Kaspersky Virus Removal Tool 11.0.0.1245 (database released 18/02/2012; 13:04)
| File name | PID | Description | Copyright | MD5 | Information
| c:\program files\sony corporation\picture package\picture package menu\sonytray.exe | Script: Quarantine, Delete, BC delete, Terminate 1224 | SonyTray.exe | Copyright 2003 Sony Corporation | ?? | 148.00 kb, rsah, | created: 04.12.2008 17:54:22, modified: 21.11.2003 21:02:42 Command line: "C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe" Detected:55, recognized as trusted 55
| | |||||
| Module name | Handle | Description | Copyright | MD5 | Used by processes
| C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.dll | Script: Quarantine, Delete, BC delete 268435456 | SonyTray.dll | Copyright 2003 Sony Corporation | -- | 1224
| Modules detected:459, recognized as trusted 458
| | |||||
| Module | Base address | Size in memory | Description | Manufacturer
| C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS | Script: Quarantine, Delete, BC delete B7B0C000 | 004000 (16384) |
| C:\WINDOWS\System32\Drivers\dump_atapi.sys | Script: Quarantine, Delete, BC delete B64A0000 | 018000 (98304) |
| C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS | Script: Quarantine, Delete, BC delete BA5EE000 | 002000 (8192) |
| C:\WINDOWS\System32\Drivers\hiber_WMILIB.SYS | Script: Quarantine, Delete, BC delete BA618000 | 002000 (8192) |
| C:\WINDOWS\system32\Drivers\sonypvl3.sys | Script: Quarantine, Delete, BC delete BA338000 | 005000 (20480) | FS Filter Driver | Copyright 2004, 2007 Sony Corp.
| Modules detected - 131, recognized as trusted - 126
| | ||||||||
| Service | Description | Status | File | Group | Dependencies
| getPlus(R) Helper | Service: Stop, Delete, Disable, BC delete getPlus(R) Helper | Not started | C:\Program Files\NOS\bin\getPlus_HelperSvc.exe | Script: Quarantine, Delete, BC delete | RPCSS
| Detected - 102, recognized as trusted - 101
| | ||||||
| File name | Status | Startup method | Description
| C:\ | Script: Quarantine, Delete, BC delete Active | Shortcut in Autoruns folder | C:\Documents and Settings\Mike\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\Mike\Application Data\Microsoft\Internet Explorer\Quick Launch\Local Disk (C).lnk,
| C:\Documents and Settings\Mike\Local Settings\Temp\_uninst_93620032.bat | Script: Quarantine, Delete, BC delete Active | Shortcut in Autoruns folder | C:\Documents and Settings\Mike\Start Menu\Programs\Startup\, C:\Documents and Settings\Mike\Start Menu\Programs\Startup\_uninst_93620032.lnk,
| C:\Picture | Script: Quarantine, Delete, BC delete Active | Shortcut in Autoruns folder | C:\Documents and Settings\Mike\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\Mike\Application Data\Microsoft\Internet Explorer\Quick Launch\Picture.lnk,
| C:\Program Files\MySpace\IM\MySpaceIM.exe | Script: Quarantine, Delete, BC delete Active | Shortcut in Autoruns folder | C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\Quick Launch\MySpaceIM.lnk,
| C:\Program Files\MySpace\IM\MySpaceIM.exe | Script: Quarantine, Delete, BC delete Active | Shortcut in Autoruns folder | C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\Quick Launch\MySpaceIM.lnk,
| C:\Program Files\MySpace\IM\MySpaceIM.exe | Script: Quarantine, Delete, BC delete Active | Shortcut in Autoruns folder | C:\Documents and Settings\Mike\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\Mike\Application Data\Microsoft\Internet Explorer\Quick Launch\MySpaceIM.lnk,
| C:\WINDOWS\System32\Drivers\lbrtfdc.sys | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\lbrtfdc, EventMessageFile
| C:\WINDOWS\System32\PrintFilterPipelineSvc.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PrintFilterPipelineSvc, EventMessageFile
| C:\WINDOWS\System32\appmgmts.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters, ServiceDll | Delete C:\WINDOWS\System32\appmgmts.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Application Management, EventMessageFile
| C:\WINDOWS\System32\appmgr.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Software Installation, EventMessageFile
| C:\WINDOWS\System32\fdeploy.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\File Deployment, EventMessageFile
| C:\WINDOWS\System32\fdeploy.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Folder Redirection, EventMessageFile
| C:\WINDOWS\System32\hidserv.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\HidServ\Parameters, ServiceDll | Delete C:\WINDOWS\System32\igmpv2.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile
| C:\WINDOWS\System32\ipbootp.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile
| C:\WINDOWS\System32\iprip2.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile
| C:\WINDOWS\System32\ntbackup.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\ntbackup, EventMessageFile
| C:\WINDOWS\System32\ospf.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPF, EventMessageFile
| C:\WINDOWS\System32\ospfmib.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPFMib, EventMessageFile
| C:\WINDOWS\System32\polagent.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PolicyAgent, EventMessageFile
| C:\WINDOWS\System32\tssdis.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\TermServSessDir, EventMessageFile
| C:\WINDOWS\system32\MsSip1.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 1, $DLL | Delete C:\WINDOWS\system32\MsSip2.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 2, $DLL | Delete C:\WINDOWS\system32\MsSip3.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 3, $DLL | Delete C:\WINDOWS\system32\asr_fmt.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR format utility for volumes | Delete C:\WINDOWS\system32\asr_ldm.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR utility for Logical Disk Manager | Delete C:\WINDOWS\system32\asr_pfu.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR protected file utility | Delete C:\WINDOWS\system32\psxss.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
| C:\WINDOWS\system32\stisvc.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System, EventMessageFile
| appmgmts.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}, DLLName | Delete kbd101.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver JPN | Delete kbd101a.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver KOR | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, .DEFAULT\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-19\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-20\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-18\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-21-532459918-1308773187-3917457064-1006\Control Panel\IOProcs, MVB | Delete vgafix.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon | Delete vgaoem.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon | Delete vgasys.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon | Delete Autoruns items detected - 860, recognized as trusted - 819
| | ||||||
| File name | Type | Description | Manufacturer | CLSID
| BHO | {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} | Delete Extension module | {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} | Delete Extension module | {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} | Delete C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe | Script: Quarantine, Delete, BC delete Extension module | {F4430FE8-2638-42e5-B849-800749B94EED} | Delete Elements detected - 18, recognized as trusted - 14
| | |||||||||||||||||
| File name | Destination | Description | Manufacturer | CLSID
| Display Panning CPL Extension | {42071714-76d4-11d1-8b24-00a0c9068ff3} | Delete Shell extensions for file compression | {764BF0E1-F219-11ce-972D-00AA00A14F56} | Delete Encryption Context Menu | {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} | Delete Taskbar and Start Menu | {0DF44EAA-FF21-4412-828E-260A8728E7F1} | Delete User Accounts | {7A9D77BD-5403-11d2-8785-2E0420524153} | Delete Microsoft Browser Architecture | {BC476F4C-D9D7-4100-8D4E-E043F6DEC409} | Delete IE User Assist | {FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} | Delete Elements detected - 217, recognized as trusted - 210
| | |||||||||||||||||||||||||||
| File name | Type | Name | Description | Manufacturer
| Elements detected - 10, recognized as trusted - 10
| | ||||||
| File name | Job name | Job status | Description | Manufacturer
| Elements detected - 4, recognized as trusted - 4
| | ||||||
| Provider | Status | EXE file | Description | GUID
| Detected - 4, recognized as trusted - 4
| | ||||||
| Provider | EXE file | Description
| Detected - 17, recognized as trusted - 17
| | ||||||
| File name | Description | Manufacturer | CLSID | Source URL
| {E2883E8F-472F-4FB0-9522-AC9BF37916A7} | Delete http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
| Elements detected - 13, recognized as trusted - 12
| | |||||||||
| File name | Description | Manufacturer
| Elements detected - 31, recognized as trusted - 31
| | ||||||
| File name | Description | Manufacturer | CLSID
| Elements detected - 16, recognized as trusted - 16
| | ||||||
Hosts file record
|
| File name | Type | Description | Manufacturer | CLSID
| mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D} | Delete mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D} | Delete mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D} | Delete Elements detected - 30, recognized as trusted - 27
| | ||||||
| File | Description | Type |
Main script of analysis Windows version: Microsoft Windows XP, Build=2600, SP="Service Pack 3" System Restore: enabled 1.1 Searching for user-mode API hooks Analysis: kernel32.dll, export table found in section .text IAT modification detected: CreateProcessA - 00B90010<>7C80236B IAT modification detected: GetModuleFileNameA - 00B90080<>7C80B56F IAT modification detected: FreeLibrary - 00B900F0<>7C80AC7E IAT modification detected: GetModuleFileNameW - 00B90160<>7C80B475 IAT modification detected: CreateProcessW - 00B901D0<>7C802336 IAT modification detected: LoadLibraryW - 00B902B0<>7C80AEEB IAT modification detected: LoadLibraryA - 00B90320<>7C801D7B IAT modification detected: GetProcAddress - 00B90390<>7C80AE40 Analysis: ntdll.dll, export table found in section .text Analysis: user32.dll, export table found in section .text Analysis: advapi32.dll, export table found in section .text Analysis: ws2_32.dll, export table found in section .text Analysis: wininet.dll, export table found in section .text Analysis: rasapi32.dll, export table found in section .text Analysis: urlmon.dll, export table found in section .text Analysis: netapi32.dll, export table found in section .text 1.2 Searching for kernel-mode API hooks Driver loaded successfully SDT found (RVA=085700) Kernel ntkrnlpa.exe found in memory at address 804D7000 SDT = 8055C700 KiST = 80504480 (284) Functions checked: 284, intercepted: 0, restored: 0 1.3 Checking IDT and SYSENTER Analysis for CPU 1 Analysis for CPU 2 CmpCallCallBacks = 00093D84 Disable callback - уже нейтирализованы Checking IDT and SYSENTER - complete 1.4 Searching for masking processes and drivers Checking not performed: extended monitoring driver (AVZPM) is not installed 1.5 Checking of IRP handlers Driver loaded successfully Checking - complete >> Services: potentially dangerous service allowed: TermService (Terminal Services) >> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery Service) >> Services: potentially dangerous service allowed: TlntSvr () >> Services: potentially dangerous service allowed: Schedule (Task Scheduler) >> Services: potentially dangerous service allowed: mnmsrvc (NetMeeting Remote Desktop Sharing) >> Services: potentially dangerous service allowed: RDSessMgr (Remote Desktop Help Session Manager) > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)! >> Security: disk drives' autorun is enabled >> Security: administrative shares (C$, D$ ...) are enabled >> Security: anonymous user access is enabled >> Security: sending Remote Assistant queries is enabled >> Disable HDD autorun >> Disable autorun from network drives >> Disable CD/DVD autorun >> Disable removable media autorun System Analysis in progressAdd commands to script:
System Analysis - complete
Script commands