Kaspersky Virus Removal Tool 11.0.0.1245 (database released 02/04/2012; 09:01)
| File name | PID | Description | Copyright | MD5 | Information
| c:\progra~1\ecopy\desktop\pclprint\mrmlnc32.exe | Script: Quarantine, Delete, BC delete, Terminate 3332 | | | ?? | 80.00 kb, rsAh, | created: 10.01.2008 12:33:45, modified: 04.03.2004 18:31:24 Command line: "C:\PROGRA~1\eCopy\Desktop\PCLprint\mrmlnc32.exe" c:\windows\system32\spoolsv.exe | Script: Quarantine, Delete, BC delete, Terminate 1440 | Spooler SubSystem App | © Microsoft Corporation. All rights reserved. | ?? | 57.50 kb, rsAh, | created: 12.08.2004 08:29:33, modified: 17.08.2010 08:17:06 Command line: C:\WINDOWS\system32\spoolsv.exe Detected:43, recognized as trusted 42
| | |||||
| Module name | Handle | Description | Copyright | MD5 | Used by processes
| C:\WINDOWS\system32\EPFaxAPI.dll | Script: Quarantine, Delete, BC delete 10682368 | EPFaxApi | Copyright © 2003, Lincoln & Co. | -- | 1440
| C:\WINDOWS\system32\mrsplnt.dll | Script: Quarantine, Delete, BC delete 268435456 | | | -- | 1440
| Modules detected:421, recognized as trusted 419
| | |||||
| Module | Base address | Size in memory | Description | Manufacturer
| C:\WINDOWS\System32\Drivers\dump_atapi.sys | Script: Quarantine, Delete, BC delete EE50B000 | 018000 (98304) |
| C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS | Script: Quarantine, Delete, BC delete F7B2F000 | 002000 (8192) |
| Modules detected - 141, recognized as trusted - 139
| | ||||||
| Service | Description | Status | File | Group | Dependencies
| NMIndexingService | Service: Stop, Delete, Disable, BC delete NMIndexingService | Not started | C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe | Script: Quarantine, Delete, BC delete | RPCSS
| Detected - 98, recognized as trusted - 97
| | ||||||
| Service | Description | Status | File | Group | Dependencies
| Abiosdsk | Driver: Unload, Delete, Disable, BC delete Abiosdsk | Not started | Abiosdsk.sys | Script: Quarantine, Delete, BC delete Primary disk |
| abp480n5 | Driver: Unload, Delete, Disable, BC delete abp480n5 | Not started | abp480n5.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| adpu160m | Driver: Unload, Delete, Disable, BC delete adpu160m | Not started | adpu160m.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Aha154x | Driver: Unload, Delete, Disable, BC delete Aha154x | Not started | Aha154x.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| aic78u2 | Driver: Unload, Delete, Disable, BC delete aic78u2 | Not started | aic78u2.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| aic78xx | Driver: Unload, Delete, Disable, BC delete aic78xx | Not started | aic78xx.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| AliIde | Driver: Unload, Delete, Disable, BC delete AliIde | Not started | AliIde.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| amsint | Driver: Unload, Delete, Disable, BC delete amsint | Not started | amsint.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| asc | Driver: Unload, Delete, Disable, BC delete asc | Not started | asc.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| asc3350p | Driver: Unload, Delete, Disable, BC delete asc3350p | Not started | asc3350p.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| asc3550 | Driver: Unload, Delete, Disable, BC delete asc3550 | Not started | asc3550.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Atdisk | Driver: Unload, Delete, Disable, BC delete Atdisk | Not started | Atdisk.sys | Script: Quarantine, Delete, BC delete Primary disk |
| catchme | Driver: Unload, Delete, Disable, BC delete catchme | Not started | C:\DOCUME~1\abq\LOCALS~1\Temp\catchme.sys | Script: Quarantine, Delete, BC delete Base |
| cd20xrnt | Driver: Unload, Delete, Disable, BC delete cd20xrnt | Not started | cd20xrnt.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Changer | Driver: Unload, Delete, Disable, BC delete Changer | Not started | Changer.sys | Script: Quarantine, Delete, BC delete Filter |
| CmdIde | Driver: Unload, Delete, Disable, BC delete CmdIde | Not started | CmdIde.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| Cpqarray | Driver: Unload, Delete, Disable, BC delete Cpqarray | Not started | Cpqarray.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| dac960nt | Driver: Unload, Delete, Disable, BC delete dac960nt | Not started | dac960nt.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| dpti2o | Driver: Unload, Delete, Disable, BC delete dpti2o | Not started | dpti2o.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| hpn | Driver: Unload, Delete, Disable, BC delete hpn | Not started | hpn.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| i2omgmt | Driver: Unload, Delete, Disable, BC delete i2omgmt | Not started | i2omgmt.sys | Script: Quarantine, Delete, BC delete SCSI Class |
| i2omp | Driver: Unload, Delete, Disable, BC delete i2omp | Not started | i2omp.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ini910u | Driver: Unload, Delete, Disable, BC delete ini910u | Not started | ini910u.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| lbrtfdc | Driver: Unload, Delete, Disable, BC delete lbrtfdc | Not started | lbrtfdc.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| mraid35x | Driver: Unload, Delete, Disable, BC delete mraid35x | Not started | mraid35x.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| PCIDump | Driver: Unload, Delete, Disable, BC delete PCIDump | Not started | PCIDump.sys | Script: Quarantine, Delete, BC delete PCI Configuration |
| PDCOMP | Driver: Unload, Delete, Disable, BC delete PDCOMP | Not started | PDCOMP.sys | Script: Quarantine, Delete, BC delete |
| PDFRAME | Driver: Unload, Delete, Disable, BC delete PDFRAME | Not started | PDFRAME.sys | Script: Quarantine, Delete, BC delete |
| PDRELI | Driver: Unload, Delete, Disable, BC delete PDRELI | Not started | PDRELI.sys | Script: Quarantine, Delete, BC delete |
| PDRFRAME | Driver: Unload, Delete, Disable, BC delete PDRFRAME | Not started | PDRFRAME.sys | Script: Quarantine, Delete, BC delete |
| perc2 | Driver: Unload, Delete, Disable, BC delete perc2 | Not started | perc2.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| perc2hib | Driver: Unload, Delete, Disable, BC delete perc2hib | Not started | perc2hib.sys | Script: Quarantine, Delete, BC delete Filter |
| ql1080 | Driver: Unload, Delete, Disable, BC delete ql1080 | Not started | ql1080.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Ql10wnt | Driver: Unload, Delete, Disable, BC delete Ql10wnt | Not started | Ql10wnt.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ql12160 | Driver: Unload, Delete, Disable, BC delete ql12160 | Not started | ql12160.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ql1240 | Driver: Unload, Delete, Disable, BC delete ql1240 | Not started | ql1240.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ql1280 | Driver: Unload, Delete, Disable, BC delete ql1280 | Not started | ql1280.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Simbad | Driver: Unload, Delete, Disable, BC delete Simbad | Not started | Simbad.sys | Script: Quarantine, Delete, BC delete Filter |
| Sparrow | Driver: Unload, Delete, Disable, BC delete Sparrow | Not started | Sparrow.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| sym_hi | Driver: Unload, Delete, Disable, BC delete sym_hi | Not started | sym_hi.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| sym_u3 | Driver: Unload, Delete, Disable, BC delete sym_u3 | Not started | sym_u3.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| symc810 | Driver: Unload, Delete, Disable, BC delete symc810 | Not started | symc810.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| symc8xx | Driver: Unload, Delete, Disable, BC delete symc8xx | Not started | symc8xx.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| TosIde | Driver: Unload, Delete, Disable, BC delete TosIde | Not started | TosIde.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| ultra | Driver: Unload, Delete, Disable, BC delete ultra | Not started | ultra.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ViaIde | Driver: Unload, Delete, Disable, BC delete ViaIde | Not started | ViaIde.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| WDICA | Driver: Unload, Delete, Disable, BC delete WDICA | Not started | WDICA.sys | Script: Quarantine, Delete, BC delete |
| Detected - 192, recognized as trusted - 145
| | ||||||
| File name | Status | Startup method | Description
| C:\Documents and Settings\abq\Local Settings\Temp\_uninst_90647482.bat | Script: Quarantine, Delete, BC delete Active | Shortcut in Autoruns folder | C:\Documents and Settings\abq\Start Menu\Programs\Startup\, C:\Documents and Settings\abq\Start Menu\Programs\Startup\_uninst_90647482.lnk,
| C:\PROGRA~1\eCopy\Desktop\PCLprint\mrmlnc32.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, eCopy Desktop Printer Service | Delete C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-21-2617700467-1337732287-186788590-1196\Software\Microsoft\Windows\CurrentVersion\Run, AdobeUpdater | Delete C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-21-2617700467-1337732287-186788590-1196\Software\Microsoft\Windows\CurrentVersion\Run, BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} | Delete C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {B327765E-D724-4347-8B16-78AE18552FC3} | Delete C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {7F1CF152-04F8-453A-B34C-E609530A9DC8} | Delete C:\Program Files\Sonic\Sonic Solutions Product CD\RecordNow!\shlext.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {DEE12703-6333-4D4E-8F34-738C4DCC2E04} | Delete C:\Program Files\WMA-MP3.com\Protected Music Converter\PMConvert.exe | Script: Quarantine, Delete, BC delete Active | Shortcut in Autoruns folder | C:\Documents and Settings\abq\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\abq\Application Data\Microsoft\Internet Explorer\Quick Launch\Protected Music Converter.lnk,
| C:\Program Files\WordPerfect Office 12\Programs\Registration.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, WordPerfect Office 1215 | Delete C:\WINDOWS\System32\Drivers\AliIde.sys | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\aliide, EventMessageFile
| C:\WINDOWS\System32\Drivers\CmdIde.sys | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\cmdide, EventMessageFile
| C:\WINDOWS\System32\Drivers\TosIde.sys | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\toside, EventMessageFile
| C:\WINDOWS\System32\Drivers\ViaIde.sys | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\viaide, EventMessageFile
| C:\WINDOWS\System32\Drivers\lbrtfdc.sys | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\lbrtfdc, EventMessageFile
| C:\WINDOWS\System32\hidserv.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\HidServ\Parameters, ServiceDll | Delete C:\WINDOWS\System32\igmpv2.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile
| C:\WINDOWS\System32\ipbootp.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile
| C:\WINDOWS\System32\iprip2.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile
| C:\WINDOWS\System32\ospf.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPF, EventMessageFile
| C:\WINDOWS\System32\ospfmib.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPFMib, EventMessageFile
| C:\WINDOWS\System32\polagent.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PolicyAgent, EventMessageFile
| C:\WINDOWS\System32\tssdis.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\TermServSessDir, EventMessageFile
| C:\WINDOWS\system32\KB905474\wgasetup.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\WgaSetup, EventMessageFile
| C:\WINDOWS\system32\MsSip1.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 1, $DLL | Delete C:\WINDOWS\system32\MsSip2.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 2, $DLL | Delete C:\WINDOWS\system32\MsSip3.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 3, $DLL | Delete C:\WINDOWS\system32\psxss.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
| C:\WINDOWS\system32\stisvc.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System, EventMessageFile
| kbd101.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver JPN | Delete kbd101a.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver KOR | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, .DEFAULT\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-19\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-20\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-18\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-21-2617700467-1337732287-186788590-1196\Control Panel\IOProcs, MVB | Delete vgafix.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon | Delete vgaoem.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon | Delete vgasys.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon | Delete Autoruns items detected - 800, recognized as trusted - 762
| | ||||||
| File name | Type | Description | Manufacturer | CLSID
| Elements detected - 9, recognized as trusted - 9
| | ||||||
| File name | Destination | Description | Manufacturer | CLSID
| Display Panning CPL Extension | {42071714-76d4-11d1-8b24-00a0c9068ff3} | Delete Shell extensions for file compression | {764BF0E1-F219-11ce-972D-00AA00A14F56} | Delete Encryption Context Menu | {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} | Delete Taskbar and Start Menu | {0DF44EAA-FF21-4412-828E-260A8728E7F1} | Delete User Accounts | {7A9D77BD-5403-11d2-8785-2E0420524153} | Delete C:\Program Files\Sonic\Sonic Solutions Product CD\RecordNow!\shlext.dll | Script: Quarantine, Delete, BC delete RecordNow! SendToExt | Shell Extensions | (c) Sonic Solutions. All rights reserved. | {DEE12703-6333-4D4E-8F34-738C4DCC2E04} | Delete C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll | Script: Quarantine, Delete, BC delete NeroDigitalIconHandler | {B327765E-D724-4347-8B16-78AE18552FC3} | Delete C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll | Script: Quarantine, Delete, BC delete NeroDigitalPropSheetHandler | {7F1CF152-04F8-453A-B34C-E609530A9DC8} | Delete C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll | Script: Quarantine, Delete, BC delete ColumnHandler | {7D4D6379-F301-4311-BEBA-E26EB0561882} | Delete Elements detected - 207, recognized as trusted - 198
| | |||||||||||||||||||||||||||
| File name | Type | Name | Description | Manufacturer
| C:\WINDOWS\system32\mrsplnt.dll | Script: Quarantine, Delete, BC delete Monitor | eCopy Desktop Port |
| Elements detected - 10, recognized as trusted - 9
| | |||||||
| File name | Job name | Job status | Description | Manufacturer
| C:\Program Files\NCH Software\Doxillion\doxillion.exe | Script: Quarantine, Delete, BC delete doxillionShakeIcon.job | The task is ready to run at its next scheduled time. | Doxillion Document Converter | NCH Software
| C:\Program Files\NCH Software\ExpressZip\expresszip.exe | Script: Quarantine, Delete, BC delete expresszipSevenDays.job | The task has not yet run. | Express Zip File Compression Software | NCH Software
| C:\Program Files\NCH Software\ExpressZip\expresszip.exe | Script: Quarantine, Delete, BC delete expresszipShakeIcon.job | The task has not yet run. | Express Zip File Compression Software | NCH Software
| Elements detected - 5, recognized as trusted - 2
| | ||||||
| Provider | Status | EXE file | Description | GUID
| Detected - 4, recognized as trusted - 4
| | ||||||
| Provider | EXE file | Description
| Detected - 11, recognized as trusted - 11
| | ||||||
| File name | Description | Manufacturer | CLSID | Source URL
| C:\WINDOWS\Downloaded Program Files\WinNTChk.dll | Script: Quarantine, Delete, BC delete WinNTChk Module | Copyright (C) 1998-2006 Trend Micro Incorporated. All rights reserved. | {00134F72-5284-44F7-95A8-52A619F70751} | Delete http://fs1.curriejohnson.com/officescan/console/ClientInstall/WinNTChk.cab
| C:\WINDOWS\Downloaded Program Files\OfficeScanSetup.dll | Script: Quarantine, Delete, BC delete OfficeScan Corp Edition Web-Deployment Setup Module | Copyright (C) 1998-2006 Trend Micro Incorporated. All rights reserved. | {08D75BC1-D2B5-11D1-88FC-0080C859833B} | Delete http://fs1.curriejohnson.com/officescan/console/ClientInstall/setup.cab
| {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} | Delete http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
| C:\WINDOWS\Downloaded Program Files\AtxEnc.dll | Script: Quarantine, Delete, BC delete AtxEnc Module | Copyright (C) 1998-2006 Trend Micro Incorporated. All rights reserved. | {9BBB3919-F518-4D06-8209-299FC243FC30} | Delete http://fs1.curriejohnson.com/SMB/console/html/root/AtxEnc.cab
| Elements detected - 11, recognized as trusted - 7
| | |||||||||
| File name | Description | Manufacturer
| Elements detected - 27, recognized as trusted - 27
| | ||||||
| File name | Description | Manufacturer | CLSID
| Elements detected - 14, recognized as trusted - 14
| | ||||||
| Hosts file record |
| File name | Type | Description | Manufacturer | CLSID
| Elements detected - 27, recognized as trusted - 27
| | ||||||
| File | Description | Type
| C:\WINDOWS\system32\DRIVERS\9585199drv.sys | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| \SystemRoot\system32\DRIVERS\9585199drv.sys | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| |
Main script of analysis Windows version: Microsoft Windows XP, Build=2600, SP="Service Pack 3" System Restore: enabled 1.1 Searching for user-mode API hooks Analysis: kernel32.dll, export table found in section .text IAT modification detected: CreateProcessA - 00B90010<>7C80236B IAT modification detected: GetModuleFileNameA - 00B90080<>7C80B56F IAT modification detected: FreeLibrary - 00B900F0<>7C80AC7E IAT modification detected: GetModuleFileNameW - 00B90160<>7C80B475 IAT modification detected: CreateProcessW - 00B901D0<>7C802336 IAT modification detected: LoadLibraryW - 00B902B0<>7C80AEEB IAT modification detected: LoadLibraryA - 00B90320<>7C801D7B IAT modification detected: GetProcAddress - 00B90390<>7C80AE40 Analysis: ntdll.dll, export table found in section .text Analysis: user32.dll, export table found in section .text Analysis: advapi32.dll, export table found in section .text Analysis: ws2_32.dll, export table found in section .text Analysis: wininet.dll, export table found in section .text Analysis: rasapi32.dll, export table found in section .text Analysis: urlmon.dll, export table found in section .text Analysis: netapi32.dll, export table found in section .text 1.2 Searching for kernel-mode API hooks Driver loaded successfully SDT found (RVA=0832A0) Kernel ntoskrnl.exe found in memory at address 804D7000 SDT = 8055A2A0 KiST = 804E26B8 (284) Function NtAdjustPrivilegesToken (0B) intercepted (8059B554->ED226690), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtClose (19) intercepted (80567AED->ED226F94), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtConnectPort (1F) intercepted (8059110B->ED227DC8), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateEvent (23) intercepted (80570022->ED228312), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateFile (25) intercepted (8056F864->ED227270), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateKey (29) intercepted (8057376F->ED225500), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateMutant (2B) intercepted (805775C8->ED2281F8), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateNamedPipeFile (2C) intercepted (80585619->ED22627E), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreatePort (2E) intercepted (805893C7->ED2280CC), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateProcess (2F) intercepted (805B1BEA->867ED160), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtCreateProcessEx (30) intercepted (8058124C->867ED420), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtCreateSection (32) intercepted (80565333->ED226426), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateSemaphore (33) intercepted (8057B80D->ED228432), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateSymbolicLinkObject (34) intercepted (805A0036->867EFC40), hook not defined >>> Function restored successfully ! >>> Hook code blocked Function NtCreateThread (35) intercepted (80578803->ED226C1C), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateWaitablePort (38) intercepted (805DB3E4->ED228162), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDebugActiveProcess (39) intercepted (8065BF7D->ED229B1A), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeleteKey (3F) intercepted (80597FFA->ED225B0A), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeleteValueKey (41) intercepted (80595C1A->ED225EBE), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeviceIoControlFile (42) intercepted (805795B9->ED2276F2), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDuplicateObject (44) intercepted (805748C2->ED22AD26), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtEnumerateKey (47) intercepted (80573E7D->ED22600A), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtEnumerateValueKey (49) intercepted (8057FB2B->ED2260A2), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtFsControlFile (54) intercepted (805770E0->ED227500), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtLoadDriver (61) intercepted (805A425D->ED229C0C), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtLoadKey (62) intercepted (805AF5C3->ED2254DC), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtLoadKey2 (63) intercepted (805AF400->ED2254EE), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtMapViewOfSection (6C) intercepted (8057AC99->ED22A374), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtNotifyChangeKey (6F) intercepted (80593FAA->ED2261CE), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenEvent (72) intercepted (8057FC98->ED2283A8), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenFile (74) intercepted (8056F7FF->ED227016), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenKey (77) intercepted (80568F68->ED2256C0), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenMutant (78) intercepted (80577676->ED228288), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenProcess (7A) intercepted (80574AA9->ED2268CC), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenSection (7D) intercepted (8056E467->ED22A10E), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenSemaphore (7E) intercepted (805DD9AC->ED2284C8), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenThread (80) intercepted (8059323B->ED2267BE), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueryKey (A0) intercepted (80573B86->ED22613A), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueryMultipleValueKey (A1) intercepted (8064F0A7->ED225D72), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQuerySection (A7) intercepted (8057EE6E->ED22A6AE), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueryValueKey (B1) intercepted (8056A419->ED22599C), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueueApcThread (B4) intercepted (8058F954->ED229FA0), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtRenameKey (C0) intercepted (8064F526->ED225C2C), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtReplaceKey (C1) intercepted (8064FE82->ED224F16), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtReplyPort (C2) intercepted (8057E67C->ED22882C), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtReplyWaitReceivePort (C3) intercepted (8056BC24->ED2286F2), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtRequestWaitReplyPort (C8) intercepted (8056DC86->ED2298B4), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtRestoreKey (CC) intercepted (8064FA19->ED22528E), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtResumeThread (CE) intercepted (80578E76->ED22ABC8), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSaveKey (CF) intercepted (8064FB1A->ED224EAE), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSecureConnectPort (D2) intercepted (80599040->ED227B0E), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetContextThread (D5) intercepted (8062E33F->ED226E38), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetInformationToken (E6) intercepted (805A8E5C->ED229154), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetSecurityObject (ED) intercepted (8059D2BD->ED229DAA), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetSystemInformation (F0) intercepted (805A8349->ED22A7FE), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetValueKey (F7) intercepted (8057BC5B->ED225816), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSuspendProcess (FD) intercepted (8062FF21->ED22A8F0), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSuspendThread (FE) intercepted (805E05AB->ED22AA2A), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSystemDebugControl (FF) intercepted (8064AA57->ED229A3E), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtTerminateProcess (101) intercepted (805839B9->ED226A68), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtTerminateThread (102) intercepted (80577F1F->ED2269C8), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtUnmapViewOfSection (10B) intercepted (8057A81E->ED22A552), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtWriteVirtualMemory (115) intercepted (8057F712->ED226B52), hook C:\WINDOWS\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function FsRtlCheckLockForReadAccess (80512959) - machine code modification Method of JmpTo. jmp ED218FD0 \SystemRoot\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! Function IoIsOperationSynchronous (804E876A) - machine code modification Method of JmpTo. jmp ED2193AC \SystemRoot\system32\DRIVERS\9585199drv.sys, driver recognized as trusted >>> Function restored successfully ! Functions checked: 284, intercepted: 63, restored: 65 1.3 Checking IDT and SYSENTER Analysis for CPU 1 CmpCallCallBacks = 0013AD62 Disable callback OK Checking IDT and SYSENTER - complete 1.4 Searching for masking processes and drivers Checking not performed: extended monitoring driver (AVZPM) is not installed 1.5 Checking of IRP handlers Driver loaded successfully Checking - complete >> Services: potentially dangerous service allowed: RemoteRegistry (Remote Registry) >> Services: potentially dangerous service allowed: TermService (Terminal Services) >> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery Service) >> Services: potentially dangerous service allowed: TlntSvr (Telnet) >> Services: potentially dangerous service allowed: Schedule (Task Scheduler) >> Services: potentially dangerous service allowed: mnmsrvc (NetMeeting Remote Desktop Sharing) >> Services: potentially dangerous service allowed: RDSessMgr (Remote Desktop Help Session Manager) > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)! >> Security: disk drives' autorun is enabled >> Security: administrative shares (C$, D$ ...) are enabled >> Security: anonymous user access is enabled >> Security: sending Remote Assistant queries is enabled >> Disable HDD autorun >> Disable autorun from network drives >> Disable CD/DVD autorun >> Disable removable media autorun >> Windows Explorer - show extensions of known file types System Analysis in progressAdd commands to script:
System Analysis - complete
Script commands