Kaspersky Virus Removal Tool 11.0.0.1245 (database released 11/08/2011; 16:53)
| File name | PID | Description | Copyright | MD5 | Information
| c:\program files\hp\digital imaging\bin\hpqimzone.exe | Script: Quarantine, Delete, BC delete, Terminate 1620 | HP Photosmart Premier | Copyright (C) Hewlett-Packard Development Company, L.P. 1995-2005 | ?? | 464.00 kb, rsAh, | created: 24.09.2005 11:42:32, modified: 24.09.2005 11:42:32 Command line: "C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe" -s c:\program files\hp\quickplay\qpservice.exe | Script: Quarantine, Delete, BC delete, Terminate 340 | HP QuickPlay Resident Program | Copyright (c) 2005 CyberLink Corp. | ?? | 100.00 kb, rsAh, | created: 17.10.2006 17:48:35, modified: 12.07.2006 00:55:34 Command line: "C:\Program Files\HP\QuickPlay\QPService.exe" Detected:76, recognized as trusted 76
| | |||||
| Module | Base address | Size in memory | Description | Manufacturer
| 56679445.sys | Script: Quarantine, Delete, BC delete F6E64000 | 522000 (5382144) |
| C:\WINDOWS\System32\Drivers\dump_nvata.sys | Script: Quarantine, Delete, BC delete EB65E000 | 019000 (102400) |
| C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS | Script: Quarantine, Delete, BC delete F7A0D000 | 002000 (8192) |
| Modules detected - 148, recognized as trusted - 145
| | |||||||
| Service | Description | Status | File | Group | Dependencies
| HitmanPro35CrusaderBoot | Service: Stop, Delete, Disable, BC delete Hitman Pro 3.5 Crusader (Boot) | Not started | F:\HitmanPro35.exe | Script: Quarantine, Delete, BC delete PNP_TDI |
| Detected - 118, recognized as trusted - 117
| | ||||||
| File name | Status | Startup method | Description
| C:\Documents and Settings\TEST\Local Settings\Temp\_uninst_43665347.bat | Script: Quarantine, Delete, BC delete Active | Shortcut in Autoruns folder | C:\Documents and Settings\TEST\Start Menu\Programs\StartUp\, C:\Documents and Settings\TEST\Start Menu\Programs\StartUp\_uninst_43665347.lnk,
| C:\Program Files\Netscape\Netscape Browser\netscape.exe | Script: Quarantine, Delete, BC delete Active | Shortcut in Autoruns folder | C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Internet Explorer\Quick Launch\Netscape Browser.lnk,
| C:\Program Files\Photo Viewer\PhotoViewer.exe | Script: Quarantine, Delete, BC delete Active | Shortcut in Autoruns folder | C:\Documents and Settings\TEST\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\TEST\Application Data\Microsoft\Internet Explorer\Quick Launch\Photo Viewer.lnk,
| C:\WINDOWS\System32\Drivers\lbrtfdc.sys | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\lbrtfdc, EventMessageFile
| C:\WINDOWS\System32\PrintFilterPipelineSvc.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PrintFilterPipelineSvc, EventMessageFile
| C:\WINDOWS\System32\igmpv2.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile
| C:\WINDOWS\System32\ipbootp.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile
| C:\WINDOWS\System32\iprip2.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile
| C:\WINDOWS\System32\ospf.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPF, EventMessageFile
| C:\WINDOWS\System32\ospfmib.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPFMib, EventMessageFile
| C:\WINDOWS\System32\polagent.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PolicyAgent, EventMessageFile
| C:\WINDOWS\System32\tssdis.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\TermServSessDir, EventMessageFile
| C:\WINDOWS\system32\MsSip1.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 1, $DLL | Delete C:\WINDOWS\system32\MsSip2.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 2, $DLL | Delete C:\WINDOWS\system32\MsSip3.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 3, $DLL | Delete C:\WINDOWS\system32\WPDShServiceObj.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad, WPDShServiceObj | Delete C:\WINDOWS\system32\nvshell.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {1CDB2949-8F65-4355-8456-263E7C208A5D} | Delete C:\WINDOWS\system32\nvshell.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {1E9B04FB-F9E5-4718-997B-B8DA88302A47} | Delete C:\WINDOWS\system32\nvshell.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {1E9B04FB-F9E5-4718-997B-B8DA88302A48} | Delete C:\WINDOWS\system32\psxss.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
| C:\WINDOWS\system32\stisvc.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System, EventMessageFile
| C:\WINDOWS\system32\terdsw32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\TermServices\Parameters, ServiceDll | Delete LCODCCMP.DLL | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, vidc.LEAD | Delete deskpan.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {42071714-76d4-11d1-8b24-00a0c9068ff3} | Delete kbd101.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver JPN | Delete kbd101a.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver KOR | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, .DEFAULT\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-19\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-20\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-18\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-21-4020052512-1902659552-4142755142-1005\Control Panel\IOProcs, MVB | Delete vgafix.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon | Delete vgaoem.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon | Delete vgasys.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon | Delete Autoruns items detected - 908, recognized as trusted - 874
| | ||||||
| File name | Type | Description | Manufacturer | CLSID
| Extension module | {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} | Delete Elements detected - 17, recognized as trusted - 16
| | |||||||||
| File name | Destination | Description | Manufacturer | CLSID
| deskpan.dll | Script: Quarantine, Delete, BC delete Display Panning CPL Extension | {42071714-76d4-11d1-8b24-00a0c9068ff3} | Delete Shell extensions for file compression | {764BF0E1-F219-11ce-972D-00AA00A14F56} | Delete Encryption Context Menu | {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} | Delete Taskbar and Start Menu | {0DF44EAA-FF21-4412-828E-260A8728E7F1} | Delete User Accounts | {7A9D77BD-5403-11d2-8785-2E0420524153} | Delete C:\WINDOWS\system32\nvshell.dll | Script: Quarantine, Delete, BC delete Desktop Explorer | {1CDB2949-8F65-4355-8456-263E7C208A5D} | Delete C:\WINDOWS\system32\nvshell.dll | Script: Quarantine, Delete, BC delete Desktop Explorer Menu | {1E9B04FB-F9E5-4718-997B-B8DA88302A47} | Delete C:\WINDOWS\system32\nvshell.dll | Script: Quarantine, Delete, BC delete nView Desktop Context Menu | {1E9B04FB-F9E5-4718-997B-B8DA88302A48} | Delete IE User Assist | {FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} | Delete Elements detected - 219, recognized as trusted - 210
| | |||||||||||||||||||||||||||||
| File name | Type | Name | Description | Manufacturer
| C:\WINDOWS\TEMP\12.tmp | Script: Quarantine, Delete, BC delete Provider |
| C:\WINDOWS\TEMP\20.tmp | Script: Quarantine, Delete, BC delete Provider | Wdawghzrrzch | © Microsoft Corporation. All rights reserved.
| Elements detected - 11, recognized as trusted - 9
| | |||||||||
| File name | Job name | Job status | Description | Manufacturer
| Elements detected - 6, recognized as trusted - 6
| | ||||||
| Provider | Status | EXE file | Description | GUID
| Detected - 4, recognized as trusted - 4
| | ||||||
| Provider | EXE file | Description
| Detected - 25, recognized as trusted - 25
| | ||||||
| File name | Description | Manufacturer | CLSID | Source URL
| {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} | Delete http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
| Elements detected - 9, recognized as trusted - 8
| | |||||||||
| File name | Description | Manufacturer
| C:\WINDOWS\system32\nvtuicpl.cpl | Script: Quarantine, Delete, BC delete
| Elements detected - 29, recognized as trusted - 28
| | |||||||
| File name | Description | Manufacturer | CLSID
| Elements detected - 17, recognized as trusted - 17
| | ||||||
| Hosts file record |
| File name | Type | Description | Manufacturer | CLSID
| mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D} | Delete mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D} | Delete mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D} | Delete Elements detected - 34, recognized as trusted - 31
| | ||||||
| File | Description | Type
| C:\WINDOWS\system32\DRIVERS\5040690drv.sys | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| \SystemRoot\system32\DRIVERS\5040690drv.sys | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| fsdfw.sys | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| C:\WINDOWS\system32\Drivers\fsdfw.sys | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| |
Main script of analysis Windows version: Microsoft Windows XP, Build=2600, SP="Service Pack 3" System Restore: enabled 1.1 Searching for user-mode API hooks Analysis: kernel32.dll, export table found in section .text Function kernel32.dll:TerminateThread (845) intercepted, method APICodeHijack.JmpTo[00973002] IAT modification detected: CreateProcessA - 00D20010<>7C80236B IAT modification detected: GetModuleFileNameA - 00D20080<>7C80B56F IAT modification detected: FreeLibrary - 00D200F0<>7C80AC7E IAT modification detected: GetModuleFileNameW - 00D20160<>7C80B475 IAT modification detected: CreateProcessW - 00D201D0<>7C802336 IAT modification detected: LoadLibraryW - 00D202B0<>7C80AEEB IAT modification detected: LoadLibraryA - 00D20320<>7C801D7B IAT modification detected: GetProcAddress - 00D20390<>7C80AE40 Analysis: ntdll.dll, export table found in section .text Function ntdll.dll:NtCreateProcess (134) intercepted, method APICodeHijack.JmpTo[00970002] Function ntdll.dll:NtCreateProcessEx (135) intercepted, method APICodeHijack.JmpTo[00971002] Function ntdll.dll:ZwCreateProcess (945) intercepted, method APICodeHijack.JmpTo[00970002] Function ntdll.dll:ZwCreateProcessEx (946) intercepted, method APICodeHijack.JmpTo[00971002] Analysis: user32.dll, export table found in section .text Function user32.dll:DdeConnect (108) intercepted, method APICodeHijack.JmpTo[0097A002] Function user32.dll:SetWindowsHookExW (652) intercepted, method APICodeHijack.JmpTo[00974002] Analysis: advapi32.dll, export table found in section .text Function advapi32.dll:CloseServiceHandle (64) intercepted, method APICodeHijack.JmpTo[00977002] Function advapi32.dll:ControlService (68) intercepted, method APICodeHijack.JmpTo[00976002] Function advapi32.dll:CreateServiceW (103) intercepted, method APICodeHijack.JmpTo[00978002] Function advapi32.dll:OpenServiceW (432) intercepted, method APICodeHijack.JmpTo[00975002] Analysis: ws2_32.dll, export table found in section .text Analysis: wininet.dll, export table found in section .text Analysis: rasapi32.dll, export table found in section .text Analysis: urlmon.dll, export table found in section .text Analysis: netapi32.dll, export table found in section .text 1.2 Searching for kernel-mode API hooks Driver loaded successfully SDT found (RVA=085700) Kernel ntkrnlpa.exe found in memory at address 804D7000 SDT = 8055C700 KiST = 80504480 (284) Function NtAdjustPrivilegesToken (0B) intercepted (805EC464->B66AB690), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtClose (19) intercepted (805BC530->B66ABF94), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtConnectPort (1F) intercepted (805A45D0->B66ACDC8), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateEvent (23) intercepted (8060EF4E->B66AD312), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateFile (25) intercepted (805790A8->B66AC270), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateKey (29) intercepted (806240F0->B66AA500), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateMutant (2B) intercepted (8061769E->B66AD1F8), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateNamedPipeFile (2C) intercepted (805790E2->B66AB27E), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreatePort (2E) intercepted (805A50EC->B66AD0CC), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateSection (32) intercepted (805AB3C8->B66AB426), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateSemaphore (33) intercepted (8061504E->B66AD432), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateThread (35) intercepted (805D1018->B66ABC1C), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateWaitablePort (38) intercepted (805A5110->B66AD162), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDebugActiveProcess (39) intercepted (80643B30->B66AEB1A), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeleteKey (3F) intercepted (8062458C->B66AAB0A), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeleteValueKey (41) intercepted (8062475C->B66AAEBE), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeviceIoControlFile (42) intercepted (8057926E->B66AC6F2), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDuplicateObject (44) intercepted (805BE008->B66AFD26), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtEnumerateKey (47) intercepted (8062493C->B66AB00A), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtEnumerateValueKey (49) intercepted (80624BA6->B66AB0A2), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtFsControlFile (54) intercepted (805792A2->B66AC500), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtLoadDriver (61) intercepted (80584160->B66AEC0C), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtLoadKey (62) intercepted (80626314->B66AA4DC), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtLoadKey2 (63) intercepted (80625F20->B66AA4EE), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtMapViewOfSection (6C) intercepted (805B203A->B66AF374), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtNotifyChangeKey (6F) intercepted (806262DE->B66AB1CE), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenEvent (72) intercepted (8060F04E->B66AD3A8), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenFile (74) intercepted (8057A1A6->B66AC016), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenKey (77) intercepted (806254CE->B66AA6C0), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenMutant (78) intercepted (80617776->B66AD288), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenProcess (7A) intercepted (805CB440->B66AB8CC), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenSection (7D) intercepted (805AA3EC->B66AF10E), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenSemaphore (7E) intercepted (80615148->B66AD4C8), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenThread (80) intercepted (805CB6CC->B66AB7BE), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueryKey (A0) intercepted (80625810->B66AB13A), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueryMultipleValueKey (A1) intercepted (8062323E->B66AAD72), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQuerySection (A7) intercepted (805B85E0->B66AF6AE), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueryValueKey (B1) intercepted (80622314->B66AA99C), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueueApcThread (B4) intercepted (805D1276->B66AEFA0), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtRenameKey (C0) intercepted (80623B12->B66AAC2C), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtReplaceKey (C1) intercepted (806261C4->B66A9F16), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtReplyPort (C2) intercepted (805A54EC->B66AD82C), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtReplyWaitReceivePort (C3) intercepted (805A64B4->B66AD6F2), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtRequestWaitReplyPort (C8) intercepted (805A2D76->B66AE8B4), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtRestoreKey (CC) intercepted (80625AD0->B66AA28E), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtResumeThread (CE) intercepted (805D49BA->B66AFBC8), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSaveKey (CF) intercepted (80625BCC->B66A9EAE), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSecureConnectPort (D2) intercepted (805A3D64->B66ACB0E), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetContextThread (D5) intercepted (805D173A->B66ABE38), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetInformationToken (E6) intercepted (805FA7B4->B66AE154), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetSecurityObject (ED) intercepted (805C062E->B66AEDAA), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetSystemInformation (F0) intercepted (8060FD06->B66AF7FE), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetValueKey (F7) intercepted (80622662->B66AA816), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSuspendProcess (FD) intercepted (805D4A82->B66AF8F0), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSuspendThread (FE) intercepted (805D48F4->B66AFA2A), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSystemDebugControl (FF) intercepted (806180BA->B66AEA3E), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtTerminateProcess (101) intercepted (805D29E2->B66ABA68), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtTerminateThread (102) intercepted (805D2BDC->B66AB9C8), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtUnmapViewOfSection (10B) intercepted (805B2E48->B66AF552), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtWriteVirtualMemory (115) intercepted (805B43CC->B66ABB52), hook C:\WINDOWS\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function FsRtlCheckLockForReadAccess (804EAF84) - machine code modification Method of JmpTo. jmp B669DFD0 \SystemRoot\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! Function IoCreateDevice (80575912) - machine code modification Method of JmpTo. jmp F6CB3FFA fsdfw.sys, driver recognized as trusted >>> Function restored successfully ! Function IoIsOperationSynchronous (804EF912) - machine code modification Method of JmpTo. jmp B669E3AC \SystemRoot\system32\DRIVERS\5040690drv.sys, driver recognized as trusted >>> Function restored successfully ! Functions checked: 284, intercepted: 60, restored: 63 1.3 Checking IDT and SYSENTER Analysis for CPU 1 Analysis for CPU 2 CmpCallCallBacks = 00093D84 Disable callback OK Checking IDT and SYSENTER - complete 1.4 Searching for masking processes and drivers Checking not performed: extended monitoring driver (AVZPM) is not installed 1.5 Checking of IRP handlers Driver loaded successfully \driver\tcpip[IRP_MJ_CREATE] = F6CB368E -> C:\WINDOWS\system32\Drivers\fsdfw.sys, driver recognized as trusted \driver\tcpip[IRP_MJ_DEVICE_CONTROL] = F6CB368E -> C:\WINDOWS\system32\Drivers\fsdfw.sys, driver recognized as trusted \driver\tcpip[IRP_MJ_INTERNAL_DEVICE_CONTROL] = F6CB368E -> C:\WINDOWS\system32\Drivers\fsdfw.sys, driver recognized as trusted \driver\tcpip[IRP_MJ_CLEANUP] = F6CB368E -> C:\WINDOWS\system32\Drivers\fsdfw.sys, driver recognized as trusted Checking - complete >> Services: potentially dangerous service allowed: RemoteRegistry (Remote Registry) >> Services: potentially dangerous service allowed: TermService (Terminal Services) >> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery Service) >> Services: potentially dangerous service allowed: TlntSvr (Telnet) >> Services: potentially dangerous service allowed: Schedule (Task Scheduler) >> Services: potentially dangerous service allowed: mnmsrvc (NetMeeting Remote Desktop Sharing) >> Services: potentially dangerous service allowed: RDSessMgr (Remote Desktop Help Session Manager) > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)! >> Security: disk drives' autorun is enabled >> Security: administrative shares (C$, D$ ...) are enabled >> Security: anonymous user access is enabled >> Security: sending Remote Assistant queries is enabled >> Disable HDD autorun >> Disable autorun from network drives >> Disable CD/DVD autorun >> Disable removable media autorun >> Windows Explorer - show extensions of known file types System Analysis in progressAdd commands to script:
System Analysis - complete
Script commands