Results of system analysis

Kaspersky Virus Removal Tool 11.0.0.1245 (database released 08/01/2012; 04:11)

List of processes

File name	PID	Description	Copyright	MD5	Information
c:\program files\avast software\avast\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate	1576	avast! Service	Copyright (c) 2011 AVAST Software	??	43.72 kb, rsAh, created: 03.01.2012 17:21:24, modified: 28.11.2011 08:01:23 Command line: "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
c:\program files\ie new window maximizer\iemaximizer.exe Script: Quarantine, Delete, BC delete, Terminate	2484	IE New Window Maximizer	(c) jiiSoft, Jonatan Dahl. All rights reserved.	??	348.00 kb, rsAh, created: 08.02.2005 23:06:40, modified: 08.02.2005 23:06:40 Command line: "C:\Program Files\IE New Window Maximizer\iemaximizer.exe"
Detected:34, recognized as trusted 33

Module name	Handle	Description	Copyright	MD5	Used by processes
C:\Program Files\AVAST Software\Avast\defs\12010701\algo.dll Script: Quarantine, Delete, BC delete	141885440			--	1576
Modules detected:465, recognized as trusted 464

Kernel Space Modules Viewer

Module	Base address	Size in memory	Description	Manufacturer
C:\WINDOWS\System32\Drivers\dump_atapi.sys Script: Quarantine, Delete, BC delete	B323B000	018000 (98304)
C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Script: Quarantine, Delete, BC delete	B8602000	002000 (8192)
C:\WINDOWS\system32\DRIVERS\intelsmb.sys Script: Quarantine, Delete, BC delete	B8490000	006000 (24576)	System Management Bus 2.0 (SMBus) Driver	Copyright (C) Intel Corporation 1997-2003
C:\Program Files\Process Hacker 2\kprocesshacker.sys Script: Quarantine, Delete, BC delete	B1D4A000	00B000 (45056)	KProcessHacker	Licensed under the GNU GPL, v3.
C:\WINDOWS\system32\DRIVERS\SMBios.sys Script: Quarantine, Delete, BC delete	B8288000	009000 (36864)	Intel(R) System Management BIOS Driver	Copyright © 2003 Intel Corp. 2000-2003
Modules detected - 132, recognized as trusted - 127

Services

Service	Description	Status	File	Group	Dependencies
Detected - 103, recognized as trusted - 103

Drivers

Service	Description	Status	File	Group	Dependencies
KProcessHacker2 Driver: Unload, Delete, Disable, BC delete	KProcessHacker2	Running	C:\Program Files\Process Hacker 2\kprocesshacker.sys Script: Quarantine, Delete, BC delete
SMBios Driver: Unload, Delete, Disable, BC delete	Intel (R) System Management BIOS Service	Running	C:\WINDOWS\system32\DRIVERS\SMBios.sys Script: Quarantine, Delete, BC delete
smbusp Driver: Unload, Delete, Disable, BC delete	Intel(R) SMBus 2.0 Driver	Running	C:\WINDOWS\system32\DRIVERS\intelsmb.sys Script: Quarantine, Delete, BC delete	SMBus
Abiosdsk Driver: Unload, Delete, Disable, BC delete	Abiosdsk	Not started	Abiosdsk.sys Script: Quarantine, Delete, BC delete	Primary disk
abp480n5 Driver: Unload, Delete, Disable, BC delete	abp480n5	Not started	abp480n5.sys Script: Quarantine, Delete, BC delete	SCSI miniport
adpu160m Driver: Unload, Delete, Disable, BC delete	adpu160m	Not started	adpu160m.sys Script: Quarantine, Delete, BC delete	SCSI miniport
Aha154x Driver: Unload, Delete, Disable, BC delete	Aha154x	Not started	Aha154x.sys Script: Quarantine, Delete, BC delete	SCSI miniport
aic78u2 Driver: Unload, Delete, Disable, BC delete	aic78u2	Not started	aic78u2.sys Script: Quarantine, Delete, BC delete	SCSI miniport
aic78xx Driver: Unload, Delete, Disable, BC delete	aic78xx	Not started	aic78xx.sys Script: Quarantine, Delete, BC delete	SCSI miniport
AliIde Driver: Unload, Delete, Disable, BC delete	AliIde	Not started	AliIde.sys Script: Quarantine, Delete, BC delete	System Bus Extender
amsint Driver: Unload, Delete, Disable, BC delete	amsint	Not started	amsint.sys Script: Quarantine, Delete, BC delete	SCSI miniport
asc Driver: Unload, Delete, Disable, BC delete	asc	Not started	asc.sys Script: Quarantine, Delete, BC delete	SCSI miniport
asc3350p Driver: Unload, Delete, Disable, BC delete	asc3350p	Not started	asc3350p.sys Script: Quarantine, Delete, BC delete	SCSI miniport
asc3550 Driver: Unload, Delete, Disable, BC delete	asc3550	Not started	asc3550.sys Script: Quarantine, Delete, BC delete	SCSI miniport
Atdisk Driver: Unload, Delete, Disable, BC delete	Atdisk	Not started	Atdisk.sys Script: Quarantine, Delete, BC delete	Primary disk
catchme Driver: Unload, Delete, Disable, BC delete	catchme	Not started	C:\ComboFix\catchme.sys Script: Quarantine, Delete, BC delete	Base
cd20xrnt Driver: Unload, Delete, Disable, BC delete	cd20xrnt	Not started	cd20xrnt.sys Script: Quarantine, Delete, BC delete	SCSI miniport
Changer Driver: Unload, Delete, Disable, BC delete	Changer	Not started	Changer.sys Script: Quarantine, Delete, BC delete	Filter
CmdIde Driver: Unload, Delete, Disable, BC delete	CmdIde	Not started	CmdIde.sys Script: Quarantine, Delete, BC delete	System Bus Extender
Cpqarray Driver: Unload, Delete, Disable, BC delete	Cpqarray	Not started	Cpqarray.sys Script: Quarantine, Delete, BC delete	SCSI miniport
dac960nt Driver: Unload, Delete, Disable, BC delete	dac960nt	Not started	dac960nt.sys Script: Quarantine, Delete, BC delete	SCSI miniport
dpti2o Driver: Unload, Delete, Disable, BC delete	dpti2o	Not started	dpti2o.sys Script: Quarantine, Delete, BC delete	SCSI miniport
hpn Driver: Unload, Delete, Disable, BC delete	hpn	Not started	hpn.sys Script: Quarantine, Delete, BC delete	SCSI miniport
i2omgmt Driver: Unload, Delete, Disable, BC delete	i2omgmt	Not started	i2omgmt.sys Script: Quarantine, Delete, BC delete	SCSI Class
i2omp Driver: Unload, Delete, Disable, BC delete	i2omp	Not started	i2omp.sys Script: Quarantine, Delete, BC delete	SCSI miniport
ini910u Driver: Unload, Delete, Disable, BC delete	ini910u	Not started	ini910u.sys Script: Quarantine, Delete, BC delete	SCSI miniport
lbrtfdc Driver: Unload, Delete, Disable, BC delete	lbrtfdc	Not started	lbrtfdc.sys Script: Quarantine, Delete, BC delete	System Bus Extender
mraid35x Driver: Unload, Delete, Disable, BC delete	mraid35x	Not started	mraid35x.sys Script: Quarantine, Delete, BC delete	SCSI miniport
osaio Driver: Unload, Delete, Disable, BC delete	osaio	Not started	C:\WINDOWS\system32\drivers\osaio.sys Script: Quarantine, Delete, BC delete
PCIDump Driver: Unload, Delete, Disable, BC delete	PCIDump	Not started	PCIDump.sys Script: Quarantine, Delete, BC delete	PCI Configuration
PDCOMP Driver: Unload, Delete, Disable, BC delete	PDCOMP	Not started	PDCOMP.sys Script: Quarantine, Delete, BC delete
PDFRAME Driver: Unload, Delete, Disable, BC delete	PDFRAME	Not started	PDFRAME.sys Script: Quarantine, Delete, BC delete
PDRELI Driver: Unload, Delete, Disable, BC delete	PDRELI	Not started	PDRELI.sys Script: Quarantine, Delete, BC delete
PDRFRAME Driver: Unload, Delete, Disable, BC delete	PDRFRAME	Not started	PDRFRAME.sys Script: Quarantine, Delete, BC delete
perc2 Driver: Unload, Delete, Disable, BC delete	perc2	Not started	perc2.sys Script: Quarantine, Delete, BC delete	SCSI miniport
perc2hib Driver: Unload, Delete, Disable, BC delete	perc2hib	Not started	perc2hib.sys Script: Quarantine, Delete, BC delete	Filter
ql1080 Driver: Unload, Delete, Disable, BC delete	ql1080	Not started	ql1080.sys Script: Quarantine, Delete, BC delete	SCSI miniport
Ql10wnt Driver: Unload, Delete, Disable, BC delete	Ql10wnt	Not started	Ql10wnt.sys Script: Quarantine, Delete, BC delete	SCSI miniport
ql12160 Driver: Unload, Delete, Disable, BC delete	ql12160	Not started	ql12160.sys Script: Quarantine, Delete, BC delete	SCSI miniport
ql1240 Driver: Unload, Delete, Disable, BC delete	ql1240	Not started	ql1240.sys Script: Quarantine, Delete, BC delete	SCSI miniport
ql1280 Driver: Unload, Delete, Disable, BC delete	ql1280	Not started	ql1280.sys Script: Quarantine, Delete, BC delete	SCSI miniport
SABProcEnum Driver: Unload, Delete, Disable, BC delete	SABProcEnum	Not started	C:\Program Files\Internet Explorer\SABProcEnum.sys Script: Quarantine, Delete, BC delete
Simbad Driver: Unload, Delete, Disable, BC delete	Simbad	Not started	Simbad.sys Script: Quarantine, Delete, BC delete	Filter
Sparrow Driver: Unload, Delete, Disable, BC delete	Sparrow	Not started	Sparrow.sys Script: Quarantine, Delete, BC delete	SCSI miniport
sym_hi Driver: Unload, Delete, Disable, BC delete	sym_hi	Not started	sym_hi.sys Script: Quarantine, Delete, BC delete	SCSI miniport
sym_u3 Driver: Unload, Delete, Disable, BC delete	sym_u3	Not started	sym_u3.sys Script: Quarantine, Delete, BC delete	SCSI miniport
symc810 Driver: Unload, Delete, Disable, BC delete	symc810	Not started	symc810.sys Script: Quarantine, Delete, BC delete	SCSI miniport
symc8xx Driver: Unload, Delete, Disable, BC delete	symc8xx	Not started	symc8xx.sys Script: Quarantine, Delete, BC delete	SCSI miniport
TosIde Driver: Unload, Delete, Disable, BC delete	TosIde	Not started	TosIde.sys Script: Quarantine, Delete, BC delete	System Bus Extender
ultra Driver: Unload, Delete, Disable, BC delete	ultra	Not started	ultra.sys Script: Quarantine, Delete, BC delete	SCSI miniport
WDICA Driver: Unload, Delete, Disable, BC delete	WDICA	Not started	WDICA.sys Script: Quarantine, Delete, BC delete
Detected - 204, recognized as trusted - 153

Autoruns

File name	Status	Startup method	Description
C:\Documents and Settings\elizabeth\Local Settings\temp\_uninst_51978410.bat Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	C:\Documents and Settings\elizabeth\Start Menu\Programs\Startup\, C:\Documents and Settings\elizabeth\Start Menu\Programs\Startup\_uninst_51978410.lnk,
C:\WINDOWS\System32\Drivers\AliIde.sys Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\aliide, EventMessageFile
C:\WINDOWS\System32\Drivers\CmdIde.sys Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\cmdide, EventMessageFile
C:\WINDOWS\System32\Drivers\TosIde.sys Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\toside, EventMessageFile
C:\WINDOWS\System32\Drivers\lbrtfdc.sys Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\lbrtfdc, EventMessageFile
C:\WINDOWS\System32\PrintFilterPipelineSvc.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PrintFilterPipelineSvc, EventMessageFile
C:\WINDOWS\System32\drivers\dwprot.sys Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\DwProt, EventMessageFile
C:\WINDOWS\System32\drivers\stdriver32.sys Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\stdriver, EventMessageFile
C:\WINDOWS\System32\igmpv2.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile
C:\WINDOWS\System32\ipbootp.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile
C:\WINDOWS\System32\iprip2.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile
C:\WINDOWS\System32\ospf.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPF, EventMessageFile
C:\WINDOWS\System32\ospfmib.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPFMib, EventMessageFile
C:\WINDOWS\System32\polagent.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PolicyAgent, EventMessageFile
C:\WINDOWS\System32\tssdis.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\TermServSessDir, EventMessageFile
C:\WINDOWS\system32\MsSip1.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 1, $DLL Delete
C:\WINDOWS\system32\MsSip2.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 2, $DLL Delete
C:\WINDOWS\system32\MsSip3.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 3, $DLL Delete
C:\WINDOWS\system32\psxss.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
C:\WINDOWS\system32\stisvc.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System, EventMessageFile
SDEvents.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Spybot - Search & Destroy 2, EventMessageFile
kbd101.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver JPN Delete
kbd101a.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver KOR Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, .DEFAULT\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-19\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-20\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-18\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-21-515967899-1425521274-725345543-1003\Control Panel\IOProcs, MVB Delete
vgafix.fon Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon Delete
vgaoem.fon Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon Delete
vgasys.fon Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon Delete
Autoruns items detected - 889, recognized as trusted - 858

Microsoft Internet Explorer extension modules (BHOs, Toolbars ...)

File name	Type	Description	Manufacturer	CLSID
	BHO			{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} Delete
	Extension module			{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} Delete
	Explorer Bar			{32683183-48a0-441b-a342-7c2a440a9478} Delete
Elements detected - 16, recognized as trusted - 13

Windows Explorer extension modules

File name	Destination	Description	Manufacturer	CLSID
	Display Panning CPL Extension			{42071714-76d4-11d1-8b24-00a0c9068ff3} Delete
	Shell extensions for file compression			{764BF0E1-F219-11ce-972D-00AA00A14F56} Delete
	Encryption Context Menu			{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} Delete
	Taskbar and Start Menu			{0DF44EAA-FF21-4412-828E-260A8728E7F1} Delete
	Media Band			{32683183-48a0-441b-a342-7c2a440a9478} Delete
	User Accounts			{7A9D77BD-5403-11d2-8785-2E0420524153} Delete
	IE User Assist			{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} Delete
	blue.shell			{79BC0345-1015-11D2-A299-006008312725} Delete
	{B9B9F083-2B04-452A-8691-83694AC1037B}			Logitech Setpoint Extension Delete
	{B2F55D43-C7A4-4B7C-90D7-7A860DFA9F2A}			XCShInfo Delete
"C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll" Script: Quarantine, Delete, BC delete	ColumnHandler			{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} Delete
Elements detected - 244, recognized as trusted - 233

Printing system extensions (print monitors, providers)

File name	Type	Name	Description	Manufacturer
LEXLMPM.DLL Script: Quarantine, Delete, BC delete	Monitor	Lexmark Network Port
Elements detected - 13, recognized as trusted - 12

Task Scheduler jobs

File name	Job name	Job status	Description	Manufacturer
C:\Program Files\NCH Software\VideoPad\videopad.exe Script: Quarantine, Delete, BC delete	videopadShakeIcon.job	The task has not yet run.	VideoPad Video Editor	NCH Software
C:\Program Files\NCH Swift Sound\WavePad\wavepad.exe Script: Quarantine, Delete, BC delete	wavepadShakeIcon.job	The task has not yet run.	WavePad Sound Editor	NCH Software
Elements detected - 3, recognized as trusted - 1

SPI/LSP settings

Namespace providers (NSP)

Provider	Status	EXE file	Description	GUID
Detected - 3, recognized as trusted - 3

Transport protocol providers (TSP, LSP)

Provider EXE file Description
Detected - 15, recognized as trusted - 15
Results of automatic SPI settings check
LSP settings checked. No errors detected

TCP/UDP ports

Port Status Remote Host Remote Port Application Notes
TCP ports
135 LISTENING 0.0.0.0 39086 [1136] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
139 LISTENING 0.0.0.0 26708 [4] System
Script: Quarantine, Delete, BC delete, Terminate
445 LISTENING 0.0.0.0 61511 [4] System
Script: Quarantine, Delete, BC delete, Terminate
1027 LISTENING 0.0.0.0 2064 [2272] c:\windows\system32\alg.exe
Script: Quarantine, Delete, BC delete, Terminate
1322 TIME_WAIT 74.55.235.50 80 [0]
1323 ESTABLISHED 127.0.0.1 12080 [5712] c:\docume~1\elizab~1\locals~1\temp\1221044\4994624.exe
Script: Quarantine, Delete, BC delete, Terminate
1324 ESTABLISHED 24.25.230.9 80 [1576] c:\program files\avast software\avast\avastsvc.exe
Script: Quarantine, Delete, BC delete, Terminate
3941 CLOSE_WAIT 127.0.0.1 12080 [2388] c:\program files\common files\java\java update\jusched.exe
Script: Quarantine, Delete, BC delete, Terminate
5152 CLOSE_WAIT 127.0.0.1 4805 [380] c:\program files\java\jre6\bin\jqs.exe
Script: Quarantine, Delete, BC delete, Terminate
5152 LISTENING 0.0.0.0 4264 [380] c:\program files\java\jre6\bin\jqs.exe
Script: Quarantine, Delete, BC delete, Terminate
12025 LISTENING 0.0.0.0 16532 [1576] c:\program files\avast software\avast\avastsvc.exe
Script: Quarantine, Delete, BC delete, Terminate
12080 LISTENING 0.0.0.0 12519 [1576] c:\program files\avast software\avast\avastsvc.exe
Script: Quarantine, Delete, BC delete, Terminate
12080 ESTABLISHED 127.0.0.1 1323 [1576] c:\program files\avast software\avast\avastsvc.exe
Script: Quarantine, Delete, BC delete, Terminate
12080 CLOSE_WAIT 127.0.0.1 3468 [1576] c:\program files\avast software\avast\avastsvc.exe
Script: Quarantine, Delete, BC delete, Terminate
12110 LISTENING 0.0.0.0 36968 [1576] c:\program files\avast software\avast\avastsvc.exe
Script: Quarantine, Delete, BC delete, Terminate
12119 LISTENING 0.0.0.0 32904 [1576] c:\program files\avast software\avast\avastsvc.exe
Script: Quarantine, Delete, BC delete, Terminate
12143 LISTENING 0.0.0.0 39038 [1576] c:\program files\avast software\avast\avastsvc.exe
Script: Quarantine, Delete, BC delete, Terminate
12465 LISTENING 0.0.0.0 28898 [1576] c:\program files\avast software\avast\avastsvc.exe
Script: Quarantine, Delete, BC delete, Terminate
12563 LISTENING 0.0.0.0 55490 [1576] c:\program files\avast software\avast\avastsvc.exe
Script: Quarantine, Delete, BC delete, Terminate
12993 LISTENING 0.0.0.0 2178 [1576] c:\program files\avast software\avast\avastsvc.exe
Script: Quarantine, Delete, BC delete, Terminate
12995 LISTENING 0.0.0.0 22667 [1576] c:\program files\avast software\avast\avastsvc.exe
Script: Quarantine, Delete, BC delete, Terminate
UDP ports
123 LISTENING -- -- [1232] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
123 LISTENING -- -- [1232] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
137 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
138 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
445 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
500 LISTENING -- -- [828] c:\windows\system32\lsass.exe
Script: Quarantine, Delete, BC delete, Terminate
1900 LISTENING -- -- [1468] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
1900 LISTENING -- -- [1468] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
3869 LISTENING -- -- [3756] c:\program files\internet explorer\iexplore.exe
Script: Quarantine, Delete, BC delete, Terminate
4111 LISTENING -- -- [1872] c:\program files\internet explorer\iexplore.exe
Script: Quarantine, Delete, BC delete, Terminate
4176 LISTENING -- -- [3656] c:\program files\internet explorer\iexplore.exe
Script: Quarantine, Delete, BC delete, Terminate
4500 LISTENING -- -- [828] c:\windows\system32\lsass.exe
Script: Quarantine, Delete, BC delete, Terminate

Downloaded Program Files (DPF)

File name Description Manufacturer CLSID Source URL
{E2883E8F-472F-4FB0-9522-AC9BF37916A7}
Delete http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Elements detected - 20, recognized as trusted - 19

Control Panel Applets (CPL)

File name Description Manufacturer
C:\WINDOWS\system32\scmgrcpl40.cpl
Script: Quarantine, Delete, BC delete SMCtrlpnl MFC Application Copyright © 1998
Elements detected - 32, recognized as trusted - 31

Active Setup

File name Description Manufacturer CLSID
Elements detected - 15, recognized as trusted - 15

HOSTS file

Hosts file record
127.0.0.1 localhost
Clear Hosts file

Protocols and handlers

File name Type Description Manufacturer CLSID
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
Elements detected - 33, recognized as trusted - 30

Suspicious objects

File Description Type
C:\WINDOWS\System32\Drivers\aswSnx.SYS
Script: Quarantine, Delete, BC delete Suspicion for Rootkit Kernel-mode hook
C:\WINDOWS\system32\DRIVERS\4994624drv.sys
Script: Quarantine, Delete, BC delete Suspicion for Rootkit Kernel-mode hook
C:\WINDOWS\System32\Drivers\aswSP.SYS
Script: Quarantine, Delete, BC delete Suspicion for Rootkit Kernel-mode hook
\SystemRoot\System32\Drivers\aswSP.SYS
Script: Quarantine, Delete, BC delete Suspicion for Rootkit Kernel-mode hook
\SystemRoot\system32\DRIVERS\4994624drv.sys
Script: Quarantine, Delete, BC delete Suspicion for Rootkit Kernel-mode hook

Main script of analysis
Windows version: Microsoft Windows XP, Build=2600, SP="Service Pack 3"
System Restore: enabled
1.1 Searching for user-mode API hooks
 Analysis: kernel32.dll, export table found in section .text
IAT modification detected: CreateProcessA - 00BE0010<>7C80236B
IAT modification detected: GetModuleFileNameA - 00BE0080<>7C80B56F
IAT modification detected: FreeLibrary - 00BE00F0<>7C80AC7E
IAT modification detected: GetModuleFileNameW - 00BE0160<>7C80B475
IAT modification detected: CreateProcessW - 00BE01D0<>7C802336
IAT modification detected: LoadLibraryW - 00BE02B0<>7C80AEEB
IAT modification detected: LoadLibraryA - 00BE0320<>7C801D7B
IAT modification detected: GetProcAddress - 00BE0390<>7C80AE40
 Analysis: ntdll.dll, export table found in section .text
Function ntdll.dll:LdrLoadDll (70) intercepted, method APICodeHijack.JmpTo[001601EE]
Function ntdll.dll:LdrUnloadDll (80) intercepted, method APICodeHijack.JmpTo[001603F2]
 Analysis: user32.dll, export table found in section .text
Function user32.dll:SetWinEventHook (639) intercepted, method APICodeHijack.JmpTo[003D01EE]
Function user32.dll:SetWindowsHookExA (651) intercepted, method APICodeHijack.JmpTo[003D05F6]
Function user32.dll:SetWindowsHookExW (652) intercepted, method APICodeHijack.JmpTo[003D07FA]
Function user32.dll:UnhookWinEvent (685) intercepted, method APICodeHijack.JmpTo[003D03F2]
Function user32.dll:UnhookWindowsHookEx (687) intercepted, method APICodeHijack.JmpTo[003D09FE]
 Analysis: advapi32.dll, export table found in section .text
Function advapi32.dll:ChangeServiceConfig2A (54) intercepted, method APICodeHijack.JmpTo[003C0C02]
Function advapi32.dll:ChangeServiceConfig2W (55) intercepted, method APICodeHijack.JmpTo[003C0E06]
Function advapi32.dll:ChangeServiceConfigA (56) intercepted, method APICodeHijack.JmpTo[003C07FA]
Function advapi32.dll:ChangeServiceConfigW (57) intercepted, method APICodeHijack.JmpTo[003C09FE]
Function advapi32.dll:CreateServiceA (102) intercepted, method APICodeHijack.JmpTo[003C01EE]
Function advapi32.dll:CreateServiceW (103) intercepted, method APICodeHijack.JmpTo[003C03F2]
Function advapi32.dll:DeleteService (177) intercepted, method APICodeHijack.JmpTo[003C05F6]
Function advapi32.dll:SetServiceObjectSecurity (572) intercepted, method APICodeHijack.JmpTo[003C100A]
 Analysis: ws2_32.dll, export table found in section .text
 Analysis: wininet.dll, export table found in section .text
 Analysis: rasapi32.dll, export table found in section .text
 Analysis: urlmon.dll, export table found in section .text
 Analysis: netapi32.dll, export table found in section .text
1.2 Searching for kernel-mode API hooks
 Driver loaded successfully
 SDT found (RVA=085700)
 Kernel ntkrnlpa.exe found in memory at address 804D7000
   SDT = 8055C700
   KiST = 80504480 (284)
Function NtAddBootEntry (09) intercepted (80616A30->B3303FC4), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtAdjustPrivilegesToken (0B) intercepted (805EC464->8B116690), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtAllocateVirtualMemory (11) intercepted (805A8ABA->B3368510), hook C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtClose (19) intercepted (805BC530->8B116F94), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtConnectPort (1F) intercepted (805A45D0->8B117DC8), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateEvent (23) intercepted (8060EF4E->8B118312), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateEventPair (24) intercepted (806172A6->B33064AE), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateFile (25) intercepted (805790A8->8B117270), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateIoCompletion (26) intercepted (80578A86->B33065C4), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateKey (29) intercepted (806240F0->8B115500), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateMutant (2B) intercepted (8061769E->8B1181F8), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateNamedPipeFile (2C) intercepted (805790E2->8B11627E), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreatePort (2E) intercepted (805A50EC->8B1180CC), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateProcessEx (30) - machine code modification Method of JmpTo. jmp B337C7A6\SystemRoot\System32\Drivers\aswSP.SYS, driver recognized as trusted
>>> Function restored successfully !
Function NtCreateSection (32) intercepted (805AB3C8->8B116426), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateSemaphore (33) intercepted (8061504E->8B118432), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateThread (35) intercepted (805D1018->8B116C1C), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateTimer (36) intercepted (80616F6E->B3306572), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateWaitablePort (38) intercepted (805A5110->8B118162), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDebugActiveProcess (39) intercepted (80643B30->8B119B1A), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDeleteBootEntry (3D) intercepted (80616A22->B3303FE8), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDeleteKey (3F) intercepted (8062458C->8B115B0A), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDeleteValueKey (41) intercepted (8062475C->8B115EBE), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDeviceIoControlFile (42) intercepted (8057926E->8B1176F2), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDuplicateObject (44) intercepted (805BE008->8B11AD26), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtEnumerateKey (47) intercepted (8062493C->8B11600A), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtEnumerateValueKey (49) intercepted (80624BA6->8B1160A2), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtFreeVirtualMemory (53) intercepted (805B2FB2->B33685C0), hook C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtFsControlFile (54) intercepted (805792A2->8B117500), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtLoadDriver (61) intercepted (80584160->8B119C0C), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtLoadKey (62) intercepted (80626314->8B1154DC), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtLoadKey2 (63) intercepted (80625F20->8B1154EE), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtMapViewOfSection (6C) intercepted (805B203A->8B11A374), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtModifyBootEntry (6D) intercepted (80616A22->B330400C), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtNotifyChangeKey (6F) intercepted (806262DE->8B1161CE), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtNotifyChangeMultipleKeys (70) intercepted (80624F12->B3304AA4), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenEvent (72) intercepted (8060F04E->8B1183A8), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenEventPair (73) intercepted (8061737E->B33064D6), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenFile (74) intercepted (8057A1A6->8B117016), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenIoCompletion (75) intercepted (80578B5E->B33065EE), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenKey (77) intercepted (806254CE->8B1156C0), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenMutant (78) intercepted (80617776->8B118288), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenProcess (7A) intercepted (805CB440->8B1168CC), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenSection (7D) intercepted (805AA3EC->8B11A10E), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenSemaphore (7E) intercepted (80615148->8B1184C8), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenThread (80) intercepted (805CB6CC->8B1167BE), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenTimer (83) intercepted (80617090->B330659C), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtProtectVirtualMemory (89) intercepted (805B841E->B3368658), hook C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQueryKey (A0) intercepted (80625810->8B11613A), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQueryMultipleValueKey (A1) intercepted (8062323E->8B115D72), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQueryObject (A3) intercepted (805C52CC->B330496A), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQuerySection (A7) intercepted (805B85E0->8B11A6AE), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQueryValueKey (B1) intercepted (80622314->8B11599C), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQueueApcThread (B4) intercepted (805D1276->8B119FA0), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtRenameKey (C0) intercepted (80623B12->8B115C2C), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtReplaceKey (C1) intercepted (806261C4->8B114F16), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtReplyPort (C2) intercepted (805A54EC->8B11882C), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtReplyWaitReceivePort (C3) intercepted (805A64B4->8B1186F2), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtRequestWaitReplyPort (C8) intercepted (805A2D76->8B1198B4), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtRestoreKey (CC) intercepted (80625AD0->8B11528E), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtResumeThread (CE) intercepted (805D49BA->8B11ABC8), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSaveKey (CF) intercepted (80625BCC->8B114EAE), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSecureConnectPort (D2) intercepted (805A3D64->8B117B0E), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetBootEntryOrder (D3) intercepted (80616A30->B3304030), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetBootOptions (D4) intercepted (80616A30->B3304054), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetContextThread (D5) intercepted (805D173A->8B116E38), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetInformationToken (E6) intercepted (805FA7B4->8B119154), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetSecurityObject (ED) intercepted (805C062E->8B119DAA), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetSystemInformation (F0) intercepted (8060FD06->8B11A7FE), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetSystemPowerState (F1) intercepted (80653E18->B3303F48), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetValueKey (F7) intercepted (80622662->8B115816), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtShutdownSystem (F9) intercepted (80612F90->B3303F24), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSuspendProcess (FD) intercepted (805D4A82->8B11A8F0), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSuspendThread (FE) intercepted (805D48F4->8B11AA2A), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSystemDebugControl (FF) intercepted (806180BA->8B119A3E), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtTerminateProcess (101) intercepted (805D29E2->8B116A68), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtTerminateThread (102) intercepted (805D2BDC->8B1169C8), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtUnmapViewOfSection (10B) intercepted (805B2E48->8B11A552), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtVdmControl (10C) intercepted (805FBB6C->B3304078), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtWriteVirtualMemory (115) intercepted (805B43CC->8B116B52), hook C:\WINDOWS\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function FsRtlCheckLockForReadAccess (804EAF84) - machine code modification Method of JmpTo. jmp 8B108FD0 \SystemRoot\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
Function IoIsOperationSynchronous (804EF912) - machine code modification Method of JmpTo. jmp 8B1093AC \SystemRoot\system32\DRIVERS\4994624drv.sys, driver recognized as trusted
>>> Function restored successfully !
Function ObInsertObject (805C2FDA) - machine code modification Method of JmpTo. jmp B337B15C \SystemRoot\System32\Drivers\aswSP.SYS, driver recognized as trusted
>>> Function restored successfully !
Function ObMakeTemporaryObject (805BC556) - machine code modification Method of JmpTo. jmp B337969C \SystemRoot\System32\Drivers\aswSP.SYS, driver recognized as trusted
>>> Function restored successfully !
Functions checked: 284, intercepted: 79, restored: 84
1.3 Checking IDT and SYSENTER
 Analysis for CPU 1
 Analysis for CPU 2
CmpCallCallBacks = 00093D84
Disable callback OK
 Checking IDT and SYSENTER - complete
1.4 Searching for masking processes and drivers
 Checking not performed: extended monitoring driver (AVZPM) is not installed
1.5 Checking of IRP handlers
 Driver loaded successfully
\FileSystem\ntfs[IRP_MJ_CREATE] = B337C2C0 -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted
\FileSystem\ntfs[IRP_MJ_CLOSE] = B337C300 -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted
\FileSystem\ntfs[IRP_MJ_WRITE] = B337C3C8 -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted
\FileSystem\ntfs[IRP_MJ_SET_INFORMATION] = B337C408 -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted
 Checking - complete
>> Services: potentially dangerous service allowed: TermService (Terminal Services)
>> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery Service)
>> Services: potentially dangerous service allowed: TlntSvr (Telnet)
>> Services: potentially dangerous service allowed: Alerter (Alerter)
>> Services: potentially dangerous service allowed: Schedule (Task Scheduler)
>> Services: potentially dangerous service allowed: mnmsrvc (NetMeeting Remote Desktop Sharing)
>> Services: potentially dangerous service allowed: RDSessMgr (Remote Desktop Help Session Manager)
> Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)!
>> Security: disk drives' autorun is enabled
>> Security: administrative shares (C$, D$ ...) are enabled
>> Security: anonymous user access is enabled
 >>  Abnormal SCR files association
 >>  Disable HDD autorun
 >>  Disable autorun from network drives
 >>  Disable CD/DVD autorun
 >>  Disable removable media autorun
System Analysis in progress

 System Analysis - complete


Script commands 
Add commands to script:
Blocking hooks using Anti-Rootkit
Enable AVZGuard
Operations with AVZPM (true=enable,false=disable)
BootCleaner - import list of deleted files
BootCleaner - import all
Registry cleanup after deleting files
ExecuteWizard ('TSW',2,3,true) - Running Troubleshooting wizard
BootCleaner - activate
Reboot
Insert template for QuarantineFile() - quarantining file
Insert template for BC_QrFile() - quarantining file via BootCleaner
Insert template for DeleteFile() - deleting file
Insert template for DelCLSID() - deleting CLSID item from registry
Additional operations:Performance tweaking: disable service TermService (Terminal Services)
Performance tweaking: disable service SSDPSRV (SSDP Discovery Service)
Performance tweaking: disable service TlntSvr (Telnet)
Performance tweaking: disable service Alerter (Alerter)
Performance tweaking: disable service Schedule (Task Scheduler)
Performance tweaking: disable service mnmsrvc (NetMeeting Remote Desktop Sharing)
Performance tweaking: disable service RDSessMgr (Remote Desktop Help Session Manager)
Security tweaking: disable CD autorun
Security tweaking: disable administrative shares
Security tweaking: disable anonymous user access

File list

Port	Status	Remote Host	Remote Port	Application	Notes
TCP ports
135	LISTENING	0.0.0.0	39086	[1136] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
139	LISTENING	0.0.0.0	26708	[4] System Script: Quarantine, Delete, BC delete, Terminate
445	LISTENING	0.0.0.0	61511	[4] System Script: Quarantine, Delete, BC delete, Terminate
1027	LISTENING	0.0.0.0	2064	[2272] c:\windows\system32\alg.exe Script: Quarantine, Delete, BC delete, Terminate
1322	TIME_WAIT	74.55.235.50	80	[0]
1323	ESTABLISHED	127.0.0.1	12080	[5712] c:\docume~1\elizab~1\locals~1\temp\1221044\4994624.exe Script: Quarantine, Delete, BC delete, Terminate
1324	ESTABLISHED	24.25.230.9	80	[1576] c:\program files\avast software\avast\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate
3941	CLOSE_WAIT	127.0.0.1	12080	[2388] c:\program files\common files\java\java update\jusched.exe Script: Quarantine, Delete, BC delete, Terminate
5152	CLOSE_WAIT	127.0.0.1	4805	[380] c:\program files\java\jre6\bin\jqs.exe Script: Quarantine, Delete, BC delete, Terminate
5152	LISTENING	0.0.0.0	4264	[380] c:\program files\java\jre6\bin\jqs.exe Script: Quarantine, Delete, BC delete, Terminate
12025	LISTENING	0.0.0.0	16532	[1576] c:\program files\avast software\avast\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate
12080	LISTENING	0.0.0.0	12519	[1576] c:\program files\avast software\avast\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate
12080	ESTABLISHED	127.0.0.1	1323	[1576] c:\program files\avast software\avast\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate
12080	CLOSE_WAIT	127.0.0.1	3468	[1576] c:\program files\avast software\avast\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate
12110	LISTENING	0.0.0.0	36968	[1576] c:\program files\avast software\avast\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate
12119	LISTENING	0.0.0.0	32904	[1576] c:\program files\avast software\avast\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate
12143	LISTENING	0.0.0.0	39038	[1576] c:\program files\avast software\avast\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate
12465	LISTENING	0.0.0.0	28898	[1576] c:\program files\avast software\avast\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate
12563	LISTENING	0.0.0.0	55490	[1576] c:\program files\avast software\avast\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate
12993	LISTENING	0.0.0.0	2178	[1576] c:\program files\avast software\avast\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate
12995	LISTENING	0.0.0.0	22667	[1576] c:\program files\avast software\avast\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate
UDP ports
123	LISTENING	--	--	[1232] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
123	LISTENING	--	--	[1232] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
137	LISTENING	--	--	[4] System Script: Quarantine, Delete, BC delete, Terminate
138	LISTENING	--	--	[4] System Script: Quarantine, Delete, BC delete, Terminate
445	LISTENING	--	--	[4] System Script: Quarantine, Delete, BC delete, Terminate
500	LISTENING	--	--	[828] c:\windows\system32\lsass.exe Script: Quarantine, Delete, BC delete, Terminate
1900	LISTENING	--	--	[1468] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
1900	LISTENING	--	--	[1468] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
3869	LISTENING	--	--	[3756] c:\program files\internet explorer\iexplore.exe Script: Quarantine, Delete, BC delete, Terminate
4111	LISTENING	--	--	[1872] c:\program files\internet explorer\iexplore.exe Script: Quarantine, Delete, BC delete, Terminate
4176	LISTENING	--	--	[3656] c:\program files\internet explorer\iexplore.exe Script: Quarantine, Delete, BC delete, Terminate
4500	LISTENING	--	--	[828] c:\windows\system32\lsass.exe Script: Quarantine, Delete, BC delete, Terminate