Results of system analysis Kaspersky Virus Removal Tool 11.0.0.1245 (database released 22/04/2012; 14:59) List of processes File name PID Description Copyright MD5 Information Detected:16, recognized as trusted 16 Module name Handle Description Copyright MD5 Used by processes Modules detected:279, recognized as trusted 279 Kernel Space Modules Viewer Module Base address Size in memory Description Manufacturer C:\WINDOWS\System32\Drivers\dump_atapi.sys Script: Quarantine, Delete, BC delete F9516000 018000 (98304) C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Script: Quarantine, Delete, BC delete F9F94000 002000 (8192) Modules detected - 87, recognized as trusted - 85 Services Service Description Status File Group Dependencies !SASCORE Service: Stop, Delete, Disable, BC delete SAS Core Service Not started C:\Program Files\SUPERAntiSpyware\SASCORE.EXE Script: Quarantine, Delete, BC delete gusvc Service: Stop, Delete, Disable, BC delete Google Software Updater Not started C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe Script: Quarantine, Delete, BC delete RPCSS Detected - 92, recognized as trusted - 90 Drivers Service Description Status File Group Dependencies Abiosdsk Driver: Unload, Delete, Disable, BC delete Abiosdsk Not started Abiosdsk.sys Script: Quarantine, Delete, BC delete Primary disk abp480n5 Driver: Unload, Delete, Disable, BC delete abp480n5 Not started abp480n5.sys Script: Quarantine, Delete, BC delete SCSI miniport adpu160m Driver: Unload, Delete, Disable, BC delete adpu160m Not started adpu160m.sys Script: Quarantine, Delete, BC delete SCSI miniport Aha154x Driver: Unload, Delete, Disable, BC delete Aha154x Not started Aha154x.sys Script: Quarantine, Delete, BC delete SCSI miniport aic78u2 Driver: Unload, Delete, Disable, BC delete aic78u2 Not started aic78u2.sys Script: Quarantine, Delete, BC delete SCSI miniport aic78xx Driver: Unload, Delete, Disable, BC delete aic78xx Not started aic78xx.sys Script: Quarantine, Delete, BC delete SCSI miniport AliIde Driver: Unload, Delete, Disable, BC delete AliIde Not started AliIde.sys Script: Quarantine, Delete, BC delete System Bus Extender amsint Driver: Unload, Delete, Disable, BC delete amsint Not started amsint.sys Script: Quarantine, Delete, BC delete SCSI miniport asc Driver: Unload, Delete, Disable, BC delete asc Not started asc.sys Script: Quarantine, Delete, BC delete SCSI miniport asc3350p Driver: Unload, Delete, Disable, BC delete asc3350p Not started asc3350p.sys Script: Quarantine, Delete, BC delete SCSI miniport asc3550 Driver: Unload, Delete, Disable, BC delete asc3550 Not started asc3550.sys Script: Quarantine, Delete, BC delete SCSI miniport Atdisk Driver: Unload, Delete, Disable, BC delete Atdisk Not started Atdisk.sys Script: Quarantine, Delete, BC delete Primary disk cd20xrnt Driver: Unload, Delete, Disable, BC delete cd20xrnt Not started cd20xrnt.sys Script: Quarantine, Delete, BC delete SCSI miniport Changer Driver: Unload, Delete, Disable, BC delete Changer Not started Changer.sys Script: Quarantine, Delete, BC delete Filter CmdIde Driver: Unload, Delete, Disable, BC delete CmdIde Not started CmdIde.sys Script: Quarantine, Delete, BC delete System Bus Extender Cpqarray Driver: Unload, Delete, Disable, BC delete Cpqarray Not started Cpqarray.sys Script: Quarantine, Delete, BC delete SCSI miniport dac960nt Driver: Unload, Delete, Disable, BC delete dac960nt Not started dac960nt.sys Script: Quarantine, Delete, BC delete SCSI miniport dpti2o Driver: Unload, Delete, Disable, BC delete dpti2o Not started dpti2o.sys Script: Quarantine, Delete, BC delete SCSI miniport hpn Driver: Unload, Delete, Disable, BC delete hpn Not started hpn.sys Script: Quarantine, Delete, BC delete SCSI miniport hpt3xx Driver: Unload, Delete, Disable, BC delete hpt3xx Not started hpt3xx.sys Script: Quarantine, Delete, BC delete SCSI miniport i2omgmt Driver: Unload, Delete, Disable, BC delete i2omgmt Not started i2omgmt.sys Script: Quarantine, Delete, BC delete SCSI Class i2omp Driver: Unload, Delete, Disable, BC delete i2omp Not started i2omp.sys Script: Quarantine, Delete, BC delete SCSI miniport ini910u Driver: Unload, Delete, Disable, BC delete ini910u Not started ini910u.sys Script: Quarantine, Delete, BC delete SCSI miniport lbrtfdc Driver: Unload, Delete, Disable, BC delete lbrtfdc Not started lbrtfdc.sys Script: Quarantine, Delete, BC delete System Bus Extender mraid35x Driver: Unload, Delete, Disable, BC delete mraid35x Not started mraid35x.sys Script: Quarantine, Delete, BC delete SCSI miniport PCIDump Driver: Unload, Delete, Disable, BC delete PCIDump Not started PCIDump.sys Script: Quarantine, Delete, BC delete PCI Configuration PCIIde Driver: Unload, Delete, Disable, BC delete PCIIde Not started PCIIde.sys Script: Quarantine, Delete, BC delete System Bus Extender PDCOMP Driver: Unload, Delete, Disable, BC delete PDCOMP Not started PDCOMP.sys Script: Quarantine, Delete, BC delete PDFRAME Driver: Unload, Delete, Disable, BC delete PDFRAME Not started PDFRAME.sys Script: Quarantine, Delete, BC delete PDRELI Driver: Unload, Delete, Disable, BC delete PDRELI Not started PDRELI.sys Script: Quarantine, Delete, BC delete PDRFRAME Driver: Unload, Delete, Disable, BC delete PDRFRAME Not started PDRFRAME.sys Script: Quarantine, Delete, BC delete perc2 Driver: Unload, Delete, Disable, BC delete perc2 Not started perc2.sys Script: Quarantine, Delete, BC delete SCSI miniport perc2hib Driver: Unload, Delete, Disable, BC delete perc2hib Not started perc2hib.sys Script: Quarantine, Delete, BC delete Filter ql1080 Driver: Unload, Delete, Disable, BC delete ql1080 Not started ql1080.sys Script: Quarantine, Delete, BC delete SCSI miniport Ql10wnt Driver: Unload, Delete, Disable, BC delete Ql10wnt Not started Ql10wnt.sys Script: Quarantine, Delete, BC delete SCSI miniport ql12160 Driver: Unload, Delete, Disable, BC delete ql12160 Not started ql12160.sys Script: Quarantine, Delete, BC delete SCSI miniport ql1240 Driver: Unload, Delete, Disable, BC delete ql1240 Not started ql1240.sys Script: Quarantine, Delete, BC delete SCSI miniport ql1280 Driver: Unload, Delete, Disable, BC delete ql1280 Not started ql1280.sys Script: Quarantine, Delete, BC delete SCSI miniport Simbad Driver: Unload, Delete, Disable, BC delete Simbad Not started Simbad.sys Script: Quarantine, Delete, BC delete Filter Sparrow Driver: Unload, Delete, Disable, BC delete Sparrow Not started Sparrow.sys Script: Quarantine, Delete, BC delete SCSI miniport sym_hi Driver: Unload, Delete, Disable, BC delete sym_hi Not started sym_hi.sys Script: Quarantine, Delete, BC delete SCSI miniport sym_u3 Driver: Unload, Delete, Disable, BC delete sym_u3 Not started sym_u3.sys Script: Quarantine, Delete, BC delete SCSI miniport symc810 Driver: Unload, Delete, Disable, BC delete symc810 Not started symc810.sys Script: Quarantine, Delete, BC delete SCSI miniport symc8xx Driver: Unload, Delete, Disable, BC delete symc8xx Not started symc8xx.sys Script: Quarantine, Delete, BC delete SCSI miniport TosIde Driver: Unload, Delete, Disable, BC delete TosIde Not started TosIde.sys Script: Quarantine, Delete, BC delete System Bus Extender ultra Driver: Unload, Delete, Disable, BC delete ultra Not started ultra.sys Script: Quarantine, Delete, BC delete SCSI miniport ViaIde Driver: Unload, Delete, Disable, BC delete ViaIde Not started ViaIde.sys Script: Quarantine, Delete, BC delete System Bus Extender WDICA Driver: Unload, Delete, Disable, BC delete WDICA Not started WDICA.sys Script: Quarantine, Delete, BC delete Detected - 177, recognized as trusted - 129 Autoruns File name Status Startup method Description C:\Documents and Settings\Brandon Zoladz\Local Settings\Temp\_uninst_.bat Script: Quarantine, Delete, BC delete Active Shortcut in Autoruns folder C:\Documents and Settings\Brandon Zoladz\Start Menu\Programs\Startup\, C:\Documents and Settings\Brandon Zoladz\Start Menu\Programs\Startup\_uninst_.lnk, C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\HotFixInstaller, EventMessageFile C:\Program Files\Common Files\MSSoap\Binaries\MSSOAP30.dll Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\MSSOAP, EventMessageFile C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\.NET Runtime 2.0 Error Reporting, EventMessageFile C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft (R) Visual C# 2005 Compiler, EventMessageFile C:\WINDOWS\System32\Drivers\AliIde.sys Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\aliide, EventMessageFile C:\WINDOWS\System32\Drivers\CmdIde.sys Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\cmdide, EventMessageFile C:\WINDOWS\System32\Drivers\PciIde.sys Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\pciide, EventMessageFile C:\WINDOWS\System32\Drivers\TosIde.sys Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\toside, EventMessageFile C:\WINDOWS\System32\Drivers\ViaIde.sys Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\viaide, EventMessageFile C:\WINDOWS\System32\Drivers\lbrtfdc.sys Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\lbrtfdc, EventMessageFile C:\WINDOWS\System32\PrintFilterPipelineSvc.exe Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PrintFilterPipelineSvc, EventMessageFile C:\WINDOWS\System32\appmgmts.dll Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters, ServiceDll Delete C:\WINDOWS\System32\appmgmts.dll Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Application Management, EventMessageFile C:\WINDOWS\System32\appmgr.dll Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Software Installation, EventMessageFile C:\WINDOWS\System32\fdeploy.dll Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\File Deployment, EventMessageFile C:\WINDOWS\System32\fdeploy.dll Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Folder Redirection, EventMessageFile C:\WINDOWS\System32\hidserv.dll Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\HidServ\Parameters, ServiceDll Delete C:\WINDOWS\System32\igmpv2.dll Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile C:\WINDOWS\System32\ipbootp.dll Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile C:\WINDOWS\System32\iprip2.dll Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile C:\WINDOWS\System32\ntbackup.exe Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\ntbackup, EventMessageFile C:\WINDOWS\System32\ospf.dll Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPF, EventMessageFile C:\WINDOWS\System32\ospfmib.dll Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPFMib, EventMessageFile C:\WINDOWS\System32\polagent.dll Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PolicyAgent, EventMessageFile C:\WINDOWS\System32\tssdis.exe Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\TermServSessDir, EventMessageFile C:\WINDOWS\System32\xsp2res.dll Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Print, EventMessageFile C:\WINDOWS\system32\MsSip1.dll Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 1, $DLL Delete C:\WINDOWS\system32\MsSip2.dll Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 2, $DLL Delete C:\WINDOWS\system32\MsSip3.dll Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 3, $DLL Delete C:\WINDOWS\system32\asr_fmt.exe Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR format utility for volumes Delete C:\WINDOWS\system32\asr_ldm.exe Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR utility for Logical Disk Manager Delete C:\WINDOWS\system32\asr_pfu.exe Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR protected file utility Delete C:\WINDOWS\system32\psxss.exe Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix C:\WINDOWS\system32\stisvc.exe Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System, EventMessageFile appmgmts.dll Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}, DLLName Delete deskpan.dll Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {42071714-76d4-11d1-8b24-00a0c9068ff3} Delete kbd101.dll Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver JPN Delete kbd101a.dll Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver KOR Delete mvfs32.dll Script: Quarantine, Delete, BC delete Active Registry key HKEY_USERS, .DEFAULT\Control Panel\IOProcs, MVB Delete mvfs32.dll Script: Quarantine, Delete, BC delete Active Registry key HKEY_USERS, S-1-5-19\Control Panel\IOProcs, MVB Delete mvfs32.dll Script: Quarantine, Delete, BC delete Active Registry key HKEY_USERS, S-1-5-20\Control Panel\IOProcs, MVB Delete mvfs32.dll Script: Quarantine, Delete, BC delete Active Registry key HKEY_USERS, S-1-5-18\Control Panel\IOProcs, MVB Delete mvfs32.dll Script: Quarantine, Delete, BC delete Active Registry key HKEY_USERS, S-1-5-21-515967899-1614895754-725345543-1004\Control Panel\IOProcs, MVB Delete vgafix.fon Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon Delete vgaoem.fon Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon Delete vgasys.fon Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon Delete Autoruns items detected - 776, recognized as trusted - 729 Microsoft Internet Explorer extension modules (BHOs, Toolbars ...) File name Type Description Manufacturer CLSID BHO {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} Delete C:\Program Files\Common Files\doubleTwist\IEPodcastPlugin.dll Script: Quarantine, Delete, BC delete BHO {65134FDF-F8A5-4B3D-91D9-CDF273CFD578} Delete C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll Script: Quarantine, Delete, BC delete BHO {AA58ED58-01DD-4d91-8333-CF10577473F7} Delete C:\Program Files\AIM Toolbar\aimtb.dll Script: Quarantine, Delete, BC delete BHO {b0cda128-b425-4eef-a174-61a11ac5dbf8} Delete C:\Program Files\AIM Toolbar\aimtb.dll Script: Quarantine, Delete, BC delete Toolbar {61539ecd-cc67-4437-a03c-9aaccbd14326} Delete C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll Script: Quarantine, Delete, BC delete Toolbar {2318C2B1-4965-11d4-9B18-009027A5CD4F} Delete Extension module {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} Delete Extension module {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} Delete Explorer Bar {32683183-48a0-441b-a342-7c2a440a9478} Delete Elements detected - 18, recognized as trusted - 9 Windows Explorer extension modules File name Destination Description Manufacturer CLSID deskpan.dll Script: Quarantine, Delete, BC delete Display Panning CPL Extension {42071714-76d4-11d1-8b24-00a0c9068ff3} Delete Shell extensions for file compression {764BF0E1-F219-11ce-972D-00AA00A14F56} Delete Encryption Context Menu {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} Delete Taskbar and Start Menu {0DF44EAA-FF21-4412-828E-260A8728E7F1} Delete Media Band {32683183-48a0-441b-a342-7c2a440a9478} Delete User Accounts {7A9D77BD-5403-11d2-8785-2E0420524153} Delete IE User Assist {FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} Delete Elements detected - 205, recognized as trusted - 198 Printing system extensions (print monitors, providers) File name Type Name Description Manufacturer Elements detected - 8, recognized as trusted - 8 Task Scheduler jobs File name Job name Job status Description Manufacturer C:\Program Files\Apple Software Update\SoftwareUpdate.exe Script: Quarantine, Delete, BC delete AppleSoftwareUpdate.job The task has not yet run. C:\Documents and Settings\Brandon Zoladz\Local Settings\Application Data\Google\Update\GoogleUpdate.exe Script: Quarantine, Delete, BC delete GoogleUpdateTaskUserS-1-5-21-515967899-1614895754-725345543-1004Core.job The task is ready to run at its next scheduled time. C:\Documents and Settings\Brandon Zoladz\Local Settings\Application Data\Google\Update\GoogleUpdate.exe Script: Quarantine, Delete, BC delete GoogleUpdateTaskUserS-1-5-21-515967899-1614895754-725345543-1004UA.job The task is ready to run at its next scheduled time. Elements detected - 6, recognized as trusted - 3 SPI/LSP settings Namespace providers (NSP) Provider Status EXE file Description GUID Detected - 4, recognized as trusted - 4 Transport protocol providers (TSP, LSP) Provider EXE file Description Detected - 13, recognized as trusted - 13 Results of automatic SPI settings check LSP settings checked. No errors detected TCP/UDP ports Port Status Remote Host Remote Port Application Notes TCP ports 135 LISTENING 0.0.0.0 63667 [692] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate 139 LISTENING 0.0.0.0 30844 [4] System Script: Quarantine, Delete, BC delete, Terminate 445 LISTENING 0.0.0.0 4243 [4] System Script: Quarantine, Delete, BC delete, Terminate 1037 ESTABLISHED 127.0.0.1 1038 [148] c:\program files\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate 1038 ESTABLISHED 127.0.0.1 1037 [148] c:\program files\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate UDP ports 137 LISTENING -- -- [4] System Script: Quarantine, Delete, BC delete, Terminate 138 LISTENING -- -- [4] System Script: Quarantine, Delete, BC delete, Terminate 445 LISTENING -- -- [4] System Script: Quarantine, Delete, BC delete, Terminate Downloaded Program Files (DPF) File name Description Manufacturer CLSID Source URL Microsoft XML Parser for Java Delete file://C:\WINDOWS\Java\classes\xmldso.cab {E2883E8F-472F-4FB0-9522-AC9BF37916A7} Delete http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Elements detected - 5, recognized as trusted - 3 Control Panel Applets (CPL) File name Description Manufacturer Elements detected - 26, recognized as trusted - 26 Active Setup File name Description Manufacturer CLSID C:\WINDOWS\system32\regsvr32.exe Script: Quarantine, Delete, BC delete {2C7339CF-2B09-4501-B3F3-F3508C9228ED} Delete C:\WINDOWS\system32\regsvr32.exe Script: Quarantine, Delete, BC delete {89820200-ECBD-11cf-8B85-00AA005B4340} Delete Elements detected - 15, recognized as trusted - 13 HOSTS file Hosts file record яю1 Clear Hosts file Protocols and handlers File name Type Description Manufacturer CLSID mscoree.dll Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D} Delete mscoree.dll Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D} Delete mscoree.dll Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D} Delete Elements detected - 29, recognized as trusted - 26 Suspicious objects File Description Type Main script of analysis Windows version: Microsoft Windows XP, Build=2600, SP="Service Pack 2" System Restore: enabled System booted in Safe Mode with Networking 1.1 Searching for user-mode API hooks Analysis: kernel32.dll, export table found in section .text IAT modification detected: CreateProcessA - 00AE0010<>7C802367 IAT modification detected: GetModuleFileNameA - 00AE0080<>7C80B4DF IAT modification detected: FreeLibrary - 00AE00F0<>7C80ABEE IAT modification detected: GetModuleFileNameW - 00AE0160<>7C80B3E5 IAT modification detected: CreateProcessW - 00AE01D0<>7C802332 IAT modification detected: LoadLibraryW - 00AE02B0<>7C80AE5B IAT modification detected: LoadLibraryA - 00AE0320<>7C801D77 IAT modification detected: GetProcAddress - 00AE0390<>7C80ADB0 Analysis: ntdll.dll, export table found in section .text Analysis: user32.dll, export table found in section .text Analysis: advapi32.dll, export table found in section .text Analysis: ws2_32.dll, export table found in section .text Analysis: wininet.dll, export table found in section .text Analysis: rasapi32.dll, export table found in section .text Analysis: urlmon.dll, export table found in section .text Analysis: netapi32.dll, export table found in section .text 1.2 Searching for kernel-mode API hooks Driver loaded successfully Driver communication failure [00000002] - [1] 1.4 Searching for masking processes and drivers Checking not performed: extended monitoring driver (AVZPM) is not installed 1.5 Checking of IRP handlers Driver loaded successfully Driver communication failure [00000002] - [1] >> Services: potentially dangerous service allowed: TermService (Terminal Services) >> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery Service) >> Services: potentially dangerous service allowed: TlntSvr () >> Services: potentially dangerous service allowed: Schedule (Task Scheduler) >> Services: potentially dangerous service allowed: mnmsrvc (NetMeeting Remote Desktop Sharing) >> Services: potentially dangerous service allowed: RDSessMgr (Remote Desktop Help Session Manager) > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)! >> Security: disk drives' autorun is enabled >> Security: administrative shares (C$, D$ ...) are enabled >> Security: anonymous user access is enabled >> Security: sending Remote Assistant queries is enabled >> Disable HDD autorun >> Disable autorun from network drives >> Disable CD/DVD autorun >> Disable removable media autorun >> Windows Explorer - show extensions of known file types System Analysis in progress System Analysis - complete Script commands Add commands to script: Blocking hooks using Anti-Rootkit Enable AVZGuard Operations with AVZPM (true=enable,false=disable) BootCleaner - import list of deleted files BootCleaner - import all Registry cleanup after deleting files ExecuteWizard ('TSW',2,3,true) - Running Troubleshooting wizard BootCleaner - activate Reboot Insert template for QuarantineFile() - quarantining file Insert template for BC_QrFile() - quarantining file via BootCleaner Insert template for DeleteFile() - deleting file Insert template for DelCLSID() - deleting CLSID item from registry Additional operations: Performance tweaking: disable service TermService (Terminal Services) Performance tweaking: disable service SSDPSRV (SSDP Discovery Service) Performance tweaking: disable service TlntSvr () Performance tweaking: disable service Schedule (Task Scheduler) Performance tweaking: disable service mnmsrvc (NetMeeting Remote Desktop Sharing) Performance tweaking: disable service RDSessMgr (Remote Desktop Help Session Manager) Security tweaking: disable CD autorun Security tweaking: disable administrative shares Security tweaking: disable anonymous user access Security: disable sending Remote Assistant queries File list