Kaspersky Virus Removal Tool 11.0.0.1245 (database released 24/07/2011; 16:00)
| File name | PID | Description | Copyright | MD5 | Information
| c:\program files\scansoft\paperport\pptd40nt.exe | Script: Quarantine, Delete, BC delete, Terminate 1056 | PaperPort Print to Desktop for NT | Copyright © 1993-2004 ScanSoft, Inc. | ?? | 56.05 kb, rsAh, | created: 17.03.2005 14:25:54, modified: 17.03.2005 14:25:54 Command line: "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" c:\windows\microsoft.net\framework\v3.0\windows communication foundation\smsvchost.exe | Script: Quarantine, Delete, BC delete, Terminate 1292 | SMSvcHost.exe | © Microsoft Corporation. All rights reserved. | ?? | 129.00 kb, rsAh, | created: 29.07.2008 19:16:38, modified: 29.07.2008 19:16:38 Command line: "c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe" Detected:59, recognized as trusted 59
| | |||||
| Module | Base address | Size in memory | Description | Manufacturer
| C:\WINDOWS\system32\DRIVERS\62875394.sys | Script: Quarantine, Delete, BC delete ECA59000 | 522000 (5382144) |
| C:\WINDOWS\system32\drivers\ALCXWDM.SYS | Script: Quarantine, Delete, BC delete F63BD000 | 3EC000 (4112384) | Realtek AC'97 Audio Driver (WDM) | Copyright (c) Realtek Semiconductor Corp.1998-2006
| C:\WINDOWS\System32\Drivers\dump_atapi.sys | Script: Quarantine, Delete, BC delete F27C5000 | 018000 (98304) |
| C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS | Script: Quarantine, Delete, BC delete F7E0F000 | 002000 (8192) |
| C:\WINDOWS\system32\Drivers\PROCEXP113.SYS | Script: Quarantine, Delete, BC delete F7DEF000 | 002000 (8192) |
| Modules detected - 131, recognized as trusted - 126
| | ||||||||
| Service | Description | Status | File | Group | Dependencies
| NSL | Service: Stop, Delete, Disable, BC delete Norton Safe Web Lite | Not started | C:\Program Files\Norton Safe Web Lite\Engine\1.2.0.6\ccSvcHst.exe | Script: Quarantine, Delete, BC delete | RpcSs
| VideoScavenger_1eService | Service: Stop, Delete, Disable, BC delete VideoScavenger Service | Not started | VideoScavenger_1eService.sys | Script: Quarantine, Delete, BC delete |
| Detected - 101, recognized as trusted - 99
| | ||||||
| File name | Status | Startup method | Description
| C:\Documents and Settings\owner_2\Local Settings\temp\_uninst_.bat | Script: Quarantine, Delete, BC delete Active | Shortcut in Autoruns folder | C:\Documents and Settings\owner_2\Start Menu\Programs\Startup\, C:\Documents and Settings\owner_2\Start Menu\Programs\Startup\_uninst_.lnk,
| C:\Documents and Settings\owner_2\Local Settings\temp\_uninst_32511957.bat | Script: Quarantine, Delete, BC delete Active | Shortcut in Autoruns folder | C:\Documents and Settings\owner_2\Start Menu\Programs\Startup\, C:\Documents and Settings\owner_2\Start Menu\Programs\Startup\_uninst_32511957.lnk,
| C:\Program Files\MySpace\IM\MySpaceIM.exe | Script: Quarantine, Delete, BC delete Active | Shortcut in Autoruns folder | C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\Quick Launch\MySpaceIM.lnk,
| C:\Program Files\MySpace\IM\MySpaceIM.exe | Script: Quarantine, Delete, BC delete Active | Shortcut in Autoruns folder | C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\Quick Launch\MySpaceIM.lnk,
| C:\WINDOWS\System32\appmgmts.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters, ServiceDll | Delete C:\WINDOWS\system32\MsSip1.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 1, $DLL | Delete C:\WINDOWS\system32\MsSip2.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 2, $DLL | Delete C:\WINDOWS\system32\MsSip3.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 3, $DLL | Delete C:\WINDOWS\system32\psxss.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
| appmgmts.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}, DLLName | Delete kbd101.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver JPN | Delete kbd101a.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver KOR | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, .DEFAULT\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-19\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-20\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-18\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-21-1078081533-1500820517-725345543-1005\Control Panel\IOProcs, MVB | Delete vgafix.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon | Delete vgaoem.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon | Delete vgasys.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon | Delete Autoruns items detected - 822, recognized as trusted - 802
| | ||||||
| File name | Type | Description | Manufacturer | CLSID
| C:\Program Files\Freeze.com\NetAssistant\NetAssistant.dll | Script: Quarantine, Delete, BC delete BHO | Freeze.com NetAssistant | Copyright ©2010 W3i Holdings, LLC. All rights reserved. | {E38FA08E-F56A-4169-ABF5-5C71E3C153A1} | Delete Extension module | {2670000A-7350-4f3c-8081-5663EE0C6C49} | Delete Extension module | {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} | Delete Toolbar | {710EB7A1-45ED-11D0-924A-0020AFC7AC4D} | Delete Elements detected - 18, recognized as trusted - 14
| | |||||||||||||||
| File name | Destination | Description | Manufacturer | CLSID
| Display Panning CPL Extension | {42071714-76d4-11d1-8b24-00a0c9068ff3} | Delete Shell extensions for file compression | {764BF0E1-F219-11ce-972D-00AA00A14F56} | Delete Encryption Context Menu | {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} | Delete Taskbar and Start Menu | {0DF44EAA-FF21-4412-828E-260A8728E7F1} | Delete User Accounts | {7A9D77BD-5403-11d2-8785-2E0420524153} | Delete Windows Search Shell Service | {da67b8ad-e81b-4c70-9b91b417b5e33527} | Delete Shell Extension for Malware scanning | {45AC2688-0253-4ED8-97DE-B5370FA7D48A} | Delete Zecter | {E032716F-2E0A-4CCB-9FEB-BF2090B035DF} | Delete Zecter | {D25B32FE-CB96-491A-98FF-AD59DA382D69} | Delete Zecter | {EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5} | Delete Zecter | {B3C78E40-6B64-47C3-AE34-60B770881EB8} | Delete Zecter | {622AFE52-33F6-4D9F-9966-E0BC52D7D69D} | Delete Zecter | {855156F0-2A0F-11DE-8C30-0800200C9A66} | Delete Elements detected - 224, recognized as trusted - 211
| | |||||||||||||||||||||||||||||||||||||||||||||
| File name | Type | Name | Description | Manufacturer
| Elements detected - 8, recognized as trusted - 8
| | ||||||
| File name | Job name | Job status | Description | Manufacturer
| Elements detected - 18, recognized as trusted - 18
| | ||||||
| Provider | Status | EXE file | Description | GUID
| Detected - 3, recognized as trusted - 3
| | ||||||
| Provider | EXE file | Description
| Detected - 11, recognized as trusted - 11
| | ||||||
| File name | Description | Manufacturer | CLSID | Source URL
| Elements detected - 3, recognized as trusted - 3
| | ||||||
| File name | Description | Manufacturer
| Elements detected - 27, recognized as trusted - 27
| | ||||||
| File name | Description | Manufacturer | CLSID
| Elements detected - 15, recognized as trusted - 15
| | ||||||
Hosts file record
|
| File name | Type | Description | Manufacturer | CLSID
| mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D} | Delete mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D} | Delete mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D} | Delete Elements detected - 32, recognized as trusted - 29
| | ||||||
| File | Description | Type
| C:\WINDOWS\system32\DRIVERS\3320355drv.sys | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| \SystemRoot\system32\DRIVERS\3320355drv.sys | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| |
Main script of analysis Windows version: Microsoft Windows XP, Build=2600, SP="Service Pack 3" System Restore: enabled 1.1 Searching for user-mode API hooks Analysis: kernel32.dll, export table found in section .text IAT modification detected: CreateProcessA - 00B40010<>7C80236B IAT modification detected: GetModuleFileNameA - 00B40080<>7C80B56F IAT modification detected: FreeLibrary - 00B400F0<>7C80AC7E IAT modification detected: GetModuleFileNameW - 00B40160<>7C80B475 IAT modification detected: CreateProcessW - 00B401D0<>7C802336 IAT modification detected: LoadLibraryW - 00B402B0<>7C80AEEB IAT modification detected: LoadLibraryA - 00B40320<>7C801D7B IAT modification detected: GetProcAddress - 00B40390<>7C80AE40 Analysis: ntdll.dll, export table found in section .text Analysis: user32.dll, export table found in section .text Analysis: advapi32.dll, export table found in section .text Analysis: ws2_32.dll, export table found in section .text Analysis: wininet.dll, export table found in section .text Analysis: rasapi32.dll, export table found in section .text Analysis: urlmon.dll, export table found in section .text Analysis: netapi32.dll, export table found in section .text >> Danger ! Process masking detected 1.2 Searching for kernel-mode API hooks Driver loaded successfully SDT found (RVA=0832A0) Kernel ntoskrnl.exe found in memory at address 804D7000 SDT = 8055A2A0 KiST = 804E26B8 (284) Function NtAdjustPrivilegesToken (0B) intercepted (8059B554->ED096690), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtClose (19) intercepted (80567AED->ED096F94), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtConnectPort (1F) intercepted (8059110B->ED097DC8), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateEvent (23) intercepted (80570022->ED098312), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateFile (25) intercepted (8056F864->ED097270), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateKey (29) intercepted (8057376F->ED095500), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateMutant (2B) intercepted (805775C8->ED0981F8), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateNamedPipeFile (2C) intercepted (80585619->ED09627E), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreatePort (2E) intercepted (805893C7->ED0980CC), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateSection (32) intercepted (80565333->ED096426), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateSemaphore (33) intercepted (8057B80D->ED098432), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateThread (35) intercepted (80578803->ED096C1C), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateWaitablePort (38) intercepted (805DB3E4->ED098162), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDebugActiveProcess (39) intercepted (8065BF7D->ED099B1A), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeleteKey (3F) intercepted (80597FFA->ED095B0A), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeleteValueKey (41) intercepted (80595C1A->ED095EBE), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeviceIoControlFile (42) intercepted (805795B9->ED0976F2), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDuplicateObject (44) intercepted (805748C2->ED09AD26), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtEnumerateKey (47) intercepted (80573E7D->ED09600A), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtEnumerateValueKey (49) intercepted (8057FB2B->ED0960A2), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtFsControlFile (54) intercepted (805770E0->ED097500), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtLoadDriver (61) intercepted (805A425D->ED099C0C), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtLoadKey (62) intercepted (805AF5C3->ED0954DC), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtLoadKey2 (63) intercepted (805AF400->ED0954EE), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtMapViewOfSection (6C) intercepted (8057AC99->ED09A374), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtNotifyChangeKey (6F) intercepted (80593FAA->ED0961CE), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenEvent (72) intercepted (8057FC98->ED0983A8), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenFile (74) intercepted (8056F7FF->ED097016), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenKey (77) intercepted (80568F68->ED0956C0), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenMutant (78) intercepted (80577676->ED098288), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenProcess (7A) intercepted (80574AA9->ED0968CC), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenSection (7D) intercepted (8056E467->ED09A10E), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenSemaphore (7E) intercepted (805DD9AC->ED0984C8), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenThread (80) intercepted (8059323B->ED0967BE), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueryKey (A0) intercepted (80573B86->ED09613A), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueryMultipleValueKey (A1) intercepted (8064F0A7->ED095D72), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQuerySection (A7) intercepted (8057EE6E->ED09A6AE), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueryValueKey (B1) intercepted (8056A419->ED09599C), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueueApcThread (B4) intercepted (8058F954->ED099FA0), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtRenameKey (C0) intercepted (8064F526->ED095C2C), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtReplaceKey (C1) intercepted (8064FE82->ED094F16), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtReplyPort (C2) intercepted (8057E67C->ED09882C), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtReplyWaitReceivePort (C3) intercepted (8056BC24->ED0986F2), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtRequestWaitReplyPort (C8) intercepted (8056DC86->ED0998B4), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtRestoreKey (CC) intercepted (8064FA19->ED09528E), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtResumeThread (CE) intercepted (80578E76->ED09ABC8), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSaveKey (CF) intercepted (8064FB1A->ED094EAE), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSecureConnectPort (D2) intercepted (80599040->ED097B0E), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetContextThread (D5) intercepted (8062E33F->ED096E38), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetInformationToken (E6) intercepted (805A8E5C->ED099154), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetSecurityObject (ED) intercepted (8059D2BD->ED099DAA), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetSystemInformation (F0) intercepted (805A8349->ED09A7FE), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetValueKey (F7) intercepted (8057BC5B->ED095816), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSuspendProcess (FD) intercepted (8062FF21->ED09A8F0), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSuspendThread (FE) intercepted (805E05AB->ED09AA2A), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSystemDebugControl (FF) intercepted (8064AA57->ED099A3E), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtTerminateProcess (101) intercepted (805839B9->ED096A68), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtTerminateThread (102) intercepted (80577F1F->ED0969C8), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtUnmapViewOfSection (10B) intercepted (8057A81E->ED09A552), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtWriteVirtualMemory (115) intercepted (8057F712->ED096B52), hook C:\WINDOWS\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function FsRtlCheckLockForReadAccess (80512959) - machine code modification Method of JmpTo. jmp ED088FD0 \SystemRoot\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! Function IoIsOperationSynchronous (804E876A) - machine code modification Method of JmpTo. jmp ED0893AC \SystemRoot\system32\DRIVERS\3320355drv.sys, driver recognized as trusted >>> Function restored successfully ! Functions checked: 284, intercepted: 60, restored: 62 1.3 Checking IDT and SYSENTER Analysis for CPU 1 CmpCallCallBacks = 0013AD62 Disable callback OK Checking IDT and SYSENTER - complete 1.4 Searching for masking processes and drivers Checking not performed: extended monitoring driver (AVZPM) is not installed 1.5 Checking of IRP handlers Driver loaded successfully Checking - complete >> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery Service) >> Services: potentially dangerous service allowed: TlntSvr () >> Services: potentially dangerous service allowed: Messenger (Messenger) >> Services: potentially dangerous service allowed: Alerter (Alerter) >> Services: potentially dangerous service allowed: Schedule (Task Scheduler) >> Services: potentially dangerous service allowed: mnmsrvc (NetMeeting Remote Desktop Sharing) >> Services: potentially dangerous service allowed: RDSessMgr (Remote Desktop Help Session Manager) > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)! >> Security: disk drives' autorun is enabled >> Security: administrative shares (C$, D$ ...) are enabled >> Security: anonymous user access is enabled >> Disable HDD autorun >> Disable autorun from network drives >> Disable CD/DVD autorun >> Disable removable media autorun System Analysis in progressAdd commands to script:
System Analysis - complete
Script commands