Kaspersky Virus Removal Tool 11.0.0.1245 (database released 19/05/2012; 14:36)
| File name | PID | Description | Copyright | MD5 | Information
| c:\archivos de programa\avast software\avast\avastsvc.exe | Script: Quarantine, Delete, BC delete, Terminate 1948 | avast! Service | Copyright (c) 2012 AVAST Software | ?? | 43.72 kb, rsAh, | created: 10.04.2012 11:09:41, modified: 06.03.2012 18:15:14 Command line: "C:\Archivos de programa\AVAST Software\Avast\AvastSvc.exe" Detected:42, recognized as trusted 42
| | |||||
| Module name | Handle | Description | Copyright | MD5 | Used by processes
| C:\Archivos de programa\AVAST Software\Avast\defs\12052100\algo.dll | Script: Quarantine, Delete, BC delete 1665138688 | | | -- | 1948
| C:\Archivos de programa\AVAST Software\Avast\defs\12052101\algo.dll | Script: Quarantine, Delete, BC delete 193265664 | | | -- | 1948
| Modules detected:527, recognized as trusted 525
| | |||||
| Module | Base address | Size in memory | Description | Manufacturer
| 45112864.sys | Script: Quarantine, Delete, BC delete B82DE000 | 522000 (5382144) |
| C:\WINDOWS\System32\Drivers\dump_nvatabus.sys | Script: Quarantine, Delete, BC delete AF079000 | 017000 (94208) |
| C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS | Script: Quarantine, Delete, BC delete B2537000 | 002000 (8192) |
| C:\WINDOWS\system32\drivers\ScFBPNT2.SYS | Script: Quarantine, Delete, BC delete ADB30000 | 003000 (12288) |
| C:\WINDOWS\system32\TUKERNEL.EXE | Script: Quarantine, Delete, BC delete 804D7000 | 24D000 (2412544) | Sistema y núcleo de Windows NT | Copyright (C) Microsoft Corporation. Reservados todos los derechos.
| Modules detected - 144, recognized as trusted - 139
| | ||||||||
| Service | Description | Status | File | Group | Dependencies
| McMPFSvc | Service: Stop, Delete, Disable, BC delete McAfee Personal Firewall Service | Not started | C:\Archivos de programa\Archivos comunes\Mcafee\McSvcHost\McSvHost.exe | Script: Quarantine, Delete, BC delete | RpcSs
| Detected - 99, recognized as trusted - 98
| | ||||||
| File name | Status | Startup method | Description
| C:\Documents and Settings\All Users.WINDOWS\Datos de programa\TuneUp Software\TuneUp Utilities 2012\WinStyler\tu_logonui.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon, UIHost
| C:\Documents and Settings\Casita\Configuración local\temp\_uninst_57855747.bat | Script: Quarantine, Delete, BC delete Active | Shortcut in Autoruns folder | C:\Documents and Settings\Casita\Menú Inicio\Programas\Inicio\, C:\Documents and Settings\Casita\Menú Inicio\Programas\Inicio\_uninst_57855747.lnk,
| C:\Documents and Settings\Casita\Configuración local\temp\_uninst_97295664.bat | Script: Quarantine, Delete, BC delete Active | Shortcut in Autoruns folder | C:\Documents and Settings\Casita\Menú Inicio\Programas\Inicio\, C:\Documents and Settings\Casita\Menú Inicio\Programas\Inicio\_uninst_97295664.lnk,
| C:\WINDOWS\System32\Drivers\AliIde.sys | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\aliide, EventMessageFile
| C:\WINDOWS\System32\Drivers\CmdIde.sys | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\cmdide, EventMessageFile
| C:\WINDOWS\System32\Drivers\IntelIde.sys | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\intelide, EventMessageFile
| C:\WINDOWS\System32\Drivers\TosIde.sys | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\toside, EventMessageFile
| C:\WINDOWS\System32\Drivers\ViaIde.sys | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\viaide, EventMessageFile
| C:\WINDOWS\System32\Drivers\lbrtfdc.sys | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\lbrtfdc, EventMessageFile
| C:\WINDOWS\System32\PrintFilterPipelineSvc.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PrintFilterPipelineSvc, EventMessageFile
| C:\WINDOWS\System32\hidserv.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\HidServ\Parameters, ServiceDll | Delete C:\WINDOWS\System32\igmpv2.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile
| C:\WINDOWS\System32\ipbootp.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile
| C:\WINDOWS\System32\iprip2.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile
| C:\WINDOWS\System32\ospf.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPF, EventMessageFile
| C:\WINDOWS\System32\ospfmib.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPFMib, EventMessageFile
| C:\WINDOWS\System32\polagent.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PolicyAgent, EventMessageFile
| C:\WINDOWS\System32\tssdis.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\TermServSessDir, EventMessageFile
| C:\WINDOWS\system32\MsSip1.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 1, $DLL | Delete C:\WINDOWS\system32\MsSip2.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 2, $DLL | Delete C:\WINDOWS\system32\MsSip3.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 3, $DLL | Delete C:\WINDOWS\system32\psxss.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
| C:\WINDOWS\system32\stisvc.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System, EventMessageFile
| deskpan.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {42071714-76d4-11d1-8b24-00a0c9068ff3} | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, .DEFAULT\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-19\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-20\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-21-602162358-1563985344-839522115-1004\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-18\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-21-602162358-1563985344-839522115-1003\Control Panel\IOProcs, MVB | Delete vgafix.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon | Delete vgaoem.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon | Delete vgasys.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon | Delete Autoruns items detected - 823, recognized as trusted - 790
| | ||||||
| File name | Type | Description | Manufacturer | CLSID
| Elements detected - 10, recognized as trusted - 10
| | ||||||
| File name | Destination | Description | Manufacturer | CLSID
| deskpan.dll | Script: Quarantine, Delete, BC delete Extensión de paneo de pantalla del Panel de control | {42071714-76d4-11d1-8b24-00a0c9068ff3} | Delete Extensiones del shell para compresión de archivos | {764BF0E1-F219-11ce-972D-00AA00A14F56} | Delete Menú de contexto de cifrado | {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} | Delete Barra de tareas y menú Inicio | {0DF44EAA-FF21-4412-828E-260A8728E7F1} | Delete Cuentas de usuario | {7A9D77BD-5403-11d2-8785-2E0420524153} | Delete IE User Assist | {FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} | Delete "C:\Archivos de programa\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll" | Script: Quarantine, Delete, BC delete ColumnHandler | {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} | Delete Elements detected - 222, recognized as trusted - 215
| | |||||||||||||||||||||||||
| File name | Type | Name | Description | Manufacturer
| Elements detected - 9, recognized as trusted - 9
| | ||||||
| File name | Job name | Job status | Description | Manufacturer
| Elements detected - 2, recognized as trusted - 2
| | ||||||
| Provider | Status | EXE file | Description | GUID
| Detected - 4, recognized as trusted - 4
| | ||||||
| Provider | EXE file | Description
| Detected - 14, recognized as trusted - 14
| | ||||||
| File name | Description | Manufacturer | CLSID | Source URL
| Elements detected - 3, recognized as trusted - 3
| | ||||||
| File name | Description | Manufacturer
| Elements detected - 29, recognized as trusted - 29
| | ||||||
| File name | Description | Manufacturer | CLSID
| Elements detected - 15, recognized as trusted - 15
| | ||||||
Hosts file record
|
| File name | Type | Description | Manufacturer | CLSID
| mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D} | Delete mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D} | Delete mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D} | Delete Elements detected - 32, recognized as trusted - 29
| | ||||||
| File | Description | Type
| C:\WINDOWS\System32\Drivers\aswSnx.SYS | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| C:\WINDOWS\system32\DRIVERS\8644589drv.sys | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| C:\WINDOWS\System32\Drivers\aswSP.SYS | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| \SystemRoot\System32\Drivers\aswSP.SYS | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| \SystemRoot\system32\DRIVERS\8644589drv.sys | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| |
Main script of analysis Windows version: Microsoft Windows XP, Build=2600, SP="Service Pack 2" System Restore: enabled 1.1 Searching for user-mode API hooks Analysis: kernel32.dll, export table found in section .text IAT modification detected: CreateProcessA - 00D80010<>7C802367 IAT modification detected: GetModuleFileNameA - 00D80080<>7C80B357 IAT modification detected: FreeLibrary - 00D800F0<>7C80AA66 IAT modification detected: GetModuleFileNameW - 00D80160<>7C80B25D IAT modification detected: CreateProcessW - 00D801D0<>7C802332 IAT modification detected: LoadLibraryW - 00D802B0<>7C80ACD3 IAT modification detected: LoadLibraryA - 00D80320<>7C801D77 IAT modification detected: GetProcAddress - 00D80390<>7C80AC28 Analysis: ntdll.dll, export table found in section .text Function ntdll.dll:LdrLoadDll (70) intercepted, method APICodeHijack.JmpTo[001501EE] Function ntdll.dll:LdrUnloadDll (80) intercepted, method APICodeHijack.JmpTo[001503F2] Analysis: user32.dll, export table found in section .text Function user32.dll:SetWinEventHook (639) intercepted, method APICodeHijack.JmpTo[004801EE] Function user32.dll:SetWindowsHookExA (651) intercepted, method APICodeHijack.JmpTo[004805F6] Function user32.dll:SetWindowsHookExW (652) intercepted, method APICodeHijack.JmpTo[004807FA] Function user32.dll:UnhookWinEvent (685) intercepted, method APICodeHijack.JmpTo[004803F2] Function user32.dll:UnhookWindowsHookEx (687) intercepted, method APICodeHijack.JmpTo[004809FE] Analysis: advapi32.dll, export table found in section .text Function advapi32.dll:ChangeServiceConfig2A (54) intercepted, method APICodeHijack.JmpTo[00470C02] Function advapi32.dll:ChangeServiceConfig2W (55) intercepted, method APICodeHijack.JmpTo[00470E06] Function advapi32.dll:ChangeServiceConfigA (56) intercepted, method APICodeHijack.JmpTo[004707FA] Function advapi32.dll:ChangeServiceConfigW (57) intercepted, method APICodeHijack.JmpTo[004709FE] Function advapi32.dll:CreateServiceA (102) intercepted, method APICodeHijack.JmpTo[004701EE] Function advapi32.dll:CreateServiceW (103) intercepted, method APICodeHijack.JmpTo[004703F2] Function advapi32.dll:DeleteService (177) intercepted, method APICodeHijack.JmpTo[004705F6] Function advapi32.dll:SetServiceObjectSecurity (570) intercepted, method APICodeHijack.JmpTo[0047100A] Analysis: ws2_32.dll, export table found in section .text Analysis: wininet.dll, export table found in section .text Analysis: rasapi32.dll, export table found in section .text Analysis: urlmon.dll, export table found in section .text Analysis: netapi32.dll, export table found in section .text 1.2 Searching for kernel-mode API hooks Driver loaded successfully SDT found (RVA=08C500) Kernel TUKERNEL.EXE found in memory at address 804D7000 SDT = 80563500 KiST = 804E4F40 (284) Function NtAddBootEntry (09) intercepted (8065038B->AF114DF8), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtAdjustPrivilegesToken (0B) intercepted (80592B77->AD574690), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtAllocateVirtualMemory (11) intercepted (80572068->AF1A1A5A), hook C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtAssignProcessToJobObject (13) intercepted (805AA365->AF11585E), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtClose (19) intercepted (80570D29->AD574F94), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtConnectPort (1F) intercepted (805951B9->AD575DC8), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateEvent (23) intercepted (80577565->AD576312), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateEventPair (24) intercepted (80650480->AF11A330), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateFile (25) intercepted (8057F5A5->AD575270), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateIoCompletion (26) intercepted (805E6E3E->AF11A422), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateKey (29) intercepted (80579528->AD573500), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateMutant (2B) intercepted (8057DDCF->AD5761F8), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateNamedPipeFile (2C) intercepted (8058EF9E->AD57427E), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreatePort (2E) intercepted (805E5546->AD5760CC), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateProcessEx (30) - machine code modification Method of JmpTo. jmp AF1B7D96\SystemRoot\System32\Drivers\aswSP.SYS, driver recognized as trusted >>> Function restored successfully ! Function NtCreateSection (32) intercepted (8056EE25->AD574426), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateSemaphore (33) intercepted (80581EA4->AD576432), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateThread (35) intercepted (80586CE6->AD574C1C), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateTimer (36) intercepted (805E14D9->AF11A3DC), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateWaitablePort (38) intercepted (805AEB55->AD576162), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDebugActiveProcess (39) intercepted (80662170->AD577B1A), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeleteBootEntry (3D) intercepted (8064FE17->AF114E44), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeleteKey (3F) intercepted (8059C6B6->AD573B0A), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeleteValueKey (41) intercepted (8059B19A->AD573EBE), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeviceIoControlFile (42) intercepted (8058EC99->AD5756F2), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDuplicateObject (44) intercepted (805817D4->AD578D26), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtEnumerateKey (47) intercepted (8057A69E->AD57400A), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtEnumerateValueKey (49) intercepted (80590C93->AD5740A2), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtFreeVirtualMemory (53) intercepted (80572703->AF1A1B34), hook C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtFsControlFile (54) intercepted (80582D0A->AD575500), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtLoadDriver (61) intercepted (805AD35E->AD577C0C), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtLoadKey (62) intercepted (805D2BEC->AD5734DC), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtLoadKey2 (63) intercepted (805D2A3A->AD5734EE), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtMapViewOfSection (6C) intercepted (80580916->AD578374), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtModifyBootEntry (6D) intercepted (8064FE17->AF114E90), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtNotifyChangeKey (6F) intercepted (80598444->AD5741CE), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtNotifyChangeMultipleKeys (70) intercepted (80598256->AF115B02), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenEvent (72) intercepted (80590DB9->AD5763A8), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenEventPair (73) intercepted (80650571->AF11A352), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenFile (74) intercepted (8057F719->AD575016), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenIoCompletion (75) intercepted (806216AF->AF11A446), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenKey (77) intercepted (80573F1D->AD5736C0), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenMutant (78) intercepted (8057DE7D->AD576288), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenProcess (7A) intercepted (80581C68->AD5748CC), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenSection (7D) intercepted (8057B7EA->AD57810E), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenSemaphore (7E) intercepted (805A934A->AD5764C8), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenThread (80) intercepted (80598726->AD5747BE), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenTimer (83) intercepted (806503A7->AF11A400), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtProtectVirtualMemory (89) intercepted (80581F7D->AF1A1CA0), hook C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueryKey (A0) intercepted (8057A29E->AD57413A), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueryMultipleValueKey (A1) intercepted (80655B40->AD573D72), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueryObject (A3) intercepted (80588F32->AF1159CE), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQuerySection (A7) intercepted (80587AA0->AD5786AE), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueryValueKey (B1) intercepted (80574361->AD57399C), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueueApcThread (B4) intercepted (805E64BF->AD577FA0), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtRenameKey (C0) intercepted (80655F85->AD573C2C), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtReplaceKey (C1) intercepted (8065647A->AD572F16), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtReplyPort (C2) intercepted (8057E038->AD57682C), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtReplyWaitReceivePort (C3) intercepted (8057702A->AD5766F2), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtRequestWaitReplyPort (C8) intercepted (8057B32D->AD5778B4), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtRestoreKey (CC) intercepted (80654F9E->AD57328E), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtResumeThread (CE) intercepted (8058735D->AD578BC8), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSaveKey (CF) intercepted (80655045->AD572EAE), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSecureConnectPort (D2) intercepted (8058FDCE->AD575B0E), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetBootEntryOrder (D3) intercepted (8065038B->AF114EDC), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetBootOptions (D4) intercepted (8065038B->AF114F28), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetContextThread (D5) intercepted (80635CAF->AD574E38), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetInformationToken (E6) intercepted (805DF797->AD577154), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetSecurityObject (ED) intercepted (805DC397->AD577DAA), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetSystemInformation (F0) intercepted (805D8F76->AD5787FE), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetSystemPowerState (F1) intercepted (8066F64D->AF114CEA), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetValueKey (F7) intercepted (80584921->AD573816), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtShutdownSystem (F9) intercepted (8064E817->AF114C92), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSuspendProcess (FD) intercepted (80637A3F->AD5788F0), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSuspendThread (FE) intercepted (8063795B->AD578A2A), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSystemDebugControl (FF) intercepted (80651001->AD577A3E), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtTerminateProcess (101) intercepted (8058CE75->AD574A68), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtTerminateThread (102) intercepted (80583EB1->AD5749C8), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtUnmapViewOfSection (10B) intercepted (8058049E->AD578552), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtVdmControl (10C) intercepted (805B1CBE->AF114F74), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtWriteVirtualMemory (115) intercepted (805880B7->AD574B52), hook C:\WINDOWS\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function FsRtlCheckLockForReadAccess (804F4595) - machine code modification Method of JmpTo. jmp AD566FD0 \SystemRoot\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! Function IoAllocateIrp (804EC0ED) - machine code modification Method not defined., embedding from byte 15 >>> Function restored successfully ! Function IoIsOperationSynchronous (804EC0FE) - machine code modification Method of JmpTo. jmp AD5673AC \SystemRoot\system32\DRIVERS\8644589drv.sys, driver recognized as trusted >>> Function restored successfully ! Function ObInsertObject (8056EBBF) - machine code modification Method of JmpTo. jmp AF1B674C \SystemRoot\System32\Drivers\aswSP.SYS, driver recognized as trusted >>> Function restored successfully ! Function ObMakeTemporaryObject (805A9184) - machine code modification Method of JmpTo. jmp AF1B4C8C \SystemRoot\System32\Drivers\aswSP.SYS, driver recognized as trusted >>> Function restored successfully ! Functions checked: 284, intercepted: 80, restored: 86 1.3 Checking IDT and SYSENTER Analysis for CPU 1 Analysis for CPU 2 CmpCallCallBacks = 00145A9F Disable callback OK Checking IDT and SYSENTER - complete 1.4 Searching for masking processes and drivers Checking not performed: extended monitoring driver (AVZPM) is not installed 1.5 Checking of IRP handlers Driver loaded successfully \FileSystem\ntfs[IRP_MJ_CREATE] = AF1B78B0 -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted \FileSystem\ntfs[IRP_MJ_CLOSE] = AF1B78F0 -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted \FileSystem\ntfs[IRP_MJ_WRITE] = AF1B79B8 -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted \FileSystem\ntfs[IRP_MJ_SET_INFORMATION] = AF1B79F8 -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted Checking - complete >> Services: potentially dangerous service allowed: TermService (Servicios de Terminal Server) >> Services: potentially dangerous service allowed: SSDPSRV (Servicio de descubrimientos SSDP) >> Services: potentially dangerous service allowed: TlntSvr (Telnet) >> Services: potentially dangerous service allowed: Schedule (Programador de tareas) >> Services: potentially dangerous service allowed: mnmsrvc (Escritorio remoto compartido de NetMeeting) >> Services: potentially dangerous service allowed: RDSessMgr (Administrador de sesión de Ayuda de escritorio remoto) > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)! >> Security: disk drives' autorun is enabled >> Security: administrative shares (C$, D$ ...) are enabled >> Security: anonymous user access is enabled >> Security: sending Remote Assistant queries is enabled >> Disable HDD autorun >> Disable autorun from network drives >> Disable CD/DVD autorun >> Disable removable media autorun System Analysis in progressAdd commands to script:
System Analysis - complete
Script commands