Results of system analysis

Kaspersky Virus Removal Tool 11.0.0.1245 (database released 29/01/2012; 23:35)

List of processes

File name	PID	Description	Copyright	MD5	Information
c:\program files\toshiba\e-key\ceekey.exe Script: Quarantine, Delete, BC delete, Terminate	3344	TOSHIBA HotKey Utility	Copyright 2003-2004 Compal Electronic Inc.	??	660.00 kb, rsAh, created: 28.04.2005 19:08:34, modified: 28.04.2005 19:08:34 Command line: "C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe"
c:\windows\explorer.exe Script: Quarantine, Delete, BC delete, Terminate	2572	Windows Explorer	© Microsoft Corporation. All rights reserved.	??	1009.50 kb, rsAh, created: 12.05.2005 14:14:23, modified: 14.04.2008 04:42:20 Command line: C:\WINDOWS\Explorer.EXE
c:\windows\system32\tctrliohook.exe Script: Quarantine, Delete, BC delete, Terminate	3492	TOSHIBA Control Utility Hotkey Hook	Copyright 2004 TOSHIBA, All Rights Reserved.	??	28.00 kb, rsAh, created: 20.04.2005 14:56:58, modified: 20.04.2005 14:56:58 Command line: "C:\WINDOWS\system32\TCtrlIOHook.exe"
c:\program files\toshiba\toshiba controls\tfncky.exe Script: Quarantine, Delete, BC delete, Terminate	3504	TFncKy	Copyright (C) 2001-2005 TOSHIBA Corporation. All rights reserved.	??	184.00 kb, rsAh, created: 13.05.2005 03:41:03, modified: 18.04.2005 10:33:42 Command line: "C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe"
c:\windows\system32\tpsbattm.exe Script: Quarantine, Delete, BC delete, Terminate	3628		Copyright (C) 1998-2004 TOSHIBA Corporation	??	36.00 kb, rsAh, created: 13.05.2005 03:40:18, modified: 28.12.2004 15:02:28 Command line: "C:\WINDOWS\system32\TPSBattM.exe"
c:\windows\system32\tpsmain.exe Script: Quarantine, Delete, BC delete, Terminate	3452		Copyright (C) 1998-2004 TOSHIBA Corporation	??	264.00 kb, rsAh, created: 13.05.2005 03:40:18, modified: 28.12.2004 15:02:46 Command line: "C:\WINDOWS\system32\TPSMain.exe"
c:\program files\toshiba\touchpad\tptray.exe Script: Quarantine, Delete, BC delete, Terminate	3376	TPTray Application	Copyright 2002-2004 Compal Electronic Inc.	??	52.00 kb, rsAh, created: 30.11.2004 12:06:26, modified: 30.11.2004 12:06:26 Command line: "C:\Program Files\TOSHIBA\TouchPad\TPTray.exe"
Detected:70, recognized as trusted 70

Module name	Handle	Description	Copyright	MD5	Used by processes
C:\WINDOWS\system32\CpuPerf.dll Script: Quarantine, Delete, BC delete	3407872		Copyright (C) 1998-2004 TOSHIBA Corporation	--	3452
C:\WINDOWS\system32\EBLib.dll Script: Quarantine, Delete, BC delete	3342336	EBLib DLL	Copyright (C) 2005	--	3344, 3492, 3504, 3452, 3376
C:\WINDOWS\system32\EKECioCtl.dll Script: Quarantine, Delete, BC delete	268435456	EKECioCtl DLL	Copyright (C) 2005	--	3344
C:\WINDOWS\system32\TCtrlIO.DLL Script: Quarantine, Delete, BC delete	10158080	TCtrlIO DLL	Copyright (C) 2005	--	3504
C:\WINDOWS\system32\TPeculiarity.dll Script: Quarantine, Delete, BC delete	4128768	TPeculiarity DLL	Copyright (C) 2005	--	3452
C:\WINDOWS\system32\TPSMainCtl.dll Script: Quarantine, Delete, BC delete	268435456		Copyright (C) 1998-2004 TOSHIBA Corporation	--	3452
C:\WINDOWS\system32\TPSTrace.DLL Script: Quarantine, Delete, BC delete	23789568		Copyright (C) 1998-2004 TOSHIBA Corporation	--	2572, 3628, 3452
C:\WINDOWS\system32\TPwrCfg.DLL Script: Quarantine, Delete, BC delete	20185088		Copyright (C) 1998-2004 TOSHIBA Corporation	--	2572, 3628
C:\WINDOWS\system32\TPwrReg.dll Script: Quarantine, Delete, BC delete	43974656		Copyright (C) 1998-2004TOSHIBA Corporation	--	2572, 3628, 3452
Modules detected:513, recognized as trusted 504

Kernel Space Modules Viewer

Module	Base address	Size in memory	Description	Manufacturer
C:\WINDOWS\system32\ckldrv.sys Script: Quarantine, Delete, BC delete	B8DC7000	006000 (24576)
C:\WINDOWS\System32\Drivers\dump_atapi.sys Script: Quarantine, Delete, BC delete	B5D2D000	018000 (98304)
C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Script: Quarantine, Delete, BC delete	F79C3000	002000 (8192)
C:\WINDOWS\System32\Drivers\TPwSav.sys Script: Quarantine, Delete, BC delete	B9DBA000	003000 (12288)	IO Driver For TOSHIBA Power Saver	Copyright 2004 ,All Rights Reserved.
C:\WINDOWS\system32\DRIVERS\wowxt_kern_i386.sys Script: Quarantine, Delete, BC delete	F74F7000	009000 (36864)	SRS Labs WOW XT kernel DLL	Copyright (C) 2004 SRS Labs, Inc.
Modules detected - 154, recognized as trusted - 149

Services

Service	Description	Status	File	Group	Dependencies
SpyHunter 4 Service Service: Stop, Delete, Disable, BC delete	SpyHunter 4 Service	Not started	C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE Script: Quarantine, Delete, BC delete	Base
Detected - 111, recognized as trusted - 110

Drivers

Service	Description	Status	File	Group	Dependencies
NetworkX Driver: Unload, Delete, Disable, BC delete	NetworkX	Running	C:\WINDOWS\system32\ckldrv.sys Script: Quarantine, Delete, BC delete
TPwSav Driver: Unload, Delete, Disable, BC delete	Common Driver	Running	C:\WINDOWS\system32\Drivers\TPwSav.sys Script: Quarantine, Delete, BC delete
Abiosdsk Driver: Unload, Delete, Disable, BC delete	Abiosdsk	Not started	Abiosdsk.sys Script: Quarantine, Delete, BC delete	Primary disk
abp480n5 Driver: Unload, Delete, Disable, BC delete	abp480n5	Not started	abp480n5.sys Script: Quarantine, Delete, BC delete	SCSI miniport
adpu160m Driver: Unload, Delete, Disable, BC delete	adpu160m	Not started	adpu160m.sys Script: Quarantine, Delete, BC delete	SCSI miniport
Aha154x Driver: Unload, Delete, Disable, BC delete	Aha154x	Not started	Aha154x.sys Script: Quarantine, Delete, BC delete	SCSI miniport
aic78u2 Driver: Unload, Delete, Disable, BC delete	aic78u2	Not started	aic78u2.sys Script: Quarantine, Delete, BC delete	SCSI miniport
aic78xx Driver: Unload, Delete, Disable, BC delete	aic78xx	Not started	aic78xx.sys Script: Quarantine, Delete, BC delete	SCSI miniport
AliIde Driver: Unload, Delete, Disable, BC delete	AliIde	Not started	AliIde.sys Script: Quarantine, Delete, BC delete	System Bus Extender
amsint Driver: Unload, Delete, Disable, BC delete	amsint	Not started	amsint.sys Script: Quarantine, Delete, BC delete	SCSI miniport
asc Driver: Unload, Delete, Disable, BC delete	asc	Not started	asc.sys Script: Quarantine, Delete, BC delete	SCSI miniport
asc3350p Driver: Unload, Delete, Disable, BC delete	asc3350p	Not started	asc3350p.sys Script: Quarantine, Delete, BC delete	SCSI miniport
asc3550 Driver: Unload, Delete, Disable, BC delete	asc3550	Not started	asc3550.sys Script: Quarantine, Delete, BC delete	SCSI miniport
Atdisk Driver: Unload, Delete, Disable, BC delete	Atdisk	Not started	Atdisk.sys Script: Quarantine, Delete, BC delete	Primary disk
Bulk3052i Driver: Unload, Delete, Disable, BC delete	Still Camera Device(EKEN)	Not started	C:\WINDOWS\system32\Drivers\Bulk3052.sys Script: Quarantine, Delete, BC delete	Base
catchme Driver: Unload, Delete, Disable, BC delete	catchme	Not started	C:\DOCUME~1\Michael\LOCALS~1\Temp\catchme.sys Script: Quarantine, Delete, BC delete	Base
cd20xrnt Driver: Unload, Delete, Disable, BC delete	cd20xrnt	Not started	cd20xrnt.sys Script: Quarantine, Delete, BC delete	SCSI miniport
Changer Driver: Unload, Delete, Disable, BC delete	Changer	Not started	Changer.sys Script: Quarantine, Delete, BC delete	Filter
CmdIde Driver: Unload, Delete, Disable, BC delete	CmdIde	Not started	CmdIde.sys Script: Quarantine, Delete, BC delete	System Bus Extender
Cpqarray Driver: Unload, Delete, Disable, BC delete	Cpqarray	Not started	Cpqarray.sys Script: Quarantine, Delete, BC delete	SCSI miniport
dac960nt Driver: Unload, Delete, Disable, BC delete	dac960nt	Not started	dac960nt.sys Script: Quarantine, Delete, BC delete	SCSI miniport
DCALEXICO Driver: Unload, Delete, Disable, BC delete	DCALEXICO	Not started	C:\WINDOWS\system32\drivers\DCalexico.sys Script: Quarantine, Delete, BC delete
dpti2o Driver: Unload, Delete, Disable, BC delete	dpti2o	Not started	dpti2o.sys Script: Quarantine, Delete, BC delete	SCSI miniport
esgiguard Driver: Unload, Delete, Disable, BC delete	esgiguard	Not started	C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys Script: Quarantine, Delete, BC delete
hpn Driver: Unload, Delete, Disable, BC delete	hpn	Not started	hpn.sys Script: Quarantine, Delete, BC delete	SCSI miniport
i2omgmt Driver: Unload, Delete, Disable, BC delete	i2omgmt	Not started	i2omgmt.sys Script: Quarantine, Delete, BC delete	SCSI Class
i2omp Driver: Unload, Delete, Disable, BC delete	i2omp	Not started	i2omp.sys Script: Quarantine, Delete, BC delete	SCSI miniport
ini910u Driver: Unload, Delete, Disable, BC delete	ini910u	Not started	ini910u.sys Script: Quarantine, Delete, BC delete	SCSI miniport
lbrtfdc Driver: Unload, Delete, Disable, BC delete	lbrtfdc	Not started	lbrtfdc.sys Script: Quarantine, Delete, BC delete	System Bus Extender
mraid35x Driver: Unload, Delete, Disable, BC delete	mraid35x	Not started	mraid35x.sys Script: Quarantine, Delete, BC delete	SCSI miniport
PCIDump Driver: Unload, Delete, Disable, BC delete	PCIDump	Not started	PCIDump.sys Script: Quarantine, Delete, BC delete	PCI Configuration
PDCOMP Driver: Unload, Delete, Disable, BC delete	PDCOMP	Not started	PDCOMP.sys Script: Quarantine, Delete, BC delete
PDFRAME Driver: Unload, Delete, Disable, BC delete	PDFRAME	Not started	PDFRAME.sys Script: Quarantine, Delete, BC delete
PDRELI Driver: Unload, Delete, Disable, BC delete	PDRELI	Not started	PDRELI.sys Script: Quarantine, Delete, BC delete
PDRFRAME Driver: Unload, Delete, Disable, BC delete	PDRFRAME	Not started	PDRFRAME.sys Script: Quarantine, Delete, BC delete
perc2 Driver: Unload, Delete, Disable, BC delete	perc2	Not started	perc2.sys Script: Quarantine, Delete, BC delete	SCSI miniport
perc2hib Driver: Unload, Delete, Disable, BC delete	perc2hib	Not started	perc2hib.sys Script: Quarantine, Delete, BC delete	Filter
pmp3052v Driver: Unload, Delete, Disable, BC delete	Video Camera Device(EKEN)	Not started	C:\WINDOWS\system32\Drivers\pmp3052v.sys Script: Quarantine, Delete, BC delete
ql1080 Driver: Unload, Delete, Disable, BC delete	ql1080	Not started	ql1080.sys Script: Quarantine, Delete, BC delete	SCSI miniport
Ql10wnt Driver: Unload, Delete, Disable, BC delete	Ql10wnt	Not started	Ql10wnt.sys Script: Quarantine, Delete, BC delete	SCSI miniport
ql12160 Driver: Unload, Delete, Disable, BC delete	ql12160	Not started	ql12160.sys Script: Quarantine, Delete, BC delete	SCSI miniport
ql1240 Driver: Unload, Delete, Disable, BC delete	ql1240	Not started	ql1240.sys Script: Quarantine, Delete, BC delete	SCSI miniport
ql1280 Driver: Unload, Delete, Disable, BC delete	ql1280	Not started	ql1280.sys Script: Quarantine, Delete, BC delete	SCSI miniport
Simbad Driver: Unload, Delete, Disable, BC delete	Simbad	Not started	Simbad.sys Script: Quarantine, Delete, BC delete	Filter
Sparrow Driver: Unload, Delete, Disable, BC delete	Sparrow	Not started	Sparrow.sys Script: Quarantine, Delete, BC delete	SCSI miniport
StickyMesger Driver: Unload, Delete, Disable, BC delete	StickyMesger	Not started	C:\Program Files\TOSHIBA\Accessibility\StickyMesger.sys Script: Quarantine, Delete, BC delete
sym_hi Driver: Unload, Delete, Disable, BC delete	sym_hi	Not started	sym_hi.sys Script: Quarantine, Delete, BC delete	SCSI miniport
sym_u3 Driver: Unload, Delete, Disable, BC delete	sym_u3	Not started	sym_u3.sys Script: Quarantine, Delete, BC delete	SCSI miniport
symc810 Driver: Unload, Delete, Disable, BC delete	symc810	Not started	symc810.sys Script: Quarantine, Delete, BC delete	SCSI miniport
symc8xx Driver: Unload, Delete, Disable, BC delete	symc8xx	Not started	symc8xx.sys Script: Quarantine, Delete, BC delete	SCSI miniport
SYMIDSCO Driver: Unload, Delete, Disable, BC delete	SYMIDSCO	Not started	C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\IDS-DI~1\20040813.178\symidsco.sys Script: Quarantine, Delete, BC delete
TosIde Driver: Unload, Delete, Disable, BC delete	TosIde	Not started	TosIde.sys Script: Quarantine, Delete, BC delete	System Bus Extender
ultra Driver: Unload, Delete, Disable, BC delete	ultra	Not started	ultra.sys Script: Quarantine, Delete, BC delete	SCSI miniport
ViaIde Driver: Unload, Delete, Disable, BC delete	ViaIde	Not started	ViaIde.sys Script: Quarantine, Delete, BC delete	System Bus Extender
WDICA Driver: Unload, Delete, Disable, BC delete	WDICA	Not started	WDICA.sys Script: Quarantine, Delete, BC delete
Detected - 228, recognized as trusted - 173

Autoruns

File name	Status	Startup method	Description
C:\Documents and Settings\Michael\Local Settings\Temp\_uninst_73471314.bat Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	C:\Documents and Settings\Michael\Start Menu\Programs\Startup\, C:\Documents and Settings\Michael\Start Menu\Programs\Startup\_uninst_73471314.lnk,
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, SpyHunter Security Suite Delete
C:\WINDOWS\System32\Drivers\AliIde.sys Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\aliide, EventMessageFile
C:\WINDOWS\System32\Drivers\CmdIde.sys Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\cmdide, EventMessageFile
C:\WINDOWS\System32\Drivers\TosIde.sys Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\toside, EventMessageFile
C:\WINDOWS\System32\Drivers\ViaIde.sys Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\viaide, EventMessageFile
C:\WINDOWS\System32\Drivers\lbrtfdc.sys Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\lbrtfdc, EventMessageFile
C:\WINDOWS\System32\PrintFilterPipelineSvc.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PrintFilterPipelineSvc, EventMessageFile
C:\WINDOWS\System32\appmgmts.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters, ServiceDll Delete
C:\WINDOWS\System32\appmgmts.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Application Management, EventMessageFile
C:\WINDOWS\System32\appmgr.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Software Installation, EventMessageFile
C:\WINDOWS\System32\fdeploy.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\File Deployment, EventMessageFile
C:\WINDOWS\System32\fdeploy.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Folder Redirection, EventMessageFile
C:\WINDOWS\System32\igmpv2.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile
C:\WINDOWS\System32\ipbootp.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile
C:\WINDOWS\System32\iprip2.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile
C:\WINDOWS\System32\ntbackup.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\ntbackup, EventMessageFile
C:\WINDOWS\System32\ospf.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPF, EventMessageFile
C:\WINDOWS\System32\ospfmib.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPFMib, EventMessageFile
C:\WINDOWS\System32\polagent.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PolicyAgent, EventMessageFile
C:\WINDOWS\System32\tssdis.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\TermServSessDir, EventMessageFile
C:\WINDOWS\system32\MsSip1.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 1, $DLL Delete
C:\WINDOWS\system32\MsSip2.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 2, $DLL Delete
C:\WINDOWS\system32\MsSip3.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 3, $DLL Delete
C:\WINDOWS\system32\asr_fmt.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR format utility for volumes Delete
C:\WINDOWS\system32\asr_ldm.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR utility for Logical Disk Manager Delete
C:\WINDOWS\system32\asr_pfu.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR protected file utility Delete
C:\WINDOWS\system32\psxss.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
C:\WINDOWS\system32\stisvc.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System, EventMessageFile
NDSTray.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, NDSTray.exe Delete
TFncKy.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, TFncKy Delete
appmgmts.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}, DLLName Delete
kbd101.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver JPN Delete
kbd101a.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver KOR Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, .DEFAULT\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-19\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-20\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-18\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-21-4171094791-476353605-951513185-1006\Control Panel\IOProcs, MVB Delete
vgafix.fon Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon Delete
vgaoem.fon Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon Delete
vgasys.fon Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon Delete
Autoruns items detected - 894, recognized as trusted - 852

Microsoft Internet Explorer extension modules (BHOs, Toolbars ...)

File name	Type	Description	Manufacturer	CLSID
Elements detected - 17, recognized as trusted - 17

Windows Explorer extension modules

File name	Destination	Description	Manufacturer	CLSID
	Display Panning CPL Extension			{42071714-76d4-11d1-8b24-00a0c9068ff3} Delete
	Shell extensions for file compression			{764BF0E1-F219-11ce-972D-00AA00A14F56} Delete
	Encryption Context Menu			{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} Delete
	Taskbar and Start Menu			{0DF44EAA-FF21-4412-828E-260A8728E7F1} Delete
	User Accounts			{7A9D77BD-5403-11d2-8785-2E0420524153} Delete
	IE User Assist			{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} Delete
Elements detected - 225, recognized as trusted - 219

Printing system extensions (print monitors, providers)

File name	Type	Name	Description	Manufacturer
Elements detected - 12, recognized as trusted - 12

Task Scheduler jobs

File name	Job name	Job status	Description	Manufacturer
C:\Program Files\Advanced PC Tweaker\OneClick.exe Script: Quarantine, Delete, BC delete	One-Click Tweak.job	The task has not yet run.
Elements detected - 6, recognized as trusted - 5

SPI/LSP settings

Namespace providers (NSP)

Provider	Status	EXE file	Description	GUID
Detected - 4, recognized as trusted - 4

Transport protocol providers (TSP, LSP)

Provider EXE file Description
Detected - 17, recognized as trusted - 17
Results of automatic SPI settings check
LSP settings checked. No errors detected

TCP/UDP ports

Port Status Remote Host Remote Port Application Notes
TCP ports
80 LISTENING 0.0.0.0 22739 [4052] c:\program files\skype\phone\skype.exe
Script: Quarantine, Delete, BC delete, Terminate
135 LISTENING 0.0.0.0 37052 [1140] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
139 LISTENING 0.0.0.0 39006 [4] System
Script: Quarantine, Delete, BC delete, Terminate
443 LISTENING 0.0.0.0 38923 [4052] c:\program files\skype\phone\skype.exe
Script: Quarantine, Delete, BC delete, Terminate
445 LISTENING 0.0.0.0 39118 [4] System
Script: Quarantine, Delete, BC delete, Terminate
1027 ESTABLISHED 127.0.0.1 5354 [1940] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe
Script: Quarantine, Delete, BC delete, Terminate
1029 LISTENING 0.0.0.0 2064 [2108] c:\windows\system32\alg.exe
Script: Quarantine, Delete, BC delete, Terminate
1034 ESTABLISHED 127.0.0.1 27015 [3904] c:\program files\itunes\ituneshelper.exe
Script: Quarantine, Delete, BC delete, Terminate
1055 ESTABLISHED 157.55.235.151 40001 [4052] c:\program files\skype\phone\skype.exe
Script: Quarantine, Delete, BC delete, Terminate
1059 ESTABLISHED 193.120.199.15 12350 [4052] c:\program files\skype\phone\skype.exe
Script: Quarantine, Delete, BC delete, Terminate
1398 TIME_WAIT 192.168.1.65 139 [0]
5152 LISTENING 0.0.0.0 2165 [340] c:\program files\java\jre6\bin\jqs.exe
Script: Quarantine, Delete, BC delete, Terminate
5152 CLOSE_WAIT 127.0.0.1 1204 [340] c:\program files\java\jre6\bin\jqs.exe
Script: Quarantine, Delete, BC delete, Terminate
5354 LISTENING 0.0.0.0 57435 [1960] c:\program files\bonjour\mdnsresponder.exe
Script: Quarantine, Delete, BC delete, Terminate
5354 ESTABLISHED 127.0.0.1 1027 [1960] c:\program files\bonjour\mdnsresponder.exe
Script: Quarantine, Delete, BC delete, Terminate
26439 LISTENING 0.0.0.0 34890 [4052] c:\program files\skype\phone\skype.exe
Script: Quarantine, Delete, BC delete, Terminate
27015 LISTENING 0.0.0.0 38942 [1940] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe
Script: Quarantine, Delete, BC delete, Terminate
27015 ESTABLISHED 127.0.0.1 1034 [1940] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe
Script: Quarantine, Delete, BC delete, Terminate
UDP ports
123 LISTENING -- -- [1216] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
123 LISTENING -- -- [1216] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
137 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
138 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
443 LISTENING -- -- [4052] c:\program files\skype\phone\skype.exe
Script: Quarantine, Delete, BC delete, Terminate
445 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
500 LISTENING -- -- [872] c:\windows\system32\lsass.exe
Script: Quarantine, Delete, BC delete, Terminate
1025 LISTENING -- -- [1940] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe
Script: Quarantine, Delete, BC delete, Terminate
1026 LISTENING -- -- [1940] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe
Script: Quarantine, Delete, BC delete, Terminate
1028 LISTENING -- -- [1960] c:\program files\bonjour\mdnsresponder.exe
Script: Quarantine, Delete, BC delete, Terminate
1035 LISTENING -- -- [3904] c:\program files\itunes\ituneshelper.exe
Script: Quarantine, Delete, BC delete, Terminate
1036 LISTENING -- -- [3904] c:\program files\itunes\ituneshelper.exe
Script: Quarantine, Delete, BC delete, Terminate
1037 LISTENING -- -- [4052] c:\program files\skype\phone\skype.exe
Script: Quarantine, Delete, BC delete, Terminate
1049 LISTENING -- -- [3976] c:\program files\messenger\msmsgs.exe
Script: Quarantine, Delete, BC delete, Terminate
1069 LISTENING -- -- [4052] c:\program files\skype\phone\skype.exe
Script: Quarantine, Delete, BC delete, Terminate
1094 LISTENING -- -- [4068] c:\program files\internet explorer\iexplore.exe
Script: Quarantine, Delete, BC delete, Terminate
1202 LISTENING -- -- [4700] c:\program files\internet explorer\iexplore.exe
Script: Quarantine, Delete, BC delete, Terminate
1900 LISTENING -- -- [1596] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
1900 LISTENING -- -- [1596] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
4500 LISTENING -- -- [872] c:\windows\system32\lsass.exe
Script: Quarantine, Delete, BC delete, Terminate
5353 LISTENING -- -- [1960] c:\program files\bonjour\mdnsresponder.exe
Script: Quarantine, Delete, BC delete, Terminate
26439 LISTENING -- -- [4052] c:\program files\skype\phone\skype.exe
Script: Quarantine, Delete, BC delete, Terminate

Downloaded Program Files (DPF)

File name Description Manufacturer CLSID Source URL
Elements detected - 8, recognized as trusted - 8

Control Panel Applets (CPL)

File name Description Manufacturer
C:\WINDOWS\system32\HWSetup.cpl
Script: Quarantine, Delete, BC delete Hardware Setup Utility Copyright (C) TOSHIBA Corp. 1995 - 2004
C:\WINDOWS\system32\TPwrSave.cpl
Script: Quarantine, Delete, BC delete Copyright (C) 1998-2004 TOSHIBA Corporation
Elements detected - 29, recognized as trusted - 27

Active Setup

File name Description Manufacturer CLSID
Elements detected - 16, recognized as trusted - 16

HOSTS file

Hosts file record
яю1
Clear Hosts file

Protocols and handlers

File name Type Description Manufacturer CLSID
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
Elements detected - 33, recognized as trusted - 30

Suspicious objects

File Description Type
C:\WINDOWS\system32\DRIVERS\4645108drv.sys
Script: Quarantine, Delete, BC delete Suspicion for Rootkit Kernel-mode hook
\SystemRoot\system32\DRIVERS\4645108drv.sys
Script: Quarantine, Delete, BC delete Suspicion for Rootkit Kernel-mode hook

Main script of analysis
Windows version: Microsoft Windows XP, Build=2600, SP="Service Pack 3"
System Restore: enabled
1.1 Searching for user-mode API hooks
 Analysis: kernel32.dll, export table found in section .text
IAT modification detected: CreateProcessA - 00CF0010<>7C80236B
IAT modification detected: GetModuleFileNameA - 00CF0080<>7C80B56F
IAT modification detected: FreeLibrary - 00CF00F0<>7C80AC7E
IAT modification detected: GetModuleFileNameW - 00CF0160<>7C80B475
IAT modification detected: CreateProcessW - 00CF01D0<>7C802336
IAT modification detected: LoadLibraryW - 00CF02B0<>7C80AEEB
IAT modification detected: LoadLibraryA - 00CF0320<>7C801D7B
IAT modification detected: GetProcAddress - 00CF0390<>7C80AE40
 Analysis: ntdll.dll, export table found in section .text
 Analysis: user32.dll, export table found in section .text
 Analysis: advapi32.dll, export table found in section .text
 Analysis: ws2_32.dll, export table found in section .text
 Analysis: wininet.dll, export table found in section .text
 Analysis: rasapi32.dll, export table found in section .text
 Analysis: urlmon.dll, export table found in section .text
 Analysis: netapi32.dll, export table found in section .text
1.2 Searching for kernel-mode API hooks
 Driver loaded successfully
 SDT found (RVA=0832A0)
 Kernel ntoskrnl.exe found in memory at address 804D7000
   SDT = 8055A2A0
   KiST = 804E26B8 (284)
Function NtAdjustPrivilegesToken (0B) intercepted (8059B554->B1A92690), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtClose (19) intercepted (80567AED->B1A92F94), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtConnectPort (1F) intercepted (8059110B->B1A93DC8), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateEvent (23) intercepted (80570022->B1A94312), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateFile (25) intercepted (8056F864->B1A93270), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateKey (29) intercepted (8057376F->B1A91500), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateMutant (2B) intercepted (805775C8->B1A941F8), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateNamedPipeFile (2C) intercepted (80585619->B1A9227E), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreatePort (2E) intercepted (805893C7->B1A940CC), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateSection (32) intercepted (80565333->B1A92426), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateSemaphore (33) intercepted (8057B80D->B1A94432), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateThread (35) intercepted (80578803->B1A92C1C), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateWaitablePort (38) intercepted (805DB3E4->B1A94162), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDebugActiveProcess (39) intercepted (8065BF7D->B1A95B1A), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDeleteKey (3F) intercepted (80597FFA->B1A91B0A), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDeleteValueKey (41) intercepted (80595C1A->B1A91EBE), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDeviceIoControlFile (42) intercepted (805795B9->B1A936F2), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDuplicateObject (44) intercepted (805748C2->B1A96D26), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtEnumerateKey (47) intercepted (80573E7D->B1A9200A), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtEnumerateValueKey (49) intercepted (8057FB2B->B1A920A2), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtFsControlFile (54) intercepted (805770E0->B1A93500), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtLoadDriver (61) intercepted (805A425D->B1A95C0C), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtLoadKey (62) intercepted (805AF5C3->B1A914DC), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtLoadKey2 (63) intercepted (805AF400->B1A914EE), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtMapViewOfSection (6C) intercepted (8057AC99->B1A96374), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtNotifyChangeKey (6F) intercepted (80593FAA->B1A921CE), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenEvent (72) intercepted (8057FC98->B1A943A8), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenFile (74) intercepted (8056F7FF->B1A93016), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenKey (77) intercepted (80568F68->B1A916C0), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenMutant (78) intercepted (80577676->B1A94288), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenProcess (7A) intercepted (80574AA9->B1A928CC), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenSection (7D) intercepted (8056E467->B1A9610E), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenSemaphore (7E) intercepted (805DD9AC->B1A944C8), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenThread (80) intercepted (8059323B->B1A927BE), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQueryKey (A0) intercepted (80573B86->B1A9213A), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQueryMultipleValueKey (A1) intercepted (8064F0A7->B1A91D72), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQuerySection (A7) intercepted (8057EE6E->B1A966AE), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQueryValueKey (B1) intercepted (8056A419->B1A9199C), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQueueApcThread (B4) intercepted (8058F954->B1A95FA0), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtRenameKey (C0) intercepted (8064F526->B1A91C2C), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtReplaceKey (C1) intercepted (8064FE82->B1A90F16), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtReplyPort (C2) intercepted (8057E67C->B1A9482C), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtReplyWaitReceivePort (C3) intercepted (8056BC24->B1A946F2), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtRequestWaitReplyPort (C8) intercepted (8056DC86->B1A958B4), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtRestoreKey (CC) intercepted (8064FA19->B1A9128E), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtResumeThread (CE) intercepted (80578E76->B1A96BC8), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSaveKey (CF) intercepted (8064FB1A->B1A90EAE), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSecureConnectPort (D2) intercepted (80599040->B1A93B0E), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetContextThread (D5) intercepted (8062E33F->B1A92E38), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetInformationToken (E6) intercepted (805A8E5C->B1A95154), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetSecurityObject (ED) intercepted (8059D2BD->B1A95DAA), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetSystemInformation (F0) intercepted (805A8349->B1A967FE), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetValueKey (F7) intercepted (8057BC5B->B1A91816), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSuspendProcess (FD) intercepted (8062FF21->B1A968F0), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSuspendThread (FE) intercepted (805E05AB->B1A96A2A), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSystemDebugControl (FF) intercepted (8064AA57->B1A95A3E), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtTerminateProcess (101) intercepted (805839B9->B1A92A68), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtTerminateThread (102) intercepted (80577F1F->B1A929C8), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtUnmapViewOfSection (10B) intercepted (8057A81E->B1A96552), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtWriteVirtualMemory (115) intercepted (8057F712->B1A92B52), hook C:\WINDOWS\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function FsRtlCheckLockForReadAccess (80512959) - machine code modification Method of JmpTo. jmp B1A84FD0 \SystemRoot\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
Function IoIsOperationSynchronous (804E876A) - machine code modification Method of JmpTo. jmp B1A853AC \SystemRoot\system32\DRIVERS\4645108drv.sys, driver recognized as trusted
>>> Function restored successfully !
Functions checked: 284, intercepted: 60, restored: 62
1.3 Checking IDT and SYSENTER
 Analysis for CPU 1
CmpCallCallBacks = 0013AD62
Disable callback OK
 Checking IDT and SYSENTER - complete
1.4 Searching for masking processes and drivers
 Checking not performed: extended monitoring driver (AVZPM) is not installed
1.5 Checking of IRP handlers
 Driver loaded successfully
 Checking - complete
>> Services: potentially dangerous service allowed: TermService (Terminal Services)
>> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery Service)
>> Services: potentially dangerous service allowed: TlntSvr ()
>> Services: potentially dangerous service allowed: Schedule (Task Scheduler)
>> Services: potentially dangerous service allowed: mnmsrvc (NetMeeting Remote Desktop Sharing)
>> Services: potentially dangerous service allowed: RDSessMgr (Remote Desktop Help Session Manager)
> Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)!
>> Security: disk drives' autorun is enabled
>> Security: administrative shares (C$, D$ ...) are enabled
>> Security: anonymous user access is enabled
>> Security: sending Remote Assistant queries is enabled
 >>  Disable HDD autorun
 >>  Disable autorun from network drives
 >>  Disable CD/DVD autorun
 >>  Disable removable media autorun
System Analysis in progress

 System Analysis - complete


Script commands 
Add commands to script:
Blocking hooks using Anti-Rootkit
Enable AVZGuard
Operations with AVZPM (true=enable,false=disable)
BootCleaner - import list of deleted files
BootCleaner - import all
Registry cleanup after deleting files
ExecuteWizard ('TSW',2,3,true) - Running Troubleshooting wizard
BootCleaner - activate
Reboot
Insert template for QuarantineFile() - quarantining file
Insert template for BC_QrFile() - quarantining file via BootCleaner
Insert template for DeleteFile() - deleting file
Insert template for DelCLSID() - deleting CLSID item from registry
Additional operations:Performance tweaking: disable service TermService (Terminal Services)
Performance tweaking: disable service SSDPSRV (SSDP Discovery Service)
Performance tweaking: disable service TlntSvr ()
Performance tweaking: disable service Schedule (Task Scheduler)
Performance tweaking: disable service mnmsrvc (NetMeeting Remote Desktop Sharing)
Performance tweaking: disable service RDSessMgr (Remote Desktop Help Session Manager)
Security tweaking: disable CD autorun
Security tweaking: disable administrative shares
Security tweaking: disable anonymous user access
Security: disable sending Remote Assistant queries

File list

Port	Status	Remote Host	Remote Port	Application	Notes
TCP ports
80	LISTENING	0.0.0.0	22739	[4052] c:\program files\skype\phone\skype.exe Script: Quarantine, Delete, BC delete, Terminate
135	LISTENING	0.0.0.0	37052	[1140] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
139	LISTENING	0.0.0.0	39006	[4] System Script: Quarantine, Delete, BC delete, Terminate
443	LISTENING	0.0.0.0	38923	[4052] c:\program files\skype\phone\skype.exe Script: Quarantine, Delete, BC delete, Terminate
445	LISTENING	0.0.0.0	39118	[4] System Script: Quarantine, Delete, BC delete, Terminate
1027	ESTABLISHED	127.0.0.1	5354	[1940] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe Script: Quarantine, Delete, BC delete, Terminate
1029	LISTENING	0.0.0.0	2064	[2108] c:\windows\system32\alg.exe Script: Quarantine, Delete, BC delete, Terminate
1034	ESTABLISHED	127.0.0.1	27015	[3904] c:\program files\itunes\ituneshelper.exe Script: Quarantine, Delete, BC delete, Terminate
1055	ESTABLISHED	157.55.235.151	40001	[4052] c:\program files\skype\phone\skype.exe Script: Quarantine, Delete, BC delete, Terminate
1059	ESTABLISHED	193.120.199.15	12350	[4052] c:\program files\skype\phone\skype.exe Script: Quarantine, Delete, BC delete, Terminate
1398	TIME_WAIT	192.168.1.65	139	[0]
5152	LISTENING	0.0.0.0	2165	[340] c:\program files\java\jre6\bin\jqs.exe Script: Quarantine, Delete, BC delete, Terminate
5152	CLOSE_WAIT	127.0.0.1	1204	[340] c:\program files\java\jre6\bin\jqs.exe Script: Quarantine, Delete, BC delete, Terminate
5354	LISTENING	0.0.0.0	57435	[1960] c:\program files\bonjour\mdnsresponder.exe Script: Quarantine, Delete, BC delete, Terminate
5354	ESTABLISHED	127.0.0.1	1027	[1960] c:\program files\bonjour\mdnsresponder.exe Script: Quarantine, Delete, BC delete, Terminate
26439	LISTENING	0.0.0.0	34890	[4052] c:\program files\skype\phone\skype.exe Script: Quarantine, Delete, BC delete, Terminate
27015	LISTENING	0.0.0.0	38942	[1940] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe Script: Quarantine, Delete, BC delete, Terminate
27015	ESTABLISHED	127.0.0.1	1034	[1940] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe Script: Quarantine, Delete, BC delete, Terminate
UDP ports
123	LISTENING	--	--	[1216] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
123	LISTENING	--	--	[1216] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
137	LISTENING	--	--	[4] System Script: Quarantine, Delete, BC delete, Terminate
138	LISTENING	--	--	[4] System Script: Quarantine, Delete, BC delete, Terminate
443	LISTENING	--	--	[4052] c:\program files\skype\phone\skype.exe Script: Quarantine, Delete, BC delete, Terminate
445	LISTENING	--	--	[4] System Script: Quarantine, Delete, BC delete, Terminate
500	LISTENING	--	--	[872] c:\windows\system32\lsass.exe Script: Quarantine, Delete, BC delete, Terminate
1025	LISTENING	--	--	[1940] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe Script: Quarantine, Delete, BC delete, Terminate
1026	LISTENING	--	--	[1940] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe Script: Quarantine, Delete, BC delete, Terminate
1028	LISTENING	--	--	[1960] c:\program files\bonjour\mdnsresponder.exe Script: Quarantine, Delete, BC delete, Terminate
1035	LISTENING	--	--	[3904] c:\program files\itunes\ituneshelper.exe Script: Quarantine, Delete, BC delete, Terminate
1036	LISTENING	--	--	[3904] c:\program files\itunes\ituneshelper.exe Script: Quarantine, Delete, BC delete, Terminate
1037	LISTENING	--	--	[4052] c:\program files\skype\phone\skype.exe Script: Quarantine, Delete, BC delete, Terminate
1049	LISTENING	--	--	[3976] c:\program files\messenger\msmsgs.exe Script: Quarantine, Delete, BC delete, Terminate
1069	LISTENING	--	--	[4052] c:\program files\skype\phone\skype.exe Script: Quarantine, Delete, BC delete, Terminate
1094	LISTENING	--	--	[4068] c:\program files\internet explorer\iexplore.exe Script: Quarantine, Delete, BC delete, Terminate
1202	LISTENING	--	--	[4700] c:\program files\internet explorer\iexplore.exe Script: Quarantine, Delete, BC delete, Terminate
1900	LISTENING	--	--	[1596] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
1900	LISTENING	--	--	[1596] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
4500	LISTENING	--	--	[872] c:\windows\system32\lsass.exe Script: Quarantine, Delete, BC delete, Terminate
5353	LISTENING	--	--	[1960] c:\program files\bonjour\mdnsresponder.exe Script: Quarantine, Delete, BC delete, Terminate
26439	LISTENING	--	--	[4052] c:\program files\skype\phone\skype.exe Script: Quarantine, Delete, BC delete, Terminate