Kaspersky Virus Removal Tool 11.0.0.1245 (database released 04/09/2011; 18:08)
| File name | PID | Description | Copyright | MD5 | Information
| c:\program files (x86)\3 mobile broadband\3connect\bechelperservice.exe | Script: Quarantine, Delete, BC delete, Terminate 2920 | | | ?? | 1699.90 kb, rsAh, | created: 23.08.2011 19:41:26, modified: 23.03.2011 16:32:20 Command line: "C:\Program Files (x86)\3 Mobile Broadband\3Connect\BecHelperService.exe" c:\program files (x86)\t-mobile\internetmanager_h\bmsdk.exe | Script: Quarantine, Delete, BC delete, Terminate 6332 | | | ?? | 189.13 kb, rsAh, | created: 03.09.2011 16:34:59, modified: 15.12.2009 10:46:32 Command line: "C:\Program Files (x86)\T-Mobile\InternetManager_H\bmsdk.exe" --initializeblock "C:\Program Files (x86)\T-Mobile\InternetManager_H\boc.ini" CFIWmxSvcs64.exe | Script: Quarantine, Delete, BC delete, Terminate 4940 | | | ?? | error getting file info | Command line: HWDeviceService64.exe | Script: Quarantine, Delete, BC delete, Terminate 3084 | | | ?? | error getting file info | Command line: NitroPDFReaderDriverServicex64.exe | Script: Quarantine, Delete, BC delete, Terminate 2404 | | | ?? | error getting file info | Command line: RAVCpl64.exe | Script: Quarantine, Delete, BC delete, Terminate 1932 | | | ?? | error getting file info | Command line: SmoothView.exe | Script: Quarantine, Delete, BC delete, Terminate 1908 | | | ?? | error getting file info | Command line: c:\program files (x86)\openoffice.org 3\program\soffice.bin | Script: Quarantine, Delete, BC delete, Terminate 2532 | OpenOffice.org 3.3 | Copyright © 2000-2010 by Oracle, Inc. | ?? | 11049.50 kb, rsAh, | created: 17.01.2011 19:08:58, modified: 17.01.2011 19:08:58 Command line: "C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe" "-quickstart" "-env:OOO_CWD=2C:\\Program Files (x86)\\OpenOffice.org 3\\program" SynTPEnh.exe | Script: Quarantine, Delete, BC delete, Terminate 1940 | | | ?? | error getting file info | Command line: SynTPHelper.exe | Script: Quarantine, Delete, BC delete, Terminate 5060 | | | ?? | error getting file info | Command line: TCrdMain.exe | Script: Quarantine, Delete, BC delete, Terminate 1924 | | | ?? | error getting file info | Command line: TemproSvc.exe | Script: Quarantine, Delete, BC delete, Terminate 3700 | | | ?? | error getting file info | Command line: TosCoSrv.exe | Script: Quarantine, Delete, BC delete, Terminate 3824 | | | ?? | error getting file info | Command line: ToshibaReminder.exe | Script: Quarantine, Delete, BC delete, Terminate 1956 | | | ?? | error getting file info | Command line: TosNcCore.exe | Script: Quarantine, Delete, BC delete, Terminate 1868 | | | ?? | error getting file info | Command line: TosReelTimeMonitor.exe | Script: Quarantine, Delete, BC delete, Terminate 1876 | | | ?? | error getting file info | Command line: TosSENotify.exe | Script: Quarantine, Delete, BC delete, Terminate 4972 | | | ?? | error getting file info | Command line: TosSmartSrv.exe | Script: Quarantine, Delete, BC delete, Terminate 4596 | | | ?? | error getting file info | Command line: TPwrMain.exe | Script: Quarantine, Delete, BC delete, Terminate 1916 | | | ?? | error getting file info | Command line: wmpnetwk.exe | Script: Quarantine, Delete, BC delete, Terminate 3336 | | | ?? | error getting file info | Command line: Detected:102, recognized as trusted 85
| | |||||
| Module | Base address | Size in memory | Description | Manufacturer
| C:\Windows\System32\Drivers\dump_dumpfve.sys | Script: Quarantine, Delete, BC delete 4200000 | 013000 (77824) |
| C:\Windows\System32\Drivers\dump_iaStor.sys | Script: Quarantine, Delete, BC delete 36DB000 | 11C000 (1163264) |
| Modules detected - 208, recognized as trusted - 206
| | ||||||
| Service | Description | Status | File | Group | Dependencies
| Detected - 176, recognized as trusted - 176
| | ||||||
| File name | Status | Startup method | Description
| C:\Program Files (x86)\BBC iPlayer Desktop\BBC iPlayer Desktop.exe | Script: Quarantine, Delete, BC delete Active | Shortcut in Autoruns folder | C:\Users\Zoe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\, C:\Users\Zoe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BBC iPlayer Desktop.lnk,
| C:\Program Files (x86)\McAfee\VirusScan\NAIEvent.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\McLogEvent, EventMessageFile
| C:\Program Files (x86)\T-Mobile\InternetManager_H\UpdateDog\ouc.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-21-1092992991-1029331785-2248815135-1000\Software\Microsoft\Windows\CurrentVersion\Run, HW_OPENEYE_OUC_T-Mobile Internet Manager | Delete C:\Users\Zoe\AppData\Local\Temp\_uninst_12558588.bat | Script: Quarantine, Delete, BC delete Active | Shortcut in Autoruns folder | C:\Users\Zoe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\, C:\Users\Zoe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_uninst_12558588.lnk,
| C:\Windows\System32\appmgmts.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters, ServiceDll | Delete C:\Windows\system32\PCImsg.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\PCIapp, EventMessageFile
| C:\Windows\system32\PCImsg.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PCIsys, EventMessageFile
| C:\Windows\system32\psxss.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
| auditcse.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{f3ccc681-b74c-4060-9f26-cd84525dca2a}, DLLName | Delete igfxdev.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui, DLLName | Delete rdpclip | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd, StartupPrograms | Delete Autoruns items detected - 631, recognized as trusted - 620
| | ||||||
| File name | Type | Description | Manufacturer | CLSID
| Elements detected - 5, recognized as trusted - 5
| | ||||||
| File name | Destination | Description | Manufacturer | CLSID
| WinZip | {E0D79304-84BE-11CE-9641-444553540000} | Delete WinZip | {E0D79305-84BE-11CE-9641-444553540000} | Delete WinZip | {E0D79306-84BE-11CE-9641-444553540000} | Delete WinZip | {E0D79307-84BE-11CE-9641-444553540000} | Delete ColumnHandler | {F9DB5320-233E-11D1-9F84-707F02C10627} | Delete Elements detected - 17, recognized as trusted - 12
| | |||||||||||||||||||||
| File name | Type | Name | Description | Manufacturer
| localspl.dll | Script: Quarantine, Delete, BC delete Monitor | Local Port |
| FXSMON.DLL | Script: Quarantine, Delete, BC delete Monitor | Microsoft Shared Fax Monitor |
| nitrolocalmon.dll | Script: Quarantine, Delete, BC delete Monitor | Nitro PDF Port Monitor |
| Primomonnt.dll | Script: Quarantine, Delete, BC delete Monitor | PrimoMon |
| tcpmon.dll | Script: Quarantine, Delete, BC delete Monitor | Standard TCP/IP Port |
| usbmon.dll | Script: Quarantine, Delete, BC delete Monitor | USB Monitor |
| WSDMon.dll | Script: Quarantine, Delete, BC delete Monitor | WSD Port |
| inetpp.dll | Script: Quarantine, Delete, BC delete Provider | HTTP Print Services |
| Elements detected - 9, recognized as trusted - 1
| | ||||||||||||||
| File name | Job name | Job status | Description | Manufacturer
| Elements detected - 4, recognized as trusted - 4
| | ||||||
| Provider | Status | EXE file | Description | GUID
| Detected - 9, recognized as trusted - 9
| | ||||||
| Provider | EXE file | Description
| Detected - 11, recognized as trusted - 11
| | ||||||
| Port | Status | Remote Host | Remote Port | Application | Notes
| TCP ports
| UDP ports
| | ||||||||||||
| File name | Description | Manufacturer | CLSID | Source URL
| Elements detected - 0, recognized as trusted - 0
| | ||||||
| File name | Description | Manufacturer
| Elements detected - 18, recognized as trusted - 18
| | ||||||
| File name | Description | Manufacturer | CLSID
| Elements detected - 9, recognized as trusted - 9
| | ||||||
Hosts file record
|
| File name | Type | Description | Manufacturer | CLSID
| mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D} | Delete mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D} | Delete mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D} | Delete Elements detected - 13, recognized as trusted - 10
| | ||||||
| File | Description | Type |
Main script of analysis Windows version: Windows 7 Home Premium, Build=7601, SP="Service Pack 1" System Restore: enabled Latent loading of libraries through AppInit_DLLs suspected: "C:\PROGRA~2\Sophos\SOPHOS~1\sophos_detoured_x64.dll" >> Services: potentially dangerous service allowed: TermService (@%SystemRoot%\System32\termsrv.dll,-268) >> Services: potentially dangerous service allowed: SSDPSRV (@%systemroot%\system32\ssdpsrv.dll,-100) >> Services: potentially dangerous service allowed: Schedule (@%SystemRoot%\system32\schedsvc.dll,-100) > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)! >> Security: disk drives' autorun is enabled >> Security: administrative shares (C$, D$ ...) are enabled >> Security: anonymous user access is enabled >> Security: sending Remote Assistant queries is enabled >> Disable HDD autorun >> Disable autorun from network drives >> Disable CD/DVD autorun >> Disable removable media autorun >> Windows Explorer - show extensions of known file types System Analysis in progressAdd commands to script:
System Analysis - complete
Script commands