Gathering system information: completed 1 minute ago (events: 266, time: 00:04:09) 8/12/2011 14:53:47 Task completed Gathering system information 8/12/2011 14:53:46 Main script of analysis 8/12/2011 14:53:46 Deleting service/driver: ujixmzc5 8/12/2011 14:53:46 Delete file:C:\WINDOWS\system32\Drivers\utixmzc5.sys 8/12/2011 14:53:46 [microprogram of healing]> registry key deleted HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\utixmzc5 8/12/2011 14:53:46 Deleting service/driver: utixmzc5 8/12/2011 14:53:46 System Analysis - complete 8/12/2011 14:50:55 System Analysis in progress 8/12/2011 14:50:54 >> Windows Explorer - show extensions of known file types 8/12/2011 14:50:53 >> Disable removable media autorun 8/12/2011 14:50:53 >> Disable CD/DVD autorun 8/12/2011 14:50:53 >> Disable autorun from network drives 8/12/2011 14:50:53 >> Disable HDD autorun 8/12/2011 14:50:49 >> Security: sending Remote Assistant queries is enabled 8/12/2011 14:50:49 >> Security: anonymous user access is enabled 8/12/2011 14:50:49 >> Security: administrative shares (C$, D$ ...) are enabled 8/12/2011 14:50:49 >> Security: disk drives' autorun is enabled 8/12/2011 14:50:49 > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)! 8/12/2011 14:50:49 >> Services: potentially dangerous service allowed: RDSessMgr (Remote Desktop Help Session Manager) 8/12/2011 14:50:49 >> Services: potentially dangerous service allowed: mnmsrvc (NetMeeting Remote Desktop Sharing) 8/12/2011 14:50:49 >> Services: potentially dangerous service allowed: Schedule (Task Scheduler) 8/12/2011 14:50:49 >> Services: potentially dangerous service allowed: TlntSvr (Telnet) 8/12/2011 14:50:49 >> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery Service) 8/12/2011 14:50:49 >> Services: potentially dangerous service allowed: TermService (Terminal Services) 8/12/2011 14:50:49 >> Services: potentially dangerous service allowed: RemoteRegistry (Remote Registry) 8/12/2011 14:49:52 Checking - complete 8/12/2011 14:49:52 \driver\tcpip[IRP_MJ_CLEANUP] = F6CB368E -> C:\WINDOWS\system32\Drivers\fsdfw.sys, driver recognized as trusted 8/12/2011 14:49:52 \driver\tcpip[IRP_MJ_INTERNAL_DEVICE_CONTROL] = F6CB368E -> C:\WINDOWS\system32\Drivers\fsdfw.sys, driver recognized as trusted 8/12/2011 14:49:52 \driver\tcpip[IRP_MJ_DEVICE_CONTROL] = F6CB368E -> C:\WINDOWS\system32\Drivers\fsdfw.sys, driver recognized as trusted 8/12/2011 14:49:52 \driver\tcpip[IRP_MJ_CREATE] = F6CB368E -> C:\WINDOWS\system32\Drivers\fsdfw.sys, driver recognized as trusted 8/12/2011 14:49:52 Driver loaded successfully 8/12/2011 14:49:52 1.5 Checking of IRP handlers 8/12/2011 14:49:51 Checking not performed: extended monitoring driver (AVZPM) is not installed 8/12/2011 14:49:51 1.4 Searching for masking processes and drivers 8/12/2011 14:49:50 Checking IDT and SYSENTER - complete 8/12/2011 14:49:50 Disable callback OK 8/12/2011 14:49:50 CmpCallCallBacks = 00093D84 8/12/2011 14:49:50 Analysis for CPU 2 8/12/2011 14:49:50 Analysis for CPU 1 8/12/2011 14:49:50 1.3 Checking IDT and SYSENTER 8/12/2011 14:49:50 Functions checked: 284, intercepted: 60, restored: 63 8/12/2011 14:49:49 >>> Function restored successfully ! 8/12/2011 14:49:49 Function IoIsOperationSynchronous (804EF912) - machine code modification Method of JmpTo. jmp B669E3AC \SystemRoot\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:49 >>> Function restored successfully ! 8/12/2011 14:49:49 Function IoCreateDevice (80575912) - machine code modification Method of JmpTo. jmp F6CB3FFA fsdfw.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function FsRtlCheckLockForReadAccess (804EAF84) - machine code modification Method of JmpTo. jmp B669DFD0 \SystemRoot\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtWriteVirtualMemory (115) intercepted (805B43CC->B66ABB52), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtUnmapViewOfSection (10B) intercepted (805B2E48->B66AF552), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtTerminateThread (102) intercepted (805D2BDC->B66AB9C8), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtTerminateProcess (101) intercepted (805D29E2->B66ABA68), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtSystemDebugControl (FF) intercepted (806180BA->B66AEA3E), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtSuspendThread (FE) intercepted (805D48F4->B66AFA2A), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtSuspendProcess (FD) intercepted (805D4A82->B66AF8F0), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtSetValueKey (F7) intercepted (80622662->B66AA816), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtSetSystemInformation (F0) intercepted (8060FD06->B66AF7FE), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtSetSecurityObject (ED) intercepted (805C062E->B66AEDAA), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtSetInformationToken (E6) intercepted (805FA7B4->B66AE154), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtSetContextThread (D5) intercepted (805D173A->B66ABE38), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtSecureConnectPort (D2) intercepted (805A3D64->B66ACB0E), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtSaveKey (CF) intercepted (80625BCC->B66A9EAE), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtResumeThread (CE) intercepted (805D49BA->B66AFBC8), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtRestoreKey (CC) intercepted (80625AD0->B66AA28E), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtRequestWaitReplyPort (C8) intercepted (805A2D76->B66AE8B4), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtReplyWaitReceivePort (C3) intercepted (805A64B4->B66AD6F2), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtReplyPort (C2) intercepted (805A54EC->B66AD82C), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtReplaceKey (C1) intercepted (806261C4->B66A9F16), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtRenameKey (C0) intercepted (80623B12->B66AAC2C), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtQueueApcThread (B4) intercepted (805D1276->B66AEFA0), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtQueryValueKey (B1) intercepted (80622314->B66AA99C), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtQuerySection (A7) intercepted (805B85E0->B66AF6AE), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtQueryMultipleValueKey (A1) intercepted (8062323E->B66AAD72), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtQueryKey (A0) intercepted (80625810->B66AB13A), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtOpenThread (80) intercepted (805CB6CC->B66AB7BE), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtOpenSemaphore (7E) intercepted (80615148->B66AD4C8), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtOpenSection (7D) intercepted (805AA3EC->B66AF10E), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtOpenProcess (7A) intercepted (805CB440->B66AB8CC), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtOpenMutant (78) intercepted (80617776->B66AD288), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtOpenKey (77) intercepted (806254CE->B66AA6C0), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtOpenFile (74) intercepted (8057A1A6->B66AC016), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtOpenEvent (72) intercepted (8060F04E->B66AD3A8), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtNotifyChangeKey (6F) intercepted (806262DE->B66AB1CE), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtMapViewOfSection (6C) intercepted (805B203A->B66AF374), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtLoadKey2 (63) intercepted (80625F20->B66AA4EE), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtLoadKey (62) intercepted (80626314->B66AA4DC), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtLoadDriver (61) intercepted (80584160->B66AEC0C), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtFsControlFile (54) intercepted (805792A2->B66AC500), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtEnumerateValueKey (49) intercepted (80624BA6->B66AB0A2), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtEnumerateKey (47) intercepted (8062493C->B66AB00A), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtDuplicateObject (44) intercepted (805BE008->B66AFD26), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtDeviceIoControlFile (42) intercepted (8057926E->B66AC6F2), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtDeleteValueKey (41) intercepted (8062475C->B66AAEBE), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:47 >>> Hook code blocked 8/12/2011 14:49:47 >>> Function restored successfully ! 8/12/2011 14:49:47 Function NtDeleteKey (3F) intercepted (8062458C->B66AAB0A), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:46 >>> Hook code blocked 8/12/2011 14:49:46 >>> Function restored successfully ! 8/12/2011 14:49:46 Function NtDebugActiveProcess (39) intercepted (80643B30->B66AEB1A), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:46 >>> Hook code blocked 8/12/2011 14:49:46 >>> Function restored successfully ! 8/12/2011 14:49:46 Function NtCreateWaitablePort (38) intercepted (805A5110->B66AD162), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:46 >>> Hook code blocked 8/12/2011 14:49:46 >>> Function restored successfully ! 8/12/2011 14:49:46 Function NtCreateThread (35) intercepted (805D1018->B66ABC1C), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:46 >>> Hook code blocked 8/12/2011 14:49:46 >>> Function restored successfully ! 8/12/2011 14:49:46 Function NtCreateSemaphore (33) intercepted (8061504E->B66AD432), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:46 >>> Hook code blocked 8/12/2011 14:49:46 >>> Function restored successfully ! 8/12/2011 14:49:46 Function NtCreateSection (32) intercepted (805AB3C8->B66AB426), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:46 >>> Hook code blocked 8/12/2011 14:49:46 >>> Function restored successfully ! 8/12/2011 14:49:46 Function NtCreatePort (2E) intercepted (805A50EC->B66AD0CC), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:46 >>> Hook code blocked 8/12/2011 14:49:46 >>> Function restored successfully ! 8/12/2011 14:49:46 Function NtCreateNamedPipeFile (2C) intercepted (805790E2->B66AB27E), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:46 >>> Hook code blocked 8/12/2011 14:49:46 >>> Function restored successfully ! 8/12/2011 14:49:46 Function NtCreateMutant (2B) intercepted (8061769E->B66AD1F8), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:46 >>> Hook code blocked 8/12/2011 14:49:46 >>> Function restored successfully ! 8/12/2011 14:49:46 Function NtCreateKey (29) intercepted (806240F0->B66AA500), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:46 >>> Hook code blocked 8/12/2011 14:49:46 >>> Function restored successfully ! 8/12/2011 14:49:46 Function NtCreateFile (25) intercepted (805790A8->B66AC270), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:46 >>> Hook code blocked 8/12/2011 14:49:46 >>> Function restored successfully ! 8/12/2011 14:49:46 Function NtCreateEvent (23) intercepted (8060EF4E->B66AD312), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:46 >>> Hook code blocked 8/12/2011 14:49:46 >>> Function restored successfully ! 8/12/2011 14:49:46 Function NtConnectPort (1F) intercepted (805A45D0->B66ACDC8), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:46 >>> Hook code blocked 8/12/2011 14:49:46 >>> Function restored successfully ! 8/12/2011 14:49:46 Function NtClose (19) intercepted (805BC530->B66ABF94), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:46 >>> Hook code blocked 8/12/2011 14:49:46 >>> Function restored successfully ! 8/12/2011 14:49:46 Function NtAdjustPrivilegesToken (0B) intercepted (805EC464->B66AB690), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted 8/12/2011 14:49:46 KiST = 80504480 (284) 8/12/2011 14:49:46 SDT = 8055C700 8/12/2011 14:49:46 Kernel ntkrnlpa.exe found in memory at address 804D7000 8/12/2011 14:49:46 SDT found (RVA=085700) 8/12/2011 14:49:46 Driver loaded successfully 8/12/2011 14:49:46 1.2 Searching for kernel-mode API hooks 8/12/2011 14:49:45 Analysis: netapi32.dll, export table found in section .text 8/12/2011 14:49:44 Analysis: urlmon.dll, export table found in section .text 8/12/2011 14:49:44 Analysis: rasapi32.dll, export table found in section .text 8/12/2011 14:49:44 Analysis: wininet.dll, export table found in section .text 8/12/2011 14:49:44 Analysis: ws2_32.dll, export table found in section .text 8/12/2011 14:49:44 Function advapi32.dll:OpenServiceW (432) intercepted, method APICodeHijack.JmpTo[00975002] 8/12/2011 14:49:44 Function advapi32.dll:CreateServiceW (103) intercepted, method APICodeHijack.JmpTo[00978002] 8/12/2011 14:49:44 Function advapi32.dll:ControlService (68) intercepted, method APICodeHijack.JmpTo[00976002] 8/12/2011 14:49:44 Function advapi32.dll:CloseServiceHandle (64) intercepted, method APICodeHijack.JmpTo[00977002] 8/12/2011 14:49:44 Analysis: advapi32.dll, export table found in section .text 8/12/2011 14:49:44 Function user32.dll:SetWindowsHookExW (652) intercepted, method APICodeHijack.JmpTo[00974002] 8/12/2011 14:49:44 Function user32.dll:DdeConnect (108) intercepted, method APICodeHijack.JmpTo[0097A002] 8/12/2011 14:49:44 Analysis: user32.dll, export table found in section .text 8/12/2011 14:49:44 Function ntdll.dll:ZwCreateProcessEx (946) intercepted, method APICodeHijack.JmpTo[00971002] 8/12/2011 14:49:44 Function ntdll.dll:ZwCreateProcess (945) intercepted, method APICodeHijack.JmpTo[00970002] 8/12/2011 14:49:44 Function ntdll.dll:NtCreateProcessEx (135) intercepted, method APICodeHijack.JmpTo[00971002] 8/12/2011 14:49:44 Function ntdll.dll:NtCreateProcess (134) intercepted, method APICodeHijack.JmpTo[00970002] 8/12/2011 14:49:44 Analysis: ntdll.dll, export table found in section .text 8/12/2011 14:49:44 IAT modification detected: GetProcAddress - 00D20390<>7C80AE40 8/12/2011 14:49:44 IAT modification detected: LoadLibraryA - 00D20320<>7C801D7B 8/12/2011 14:49:44 IAT modification detected: LoadLibraryW - 00D202B0<>7C80AEEB 8/12/2011 14:49:44 IAT modification detected: CreateProcessW - 00D201D0<>7C802336 8/12/2011 14:49:44 IAT modification detected: GetModuleFileNameW - 00D20160<>7C80B475 8/12/2011 14:49:44 IAT modification detected: FreeLibrary - 00D200F0<>7C80AC7E 8/12/2011 14:49:44 IAT modification detected: GetModuleFileNameA - 00D20080<>7C80B56F 8/12/2011 14:49:44 IAT modification detected: CreateProcessA - 00D20010<>7C80236B 8/12/2011 14:49:44 Function kernel32.dll:TerminateThread (845) intercepted, method APICodeHijack.JmpTo[00973002] 8/12/2011 14:49:44 Analysis: kernel32.dll, export table found in section .text 8/12/2011 14:49:44 1.1 Searching for user-mode API hooks 8/12/2011 14:49:43 System Restore: enabled 8/12/2011 14:49:43 Windows version: Microsoft Windows XP, Build=2600, SP="Service Pack 3" 8/12/2011 14:49:42 Main script of analysis 8/12/2011 14:49:37 Task started Gathering system information