Results of system analysis

Kaspersky Virus Removal Tool 11.0.0.1245 (database released 20/09/2011; 10:23)

List of processes

File name	PID	Description	Copyright	MD5	Information
AESTSr64.exe Script: Quarantine, Delete, BC delete, Terminate	1592			??	error getting file info Command line:
SASCore64.exe Script: Quarantine, Delete, BC delete, Terminate	1568			??	error getting file info Command line:
stacsv64.exe Script: Quarantine, Delete, BC delete, Terminate	948			??	error getting file info Command line:
sttray64.exe Script: Quarantine, Delete, BC delete, Terminate	4996			??	error getting file info Command line:
SynTPEnh.exe Script: Quarantine, Delete, BC delete, Terminate	5004			??	error getting file info Command line:
SynTPHelper.exe Script: Quarantine, Delete, BC delete, Terminate	4384			??	error getting file info Command line:
wmpnetwk.exe Script: Quarantine, Delete, BC delete, Terminate	5248			??	error getting file info Command line:
Detected:68, recognized as trusted 61

Module name	Handle	Description	Copyright	MD5	Used by processes
Modules detected:443, recognized as trusted 443

Kernel Space Modules Viewer

Module	Base address	Size in memory	Description	Manufacturer
C:\Windows\System32\Drivers\dump_dumpfve.sys Script: Quarantine, Delete, BC delete	660E000	013000 (77824)
C:\Windows\System32\Drivers\dump_iaStor.sys Script: Quarantine, Delete, BC delete	4A21000	208000 (2129920)
Modules detected - 204, recognized as trusted - 202

Services

Service	Description	Status	File	Group	Dependencies
gupdate Service: Stop, Delete, Disable, BC delete	Google Update Service (gupdate)	Not started	C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Script: Quarantine, Delete, BC delete		RPCSS
gupdatem Service: Stop, Delete, Disable, BC delete	Google Update Service (gupdatem)	Not started	C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Script: Quarantine, Delete, BC delete		RPCSS
Detected - 172, recognized as trusted - 170

Drivers

Service	Description	Status	File	Group	Dependencies
Detected - 270, recognized as trusted - 270

Autoruns

File name	Status	Startup method	Description
C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\GoToAssist, DLLName Delete
C:\Program Files (x86)\Dell\DellDock\DellDock.exe Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	C:\Users\Regjon Higgins\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\, C:\Users\Regjon Higgins\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk,
C:\Users\Regjon Higgins\AppData\Local\Temp\_uninst_88646186.bat Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	C:\Users\Regjon Higgins\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\, C:\Users\Regjon Higgins\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_uninst_88646186.lnk,
C:\Users\Regjon Higgins\AppData\Local\Temp\_uninst_89585899.bat Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	C:\Users\Regjon Higgins\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\, C:\Users\Regjon Higgins\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_uninst_89585899.lnk,
C:\Windows\System32\appmgmts.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters, ServiceDll Delete
C:\Windows\system32\psxss.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
C:\d910ac4ce79853401de3\DW\DW20.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\VSSetup, EventMessageFile
auditcse.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{f3ccc681-b74c-4060-9f26-cd84525dca2a}, DLLName Delete
igfxdev.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui, DLLName Delete
rdpclip Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd, StartupPrograms Delete
Autoruns items detected - 605, recognized as trusted - 595

Microsoft Internet Explorer extension modules (BHOs, Toolbars ...)

File name	Type	Description	Manufacturer	CLSID
	Extension module			{2670000A-7350-4f3c-8081-5663EE0C6C49} Delete
	Extension module			{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} Delete
Elements detected - 6, recognized as trusted - 4

Windows Explorer extension modules

File name	Destination	Description	Manufacturer	CLSID
	ColumnHandler			{F9DB5320-233E-11D1-9F84-707F02C10627} Delete
Elements detected - 14, recognized as trusted - 13

Printing system extensions (print monitors, providers)

File name	Type	Name	Description	Manufacturer
hpzllw71.dll Script: Quarantine, Delete, BC delete	Monitor	LIDIL hpzllw71
localspl.dll Script: Quarantine, Delete, BC delete	Monitor	Local Port
FXSMON.DLL Script: Quarantine, Delete, BC delete	Monitor	Microsoft Shared Fax Monitor
hpz3lw71.dll Script: Quarantine, Delete, BC delete	Monitor	PCL hpz3lw71
PJLMON.DLL Script: Quarantine, Delete, BC delete	Monitor	PJL Language Monitor
tcpmon.dll Script: Quarantine, Delete, BC delete	Monitor	Standard TCP/IP Port
usbmon.dll Script: Quarantine, Delete, BC delete	Monitor	USB Monitor
WSDMon.dll Script: Quarantine, Delete, BC delete	Monitor	WSD Port
inetpp.dll Script: Quarantine, Delete, BC delete	Provider	HTTP Print Services
Elements detected - 10, recognized as trusted - 1

Task Scheduler jobs

File name	Job name	Job status	Description	Manufacturer
Elements detected - 0, recognized as trusted - 0

SPI/LSP settings

Namespace providers (NSP)

Provider	Status	EXE file	Description	GUID
Detected - 9, recognized as trusted - 9

Transport protocol providers (TSP, LSP)

Provider EXE file Description
Detected - 10, recognized as trusted - 10
Results of automatic SPI settings check
LSP settings checked. No errors detected

TCP/UDP ports

Port Status Remote Host Remote Port Application Notes
TCP ports
135 LISTENING 0.0.0.0 0 [720] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
139 LISTENING 0.0.0.0 0 [4] System
Script: Quarantine, Delete, BC delete, Terminate
445 LISTENING 0.0.0.0 0 [4] System
Script: Quarantine, Delete, BC delete, Terminate
554 LISTENING 0.0.0.0 0 [5248] wmpnetwk.exe
Script: Quarantine, Delete, BC delete, Terminate
2869 LISTENING 0.0.0.0 0 [4] System
Script: Quarantine, Delete, BC delete, Terminate
5354 LISTENING 0.0.0.0 0 [1668] c:\program files (x86)\bonjour\mdnsresponder.exe
Script: Quarantine, Delete, BC delete, Terminate
5357 LISTENING 0.0.0.0 0 [4] System
Script: Quarantine, Delete, BC delete, Terminate
10243 LISTENING 0.0.0.0 0 [4] System
Script: Quarantine, Delete, BC delete, Terminate
27015 LISTENING 0.0.0.0 0 [1620] c:\program files (x86)\common files\apple\mobile device support\applemobiledeviceservice.exe
Script: Quarantine, Delete, BC delete, Terminate
49152 LISTENING 0.0.0.0 0 [456] wininit.exe
Script: Quarantine, Delete, BC delete, Terminate
49153 LISTENING 0.0.0.0 0 [784] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
49154 LISTENING 0.0.0.0 0 [900] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
49155 LISTENING 0.0.0.0 0 [536] lsass.exe
Script: Quarantine, Delete, BC delete, Terminate
49156 LISTENING 0.0.0.0 0 [1404] spoolsv.exe
Script: Quarantine, Delete, BC delete, Terminate
49157 LISTENING 0.0.0.0 0 [1796] c:\program files (x86)\norton security suite\engine\4.3.0.5\ccsvchst.exe
Script: Quarantine, Delete, BC delete, Terminate
49159 LISTENING 0.0.0.0 0 [512] services.exe
Script: Quarantine, Delete, BC delete, Terminate
49295 LISTENING 0.0.0.0 0 [5060] c:\program files (x86)\intel\intel(r) management engine components\uns\uns.exe
Script: Quarantine, Delete, BC delete, Terminate
59309 TIME_WAIT 192.168.1.1 5000 [0]
59310 TIME_WAIT 192.168.1.1 5000 [0]
59311 TIME_WAIT 192.168.1.1 5000 [0]
59323 TIME_WAIT 192.168.1.1 5000 [0]
59324 TIME_WAIT 192.168.1.1 5000 [0]
59325 TIME_WAIT 192.168.1.1 5000 [0]
59334 TIME_WAIT 192.168.1.1 1780 [0]
59338 TIME_WAIT 192.168.1.1 5000 [0]
59339 TIME_WAIT 192.168.1.1 5000 [0]
59340 TIME_WAIT 192.168.1.1 5000 [0]
UDP ports
137 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
138 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
500 LISTENING -- -- [900] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
1900 LISTENING -- -- [1704] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
1900 LISTENING -- -- [1704] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
3544 LISTENING -- -- [900] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
3702 LISTENING -- -- [432] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
3702 LISTENING -- -- [432] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
3702 LISTENING -- -- [1704] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
3702 LISTENING -- -- [1704] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
4500 LISTENING -- -- [900] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
5004 LISTENING -- -- [5248] wmpnetwk.exe
Script: Quarantine, Delete, BC delete, Terminate
5005 LISTENING -- -- [5248] wmpnetwk.exe
Script: Quarantine, Delete, BC delete, Terminate
5353 LISTENING -- -- [1668] c:\program files (x86)\bonjour\mdnsresponder.exe
Script: Quarantine, Delete, BC delete, Terminate
5355 LISTENING -- -- [972] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
49347 LISTENING -- -- [1704] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
49348 LISTENING -- -- [1704] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
53623 LISTENING -- -- [1704] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
53625 LISTENING -- -- [1404] spoolsv.exe
Script: Quarantine, Delete, BC delete, Terminate
54645 LISTENING -- -- [432] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
56024 LISTENING -- -- [900] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
58974 LISTENING -- -- [1620] c:\program files (x86)\common files\apple\mobile device support\applemobiledeviceservice.exe
Script: Quarantine, Delete, BC delete, Terminate
58975 LISTENING -- -- [1620] c:\program files (x86)\common files\apple\mobile device support\applemobiledeviceservice.exe
Script: Quarantine, Delete, BC delete, Terminate
58976 LISTENING -- -- [1668] c:\program files (x86)\bonjour\mdnsresponder.exe
Script: Quarantine, Delete, BC delete, Terminate

Downloaded Program Files (DPF)

File name Description Manufacturer CLSID Source URL
C:\Program Files\Java\jre6\bin\npjpi160_20.dll
Script: Quarantine, Delete, BC delete {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Delete http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
Elements detected - 3, recognized as trusted - 2

Control Panel Applets (CPL)

File name Description Manufacturer
Elements detected - 18, recognized as trusted - 18

Active Setup

File name Description Manufacturer CLSID
Elements detected - 9, recognized as trusted - 9

HOSTS file

Hosts file record
127.0.0.1 localhost
Clear Hosts file

Protocols and handlers

File name Type Description Manufacturer CLSID
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
Elements detected - 16, recognized as trusted - 13

Suspicious objects

File Description Type

Main script of analysis
Windows version: Windows 7 Home Premium, Build=7600, SP=""
System Restore: enabled
>> Services: potentially dangerous service allowed: TermService (@%SystemRoot%\System32\termsrv.dll,-268)
>> Services: potentially dangerous service allowed: SSDPSRV (@%systemroot%\system32\ssdpsrv.dll,-100)
>> Services: potentially dangerous service allowed: Schedule (@%SystemRoot%\system32\schedsvc.dll,-100)
> Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)!
>> Security: disk drives' autorun is enabled
>> Security: administrative shares (C$, D$ ...) are enabled
>> Security: anonymous user access is enabled
>> Security: sending Remote Assistant queries is enabled
 >>  Disable HDD autorun
 >>  Disable autorun from network drives
 >>  Disable CD/DVD autorun
 >>  Disable removable media autorun
 >>  Windows Explorer - show extensions of known file types
System Analysis in progress

 System Analysis - complete


Script commands 
Add commands to script:
Blocking hooks using Anti-Rootkit
Enable AVZGuard
Operations with AVZPM (true=enable,false=disable)
BootCleaner - import list of deleted files
BootCleaner - import all
Registry cleanup after deleting files
ExecuteWizard ('TSW',2,3,true) - Running Troubleshooting wizard
BootCleaner - activate
Reboot
Insert template for QuarantineFile() - quarantining file
Insert template for BC_QrFile() - quarantining file via BootCleaner
Insert template for DeleteFile() - deleting file
Insert template for DelCLSID() - deleting CLSID item from registry
Additional operations:Performance tweaking: disable service TermService (@%SystemRoot%\System32\termsrv.dll,-268)
Performance tweaking: disable service SSDPSRV (@%systemroot%\system32\ssdpsrv.dll,-100)
Performance tweaking: disable service Schedule (@%SystemRoot%\system32\schedsvc.dll,-100)
Security tweaking: disable CD autorun
Security tweaking: disable administrative shares
Security tweaking: disable anonymous user access
Security: disable sending Remote Assistant queries

File list

Port	Status	Remote Host	Remote Port	Application	Notes
TCP ports
135	LISTENING	0.0.0.0	0	[720] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
139	LISTENING	0.0.0.0	0	[4] System Script: Quarantine, Delete, BC delete, Terminate
445	LISTENING	0.0.0.0	0	[4] System Script: Quarantine, Delete, BC delete, Terminate
554	LISTENING	0.0.0.0	0	[5248] wmpnetwk.exe Script: Quarantine, Delete, BC delete, Terminate
2869	LISTENING	0.0.0.0	0	[4] System Script: Quarantine, Delete, BC delete, Terminate
5354	LISTENING	0.0.0.0	0	[1668] c:\program files (x86)\bonjour\mdnsresponder.exe Script: Quarantine, Delete, BC delete, Terminate
5357	LISTENING	0.0.0.0	0	[4] System Script: Quarantine, Delete, BC delete, Terminate
10243	LISTENING	0.0.0.0	0	[4] System Script: Quarantine, Delete, BC delete, Terminate
27015	LISTENING	0.0.0.0	0	[1620] c:\program files (x86)\common files\apple\mobile device support\applemobiledeviceservice.exe Script: Quarantine, Delete, BC delete, Terminate
49152	LISTENING	0.0.0.0	0	[456] wininit.exe Script: Quarantine, Delete, BC delete, Terminate
49153	LISTENING	0.0.0.0	0	[784] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
49154	LISTENING	0.0.0.0	0	[900] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
49155	LISTENING	0.0.0.0	0	[536] lsass.exe Script: Quarantine, Delete, BC delete, Terminate
49156	LISTENING	0.0.0.0	0	[1404] spoolsv.exe Script: Quarantine, Delete, BC delete, Terminate
49157	LISTENING	0.0.0.0	0	[1796] c:\program files (x86)\norton security suite\engine\4.3.0.5\ccsvchst.exe Script: Quarantine, Delete, BC delete, Terminate
49159	LISTENING	0.0.0.0	0	[512] services.exe Script: Quarantine, Delete, BC delete, Terminate
49295	LISTENING	0.0.0.0	0	[5060] c:\program files (x86)\intel\intel(r) management engine components\uns\uns.exe Script: Quarantine, Delete, BC delete, Terminate
59309	TIME_WAIT	192.168.1.1	5000	[0]
59310	TIME_WAIT	192.168.1.1	5000	[0]
59311	TIME_WAIT	192.168.1.1	5000	[0]
59323	TIME_WAIT	192.168.1.1	5000	[0]
59324	TIME_WAIT	192.168.1.1	5000	[0]
59325	TIME_WAIT	192.168.1.1	5000	[0]
59334	TIME_WAIT	192.168.1.1	1780	[0]
59338	TIME_WAIT	192.168.1.1	5000	[0]
59339	TIME_WAIT	192.168.1.1	5000	[0]
59340	TIME_WAIT	192.168.1.1	5000	[0]
UDP ports
137	LISTENING	--	--	[4] System Script: Quarantine, Delete, BC delete, Terminate
138	LISTENING	--	--	[4] System Script: Quarantine, Delete, BC delete, Terminate
500	LISTENING	--	--	[900] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
1900	LISTENING	--	--	[1704] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
1900	LISTENING	--	--	[1704] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
3544	LISTENING	--	--	[900] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
3702	LISTENING	--	--	[432] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
3702	LISTENING	--	--	[432] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
3702	LISTENING	--	--	[1704] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
3702	LISTENING	--	--	[1704] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
4500	LISTENING	--	--	[900] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
5004	LISTENING	--	--	[5248] wmpnetwk.exe Script: Quarantine, Delete, BC delete, Terminate
5005	LISTENING	--	--	[5248] wmpnetwk.exe Script: Quarantine, Delete, BC delete, Terminate
5353	LISTENING	--	--	[1668] c:\program files (x86)\bonjour\mdnsresponder.exe Script: Quarantine, Delete, BC delete, Terminate
5355	LISTENING	--	--	[972] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
49347	LISTENING	--	--	[1704] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
49348	LISTENING	--	--	[1704] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
53623	LISTENING	--	--	[1704] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
53625	LISTENING	--	--	[1404] spoolsv.exe Script: Quarantine, Delete, BC delete, Terminate
54645	LISTENING	--	--	[432] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
56024	LISTENING	--	--	[900] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
58974	LISTENING	--	--	[1620] c:\program files (x86)\common files\apple\mobile device support\applemobiledeviceservice.exe Script: Quarantine, Delete, BC delete, Terminate
58975	LISTENING	--	--	[1620] c:\program files (x86)\common files\apple\mobile device support\applemobiledeviceservice.exe Script: Quarantine, Delete, BC delete, Terminate
58976	LISTENING	--	--	[1668] c:\program files (x86)\bonjour\mdnsresponder.exe Script: Quarantine, Delete, BC delete, Terminate