iPod\bin\iPodService.exe | Script: Quarantine, Delete, BC delete | RpcSs
| Detected - 111, recognized as trusted - 108
| | ||||||
| Service | Description | Status | File | Group | Dependencies
| caboagp | Driver: Unload, Delete, Disable ATI Cabo AGP Filter | Running | C:\WINDOWS\System32\DRIVERS\atisgkaf.sys | Script: Quarantine, Delete, BC delete PnP Filter |
| tcpipBM | Driver: Unload, Delete, Disable Bytemobile Kernel Network Provider | Running | C:\WINDOWS\system32\Drivers\tcpipBM.sys | Script: Quarantine, Delete, BC delete PNP_TDI | Tcpip
| Abiosdsk | Driver: Unload, Delete, Disable Abiosdsk | Not started | Abiosdsk.sys | Script: Quarantine, Delete, BC delete Primary disk |
| abp480n5 | Driver: Unload, Delete, Disable abp480n5 | Not started | abp480n5.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| adpu160m | Driver: Unload, Delete, Disable adpu160m | Not started | adpu160m.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Aha154x | Driver: Unload, Delete, Disable Aha154x | Not started | Aha154x.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| aic78u2 | Driver: Unload, Delete, Disable aic78u2 | Not started | aic78u2.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| aic78xx | Driver: Unload, Delete, Disable aic78xx | Not started | aic78xx.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ALiIRDA | Driver: Unload, Delete, Disable ALi Infrared Device Driver | Not started | C:\WINDOWS\system32\DRIVERS\aliirda.sys | Script: Quarantine, Delete, BC delete NDIS |
| amsint | Driver: Unload, Delete, Disable amsint | Not started | amsint.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| asc | Driver: Unload, Delete, Disable asc | Not started | asc.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| asc3350p | Driver: Unload, Delete, Disable asc3350p | Not started | asc3350p.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| asc3550 | Driver: Unload, Delete, Disable asc3550 | Not started | asc3550.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Atdisk | Driver: Unload, Delete, Disable Atdisk | Not started | Atdisk.sys | Script: Quarantine, Delete, BC delete Primary disk |
| BCM43XX | Driver: Unload, Delete, Disable BCM 802.11g Network Adapter Driver | Not started | C:\WINDOWS\system32\DRIVERS\bcmwl5.sys | Script: Quarantine, Delete, BC delete NDIS |
| catchme | Driver: Unload, Delete, Disable catchme | Not started | C:\DOCUME~1\sworthin\LOCALS~1\Temp\catchme.sys | Script: Quarantine, Delete, BC delete Base |
| cd20xrnt | Driver: Unload, Delete, Disable cd20xrnt | Not started | cd20xrnt.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Changer | Driver: Unload, Delete, Disable Changer | Not started | Changer.sys | Script: Quarantine, Delete, BC delete Filter |
| CmdIde | Driver: Unload, Delete, Disable CmdIde | Not started | CmdIde.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| Cpqarray | Driver: Unload, Delete, Disable Cpqarray | Not started | Cpqarray.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| dac960nt | Driver: Unload, Delete, Disable dac960nt | Not started | dac960nt.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| dpti2o | Driver: Unload, Delete, Disable dpti2o | Not started | dpti2o.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| hpn | Driver: Unload, Delete, Disable hpn | Not started | hpn.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| i2omgmt | Driver: Unload, Delete, Disable i2omgmt | Not started | i2omgmt.sys | Script: Quarantine, Delete, BC delete SCSI Class |
| i2omp | Driver: Unload, Delete, Disable i2omp | Not started | i2omp.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ini910u | Driver: Unload, Delete, Disable ini910u | Not started | ini910u.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| lbrtfdc | Driver: Unload, Delete, Disable lbrtfdc | Not started | lbrtfdc.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| mraid35x | Driver: Unload, Delete, Disable mraid35x | Not started | mraid35x.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| pccsmcfd | Driver: Unload, Delete, Disable PCCS Mode Change Filter Driver | Not started | C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys | Script: Quarantine, Delete, BC delete |
| PCIDump | Driver: Unload, Delete, Disable PCIDump | Not started | PCIDump.sys | Script: Quarantine, Delete, BC delete PCI Configuration |
| PDCOMP | Driver: Unload, Delete, Disable PDCOMP | Not started | PDCOMP.sys | Script: Quarantine, Delete, BC delete |
| PDFRAME | Driver: Unload, Delete, Disable PDFRAME | Not started | PDFRAME.sys | Script: Quarantine, Delete, BC delete |
| PDRELI | Driver: Unload, Delete, Disable PDRELI | Not started | PDRELI.sys | Script: Quarantine, Delete, BC delete |
| PDRFRAME | Driver: Unload, Delete, Disable PDRFRAME | Not started | PDRFRAME.sys | Script: Quarantine, Delete, BC delete |
| perc2 | Driver: Unload, Delete, Disable perc2 | Not started | perc2.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| perc2hib | Driver: Unload, Delete, Disable perc2hib | Not started | perc2hib.sys | Script: Quarantine, Delete, BC delete Filter |
| ql1080 | Driver: Unload, Delete, Disable ql1080 | Not started | ql1080.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Ql10wnt | Driver: Unload, Delete, Disable Ql10wnt | Not started | Ql10wnt.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ql12160 | Driver: Unload, Delete, Disable ql12160 | Not started | ql12160.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ql1240 | Driver: Unload, Delete, Disable ql1240 | Not started | ql1240.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ql1280 | Driver: Unload, Delete, Disable ql1280 | Not started | ql1280.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| SABKUTIL | Driver: Unload, Delete, Disable SABKUTIL | Not started | C:\Program Files\SUPERAntiSpyware\SABKUTIL.sys | Script: Quarantine, Delete, BC delete |
| Simbad | Driver: Unload, Delete, Disable Simbad | Not started | Simbad.sys | Script: Quarantine, Delete, BC delete Filter |
| Sparrow | Driver: Unload, Delete, Disable Sparrow | Not started | Sparrow.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| sym_hi | Driver: Unload, Delete, Disable sym_hi | Not started | sym_hi.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| sym_u3 | Driver: Unload, Delete, Disable sym_u3 | Not started | sym_u3.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| symc810 | Driver: Unload, Delete, Disable symc810 | Not started | symc810.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| symc8xx | Driver: Unload, Delete, Disable symc8xx | Not started | symc8xx.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| TosIde | Driver: Unload, Delete, Disable TosIde | Not started | TosIde.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| ultra | Driver: Unload, Delete, Disable ultra | Not started | ultra.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| WDICA | Driver: Unload, Delete, Disable WDICA | Not started | WDICA.sys | Script: Quarantine, Delete, BC delete |
| WlanUIG | Driver: Unload, Delete, Disable EDUP 802.11g Wireless LAN USB Adapter Driver | Not started | C:\WINDOWS\system32\DRIVERS\WlanUIG.sys | Script: Quarantine, Delete, BC delete NDIS |
| Detected - 228, recognized as trusted - 176
| | ||||||
| File name | Status | Startup method | Description
| C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\ccEvtMgr, EventMessageFile | Delete C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\ccPwdSvc, EventMessageFile | Delete C:\Program Files\HPQ\Default Settings\cpqset.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, Cpqset | Delete C:\Program Files\Norton SystemWorks\Norton Utilities\UE32.EXE | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\NUEWizard, EventMessageFile | Delete C:\Program Files\T-Mobile Mobile Broadband Manager\UIExec.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, UIExec | Delete C:\WINDOWS\System32\Ip6FwHlp.dll;C:\WINDOWS\System32\xpob2res.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Ip6FwHlp, EventMessageFile | Delete C:\WINDOWS\System32\PrintFilterPipelineSvc.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PrintFilterPipelineSvc, EventMessageFile | Delete C:\WINDOWS\System32\appmgmts.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters, ServiceDll | Delete C:\WINDOWS\System32\appmgmts.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Application Management, EventMessageFile | Delete C:\WINDOWS\System32\appmgr.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Software Installation, EventMessageFile | Delete C:\WINDOWS\System32\fdeploy.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\File Deployment, EventMessageFile | Delete C:\WINDOWS\System32\fdeploy.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Folder Redirection, EventMessageFile | Delete C:\WINDOWS\System32\hidserv.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\HidServ\Parameters, ServiceDll | Delete C:\WINDOWS\System32\igmpv2.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile | Delete C:\WINDOWS\System32\ipbootp.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile | Delete C:\WINDOWS\System32\iprip2.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile | Delete C:\WINDOWS\System32\ospf.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPF, EventMessageFile | Delete C:\WINDOWS\System32\ospfmib.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPFMib, EventMessageFile | Delete C:\WINDOWS\System32\polagent.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PolicyAgent, EventMessageFile | Delete C:\WINDOWS\System32\tssdis.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\TermServSessDir, EventMessageFile | Delete C:\WINDOWS\system32\MsSip1.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 1, $DLL | Delete C:\WINDOWS\system32\MsSip2.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 2, $DLL | Delete C:\WINDOWS\system32\MsSip3.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 3, $DLL | Delete C:\WINDOWS\system32\asr_fmt.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR format utility for volumes | Delete C:\WINDOWS\system32\asr_ldm.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR utility for Logical Disk Manager | Delete C:\WINDOWS\system32\asr_pfu.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR protected file utility | Delete C:\WINDOWS\system32\psxss.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
| C:\WINDOWS\system32\stisvc.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System, EventMessageFile | Delete appmgmts.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}, DLLName | Delete c:\windows\system\hpsysdrv.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, hpsysdrv | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, .DEFAULT\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-19\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-20\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-18\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-21-3532832697-4035846255-1194078510-1008\Control Panel\IOProcs, MVB | Delete vgafix.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon | Delete vgaoem.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon | Delete vgasys.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon | Delete Autoruns items detected - 642, recognized as trusted - 604
| | ||||||
| File name | Type | Description | Manufacturer | CLSID
| Explorer Bar | {32683183-48a0-441b-a342-7c2a440a9478} | Delete Elements detected - 8, recognized as trusted - 7
| | |||||||||
| File name | Destination | Description | Manufacturer | CLSID
| Multimedia File Property Sheet | {00022613-0000-0000-C000-000000000046} | Delete Display Panning CPL Extension | {42071714-76d4-11d1-8b24-00a0c9068ff3} | Delete Shell extensions for file compression | {764BF0E1-F219-11ce-972D-00AA00A14F56} | Delete Encryption Context Menu | {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} | Delete Taskbar and Start Menu | {0DF44EAA-FF21-4412-828E-260A8728E7F1} | Delete Media Band | {32683183-48a0-441b-a342-7c2a440a9478} | Delete User Accounts | {7A9D77BD-5403-11d2-8785-2E0420524153} | Delete Windows Search Shell Service | {da67b8ad-e81b-4c70-9b91b417b5e33527} | Delete Elements detected - 217, recognized as trusted - 209
| | ||||||||||||||||||||||||||||||
| File name | Type | Name | Description | Manufacturer
| Elements detected - 8, recognized as trusted - 8
| | ||||||
| File name | Job name | Job status | Description | Manufacturer
| Elements detected - 0, recognized as trusted - 0
| | ||||||
| Provider | Status | EXE file | Description | GUID
| Detected - 5, recognized as trusted - 5
| | ||||||
| Provider | EXE file | Description
| Detected - 35, recognized as trusted - 35
| | ||||||
| File name | Description | Manufacturer | CLSID | Source URL
| {9F1C11AA-197B-4942-BA54-47A8489BB47F} | Delete http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37951.2587847222
| Elements detected - 6, recognized as trusted - 5
| | |||||||||
| File name | Description | Manufacturer
| C:\WINDOWS\system32\bcmwlcpl.cpl | Script: Quarantine, Delete, BC delete Wireless LAN Utility | 2002 Belkin Corporation, All rights reserved
| Elements detected - 26, recognized as trusted - 25
| | ||||||
| File name | Description | Manufacturer | CLSID
| Elements detected - 15, recognized as trusted - 15
| | ||||||
Hosts file record
|
| File name | Type | Description | Manufacturer | CLSID
| mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| Elements detected - 33, recognized as trusted - 30
| | ||||||
| File | Description | Type
| C:\WINDOWS\System32\Drivers\aswSnx.SYS | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| C:\WINDOWS\System32\Drivers\aswSP.SYS | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| C:\WINDOWS\System32\vsdatant.sys | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| \SystemRoot\System32\Drivers\aswSP.SYS | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| |
Main script of analysis Windows version: Microsoft Windows XP, Build=2600, SP="Service Pack 3" System Restore: enabled 1.1 Searching for user-mode API hooks Analysis: kernel32.dll, export table found in section .text IAT modification detected: CreateProcessA - 00BF0010<>7C80236B IAT modification detected: GetModuleFileNameA - 00BF0080<>7C80B56F IAT modification detected: GetModuleFileNameW - 00BF00F0<>7C80B475 IAT modification detected: CreateProcessW - 00BF0160<>7C802336 IAT modification detected: LoadLibraryW - 00BF0240<>7C80AEEB IAT modification detected: LoadLibraryA - 00BF0320<>7C801D7B IAT modification detected: GetProcAddress - 00BF0390<>7C80AE40 IAT modification detected: FreeLibrary - 00BF0400<>7C80AC7E Analysis: ntdll.dll, export table found in section .text Function ntdll.dll:LdrLoadDll (70) intercepted, method APICodeHijack.JmpTo[001501EE] Function ntdll.dll:LdrUnloadDll (80) intercepted, method APICodeHijack.JmpTo[001503F2] Analysis: user32.dll, export table found in section .text Function user32.dll:SetWinEventHook (639) intercepted, method APICodeHijack.JmpTo[003D01EE] Function user32.dll:SetWindowsHookExA (651) intercepted, method APICodeHijack.JmpTo[003D05F6] Function user32.dll:SetWindowsHookExW (652) intercepted, method APICodeHijack.JmpTo[003D07FA] Function user32.dll:UnhookWinEvent (685) intercepted, method APICodeHijack.JmpTo[003D03F2] Function user32.dll:UnhookWindowsHookEx (687) intercepted, method APICodeHijack.JmpTo[003D09FE] Analysis: advapi32.dll, export table found in section .text Function advapi32.dll:ChangeServiceConfig2A (54) intercepted, method APICodeHijack.JmpTo[003C0C02] Function advapi32.dll:ChangeServiceConfig2W (55) intercepted, method APICodeHijack.JmpTo[003C0E06] Function advapi32.dll:ChangeServiceConfigA (56) intercepted, method APICodeHijack.JmpTo[003C07FA] Function advapi32.dll:ChangeServiceConfigW (57) intercepted, method APICodeHijack.JmpTo[003C09FE] Function advapi32.dll:CreateServiceA (102) intercepted, method APICodeHijack.JmpTo[003C01EE] Function advapi32.dll:CreateServiceW (103) intercepted, method APICodeHijack.JmpTo[003C03F2] Function advapi32.dll:DeleteService (177) intercepted, method APICodeHijack.JmpTo[003C05F6] Function advapi32.dll:SetServiceObjectSecurity (572) intercepted, method APICodeHijack.JmpTo[003C100A] Analysis: ws2_32.dll, export table found in section .text Analysis: wininet.dll, export table found in section .text Analysis: rasapi32.dll, export table found in section .text Analysis: urlmon.dll, export table found in section .text Analysis: netapi32.dll, export table found in section .text 1.2 Searching for kernel-mode API hooks Driver loaded successfully SDT found (RVA=0832A0) Kernel ntoskrnl.exe found in memory at address 804D7000 SDT = 8055A2A0 KiST = 804E26B8 (284) Function NtAddBootEntry (09) intercepted (8064986F->EF9FA202), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtAllocateVirtualMemory (11) intercepted (805691EA->EFA60CB2), hook C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtClose (19) intercepted (80567AED->EFA1E6C1), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtConnectPort (1F) intercepted (8059110B->EFC69534), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateEvent (23) intercepted (80570022->EF9FC81C), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateEventPair (24) intercepted (80649EC0->EF9FC874), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateFile (25) intercepted (8056F864->EFC63782), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateIoCompletion (26) intercepted (8058FC37->EF9FC98A), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateKey (29) intercepted (8057376F->EFA1E075), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateMutant (2B) intercepted (805775C8->EF9FC772), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreatePort (2E) intercepted (805893C7->EFC69CC0), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateProcess (2F) intercepted (805B1BEA->EFC7CEB4), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateProcessEx (30) intercepted (8058124C->EFC7D2A2), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateSection (32) intercepted (80565333->EFC86916), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateSemaphore (33) intercepted (8057B80D->EF9FC7C6), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateTimer (36) intercepted (80588A6B->EF9FC938), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateWaitablePort (38) intercepted (805DB3E4->EFC69DF6), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeleteBootEntry (3D) intercepted (8062C782->EF9FA226), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeleteFile (3E) intercepted (805D7A13->EFC64398), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeleteKey (3F) intercepted (80597FFA->EFA1ED87), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeleteValueKey (41) intercepted (80595C1A->EFA1F03D), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDuplicateObject (44) intercepted (805748C2->EFC7BDF0), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtEnumerateKey (47) intercepted (80573E7D->EFA1EBF2), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtEnumerateValueKey (49) intercepted (8057FB2B->EFA1EA5D), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtFreeVirtualMemory (53) intercepted (80569B15->EFA60D62), hook C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtLoadDriver (61) intercepted (805A425D->EF9F9FF0), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtLoadKey (62) intercepted (805AF5C3->EFC8493C), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtLoadKey2 (63) intercepted (805AF400->EFC84B44), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtModifyBootEntry (6D) intercepted (8062C782->EF9FA24A), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtNotifyChangeKey (6F) intercepted (80593FAA->EF9FCD82), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtNotifyChangeMultipleKeys (70) intercepted (80594073->EF9FACDA), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenEvent (72) intercepted (8057FC98->EF9FC84C), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenEventPair (73) intercepted (80649FB3->EF9FC89C), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenFile (74) intercepted (8056F7FF->EFC63FAA), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenIoCompletion (75) intercepted (80616DAB->EF9FC9B4), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenKey (77) intercepted (80568F68->EFA1E3D1), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenMutant (78) intercepted (80577676->EF9FC79E), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenProcess (7A) intercepted (80574AA9->EFC7F1CE), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenSection (7D) intercepted (8056E467->EF9FC904), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenSemaphore (7E) intercepted (805DD9AC->EF9FC7F4), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenThread (80) intercepted (8059323B->EFC7EDF8), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenTimer (83) intercepted (80649DE9->EF9FC962), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtProtectVirtualMemory (89) intercepted (80574E58->EFA60DFA), hook C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueryKey (A0) intercepted (80573B86->EFA1E8D8), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueryObject (A3) intercepted (80580A94->EF9FABA0), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueryValueKey (B1) intercepted (8056A419->EFA1E72A), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtRenameKey (C0) intercepted (8064F526->EFA69E48), hook C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtReplaceKey (C1) intercepted (8064FE82->EFC85208), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtRequestWaitReplyPort (C8) intercepted (8056DC86->EFC690F4), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtRestoreKey (CC) intercepted (8064FA19->EFA1D6E8), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSecureConnectPort (D2) intercepted (80599040->EFC697DC), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetBootEntryOrder (D3) intercepted (8064986F->EF9FA26E), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetBootOptions (D4) intercepted (8064986F->EF9FA292), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetInformationFile (E0) intercepted (8057C641->EFC6475C), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetSecurityObject (ED) intercepted (8059D2BD->EFC85E12), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetSystemInformation (F0) intercepted (805A8349->EF9FA04A), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetSystemPowerState (F1) intercepted (8066848B->EF9FA186), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetValueKey (F7) intercepted (8057BC5B->EFA1EE8E), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtShutdownSystem (F9) intercepted (80647EF7->EF9FA162), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSystemDebugControl (FF) intercepted (8064AA57->EFC7DF0A), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtTerminateProcess (101) intercepted (805839B9->EFC7DC86), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtVdmControl (10C) intercepted (805C02DA->EF9FA2B6), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function ObInsertObject (805650BA) - machine code modification Method of JmpTo. jmp EFA73D5C \SystemRoot\System32\Drivers\aswSP.SYS, driver recognized as trusted >>> Function restored successfully ! Function ObMakeTemporaryObject (805A038B) - machine code modification Method of JmpTo. jmp EFA722BE \SystemRoot\System32\Drivers\aswSP.SYS, driver recognized as trusted >>> Function restored successfully ! Functions checked: 284, intercepted: 62, restored: 64 1.3 Checking IDT and SYSENTER Analysis for CPU 1 CmpCallCallBacks = 0013AD62 Disable callback OK Checking IDT and SYSENTER - complete 1.4 Searching for masking processes and drivers Checking not performed: extended monitoring driver (AVZPM) is not installed Driver loaded successfully 1.5 Checking of IRP handlers \FileSystem\ntfs[IRP_MJ_CREATE] = EFA763F2 -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted \FileSystem\ntfs[IRP_MJ_CLOSE] = EFA76432 -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted \FileSystem\ntfs[IRP_MJ_WRITE] = EFA7650E -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted \FileSystem\ntfs[IRP_MJ_SET_INFORMATION] = EFA7654E -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted \FileSystem\FastFat[IRP_MJ_CREATE] = EFA7658E -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted \FileSystem\FastFat[IRP_MJ_CLOSE] = EFA765CE -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted \FileSystem\FastFat[IRP_MJ_WRITE] = EFA766AA -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted \FileSystem\FastFat[IRP_MJ_SET_INFORMATION] = EFA766EA -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted \driver\tcpip[IRP_MJ_CREATE] = EFC52434 -> C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted \driver\tcpip[IRP_MJ_CLOSE] = EFC52434 -> C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted \driver\tcpip[IRP_MJ_DEVICE_CONTROL] = EFC52434 -> C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted \driver\tcpip[IRP_MJ_INTERNAL_DEVICE_CONTROL] = EFC52434 -> C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted \driver\tcpip[IRP_MJ_CLEANUP] = EFC52434 -> C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted Checking - complete >> Services: potentially dangerous service allowed: TermService (Terminal Services) Error [2, SC_EXT_ADDITEMST] >> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery Service) Error [2, SC_EXT_ADDITEMST] >> Services: potentially dangerous service allowed: TlntSvr () Error [2, SC_EXT_ADDITEMST] >> Services: potentially dangerous service allowed: Schedule (Task Scheduler) Error [2, SC_EXT_ADDITEMST] >> Services: potentially dangerous service allowed: RDSessMgr (Remote Desktop Help Session Manager) Error [2, SC_EXT_ADDITEMST] > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)! >> Security: disk drives' autorun is enabled Error [2, SC_EXT_ADDITEMST] >> Security: administrative shares (C$, D$ ...) are enabled Error [2, SC_EXT_ADDITEMST] >> Security: anonymous user access is enabled Error [2, SC_EXT_ADDITEMST] Error [2, SC_EXT_ADDITEMST] >> Security: sending Remote Assistant queries is enabled >> Process termination timeout is out of admissible values >> Service termination timeout is out of admissible values >> Disable HDD autorun >> Disable autorun from network drives >> Disable CD/DVD autorun >> Disable removable media autorun >> Windows Explorer - show extensions of known file types System Analysis in progressAdd commands to script:
System Analysis - complete
Script commands