Results of system analysis Kaspersky Virus Removal Tool 11.0.0.1245 (database released 08/09/2011; 19:42) List of processes File name PID Description Copyright MD5 Information c:\program files\avast software\avast\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate 1440 avast! Service Copyright (c) 2011 AVAST Software ?? 41.20 kb, rsAh, created: 03.09.2011 17:26:50, modified: 04.07.2011 07:43:51 Command line: "C:\Program Files\AVAST Software\Avast\AvastSvc.exe" c:\program files\google\google desktop search\googledesktop.exe Script: Quarantine, Delete, BC delete, Terminate 1316 Google Desktop Copyright (c) 2003-08 Google. All Rights Reserved. ?? 23.50 kb, rsAh, created: 12.03.2009 02:06:21, modified: 12.03.2009 02:06:28 Command line: "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup Detected:49, recognized as trusted 49 Module name Handle Description Copyright MD5 Used by processes C:\Program Files\AVAST Software\Avast\defs\11090900\algo.dll Script: Quarantine, Delete, BC delete 166002688     -- 1440 C:\Program Files\Google\Google Desktop Search\GoogleDesktopCommon.dll Script: Quarantine, Delete, BC delete 1107296256 Google Desktop Copyright (c) 2003-08 Google. All Rights Reserved. -- 1316 C:\Program Files\Google\Google Desktop Search\GoogleDesktopHyper.dll Script: Quarantine, Delete, BC delete 1291845632 Google Desktop Copyright (c) 2003-08 Google. All Rights Reserved. -- 1316 Modules detected:418, recognized as trusted 415 Kernel Space Modules Viewer Module Base address Size in memory Description Manufacturer 14497202.sys Script: Quarantine, Delete, BC delete F6FFC000 522000 (5382144) C:\WINDOWS\System32\Drivers\dump_iaStor.sys Script: Quarantine, Delete, BC delete A5A63000 0CE000 (843776) Modules detected - 167, recognized as trusted - 165 Services Service Description Status File Group Dependencies Detected - 99, recognized as trusted - 99 Drivers Service Description Status File Group Dependencies 14497202 Driver: Unload, Delete, Disable, BC delete 14497202 Running 14497202.sys Script: Quarantine, Delete, BC delete     Abiosdsk Driver: Unload, Delete, Disable, BC delete Abiosdsk Not started Abiosdsk.sys Script: Quarantine, Delete, BC delete Primary disk   Atdisk Driver: Unload, Delete, Disable, BC delete Atdisk Not started Atdisk.sys Script: Quarantine, Delete, BC delete Primary disk   Avgrkx86 Driver: Unload, Delete, Disable, BC delete AVG Anti-Rootkit Driver Not started C:\WINDOWS\system32\DRIVERS\avgrkx86.sys Script: Quarantine, Delete, BC delete     Changer Driver: Unload, Delete, Disable, BC delete Changer Not started Changer.sys Script: Quarantine, Delete, BC delete Filter   int15.sys Driver: Unload, Delete, Disable, BC delete int15.sys Not started c:\acernb\int15.sys Script: Quarantine, Delete, BC delete     lbrtfdc Driver: Unload, Delete, Disable, BC delete lbrtfdc Not started lbrtfdc.sys Script: Quarantine, Delete, BC delete System Bus Extender   PCIDump Driver: Unload, Delete, Disable, BC delete PCIDump Not started PCIDump.sys Script: Quarantine, Delete, BC delete PCI Configuration   PDCOMP Driver: Unload, Delete, Disable, BC delete PDCOMP Not started PDCOMP.sys Script: Quarantine, Delete, BC delete     PDFRAME Driver: Unload, Delete, Disable, BC delete PDFRAME Not started PDFRAME.sys Script: Quarantine, Delete, BC delete     PDRELI Driver: Unload, Delete, Disable, BC delete PDRELI Not started PDRELI.sys Script: Quarantine, Delete, BC delete     PDRFRAME Driver: Unload, Delete, Disable, BC delete PDRFRAME Not started PDRFRAME.sys Script: Quarantine, Delete, BC delete     Rts516xIR Driver: Unload, Delete, Disable, BC delete Realtek IR Driver Not started C:\WINDOWS\system32\DRIVERS\Rts516xIR.sys Script: Quarantine, Delete, BC delete     Simbad Driver: Unload, Delete, Disable, BC delete Simbad Not started Simbad.sys Script: Quarantine, Delete, BC delete Filter   USBCCID Driver: Unload, Delete, Disable, BC delete Realtek Smartcard Reader Driver Not started C:\WINDOWS\system32\DRIVERS\Rts5161ccid.sys Script: Quarantine, Delete, BC delete     WDICA Driver: Unload, Delete, Disable, BC delete WDICA Not started WDICA.sys Script: Quarantine, Delete, BC delete     Detected - 210, recognized as trusted - 194 Autoruns File name Status Startup method Description C:\Documents and Settings\Lacey Smith\Local Settings\Temp\_uninst_14497202.bat Script: Quarantine, Delete, BC delete Active Shortcut in Autoruns folder C:\Documents and Settings\Lacey Smith\Start Menu\Programs\Startup\, C:\Documents and Settings\Lacey Smith\Start Menu\Programs\Startup\_uninst_14497202.lnk, C:\Documents and Settings\Lacey Smith\Local Settings\Temp\_uninst_57093746.bat Script: Quarantine, Delete, BC delete Active Shortcut in Autoruns folder C:\Documents and Settings\Lacey Smith\Start Menu\Programs\Startup\, C:\Documents and Settings\Lacey Smith\Start Menu\Programs\Startup\_uninst_57093746.lnk, C:\Program Files\McAfee\VirusScan\NAIEvent.dll Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\McLogEvent, EventMessageFile C:\WINDOWS\System32\Drivers\lbrtfdc.sys Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\lbrtfdc, EventMessageFile C:\WINDOWS\System32\PrintFilterPipelineSvc.exe Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PrintFilterPipelineSvc, EventMessageFile C:\WINDOWS\System32\appmgmts.dll Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters, ServiceDll Delete C:\WINDOWS\System32\appmgmts.dll Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Application Management, EventMessageFile C:\WINDOWS\System32\appmgr.dll Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Software Installation, EventMessageFile C:\WINDOWS\System32\fdeploy.dll Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\File Deployment, EventMessageFile C:\WINDOWS\System32\fdeploy.dll Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Folder Redirection, EventMessageFile C:\WINDOWS\System32\hidserv.dll Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\HidServ\Parameters, ServiceDll Delete C:\WINDOWS\System32\igmpv2.dll Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile C:\WINDOWS\System32\ipbootp.dll Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile C:\WINDOWS\System32\iprip2.dll Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile C:\WINDOWS\System32\ntbackup.exe Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\ntbackup, EventMessageFile C:\WINDOWS\System32\ospf.dll Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPF, EventMessageFile C:\WINDOWS\System32\ospfmib.dll Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPFMib, EventMessageFile C:\WINDOWS\System32\polagent.dll Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PolicyAgent, EventMessageFile C:\WINDOWS\System32\tssdis.exe Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\TermServSessDir, EventMessageFile C:\WINDOWS\system32\MsSip1.dll Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 1, $DLL Delete C:\WINDOWS\system32\MsSip2.dll Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 2, $DLL Delete C:\WINDOWS\system32\MsSip3.dll Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 3, $DLL Delete C:\WINDOWS\system32\asr_fmt.exe Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR format utility for volumes Delete C:\WINDOWS\system32\asr_ldm.exe Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR utility for Logical Disk Manager Delete C:\WINDOWS\system32\asr_pfu.exe Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR protected file utility Delete C:\WINDOWS\system32\psxss.exe Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix C:\WINDOWS\system32\stisvc.exe Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System, EventMessageFile appmgmts.dll Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}, DLLName Delete c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Protexis Licensing Service, EventMessageFile deskpan.dll Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {42071714-76d4-11d1-8b24-00a0c9068ff3} Delete mvfs32.dll Script: Quarantine, Delete, BC delete Active Registry key HKEY_USERS, .DEFAULT\Control Panel\IOProcs, MVB Delete mvfs32.dll Script: Quarantine, Delete, BC delete Active Registry key HKEY_USERS, S-1-5-19\Control Panel\IOProcs, MVB Delete mvfs32.dll Script: Quarantine, Delete, BC delete Active Registry key HKEY_USERS, S-1-5-20\Control Panel\IOProcs, MVB Delete mvfs32.dll Script: Quarantine, Delete, BC delete Active Registry key HKEY_USERS, S-1-5-18\Control Panel\IOProcs, MVB Delete mvfs32.dll Script: Quarantine, Delete, BC delete Active Registry key HKEY_USERS, S-1-5-21-1809832699-1238661117-741939197-1005\Control Panel\IOProcs, MVB Delete vgafix.fon Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon Delete vgaoem.fon Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon Delete vgasys.fon Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon Delete Autoruns items detected - 862, recognized as trusted - 824 Microsoft Internet Explorer extension modules (BHOs, Toolbars ...) File name Type Description Manufacturer CLSID Extension module {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} Delete Elements detected - 14, recognized as trusted - 13 Windows Explorer extension modules File name Destination Description Manufacturer CLSID deskpan.dll Script: Quarantine, Delete, BC delete Display Panning CPL Extension {42071714-76d4-11d1-8b24-00a0c9068ff3} Delete Shell extensions for file compression {764BF0E1-F219-11ce-972D-00AA00A14F56} Delete Encryption Context Menu {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} Delete Taskbar and Start Menu {0DF44EAA-FF21-4412-828E-260A8728E7F1} Delete User Accounts {7A9D77BD-5403-11d2-8785-2E0420524153} Delete Elements detected - 221, recognized as trusted - 216 Printing system extensions (print monitors, providers) File name Type Name Description Manufacturer Elements detected - 9, recognized as trusted - 9 Task Scheduler jobs File name Job name Job status Description Manufacturer Elements detected - 2, recognized as trusted - 2 SPI/LSP settings Namespace providers (NSP) Provider Status EXE file Description GUID Detected - 3, recognized as trusted - 3 Transport protocol providers (TSP, LSP) Provider EXE file Description Detected - 15, recognized as trusted - 15 Results of automatic SPI settings check LSP settings checked. No errors detected TCP/UDP ports Port Status Remote Host Remote Port Application Notes TCP ports 135 LISTENING 0.0.0.0 47324 [1060] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate   139 LISTENING 0.0.0.0 16389 [4] System Script: Quarantine, Delete, BC delete, Terminate   445 LISTENING 0.0.0.0 39150 [4] System Script: Quarantine, Delete, BC delete, Terminate   1025 LISTENING 0.0.0.0 16458 [476] c:\windows\system32\lexpps.exe Script: Quarantine, Delete, BC delete, Terminate   1047 LISTENING 0.0.0.0 2288 [2116] c:\windows\system32\alg.exe Script: Quarantine, Delete, BC delete, Terminate   2484 CLOSE_WAIT 72.14.204.102 80 [1928] c:\program files\google\googletoolbarnotifier\googletoolbarnotifier.exe Script: Quarantine, Delete, BC delete, Terminate   3826 LISTENING 0.0.0.0 39134 [2716] c:\program files\acer\acer vcm\rs_service.exe Script: Quarantine, Delete, BC delete, Terminate   4664 LISTENING 0.0.0.0 53302 [1316] c:\program files\google\google desktop search\googledesktop.exe Script: Quarantine, Delete, BC delete, Terminate   5152 LISTENING 0.0.0.0 63570 [2464] c:\program files\java\jre6\bin\jqs.exe Script: Quarantine, Delete, BC delete, Terminate   12025 LISTENING 0.0.0.0 6348 [1440] c:\program files\avast software\avast\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate   12080 LISTENING 0.0.0.0 34945 [1440] c:\program files\avast software\avast\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate   12110 LISTENING 0.0.0.0 37052 [1440] c:\program files\avast software\avast\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate   12119 LISTENING 0.0.0.0 45121 [1440] c:\program files\avast software\avast\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate   12143 LISTENING 0.0.0.0 39038 [1440] c:\program files\avast software\avast\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate   12465 LISTENING 0.0.0.0 55414 [1440] c:\program files\avast software\avast\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate   12563 LISTENING 0.0.0.0 55363 [1440] c:\program files\avast software\avast\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate   12993 LISTENING 0.0.0.0 2227 [1440] c:\program files\avast software\avast\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate   12995 LISTENING 0.0.0.0 36923 [1440] c:\program files\avast software\avast\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate   UDP ports 123 LISTENING -- -- [1100] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate   123 LISTENING -- -- [1100] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate   137 LISTENING -- -- [4] System Script: Quarantine, Delete, BC delete, Terminate   138 LISTENING -- -- [4] System Script: Quarantine, Delete, BC delete, Terminate   445 LISTENING -- -- [4] System Script: Quarantine, Delete, BC delete, Terminate   500 LISTENING -- -- [676] c:\windows\system32\lsass.exe Script: Quarantine, Delete, BC delete, Terminate   1026 LISTENING -- -- [1688] c:\program files\divx\divx update\divxupdate.exe Script: Quarantine, Delete, BC delete, Terminate   1900 LISTENING -- -- [1232] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate   1900 LISTENING -- -- [1232] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate   4500 LISTENING -- -- [676] c:\windows\system32\lsass.exe Script: Quarantine, Delete, BC delete, Terminate   Downloaded Program Files (DPF) File name Description Manufacturer CLSID Source URL Elements detected - 3, recognized as trusted - 3 Control Panel Applets (CPL) File name Description Manufacturer Elements detected - 28, recognized as trusted - 28 Active Setup File name Description Manufacturer CLSID Elements detected - 16, recognized as trusted - 16 HOSTS file Hosts file record ??1 Clear Hosts file Protocols and handlers File name Type Description Manufacturer CLSID mscoree.dll Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D} Delete mscoree.dll Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D} Delete mscoree.dll Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D} Delete Elements detected - 33, recognized as trusted - 30 Suspicious objects File Description Type C:\WINDOWS\System32\Drivers\aswSnx.SYS Script: Quarantine, Delete, BC delete Suspicion for Rootkit Kernel-mode hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys Script: Quarantine, Delete, BC delete Suspicion for Rootkit Kernel-mode hook C:\WINDOWS\System32\Drivers\aswSP.SYS Script: Quarantine, Delete, BC delete Suspicion for Rootkit Kernel-mode hook \SystemRoot\System32\Drivers\aswSP.SYS Script: Quarantine, Delete, BC delete Suspicion for Rootkit Kernel-mode hook \SystemRoot\system32\DRIVERS\0522806drv.sys Script: Quarantine, Delete, BC delete Suspicion for Rootkit Kernel-mode hook Main script of analysis Windows version: Microsoft Windows XP, Build=2600, SP="Service Pack 3" System Restore: enabled 1.1 Searching for user-mode API hooks Analysis: kernel32.dll, export table found in section .text IAT modification detected: CreateProcessA - 00CA0010<>7C80236B IAT modification detected: GetModuleFileNameA - 00CA0080<>7C80B56F IAT modification detected: FreeLibrary - 00CA00F0<>7C80AC7E IAT modification detected: GetModuleFileNameW - 00CA0160<>7C80B475 IAT modification detected: CreateProcessW - 00CA01D0<>7C802336 IAT modification detected: LoadLibraryW - 00CA02B0<>7C80AEEB IAT modification detected: LoadLibraryA - 00CA0320<>7C801D7B IAT modification detected: GetProcAddress - 00CA0390<>7C80AE40 Analysis: ntdll.dll, export table found in section .text Function ntdll.dll:LdrLoadDll (70) intercepted, method APICodeHijack.JmpTo[001501EE] Function ntdll.dll:LdrUnloadDll (80) intercepted, method APICodeHijack.JmpTo[001503F2] Analysis: user32.dll, export table found in section .text Function user32.dll:SetWinEventHook (639) intercepted, method APICodeHijack.JmpTo[003D01EE] Function user32.dll:SetWindowsHookExA (651) intercepted, method APICodeHijack.JmpTo[003D05F6] Function user32.dll:SetWindowsHookExW (652) intercepted, method APICodeHijack.JmpTo[003D07FA] Function user32.dll:UnhookWinEvent (685) intercepted, method APICodeHijack.JmpTo[003D03F2] Function user32.dll:UnhookWindowsHookEx (687) intercepted, method APICodeHijack.JmpTo[003D09FE] Analysis: advapi32.dll, export table found in section .text Function advapi32.dll:ChangeServiceConfig2A (54) intercepted, method APICodeHijack.JmpTo[003C0C02] Function advapi32.dll:ChangeServiceConfig2W (55) intercepted, method APICodeHijack.JmpTo[003C0E06] Function advapi32.dll:ChangeServiceConfigA (56) intercepted, method APICodeHijack.JmpTo[003C07FA] Function advapi32.dll:ChangeServiceConfigW (57) intercepted, method APICodeHijack.JmpTo[003C09FE] Function advapi32.dll:CreateServiceA (102) intercepted, method APICodeHijack.JmpTo[003C01EE] Function advapi32.dll:CreateServiceW (103) intercepted, method APICodeHijack.JmpTo[003C03F2] Function advapi32.dll:DeleteService (177) intercepted, method APICodeHijack.JmpTo[003C05F6] Function advapi32.dll:SetServiceObjectSecurity (572) intercepted, method APICodeHijack.JmpTo[003C100A] Analysis: ws2_32.dll, export table found in section .text Analysis: wininet.dll, export table found in section .text Analysis: rasapi32.dll, export table found in section .text Analysis: urlmon.dll, export table found in section .text Analysis: netapi32.dll, export table found in section .text 1.2 Searching for kernel-mode API hooks Driver loaded successfully SDT found (RVA=08B520) Kernel ntoskrnl.exe found in memory at address 804D7000 SDT = 80562520 KiST = 804E48D0 (284) Function NtAddBootEntry (09) intercepted (80650DFF->A5B68202), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtAdjustPrivilegesToken (0B) intercepted (8059741F->A4C88690), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtAllocateVirtualMemory (11) intercepted (80570BC5->A5BCED8C), hook C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtClose (19) intercepted (8056F8D7->A4C88F94), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtConnectPort (1F) intercepted (80590E53->A4C89DC8), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateEvent (23) intercepted (805744F6->A4C8A312), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateEventPair (24) intercepted (80650EF4->A5B6A848), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateFile (25) intercepted (80573DFB->A4C89270), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateIoCompletion (26) intercepted (805E73F1->A5B6A95E), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateKey (29) intercepted (80578AB4->A4C87500), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateMutant (2B) intercepted (8058408D->A4C8A1F8), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateNamedPipeFile (2C) intercepted (80588FBA->A4C8827E), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreatePort (2E) intercepted (805A13A0->A4C8A0CC), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateProcessEx (30) - machine code modification Method of JmpTo. jmp A5BE439C\SystemRoot\System32\Drivers\aswSP.SYS, driver recognized as trusted >>> Function restored successfully ! Function NtCreateSection (32) intercepted (8056DB66->A4C88426), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateSemaphore (33) intercepted (8057FD03->A4C8A432), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateThread (35) intercepted (80584D39->A4C88C1C), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateTimer (36) intercepted (8059EFE9->A5B6A90C), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateWaitablePort (38) intercepted (805B68AC->A4C8A162), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDebugActiveProcess (39) intercepted (80663211->A4C8BB1A), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeleteBootEntry (3D) intercepted (8063417A->A5B68226), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeleteKey (3F) intercepted (8059A5C9->A4C87B0A), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeleteValueKey (41) intercepted (805991E8->A4C87EBE), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeviceIoControlFile (42) intercepted (80588CB6->A4C896F2), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDuplicateObject (44) intercepted (8057F18D->A4C8CD26), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtEnumerateKey (47) intercepted (8057F002->A4C8800A), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtEnumerateValueKey (49) intercepted (80590232->A4C880A2), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtFreeVirtualMemory (53) intercepted (805710BF->A5BCEE3C), hook C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtFsControlFile (54) intercepted (80582AF2->A4C89500), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtLoadDriver (61) intercepted (805B52F0->A4C8BC0C), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtLoadKey (62) intercepted (805B8287->A4C874DC), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtLoadKey2 (63) intercepted (805B83E6->A4C874EE), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtMapViewOfSection (6C) intercepted (8057AC21->A4C8C374), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtModifyBootEntry (6D) intercepted (8063417A->A5B6824A), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtNotifyChangeKey (6F) intercepted (80596D8A->A4C881CE), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtNotifyChangeMultipleKeys (70) intercepted (80596B9C->A5B68CDA), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenEvent (72) intercepted (80589D61->A4C8A3A8), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenEventPair (73) intercepted (80650FE5->A5B6A870), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenFile (74) intercepted (8057A095->A4C89016), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenIoCompletion (75) intercepted (80621643->A5B6A988), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenKey (77) intercepted (80572BDF->A4C876C0), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenMutant (78) intercepted (8058413B->A4C8A288), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenProcess (7A) intercepted (8057F93A->A4C888CC), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenSection (7D) intercepted (80579192->A4C8C10E), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenSemaphore (7E) intercepted (805AD95A->A4C8A4C8), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenThread (80) intercepted (80596743->A4C887BE), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenTimer (83) intercepted (80650E1B->A5B6A936), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtProtectVirtualMemory (89) intercepted (8057F56B->A5BCEED4), hook C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueryKey (A0) intercepted (8057EC02->A4C8813A), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueryMultipleValueKey (A1) intercepted (806563CF->A4C87D72), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueryObject (A3) intercepted (8058A65E->A5B68BA0), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQuerySection (A7) intercepted (80587073->A4C8C6AE), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueryValueKey (B1) intercepted (80572F19->A4C8799C), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueueApcThread (B4) intercepted (8059FC75->A4C8BFA0), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtRenameKey (C0) intercepted (8065684C->A4C87C2C), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtReplaceKey (C1) intercepted (806571A8->A4C86F16), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtReplyPort (C2) intercepted (805862F8->A4C8A82C), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtReplyWaitReceivePort (C3) intercepted (80576817->A4C8A6F2), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtRequestWaitReplyPort (C8) intercepted (8057D13B->A4C8B8B4), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtRestoreKey (CC) intercepted (80656D3D->A4C8728E), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtResumeThread (CE) intercepted (805853B0->A4C8CBC8), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSaveKey (CF) intercepted (80656E3E->A4C86EAE), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSecureConnectPort (D2) intercepted (80587E0A->A4C89B0E), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetBootEntryOrder (D3) intercepted (80650DFF->A5B6826E), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetBootOptions (D4) intercepted (80650DFF->A5B68292), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetContextThread (D5) intercepted (80635EFB->A4C88E38), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetInformationToken (E6) intercepted (805B0A10->A4C8B154), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetSecurityObject (ED) intercepted (805E8694->A4C8BDAA), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetSystemInformation (F0) intercepted (805BFDB1->A4C8C7FE), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetSystemPowerState (F1) intercepted (806700E7->A5B68186), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetValueKey (F7) intercepted (80580088->A4C87816), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtShutdownSystem (F9) intercepted (8064F29B->A5B68162), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSuspendProcess (FD) intercepted (80637C93->A4C8C8F0), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSuspendThread (FE) intercepted (80637BAF->A4C8CA2A), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSystemDebugControl (FF) intercepted (80651A75->A4C8BA3E), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtTerminateProcess (101) intercepted (8058E8B1->A4C88A68), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtTerminateThread (102) intercepted (80584966->A4C889C8), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtUnmapViewOfSection (10B) intercepted (8057A7A9->A4C8C552), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtVdmControl (10C) intercepted (805C28F0->A5B682B6), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtWriteVirtualMemory (115) intercepted (805875EF->A4C88B52), hook C:\WINDOWS\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function FsRtlCheckLockForReadAccess (804F45B3) - machine code modification Method of JmpTo. jmp A4C7AFD0 \SystemRoot\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! Function IoAllocateIrp (804EAFBD) - machine code modification Method not defined., embedding from byte 15 >>> Function restored successfully ! Function IoIsOperationSynchronous (804EAFCE) - machine code modification Method of JmpTo. jmp A4C7B3AC \SystemRoot\system32\DRIVERS\0522806drv.sys, driver recognized as trusted >>> Function restored successfully ! Function ObInsertObject (8056DA64) - machine code modification Method of JmpTo. jmp A5BE17F2 \SystemRoot\System32\Drivers\aswSP.SYS, driver recognized as trusted >>> Function restored successfully ! Function ObMakeTemporaryObject (805AD1E0) - machine code modification Method of JmpTo. jmp A5BDFD4C \SystemRoot\System32\Drivers\aswSP.SYS, driver recognized as trusted >>> Function restored successfully ! Functions checked: 284, intercepted: 79, restored: 85 1.3 Checking IDT and SYSENTER Analysis for CPU 1 Analysis for CPU 2 CmpCallCallBacks = 00145638 Disable callback OK Checking IDT and SYSENTER - complete 1.4 Searching for masking processes and drivers Checking not performed: extended monitoring driver (AVZPM) is not installed 1.5 Checking of IRP handlers Driver loaded successfully \FileSystem\ntfs[IRP_MJ_CREATE] = A5BE3E88 -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted \FileSystem\ntfs[IRP_MJ_CLOSE] = A5BE3EC8 -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted \FileSystem\ntfs[IRP_MJ_WRITE] = A5BE3FA4 -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted \FileSystem\ntfs[IRP_MJ_SET_INFORMATION] = A5BE3FE4 -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted Checking - complete Latent loading of libraries through AppInit_DLLs suspected: "C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL" >> Services: potentially dangerous service allowed: TermService (Terminal Services) >> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery Service) >> Services: potentially dangerous service allowed: Schedule (Task Scheduler) >> Services: potentially dangerous service allowed: mnmsrvc (NetMeeting Remote Desktop Sharing) >> Services: potentially dangerous service allowed: RDSessMgr (Remote Desktop Help Session Manager) > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)! >> Security: disk drives' autorun is enabled >> Security: administrative shares (C$, D$ ...) are enabled >> Security: anonymous user access is enabled >> Security: sending Remote Assistant queries is enabled >> Disable HDD autorun >> Disable autorun from network drives >> Disable CD/DVD autorun >> Disable removable media autorun >> Windows Explorer - show extensions of known file types System Analysis in progress System Analysis - complete Script commands Add commands to script: Blocking hooks using Anti-Rootkit Enable AVZGuard Operations with AVZPM (true=enable,false=disable) BootCleaner - import list of deleted files BootCleaner - import all Registry cleanup after deleting files ExecuteWizard ('TSW',2,3,true) - Running Troubleshooting wizard BootCleaner - activate Reboot Insert template for QuarantineFile() - quarantining file Insert template for BC_QrFile() - quarantining file via BootCleaner Insert template for DeleteFile() - deleting file Insert template for DelCLSID() - deleting CLSID item from registry Additional operations:Performance tweaking: disable service TermService (Terminal Services) Performance tweaking: disable service SSDPSRV (SSDP Discovery Service) Performance tweaking: disable service Schedule (Task Scheduler) Performance tweaking: disable service mnmsrvc (NetMeeting Remote Desktop Sharing) Performance tweaking: disable service RDSessMgr (Remote Desktop Help Session Manager) Security tweaking: disable CD autorun Security tweaking: disable administrative shares Security tweaking: disable anonymous user access Security: disable sending Remote Assistant queries File list