Results of system analysis

Kaspersky Virus Removal Tool 11.0.0.1245 (database released 23/10/2011; 15:18)

List of processes

Kernel Space Modules Viewer

Services

Drivers

Autoruns

Microsoft Internet Explorer extension modules (BHOs, Toolbars ...)

Windows Explorer extension modules

Printing system extensions (print monitors, providers)

Task Scheduler jobs

SPI/LSP settings

LSP settings checked. No errors detected

яю1

Main script of analysis
Windows version: Windows Vista (TM) Home Premium, Build=6001, SP="Service Pack 1"
System Restore: enabled
1.1 Searching for user-mode API hooks
 Analysis: kernel32.dll, export table found in section .text
IAT modification detected: CreateProcessA - 00B80010<>759D1C36
IAT modification detected: GetModuleFileNameA - 00B80080<>75A14625
IAT modification detected: FreeLibrary - 00B800F0<>75A10B10
IAT modification detected: GetModuleFileNameW - 00B80160<>75A15AF5
IAT modification detected: CreateProcessW - 00B801D0<>759D1C01
IAT modification detected: LoadLibraryW - 00B802B0<>759F382D
IAT modification detected: LoadLibraryA - 00B80320<>759F9671
IAT modification detected: GetProcAddress - 00B80390<>75A1BAC6
 Analysis: ntdll.dll, export table found in section .text
 Analysis: user32.dll, export table found in section .text
 Analysis: advapi32.dll, export table found in section .text
 Analysis: ws2_32.dll, export table found in section .text
 Analysis: wininet.dll, export table found in section .text
 Analysis: rasapi32.dll, export table found in section .text
 Analysis: urlmon.dll, export table found in section .text
 Analysis: netapi32.dll, export table found in section .text
1.2 Searching for kernel-mode API hooks
 Error loading driver - scan interrupted [C0000022]
 >>>> Suspicion for Rootkit uti1odu0 C:\Windows\system32\Drivers\uti1odu0.sys
1.4 Searching for masking processes and drivers
Masking process with PID=536, name = ""
 >> PID substitution detected (current PID=0, real = 536)
Masking process with PID=552, name = ""
 >> PID substitution detected (current PID=0, real = 552)
Masking process with PID=596, name = ""
 >> PID substitution detected (current PID=0, real = 596)
Masking process with PID=644, name = ""
 >> PID substitution detected (current PID=0, real = 644)
Masking process with PID=1088, name = ""
 >> PID substitution detected (current PID=0, real = 1088)
Masking process with PID=1712, name = ""
 >> PID substitution detected (current PID=0, real = 1712)
Masking process with PID=1784, name = ""
 >> PID substitution detected (current PID=0, real = 1784)
Masking process with PID=1804, name = ""
 >> PID substitution detected (current PID=0, real = 1804)
Masking process with PID=1888, name = ""
 >> PID substitution detected (current PID=0, real = 1888)
Masking process with PID=1932, name = ""
 >> PID substitution detected (current PID=0, real = 1932)
Masking process with PID=644, name = ""
 >> PID substitution detected (current PID=0, real = 644)
Masking process with PID=2112, name = ""
 >> PID substitution detected (current PID=0, real = 2112)
Masking process with PID=2176, name = ""
 >> PID substitution detected (current PID=0, real = 2176)
Masking process with PID=2188, name = ""
 >> PID substitution detected (current PID=0, real = 2188)
Masking process with PID=2196, name = ""
 >> PID substitution detected (current PID=0, real = 2196)
Masking process with PID=2324, name = ""
 >> PID substitution detected (current PID=0, real = 2324)
Masking process with PID=2596, name = ""
 >> PID substitution detected (current PID=0, real = 2596)
Masking process with PID=2612, name = ""
 >> PID substitution detected (current PID=0, real = 2612)
Masking process with PID=2628, name = ""
 >> PID substitution detected (current PID=0, real = 2628)
Masking process with PID=2636, name = ""
 >> PID substitution detected (current PID=0, real = 2636)
Masking process with PID=2652, name = ""
 >> PID substitution detected (current PID=0, real = 2652)
Masking process with PID=2684, name = ""
 >> PID substitution detected (current PID=0, real = 2684)
Masking process with PID=2928, name = ""
 >> PID substitution detected (current PID=0, real = 2928)
Masking process with PID=2952, name = ""
 >> PID substitution detected (current PID=0, real = 2952)
Masking process with PID=2968, name = ""
 >> PID substitution detected (current PID=0, real = 2968)
Masking process with PID=2988, name = ""
 >> PID substitution detected (current PID=0, real = 2988)
Masking process with PID=3280, name = ""
 >> PID substitution detected (current PID=0, real = 3280)
Masking process with PID=3344, name = ""
 >> PID substitution detected (current PID=0, real = 3344)
Masking process with PID=3392, name = ""
 >> PID substitution detected (current PID=0, real = 3392)
Masking process with PID=3432, name = ""
 >> PID substitution detected (current PID=0, real = 3432)
Masking process with PID=3912, name = ""
 >> PID substitution detected (current PID=0, real = 3912)
Masking process with PID=1196, name = ""
 >> PID substitution detected (current PID=0, real = 1196)
Masking process with PID=1872, name = ""
 >> PID substitution detected (current PID=0, real = 1872)
Masking process with PID=2916, name = ""
 >> PID substitution detected (current PID=0, real = 2916)
Masking process with PID=3772, name = ""
 >> PID substitution detected (current PID=0, real = 3772)
Masking process with PID=644, name = ""
 >> PID substitution detected (current PID=0, real = 644)
Masking process with PID=2108, name = ""
 >> PID substitution detected (current PID=0, real = 2108)
Masking process with PID=1260, name = ""
 >> PID substitution detected (current PID=0, real = 1260)
Masking process with PID=2944, name = ""
 >> PID substitution detected (current PID=0, real = 2944)
Masking process with PID=4780, name = ""
 >> PID substitution detected (current PID=0, real = 4780)
Masking process with PID=4952, name = ""
 >> PID substitution detected (current PID=0, real = 4952)
Masking process with PID=4964, name = ""
 >> PID substitution detected (current PID=0, real = 4964)
Masking process with PID=5024, name = ""
 >> PID substitution detected (current PID=0, real = 5024)
Masking process with PID=5316, name = ""
 >> PID substitution detected (current PID=0, real = 5316)
Masking process with PID=5332, name = ""
 >> PID substitution detected (current PID=0, real = 5332)
Masking process with PID=5376, name = ""
 >> PID substitution detected (current PID=0, real = 5376)
Masking process with PID=5396, name = ""
 >> PID substitution detected (current PID=0, real = 5396)
Masking process with PID=5644, name = ""
 >> PID substitution detected (current PID=0, real = 5644)
Masking process with PID=2568, name = ""
 >> PID substitution detected (current PID=0, real = 2568)
Masking process with PID=4320, name = ""
 >> PID substitution detected (current PID=0, real = 4320)
Masking process with PID=3880, name = ""
 >> PID substitution detected (current PID=0, real = 3880)
Masking process with PID=4572, name = ""
 >> PID substitution detected (current PID=0, real = 4572)
Masking process with PID=1888, name = ""
 >> PID substitution detected (current PID=0, real = 1888)
Masking process with PID=2992, name = ""
 >> PID substitution detected (current PID=0, real = 2992)
Masking process with PID=4896, name = ""
 >> PID substitution detected (current PID=0, real = 4896)
Masking process with PID=4844, name = ""
 >> PID substitution detected (current PID=0, real = 4844)
Masking process with PID=2224, name = ""
 >> PID substitution detected (current PID=0, real = 2224)
Masking process with PID=5568, name = ""
 >> PID substitution detected (current PID=0, real = 5568)
Masking process with PID=4480, name = ""
 >> PID substitution detected (current PID=0, real = 4480)
Masking process with PID=4808, name = ""
 >> PID substitution detected (current PID=0, real = 4808)
Masking process with PID=5220, name = ""
 >> PID substitution detected (current PID=0, real = 5220)
Masking process with PID=3780, name = ""
 >> PID substitution detected (current PID=0, real = 3780)
Masking process with PID=5632, name = ""
 >> PID substitution detected (current PID=0, real = 5632)
Masking process with PID=3524, name = ""
 >> PID substitution detected (current PID=0, real = 3524)
Masking process with PID=2484, name = ""
 >> PID substitution detected (current PID=0, real = 2484)
Masking process with PID=3720, name = ""
 >> PID substitution detected (current PID=0, real = 3720)
Masking process with PID=4932, name = ""
 >> PID substitution detected (current PID=0, real = 4932)
Masking process with PID=300, name = ""
 >> PID substitution detected (current PID=0, real = 300)
Masking process with PID=5352, name = ""
 >> PID substitution detected (current PID=0, real = 5352)
Masking process with PID=2148, name = ""
 >> PID substitution detected (current PID=0, real = 2148)
Masking process with PID=5448, name = ""
 >> PID substitution detected (current PID=0, real = 5448)
Masking process with PID=5400, name = ""
 >> PID substitution detected (current PID=0, real = 5400)
Masking process with PID=4240, name = ""
 >> PID substitution detected (current PID=0, real = 4240)
Masking process with PID=5656, name = ""
 >> PID substitution detected (current PID=0, real = 5656)
Masking process with PID=5144, name = ""
 >> PID substitution detected (current PID=0, real = 5144)
Masking process with PID=1448, name = ""
 >> PID substitution detected (current PID=0, real = 1448)
Masking process with PID=1936, name = ""
 >> PID substitution detected (current PID=0, real = 1936)
Masking process with PID=5348, name = ""
 >> PID substitution detected (current PID=0, real = 5348)
Masking process with PID=2096, name = ""
 >> PID substitution detected (current PID=0, real = 2096)
Masking process with PID=4364, name = ""
 >> PID substitution detected (current PID=0, real = 4364)
 Searching for masking processes and drivers - complete
1.5 Checking of IRP handlers
 Error loading driver - scan interrupted [C0000022]
>> Services: potentially dangerous service allowed: TermService (Terminal Services)
>> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery)
>> Services: potentially dangerous service allowed: Schedule (Task Scheduler)
> Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)!
>> Security: disk drives' autorun is enabled
>> Security: administrative shares (C$, D$ ...) are enabled
>> Security: anonymous user access is enabled
>> Security: sending Remote Assistant queries is enabled
 >>  Process termination timeout is out of admissible values
 >>  Service termination timeout is out of admissible values
 >>  Disable HDD autorun
 >>  Disable autorun from network drives
 >>  Disable CD/DVD autorun
 >>  Disable removable media autorun
 >>  Run command on the Start menu is blocked
System Analysis in progress

 System Analysis - complete


Script commands
 
Add commands to script:
Blocking hooks using Anti-Rootkit
Enable AVZGuard
Operations with AVZPM (true=enable,false=disable)
BootCleaner - import list of deleted files
BootCleaner - import all
Registry cleanup after deleting files
ExecuteWizard ('TSW',2,3,true) - Running Troubleshooting wizard
BootCleaner - activate
Reboot
Insert template for QuarantineFile() - quarantining file
Insert template for BC_QrFile() - quarantining file via BootCleaner
Insert template for DeleteFile() - deleting file
Insert template for DelCLSID() - deleting CLSID item from registry
Additional operations:
Performance tweaking: disable service TermService (Terminal Services)
Performance tweaking: disable service SSDPSRV (SSDP Discovery)
Performance tweaking: disable service Schedule (Task Scheduler)
Security tweaking: disable CD autorun
Security tweaking: disable administrative shares
Security tweaking: disable anonymous user access
Security: disable sending Remote Assistant queries

File list