Kaspersky Virus Removal Tool 2010 9.0.0.722 (database released 04/07/2011; 07:03)
| File name | PID | Description | Copyright | MD5 | Information
| c:\program files\ati technologies\ati.ace\core-static\ccc.exe | Script: Quarantine, Delete, BC delete, Terminate 2132 | Catalyst Control Centre: Host application | 2002-2006 | ?? | 48.00 kb, rsAh, | created: 6/1/2007 12:52:34 PM, modified: 6/1/2007 12:52:34 PM Command line: "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe" 0 c:\toshiba\ivp\ism\ivpsvmgr.exe | Script: Quarantine, Delete, BC delete, Terminate 828 | IVP Service Manager Application | © 1997-2007 TOSHIBA Corporation | ?? | 457.62 kb, rsAh, | created: 2/13/2008 1:52:39 AM, modified: 1/25/2007 10:45:42 PM Command line: "C:\Toshiba\IVP\ISM\ivpsvmgr.exe" /remind c:\program files\ati technologies\ati.ace\core-static\mom.exe | Script: Quarantine, Delete, BC delete, Terminate 3516 | Catalyst Control Center: Monitoring program | 2002-2007 | ?? | 48.00 kb, rsAh, | created: 6/1/2007 12:52:10 PM, modified: 6/1/2007 12:52:10 PM Command line: "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE" c:\windows\microsoft.net\framework\v3.0\wpf\presentationfontcache.exe | Script: Quarantine, Delete, BC delete, Terminate 948 | PresentationFontCache.exe | © Microsoft Corporation. All rights reserved. | ?? | 45.02 kb, rsAh, | created: 6/5/2011 3:12:31 AM, modified: 6/19/2008 9:14:44 PM Command line: C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe Detected:71, recognized as trusted 71
| | |||||
| Module | Base address | Size in memory | Description | Manufacturer
| C:\Windows\System32\Drivers\dump_atapi.sys | Script: Quarantine, Delete, BC delete 8F970000 | 008000 (32768) |
| C:\Windows\System32\Drivers\dump_dumpata.sys | Script: Quarantine, Delete, BC delete 8F965000 | 00B000 (45056) |
| Modules detected - 161, recognized as trusted - 159
| | ||||||
| Service | Description | Status | File | Group | Dependencies
| CLTNetCnService | Service: Stop, Delete, Disable Symantec Lic NetConnect service | Not started | C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe | Script: Quarantine, Delete, BC delete |
| msiserver | Service: Stop, Delete, Disable Windows Installer | Not started | C:\Windows\system32\msiexec | Script: Quarantine, Delete, BC delete | rpcss
| Detected - 149, recognized as trusted - 147
| | ||||||
| Service | Description | Status | File | Group | Dependencies
| IpInIp | Driver: Unload, Delete, Disable IP in IP Tunnel Driver | Not started | C:\Windows\system32\DRIVERS\ipinip.sys | Script: Quarantine, Delete, BC delete | Tcpip
| NwlnkFlt | Driver: Unload, Delete, Disable IPX Traffic Filter Driver | Not started | C:\Windows\system32\DRIVERS\nwlnkflt.sys | Script: Quarantine, Delete, BC delete | NwlnkFwd
| NwlnkFwd | Driver: Unload, Delete, Disable IPX Traffic Forwarder Driver | Not started | C:\Windows\system32\DRIVERS\nwlnkfwd.sys | Script: Quarantine, Delete, BC delete |
| RTHDMIAzAudService | Driver: Unload, Delete, Disable Service for HDMI | Not started | C:\Windows\system32\drivers\RtHDMIV.sys | Script: Quarantine, Delete, BC delete |
| Tosrfcom | Driver: Unload, Delete, Disable Tosrfcom | Not started | Tosrfcom.sys | Script: Quarantine, Delete, BC delete |
| Detected - 244, recognized as trusted - 239
| | ||||||
| File name | Status | Startup method | Description
| C:\Program Files\Jumpstart\jswtrayutil.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, jswtrayutil | Delete C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-21-3963208769-723974312-1458819542-1000\Software\Microsoft\Windows\CurrentVersion\Run, Active Desktop Calendar | Delete C:\WindowsSystem32\IoLogMsg.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\vsmraid, EventMessageFile | Delete C:\Windows\System32\igmpv2.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile | Delete C:\Windows\System32\ipbootp.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile | Delete C:\Windows\System32\iprip2.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile | Delete C:\Windows\system32\psxss.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
| NDSTray.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, NDSTray.exe | Delete progman.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, shell | Delete rdpclip | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd, StartupPrograms | Delete vgafix.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon | Delete vgaoem.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon | Delete vgasys.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon | Delete Autoruns items detected - 494, recognized as trusted - 481
| | ||||||
| File name | Type | Description | Manufacturer | CLSID
| Elements detected - 6, recognized as trusted - 6
| | ||||||
| File name | Destination | Description | Manufacturer | CLSID
| Color Control Panel Applet | {b2c761c6-29bc-4f19-9251-e6195265baf1} | Delete Add New Hardware | {7A979262-40CE-46ff-AEEE-7884AC3B6136} | Delete Get Programs Online | {3e7efb4c-faf1-453d-89eb-56026875ef90} | Delete Taskbar and Start Menu | {0DF44EAA-FF21-4412-828E-260A8728E7F1} | Delete ActiveDirectory Folder | {1b24a030-9b20-49bc-97ac-1be4426f9e59} | Delete ActiveDirectory Folder | {34449847-FD14-4fc8-A75A-7432F5181EFB} | Delete Sam Account Folder | {C8494E42-ACDD-4739-B0FB-217361E4894F} | Delete Sam Account Folder | {E29F9716-5C08-4FCD-955A-119FDB5A522D} | Delete Control Panel command object for Start menu | {5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0} | Delete Default Programs command object for Start menu | {E44E5D18-0652-4508-A4E2-8A090067BCB0} | Delete Folder Options | {6dfd7c5c-2451-11d3-a299-00c04f8ef6af} | Delete Explorer Query Band | {2C2577C2-63A7-40e3-9B7F-586602617ECB} | Delete View Available Networks | {38a98528-6cbf-4ca9-8dc0-b1e1d10f7b1b} | Delete Contacts folder | {0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} | Delete Windows Firewall | {4026492f-2f69-46b8-b9bf-5654fc07e423} | Delete Problem Reports and Solutions | {fcfeecae-ee1b-4849-ae50-685dcf7717ec} | Delete iSCSI Initiator | {a304259d-52b8-4526-8b1a-a1d6cecc8243} | Delete .cab or .zip files | {911051fa-c21c-4246-b470-070cd8df6dc4} | Delete Windows Search Shell Service | {da67b8ad-e81b-4c70-9b91b417b5e33527} | Delete Microsoft.ScannersAndCameras | {00f2886f-cd64-4fc9-8ec5-30ef6cdbe8c3} | Delete "C:\Windows\System32\rundll32.exe" "C:\Program Files\\Windows Photo Gallery\PhotoViewer.dll",ImageView_COMServer {9D687A4C-1404-41ef-A089-883B6FBECDE6} | Script: Quarantine, Delete, BC delete Windows Photo Gallery Viewer Autoplay Handler | {9D687A4C-1404-41ef-A089-883B6FBECDE6} | Delete Windows Sidebar Properties | {37efd44d-ef8d-41b1-940d-96973a50e9e0} | Delete Windows Features | {67718415-c450-4f3c-bf8a-b487642dc39b} | Delete Windows Defender | {d8559eb9-20c0-410e-beda-7ed416aecc2a} | Delete Mobility Center Control Panel | {5ea4f148-308c-46d7-98a9-49041b1dd468} | Delete "C:\Program Files\\Windows Media Player\wmprph.exe" | Script: Quarantine, Delete, BC delete Windows Media Player Rich Preview Handler | {031EE060-67BC-460d-8847-E4A7C5E45A27} | Delete User Accounts | {7A9D77BD-5403-11d2-8785-2E0420524153} | Delete Elements detected - 285, recognized as trusted - 258
| | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| File name | Type | Name | Description | Manufacturer
| Elements detected - 8, recognized as trusted - 8
| | ||||||
| File name | Job name | Job status | Description | Manufacturer
| Elements detected - 0, recognized as trusted - 0
| | ||||||
| Provider | Status | EXE file | Description | GUID
| Detected - 6, recognized as trusted - 6
| | ||||||
| Provider | EXE file | Description
| Detected - 26, recognized as trusted - 26
| | ||||||
| File name | Description | Manufacturer | CLSID | Source URL
| {E2883E8F-472F-4FB0-9522-AC9BF37916A7} | Delete http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
| Elements detected - 5, recognized as trusted - 4
| | |||||||||
| File name | Description | Manufacturer
| Elements detected - 25, recognized as trusted - 25
| | ||||||
| File name | Description | Manufacturer | CLSID
| Elements detected - 9, recognized as trusted - 9
| | ||||||
Hosts file record
|
| File name | Type | Description | Manufacturer | CLSID
| mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| Elements detected - 17, recognized as trusted - 14
| | ||||||
| File | Description | Type |
Main script of analysis Windows version: Windows Vista (TM) Home Premium, Build=6001, SP="Service Pack 1" System Restore: enabled 1.1 Searching for user-mode API hooks Analysis: kernel32.dll, export table found in section .text IAT modification detected: CreateProcessA - 00C70010<>761E1C36 IAT modification detected: GetModuleFileNameA - 00C70080<>7622440D IAT modification detected: GetModuleFileNameW - 00C700F0<>762258E5 IAT modification detected: CreateProcessW - 00C70160<>761E1C01 IAT modification detected: LoadLibraryW - 00C70240<>7620361F IAT modification detected: LoadLibraryA - 00C70320<>76209491 IAT modification detected: GetProcAddress - 00C70390<>7622B8B6 IAT modification detected: FreeLibrary - 00C70400<>762208F8 Analysis: ntdll.dll, export table found in section .text Analysis: user32.dll, export table found in section .text Analysis: advapi32.dll, export table found in section .text Analysis: ws2_32.dll, export table found in section .text Analysis: wininet.dll, export table found in section .text Analysis: rasapi32.dll, export table found in section .text Analysis: urlmon.dll, export table found in section .text Analysis: netapi32.dll, export table found in section .text 1.2 Searching for kernel-mode API hooks Driver loaded successfully SDT found (RVA=137B00) Kernel ntkrnlpa.exe found in memory at address 81E4E000 SDT = 81F85B00 KiST = 81F06940 (391) Functions checked: 391, intercepted: 0, restored: 0 1.3 Checking IDT and SYSENTER Analysis for CPU 1 Analysis for CPU 2 CmpCallCallBacks = 00000000 Checking IDT and SYSENTER - complete 1.4 Searching for masking processes and drivers Checking not performed: extended monitoring driver (AVZPM) is not installed Driver loaded successfully 1.5 Checking of IRP handlers Checking - complete >> Services: potentially dangerous service allowed: TermService (@%SystemRoot%\System32\termsrv.dll,-268) Error [2, SC_EXT_ADDITEMST] >> Services: potentially dangerous service allowed: SSDPSRV (@%systemroot%\system32\ssdpsrv.dll,-100) Error [2, SC_EXT_ADDITEMST] >> Services: potentially dangerous service allowed: Schedule (@%SystemRoot%\system32\schedsvc.dll,-100) Error [2, SC_EXT_ADDITEMST] > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)! >> Security: disk drives' autorun is enabled Error [2, SC_EXT_ADDITEMST] >> Security: administrative shares (C$, D$ ...) are enabled Error [2, SC_EXT_ADDITEMST] >> Security: anonymous user access is enabled Error [2, SC_EXT_ADDITEMST] Error [2, SC_EXT_ADDITEMST] >> Security: sending Remote Assistant queries is enabled >> Disable HDD autorun >> Disable autorun from network drives >> Disable CD/DVD autorun >> Disable removable media autorun >> Windows Explorer - show extensions of known file types System Analysis in progressAdd commands to script:
System Analysis - complete
Script commands