Results of system analysis

Kaspersky Virus Removal Tool 11.0.0.1245 (database released 25/07/2012; 03:03)

List of processes

File name	PID	Description	Copyright	MD5	Information
c:\windows\explorer.exe Script: Quarantine, Delete, BC delete, Terminate	684	Windows Explorer	© Microsoft Corporation. All rights reserved.	??	1009.50 kb, rsAh, created: 16.01.2008 16:05:28, modified: 14.04.2008 06:42:20 Command line: C:\WINDOWS\explorer.exe
c:\program files\broadcom corporation\broadcom ush host components\cv\bin\hostcontrolservice.exe Script: Quarantine, Delete, BC delete, Terminate	1356	Host Control Application	Copyright (C) 2007 Broadcom Corporation	??	789.35 kb, rsAh, created: 31.07.2008 22:41:50, modified: 31.07.2008 22:41:50 Command line: "C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe"
c:\program files\broadcom corporation\broadcom ush host components\cv\bin\hoststorageservice.exe Script: Quarantine, Delete, BC delete, Terminate	1424	Host Storage Application	Copyright (C) 2007 Broadcom Corporation	??	20.85 kb, rsAh, created: 31.07.2008 22:41:50, modified: 31.07.2008 22:41:50 Command line: "C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe"
e:\killsaver.exe Script: Quarantine, Delete, BC delete, Terminate	2760			??	319.27 kb, rsAh, created: 27.07.2010 21:29:23, modified: 30.06.2005 10:36:14 Command line: "E:\KillSaver.exe"
c:\program files\common files\lightscribe\lssrvc.exe Script: Quarantine, Delete, BC delete, Terminate	688	LightScribe Service	© Copyright 2003-2011 Hewlett-Packard Development Company, LP	??	72.00 kb, rsAh, created: 04.03.2011 12:38:48, modified: 04.03.2011 12:38:48 Command line: "C:\Program Files\Common Files\LightScribe\LSSrvc.exe"
c:\program files\palm, inc\novacomd\x86\novacomd.exe Script: Quarantine, Delete, BC delete, Terminate	2136	novacomd Application	Copyright (C) 2009, Palm	??	60.00 kb, rsAh, created: 15.03.2011 16:35:16, modified: 15.03.2011 16:35:16 Command line: "C:\Program Files\Palm, Inc\novacomd\x86\novacomd.exe"
c:\program files\yuna software\messenger plus!\plusservice.exe Script: Quarantine, Delete, BC delete, Terminate	2776	Messenger Plus! 5	Copyright (C) 2001-2012 Yuna Software	??	783.00 kb, rsAh, created: 19.10.2011 22:03:43, modified: 27.02.2012 15:43:07 Command line: "C:\Program Files\Yuna Software\Messenger Plus!\PlusService.exe"
c:\program files\ad-aware antivirus\sbamsvc.exe Script: Quarantine, Delete, BC delete, Terminate	2224	GFI Software Anti Malware Service	Copyright (c) 2002-2011 GFI Software. All rights reserved.	??	3211.95 kb, rsAh, created: 19.12.2011 13:20:06, modified: 19.12.2011 13:20:06 Command line: "C:\Program Files\Ad-Aware Antivirus\SBAMSvc.exe"
Detected:66, recognized as trusted 62

Module name	Handle	Description	Copyright	MD5	Used by processes
C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\CVUsrIfc.dll Script: Quarantine, Delete, BC delete	268435456	CV User Interface	Copyright (C) 2007 Broadcom Corporation	--	1356, 1424
C:\Program Files\Common Files\LightScribe\LSLog.dll Script: Quarantine, Delete, BC delete	1744830464		© Copyright 2003-2011 Hewlett-Packard Development Company, LP	--	688
C:\Program Files\Common Files\LightScribe\LSSProxy.dll Script: Quarantine, Delete, BC delete	1728053248		© Copyright 2003-2011 Hewlett-Packard Development Company, LP	--	688
C:\Program Files\Copy Path\CopyPath.dll Script: Quarantine, Delete, BC delete	104267776	CopyPath	Copyright © Vertigo Software, Inc. 2006	--	684
C:\Program Files\Microsoft Research\Image Composite Editor\ShellExtension.dll Script: Quarantine, Delete, BC delete	107413504	Microsoft Image Composite Editor Shell Extension	Copyright (c) 2010 Microsoft Corporation, all rights reserved worldwide	--	684
C:\WINDOWS\system32\icudt34.dll Script: Quarantine, Delete, BC delete	1637351424	ICU Data DLL	Copyright (C) 2005, International Business Machines Corporation and others. All Rights Reserved.	--	2224
C:\WINDOWS\system32\icuuc34.dll Script: Quarantine, Delete, BC delete	1651769344	IBM ICU Common DLL	Copyright (C) 2005, International Business Machines Corporation and others. All Rights Reserved.	--	2224
Modules detected:703, recognized as trusted 696

Kernel Space Modules Viewer

Module	Base address	Size in memory	Description	Manufacturer
C:\ComboFix\catchme.sys Script: Quarantine, Delete, BC delete	BA3E0000	008000 (32768)
Combo-Fix.sys Script: Quarantine, Delete, BC delete	BA128000	00F000 (61440)
C:\WINDOWS\System32\Drivers\dump_iaStor.sys Script: Quarantine, Delete, BC delete	A8012000	0BE000 (778240)
C:\DOCUME~1\CSCHAA~2\LOCALS~1\Temp\mbr.sys Script: Quarantine, Delete, BC delete	BA450000	007000 (28672)
C:\WINDOWS\system32\Drivers\PROCEXP113.SYS Script: Quarantine, Delete, BC delete	BA5D6000	002000 (8192)
Modules detected - 180, recognized as trusted - 175

Services

Service	Description	Status	File	Group	Dependencies
LightScribeService Service: Stop, Delete, Disable, BC delete	LightScribeService Direct Disc Labeling Service	Running	C:\Program Files\Common Files\LightScribe\LSSrvc.exe Script: Quarantine, Delete, BC delete
NovacomD Service: Stop, Delete, Disable, BC delete	Palm Novacom	Running	C:\Program Files\Palm, Inc\novacomd\x86\novacomd.exe Script: Quarantine, Delete, BC delete
SitCommunicatorV2.0.1 Service: Stop, Delete, Disable, BC delete	SitCommunicatorV2.0.1	Not started	C:\Program Files\Comcast\SitCommunicator\SitCommunicatorV2.0.1.exe Script: Quarantine, Delete, BC delete
stllssvr Service: Stop, Delete, Disable, BC delete	stllssvr	Not started	C:\Program Files\Common Files\SureThing Shared\stllssvr.exe Script: Quarantine, Delete, BC delete
Detected - 134, recognized as trusted - 130

Drivers

Service	Description	Status	File	Group	Dependencies
catchme Driver: Unload, Delete, Disable, BC delete	catchme	Running	C:\ComboFix\catchme.sys Script: Quarantine, Delete, BC delete	Base
sym_hi Driver: Unload, Delete, Disable, BC delete	sym_hi	Not started	sym_hi.sys Script: Quarantine, Delete, BC delete	SCSI miniport
sym_u3 Driver: Unload, Delete, Disable, BC delete	sym_u3	Not started	sym_u3.sys Script: Quarantine, Delete, BC delete	SCSI miniport
Abiosdsk Driver: Unload, Delete, Disable, BC delete	Abiosdsk	Not started	Abiosdsk.sys Script: Quarantine, Delete, BC delete	Primary disk
abp480n5 Driver: Unload, Delete, Disable, BC delete	abp480n5	Not started	abp480n5.sys Script: Quarantine, Delete, BC delete	SCSI miniport
adpu160m Driver: Unload, Delete, Disable, BC delete	adpu160m	Not started	adpu160m.sys Script: Quarantine, Delete, BC delete	SCSI miniport
Aha154x Driver: Unload, Delete, Disable, BC delete	Aha154x	Not started	Aha154x.sys Script: Quarantine, Delete, BC delete	SCSI miniport
aic78u2 Driver: Unload, Delete, Disable, BC delete	aic78u2	Not started	aic78u2.sys Script: Quarantine, Delete, BC delete	SCSI miniport
aic78xx Driver: Unload, Delete, Disable, BC delete	aic78xx	Not started	aic78xx.sys Script: Quarantine, Delete, BC delete	SCSI miniport
AliIde Driver: Unload, Delete, Disable, BC delete	AliIde	Not started	AliIde.sys Script: Quarantine, Delete, BC delete	System Bus Extender
amsint Driver: Unload, Delete, Disable, BC delete	amsint	Not started	amsint.sys Script: Quarantine, Delete, BC delete	SCSI miniport
asc Driver: Unload, Delete, Disable, BC delete	asc	Not started	asc.sys Script: Quarantine, Delete, BC delete	SCSI miniport
asc3350p Driver: Unload, Delete, Disable, BC delete	asc3350p	Not started	asc3350p.sys Script: Quarantine, Delete, BC delete	SCSI miniport
asc3550 Driver: Unload, Delete, Disable, BC delete	asc3550	Not started	asc3550.sys Script: Quarantine, Delete, BC delete	SCSI miniport
Atdisk Driver: Unload, Delete, Disable, BC delete	Atdisk	Not started	Atdisk.sys Script: Quarantine, Delete, BC delete	Primary disk
cd20xrnt Driver: Unload, Delete, Disable, BC delete	cd20xrnt	Not started	cd20xrnt.sys Script: Quarantine, Delete, BC delete	SCSI miniport
Changer Driver: Unload, Delete, Disable, BC delete	Changer	Not started	Changer.sys Script: Quarantine, Delete, BC delete	Filter
CmdIde Driver: Unload, Delete, Disable, BC delete	CmdIde	Not started	CmdIde.sys Script: Quarantine, Delete, BC delete	System Bus Extender
Cpqarray Driver: Unload, Delete, Disable, BC delete	Cpqarray	Not started	Cpqarray.sys Script: Quarantine, Delete, BC delete	SCSI miniport
dac960nt Driver: Unload, Delete, Disable, BC delete	dac960nt	Not started	dac960nt.sys Script: Quarantine, Delete, BC delete	SCSI miniport
dpti2o Driver: Unload, Delete, Disable, BC delete	dpti2o	Not started	dpti2o.sys Script: Quarantine, Delete, BC delete	SCSI miniport
hpn Driver: Unload, Delete, Disable, BC delete	hpn	Not started	hpn.sys Script: Quarantine, Delete, BC delete	SCSI miniport
i2omgmt Driver: Unload, Delete, Disable, BC delete	i2omgmt	Not started	i2omgmt.sys Script: Quarantine, Delete, BC delete	SCSI Class
i2omp Driver: Unload, Delete, Disable, BC delete	i2omp	Not started	i2omp.sys Script: Quarantine, Delete, BC delete	SCSI miniport
idisw2km Driver: Unload, Delete, Disable, BC delete	idisw2km	Not started	C:\WINDOWS\system32\DRIVERS\idisw2km.sys Script: Quarantine, Delete, BC delete	Video
ini910u Driver: Unload, Delete, Disable, BC delete	ini910u	Not started	ini910u.sys Script: Quarantine, Delete, BC delete	SCSI miniport
IntelIde Driver: Unload, Delete, Disable, BC delete	IntelIde	Not started	IntelIde.sys Script: Quarantine, Delete, BC delete	System Bus Extender
kbstuff Driver: Unload, Delete, Disable, BC delete	SMS Virtual Keyboard	Not started	C:\WINDOWS\system32\DRIVERS\kbstuff5.sys Script: Quarantine, Delete, BC delete	Keyboard Port
Lavasoft Kernexplorer Driver: Unload, Delete, Disable, BC delete	Lavasoft helper driver	Not started	C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys Script: Quarantine, Delete, BC delete
lbrtfdc Driver: Unload, Delete, Disable, BC delete	lbrtfdc	Not started	lbrtfdc.sys Script: Quarantine, Delete, BC delete	System Bus Extender
mferkdk Driver: Unload, Delete, Disable, BC delete	VSCore mferkdk	Not started	C:\Program Files\McAfee\VirusScan Enterprise\mferkdk.sys Script: Quarantine, Delete, BC delete
mraid35x Driver: Unload, Delete, Disable, BC delete	mraid35x	Not started	mraid35x.sys Script: Quarantine, Delete, BC delete	SCSI miniport
MREMP50 Driver: Unload, Delete, Disable, BC delete	MREMP50 NDIS Protocol Driver	Not started	C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS Script: Quarantine, Delete, BC delete	PNP_TDI
MREMPR5 Driver: Unload, Delete, Disable, BC delete	MREMPR5 NDIS Protocol Driver	Not started	C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS Script: Quarantine, Delete, BC delete	PNP_TDI
MRENDIS5 Driver: Unload, Delete, Disable, BC delete	MRENDIS5 NDIS Protocol Driver	Not started	C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS Script: Quarantine, Delete, BC delete	PNP_TDI
MRESP50 Driver: Unload, Delete, Disable, BC delete	MRESP50 NDIS Protocol Driver	Not started	C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS Script: Quarantine, Delete, BC delete	PNP_TDI
PCIDump Driver: Unload, Delete, Disable, BC delete	PCIDump	Not started	PCIDump.sys Script: Quarantine, Delete, BC delete	PCI Configuration
PCIIde Driver: Unload, Delete, Disable, BC delete	PCIIde	Not started	PCIIde.sys Script: Quarantine, Delete, BC delete	System Bus Extender
PDCOMP Driver: Unload, Delete, Disable, BC delete	PDCOMP	Not started	PDCOMP.sys Script: Quarantine, Delete, BC delete
PDFRAME Driver: Unload, Delete, Disable, BC delete	PDFRAME	Not started	PDFRAME.sys Script: Quarantine, Delete, BC delete
PDRELI Driver: Unload, Delete, Disable, BC delete	PDRELI	Not started	PDRELI.sys Script: Quarantine, Delete, BC delete
PDRFRAME Driver: Unload, Delete, Disable, BC delete	PDRFRAME	Not started	PDRFRAME.sys Script: Quarantine, Delete, BC delete
perc2 Driver: Unload, Delete, Disable, BC delete	perc2	Not started	perc2.sys Script: Quarantine, Delete, BC delete	SCSI miniport
perc2hib Driver: Unload, Delete, Disable, BC delete	perc2hib	Not started	perc2hib.sys Script: Quarantine, Delete, BC delete	Filter
ql1080 Driver: Unload, Delete, Disable, BC delete	ql1080	Not started	ql1080.sys Script: Quarantine, Delete, BC delete	SCSI miniport
Ql10wnt Driver: Unload, Delete, Disable, BC delete	Ql10wnt	Not started	Ql10wnt.sys Script: Quarantine, Delete, BC delete	SCSI miniport
ql12160 Driver: Unload, Delete, Disable, BC delete	ql12160	Not started	ql12160.sys Script: Quarantine, Delete, BC delete	SCSI miniport
ql1240 Driver: Unload, Delete, Disable, BC delete	ql1240	Not started	ql1240.sys Script: Quarantine, Delete, BC delete	SCSI miniport
ql1280 Driver: Unload, Delete, Disable, BC delete	ql1280	Not started	ql1280.sys Script: Quarantine, Delete, BC delete	SCSI miniport
Simbad Driver: Unload, Delete, Disable, BC delete	Simbad	Not started	Simbad.sys Script: Quarantine, Delete, BC delete	Filter
Sparrow Driver: Unload, Delete, Disable, BC delete	Sparrow	Not started	Sparrow.sys Script: Quarantine, Delete, BC delete	SCSI miniport
symc810 Driver: Unload, Delete, Disable, BC delete	symc810	Not started	symc810.sys Script: Quarantine, Delete, BC delete	SCSI miniport
symc8xx Driver: Unload, Delete, Disable, BC delete	symc8xx	Not started	symc8xx.sys Script: Quarantine, Delete, BC delete	SCSI miniport
TosIde Driver: Unload, Delete, Disable, BC delete	TosIde	Not started	TosIde.sys Script: Quarantine, Delete, BC delete	System Bus Extender
ultra Driver: Unload, Delete, Disable, BC delete	ultra	Not started	ultra.sys Script: Quarantine, Delete, BC delete	SCSI miniport
ViaIde Driver: Unload, Delete, Disable, BC delete	ViaIde	Not started	ViaIde.sys Script: Quarantine, Delete, BC delete	System Bus Extender
WDICA Driver: Unload, Delete, Disable, BC delete	WDICA	Not started	WDICA.sys Script: Quarantine, Delete, BC delete
Detected - 269, recognized as trusted - 212

Autoruns

File name	Status	Startup method	Description
C:\Documents and Settings\cschaa001\Local Settings\Temp\_uninst_65771502.bat Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	C:\Documents and Settings\cschaa001\Start Menu\Programs\Startup\, C:\Documents and Settings\cschaa001\Start Menu\Programs\Startup\_uninst_65771502.lnk,
C:\PROGRA~1\Adobe\ADOBEC~2\CPEXTR~1.DLL Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {CBD203BC-EC53-4432-9C17-1E0218C1A30C} Delete
C:\Program Files\1E\NightWatchman50\1Emsgrc.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\NightWatchman50, EventMessageFile
C:\Program Files\1E\WakeUp\Agent\1Emsgrc.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\WakeUpAgt, EventMessageFile
C:\Program Files\Ad-Aware Antivirus\SBAMRes.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\SBAMSvc, EventMessageFile
C:\Program Files\BatteryCare\BatteryCare.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-21-2052111302-448539723-1801674531-137367\Software\Microsoft\Windows\CurrentVersion\Run, BatteryCare Delete
C:\Program Files\Common Files\Microsoft Shared\DW\DW.EXE Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft Visual Studio Tools for Applications, EventMessageFile
C:\Program Files\FolderMenu\FolderMenu.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-21-2052111302-448539723-1801674531-137367\Software\Microsoft\Windows\CurrentVersion\Run, FolderMenu Delete
C:\Program Files\McAfee\Common Framework\McTrayEventLog.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\McAfee Win32 GUI Support Library, EventMessageFile
C:\Program Files\Microsoft Research\Image Composite Editor\ShellExtension.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {1AC77AE9-9EC6-405A-9F9B-C06AB3C10B71} Delete
C:\Program Files\QuickTime\QTSystem\QuickTime.cpl Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cpls, QuickTime Delete
C:\Program Files\QuickTime\qttask.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, QuickTime Task Delete
C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Synchronize, EventMessageFile
C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} Delete
C:\Program Files\Trondent Development Corp\Infuzer\Infuzer.exe Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	C:\Documents and Settings\All Users\Start Menu\Programs\Startup\, C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Infuzer.lnk,
C:\Program Files\Yuna Software\Messenger Plus!\PlusService.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, PlusService Delete
C:\WINDOWS\System32\Drivers\AliIde.sys Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\aliide, EventMessageFile
C:\WINDOWS\System32\Drivers\CmdIde.sys Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\cmdide, EventMessageFile
C:\WINDOWS\System32\Drivers\IntelIde.sys Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\intelide, EventMessageFile
C:\WINDOWS\System32\Drivers\PciIde.sys Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\pciide, EventMessageFile
C:\WINDOWS\System32\Drivers\TosIde.sys Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\toside, EventMessageFile
C:\WINDOWS\System32\Drivers\ViaIde.sys Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\viaide, EventMessageFile
C:\WINDOWS\System32\Drivers\lbrtfdc.sys Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\lbrtfdc, EventMessageFile
C:\WINDOWS\System32\PrintFilterPipelineSvc.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PrintFilterPipelineSvc, EventMessageFile
C:\WINDOWS\System32\drivers\idisw2km.sys Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\idisw2km, EventMessageFile
C:\WINDOWS\System32\igmpv2.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile
C:\WINDOWS\System32\ipbootp.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile
C:\WINDOWS\System32\iprip2.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile
C:\WINDOWS\System32\ospf.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPF, EventMessageFile
C:\WINDOWS\System32\ospfmib.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPFMib, EventMessageFile
C:\WINDOWS\System32\polagent.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PolicyAgent, EventMessageFile
C:\WINDOWS\System32\tssdis.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\TermServSessDir, EventMessageFile
C:\WINDOWS\system32\CCM\CLICOMP\RemCtrl\1033\wusermsg.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\SMS Remote Control, EventMessageFile
C:\WINDOWS\system32\Drivers\FirePM.sys Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\FirePM, EventMessageFile
C:\WINDOWS\system32\Drivers\FireTDI.sys Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\FireTDI, EventMessageFile
C:\WINDOWS\system32\HPZinw12.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Net Driver HPZ12\Parameters, ServiceDll Delete
C:\WINDOWS\system32\HPZipm12.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Pml Driver HPZ12\Parameters, ServiceDll Delete
C:\WINDOWS\system32\MsSip1.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 1, $DLL Delete
C:\WINDOWS\system32\MsSip2.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 2, $DLL Delete
C:\WINDOWS\system32\MsSip3.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 3, $DLL Delete
C:\WINDOWS\system32\psxss.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
C:\WINDOWS\system32\stisvc.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System, EventMessageFile
CSSaver.scr Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-21-2052111302-448539723-1801674531-137367\Control Panel\Desktop, scrnsave.exe Delete
CSSaver.scr Script: Quarantine, Delete, BC delete	Active	File system.ini	C:\WINDOWS\system.ini, boot, SCRNSAVE.EXE
MPG4C32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, vidc.MP42 Delete
ResLuComServer_3_3.DLL Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\LiveUpdate, EventMessageFile
c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727.3618 (GDR\aspnet_isapi.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SOFTWARE\Microsoft\ASP.NET\2.0.50727.3618 (GDR.0, DllFullPath Delete
camcodec.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, vidc.CSCD Delete
deskpan.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {42071714-76d4-11d1-8b24-00a0c9068ff3} Delete
jp2avi.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, vidc.IPJ2 Delete
kbd101.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver JPN Delete
kbd101a.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver KOR Delete
lagarith.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, vidc.LAGS Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, .DEFAULT\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-19\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-20\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-18\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-21-2052111302-448539723-1801674531-137367\Control Panel\IOProcs, MVB Delete
vgafix.fon Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon Delete
vgaoem.fon Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon Delete
vgasys.fon Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon Delete
vp4vfw.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, vidc.VP40 Delete
vp7vfw.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, vidc.VP70 Delete
Autoruns items detected - 1082, recognized as trusted - 1019

Microsoft Internet Explorer extension modules (BHOs, Toolbars ...)

File name	Type	Description	Manufacturer	CLSID
C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll Script: Quarantine, Delete, BC delete	BHO	SnagIt Browser Helper Object for Internet Explorer	Copyright © 2003 TechSmith Corp. All rights reserved.	{00C6482D-C502-44C8-8409-FCE54AD9C208} Delete
C:\Program Files\Telephony Toolbar\bin\BW_Assistant_Enterprise_IE_S.dll Script: Quarantine, Delete, BC delete	BHO	BroadWorks Assistant - Enterprise IE Edition	Copyright 2007	{431A60E6-675F-4b9f-B3F0-66E0FECC8B34} Delete
	BHO			{5C255C8A-E604-49b4-9D64-90988571CECB} Delete
C:\Program Files\Telephony Toolbar\bin\BW_Assistant_Enterprise_IE_CC.dll Script: Quarantine, Delete, BC delete	BHO	BroadWorks Assistant - Enterprise IE Edition	Copyright 2007	{8F1FF1A7-C048-4d6b-B052-56E42CE427CB} Delete
C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll Script: Quarantine, Delete, BC delete	Toolbar	SnagIt Add-in for Internet Explorer	Copyright © 2003 TechSmith Corp. All rights reserved.	{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} Delete
C:\Program Files\Telephony Toolbar\bin\BW_Assistant_Enterprise_IE_CC.dll Script: Quarantine, Delete, BC delete	Toolbar	BroadWorks Assistant - Enterprise IE Edition	Copyright 2007	{6F6690B9-C5DB-4F08-8833-F2EF4DEE956B} Delete
C:\Program Files\Telephony Toolbar\bin\BW_Assistant_Enterprise_IE_S.dll Script: Quarantine, Delete, BC delete	Toolbar	BroadWorks Assistant - Enterprise IE Edition	Copyright 2007	{F10D927F-D3DF-4734-98AB-DD258253F5FD} Delete
C:\Program Files\Telephony Toolbar\bin\BW_Assistant_Enterprise_IE_S.dll Script: Quarantine, Delete, BC delete	Extension module	BroadWorks Assistant - Enterprise IE Edition	Copyright 2007	{92780B25-18CC-41C8-B9BE-3C9C571A8263} Delete
Elements detected - 24, recognized as trusted - 16

Windows Explorer extension modules

File name	Destination	Description	Manufacturer	CLSID
deskpan.dll Script: Quarantine, Delete, BC delete	Display Panning CPL Extension			{42071714-76d4-11d1-8b24-00a0c9068ff3} Delete
	Shell extensions for file compression			{764BF0E1-F219-11ce-972D-00AA00A14F56} Delete
	Encryption Context Menu			{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} Delete
	Taskbar and Start Menu			{0DF44EAA-FF21-4412-828E-260A8728E7F1} Delete
	User Accounts			{7A9D77BD-5403-11d2-8785-2E0420524153} Delete
	Windows Search Shell Service			{da67b8ad-e81b-4c70-9b91b417b5e33527} Delete
	{B9B9F083-2B04-452A-8691-83694AC1037B}			Logitech Setpoint Extension Delete
C:\Program Files\Microsoft Research\Image Composite Editor\ShellExtension.dll Script: Quarantine, Delete, BC delete	Microsoft Image Composite Editor	Microsoft Image Composite Editor Shell Extension	Copyright (c) 2010 Microsoft Corporation, all rights reserved worldwide	{1AC77AE9-9EC6-405A-9F9B-C06AB3C10B71} Delete
C:\PROGRA~1\Adobe\ADOBEC~2\CPEXTR~1.DLL Script: Quarantine, Delete, BC delete	Captivate Thumbnail Extractor			{CBD203BC-EC53-4432-9C17-1E0218C1A30C} Delete
C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll Script: Quarantine, Delete, BC delete	SnagIt	SnagIt Add-in for Internet Explorer	Copyright © 2003 TechSmith Corp. All rights reserved.	{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} Delete
Elements detected - 231, recognized as trusted - 221

Printing system extensions (print monitors, providers)

File name	Type	Name	Description	Manufacturer
Elements detected - 10, recognized as trusted - 10

Task Scheduler jobs

File name	Job name	Job status	Description	Manufacturer
Elements detected - 6, recognized as trusted - 6

SPI/LSP settings

Namespace providers (NSP)

Provider	Status	EXE file	Description	GUID
Detected - 4, recognized as trusted - 4

Transport protocol providers (TSP, LSP)

Provider EXE file Description
Detected - 19, recognized as trusted - 19
Results of automatic SPI settings check
LSP settings checked. No errors detected

TCP/UDP ports

Port Status Remote Host Remote Port Application Notes
TCP ports
135 LISTENING 0.0.0.0 63592 [1284] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
445 LISTENING 0.0.0.0 32858 [4] System
Script: Quarantine, Delete, BC delete, Terminate
1035 LISTENING 0.0.0.0 61674 [3824] c:\windows\system32\alg.exe
Script: Quarantine, Delete, BC delete, Terminate
1067 LISTENING 0.0.0.0 28675 [3092] c:\program files\common files\symantec shared\ccapp.exe
Script: Quarantine, Delete, BC delete, Terminate
1776 LISTENING 0.0.0.0 57446 [2392] c:\program files\1e\wakeup\agent\wakeupagt.exe
Script: Quarantine, Delete, BC delete, Terminate
3100 ESTABLISHED 127.0.0.1 5354 [2384] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe
Script: Quarantine, Delete, BC delete, Terminate
3109 ESTABLISHED 127.0.0.1 3110 [5972] c:\program files\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
3110 ESTABLISHED 127.0.0.1 3109 [5972] c:\program files\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
3389 LISTENING 0.0.0.0 39150 [1028] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
5152 LISTENING 0.0.0.0 47318 [324] c:\program files\java\jre6\bin\jqs.exe
Script: Quarantine, Delete, BC delete, Terminate
5354 LISTENING 0.0.0.0 34908 [1952] c:\program files\bonjour\mdnsresponder.exe
Script: Quarantine, Delete, BC delete, Terminate
5354 ESTABLISHED 127.0.0.1 3100 [1952] c:\program files\bonjour\mdnsresponder.exe
Script: Quarantine, Delete, BC delete, Terminate
6968 LISTENING 0.0.0.0 2128 [2136] c:\program files\palm, inc\novacomd\x86\novacomd.exe
Script: Quarantine, Delete, BC delete, Terminate
6969 LISTENING 0.0.0.0 8339 [2136] c:\program files\palm, inc\novacomd\x86\novacomd.exe
Script: Quarantine, Delete, BC delete, Terminate
6970 LISTENING 0.0.0.0 2144 [2136] c:\program files\palm, inc\novacomd\x86\novacomd.exe
Script: Quarantine, Delete, BC delete, Terminate
6971 LISTENING 0.0.0.0 16516 [2136] c:\program files\palm, inc\novacomd\x86\novacomd.exe
Script: Quarantine, Delete, BC delete, Terminate
12311 LISTENING 0.0.0.0 16419 [2136] c:\program files\palm, inc\novacomd\x86\novacomd.exe
Script: Quarantine, Delete, BC delete, Terminate
27015 LISTENING 0.0.0.0 2272 [2384] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe
Script: Quarantine, Delete, BC delete, Terminate
62514 LISTENING 0.0.0.0 59644 [232] c:\program files\cisco systems\vpn client\cvpnd.exe
Script: Quarantine, Delete, BC delete, Terminate
64022 LISTENING 0.0.0.0 210 [2136] c:\program files\palm, inc\novacomd\x86\novacomd.exe
Script: Quarantine, Delete, BC delete, Terminate
UDP ports
123 LISTENING -- -- [1324] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
445 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
500 LISTENING -- -- [832] c:\windows\system32\lsass.exe
Script: Quarantine, Delete, BC delete, Terminate
1027 LISTENING -- -- [1952] c:\program files\bonjour\mdnsresponder.exe
Script: Quarantine, Delete, BC delete, Terminate
1038 LISTENING -- -- [1504] c:\program files\symantec\symantec endpoint protection\smc.exe
Script: Quarantine, Delete, BC delete, Terminate
1776 LISTENING -- -- [2392] c:\program files\1e\wakeup\agent\wakeupagt.exe
Script: Quarantine, Delete, BC delete, Terminate
1900 LISTENING -- -- [1740] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
3098 LISTENING -- -- [2384] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe
Script: Quarantine, Delete, BC delete, Terminate
3099 LISTENING -- -- [2384] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe
Script: Quarantine, Delete, BC delete, Terminate
4500 LISTENING -- -- [832] c:\windows\system32\lsass.exe
Script: Quarantine, Delete, BC delete, Terminate
5353 LISTENING -- -- [1952] c:\program files\bonjour\mdnsresponder.exe
Script: Quarantine, Delete, BC delete, Terminate
39999 LISTENING -- -- [1360] c:\program files\symantec\symantec endpoint protection\snac.exe
Script: Quarantine, Delete, BC delete, Terminate
62514 LISTENING -- -- [232] c:\program files\cisco systems\vpn client\cvpnd.exe
Script: Quarantine, Delete, BC delete, Terminate

Downloaded Program Files (DPF)

File name Description Manufacturer CLSID Source URL
{33564D57-0000-0010-8000-00AA00389B71}
Delete http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
C:\WINDOWS\Downloaded Program Files\axloader.dll
Script: Quarantine, Delete, BC delete AxLoader Module © 1997-2002 Research In Motion Limited. {DAF7E6E6-D53A-439A-B28D-12271406B8A9}
Delete http://mobileapps.blackberry.com/devicesoftware/AxLoader.cab
{E2883E8F-472F-4FB0-9522-AC9BF37916A7}
Delete http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
C:\WINDOWS\DOWNLO~1\CTI_CO~1.OCX
Script: Quarantine, Delete, BC delete AWD Voice CTI ActiveX Control Copyright (C) 1998 {EFCBF9F8-0F50-11D2-A9F3-0004ACFF1B93}
Delete http://comtrac/Comcast0607/controls/cti_control.ocx
Elements detected - 15, recognized as trusted - 11

Control Panel Applets (CPL)

File name Description Manufacturer
C:\WINDOWS\system32\javacpl.cpl
Script: Quarantine, Delete, BC delete Java(TM) Control Panel Copyright © 2012
Elements detected - 34, recognized as trusted - 33

Active Setup

File name Description Manufacturer CLSID
Elements detected - 16, recognized as trusted - 16

HOSTS file

Hosts file record
127.0.0.1 localhost
Clear Hosts file

Protocols and handlers

File name Type Description Manufacturer CLSID
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
Elements detected - 35, recognized as trusted - 32

Suspicious objects

File Description Type
C:\WINDOWS\system32\DRIVERS\9349176drv.sys
Script: Quarantine, Delete, BC delete Suspicion for Rootkit Kernel-mode hook
C:\WINDOWS\system32\drivers\wpsdrvnt.sys
Script: Quarantine, Delete, BC delete Suspicion for Rootkit Kernel-mode hook
C:\WINDOWS\SYSTEM32\Drivers\SysPlant.sys
Script: Quarantine, Delete, BC delete Suspicion for Rootkit Kernel-mode hook
\SystemRoot\system32\DRIVERS\9349176drv.sys
Script: Quarantine, Delete, BC delete Suspicion for Rootkit Kernel-mode hook
E:\autorun.inf
Script: Quarantine, Delete, BC delete Suspicion by Heuristic analysis HSC: suspicion for hidden autorun (high degree of probability)

Main script of analysis
Windows version: Microsoft Windows XP, Build=2600, SP="Service Pack 3"
System Restore: enabled
1.1 Searching for user-mode API hooks
 Analysis: kernel32.dll, export table found in section .text
IAT modification detected: CreateProcessA - 00CA0010<>7C80236B
IAT modification detected: GetModuleFileNameA - 00CA0080<>7C80B56F
IAT modification detected: FreeLibrary - 00CA00F0<>7C80AC7E
IAT modification detected: GetModuleFileNameW - 00CA0160<>7C80B475
IAT modification detected: CreateProcessW - 00CA01D0<>7C802336
IAT modification detected: LoadLibraryW - 00CA02B0<>7C80AEEB
IAT modification detected: LoadLibraryA - 00CA0320<>7C801D7B
IAT modification detected: GetProcAddress - 00CA0390<>7C80AE40
 Analysis: ntdll.dll, export table found in section .text
 Analysis: user32.dll, export table found in section .text
 Analysis: advapi32.dll, export table found in section .text
 Analysis: ws2_32.dll, export table found in section .text
 Analysis: wininet.dll, export table found in section .text
 Analysis: rasapi32.dll, export table found in section .text
 Analysis: urlmon.dll, export table found in section .text
 Analysis: netapi32.dll, export table found in section .text
 >> Danger ! Process masking detected
1.2 Searching for kernel-mode API hooks
 Driver loaded successfully
 SDT found (RVA=085700)
 Kernel ntkrnlpa.exe found in memory at address 804D7000
   SDT = 8055C700
   KiST = 80504480 (284)
Function NtAdjustPrivilegesToken (0B) intercepted (805EC464->A23C1690), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtAlertResumeThread (0C) intercepted (805D4B7E->8A512F90), hook not defined
>>> Function restored successfully !
>>> Hook code blocked
Function NtAlertThread (0D) intercepted (805D4B2E->8A513E88), hook not defined
>>> Function restored successfully !
>>> Hook code blocked
Function NtAllocateVirtualMemory (11) intercepted (805A8ABA->88F12990), hook not defined
>>> Function restored successfully !
>>> Hook code blocked
Function NtClose (19) intercepted (805BC530->A23C1F94), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtConnectPort (1F) intercepted (805A45D0->A23C2DC8), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateEvent (23) intercepted (8060EF4E->A23C3312), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateFile (25) intercepted (805790A8->A23C2270), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateKey (29) intercepted (806240F0->A23C0500), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateMutant (2B) intercepted (8061769E->A23C31F8), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateNamedPipeFile (2C) intercepted (805790E2->A23C127E), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreatePort (2E) intercepted (805A50EC->A23C30CC), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateSection (32) intercepted (805AB3C8->A23C1426), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateSemaphore (33) intercepted (8061504E->A23C3432), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateThread (35) intercepted (805D1018->A23C1C1C), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateWaitablePort (38) intercepted (805A5110->A23C3162), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDebugActiveProcess (39) intercepted (80643B30->A23C4B1A), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDeleteKey (3F) intercepted (8062458C->A23C0B0A), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDeleteValueKey (41) intercepted (8062475C->A23C0EBE), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDeviceIoControlFile (42) intercepted (8057926E->A23C26F2), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDuplicateObject (44) intercepted (805BE008->A23C5D26), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtEnumerateKey (47) intercepted (8062493C->A23C100A), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtEnumerateValueKey (49) intercepted (80624BA6->A23C10A2), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtFreeVirtualMemory (53) intercepted (805B2FB2->8925B950), hook not defined
>>> Function restored successfully !
>>> Hook code blocked
Function NtFsControlFile (54) intercepted (805792A2->A23C2500), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtImpersonateAnonymousToken (59) intercepted (805F9386->893CD960), hook not defined
>>> Function restored successfully !
>>> Hook code blocked
Function NtImpersonateThread (5B) intercepted (805D7802->8A512ED0), hook not defined
>>> Function restored successfully !
>>> Hook code blocked
Function NtLoadDriver (61) intercepted (80584160->A23C4C0C), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtLoadKey (62) intercepted (80626314->A23C04DC), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtLoadKey2 (63) intercepted (80625F20->A23C04EE), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtMapViewOfSection (6C) intercepted (805B203A->A23C5374), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtNotifyChangeKey (6F) intercepted (806262DE->A23C11CE), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenEvent (72) intercepted (8060F04E->A23C33A8), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenFile (74) intercepted (8057A1A6->A23C2016), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenKey (77) intercepted (806254CE->A23C06C0), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenMutant (78) intercepted (80617776->A23C3288), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenProcess (7A) intercepted (805CB440->A23C18CC), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenProcessToken (7B) intercepted (805EE054->8A51AA78), hook not defined
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenSection (7D) intercepted (805AA3EC->A23C510E), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenSemaphore (7E) intercepted (80615148->A23C34C8), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenThread (80) intercepted (805CB6CC->A23C17BE), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenThreadToken (81) intercepted (805EE072->8A52ECE0), hook not defined
>>> Function restored successfully !
>>> Hook code blocked
Function NtProtectVirtualMemory (89) intercepted (805B841E->BA2FDB90), hook C:\WINDOWS\system32\drivers\wpsdrvnt.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQueryDefaultLocale (8F) intercepted (80610CF8->A8268280), hook C:\WINDOWS\SYSTEM32\Drivers\SysPlant.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQueryKey (A0) intercepted (80625810->A23C113A), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQueryMultipleValueKey (A1) intercepted (8062323E->A23C0D72), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQuerySection (A7) intercepted (805B85E0->A23C56AE), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQueryValueKey (B1) intercepted (80622314->A23C099C), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQueueApcThread (B4) intercepted (805D1276->A23C4FA0), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtRenameKey (C0) intercepted (80623B12->A23C0C2C), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtReplaceKey (C1) intercepted (806261C4->A23BFF16), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtReplyPort (C2) intercepted (805A54EC->A23C382C), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtReplyWaitReceivePort (C3) intercepted (805A64B4->A23C36F2), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtRequestWaitReplyPort (C8) intercepted (805A2D76->A23C48B4), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtRestoreKey (CC) intercepted (80625AD0->A23C028E), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtResumeThread (CE) intercepted (805D49BA->A23C5BC8), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSaveKey (CF) intercepted (80625BCC->A23BFEAE), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSecureConnectPort (D2) intercepted (805A3D64->A23C2B0E), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetContextThread (D5) intercepted (805D173A->A23C1E38), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetInformationProcess (E4) intercepted (805CDE8A->8A52EDB0), hook not defined
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetInformationThread (E5) intercepted (805CC10E->8A520F38), hook not defined
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetInformationToken (E6) intercepted (805FA7B4->A23C4154), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetSecurityObject (ED) intercepted (805C062E->A23C4DAA), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetSystemInformation (F0) intercepted (8060FD06->A23C57FE), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetValueKey (F7) intercepted (80622662->A23C0816), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSuspendProcess (FD) intercepted (805D4A82->A23C58F0), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSuspendThread (FE) intercepted (805D48F4->A23C5A2A), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSystemDebugControl (FF) intercepted (806180BA->A23C4A3E), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtTerminateProcess (101) intercepted (805D29E2->A23C1A68), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtTerminateThread (102) intercepted (805D2BDC->A23C19C8), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtUnmapViewOfSection (10B) intercepted (805B2E48->A23C5552), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtWriteVirtualMemory (115) intercepted (805B43CC->A23C1B52), hook C:\WINDOWS\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function FsRtlCheckLockForReadAccess (804EAF84) - machine code modification Method of JmpTo. jmp A23B3FD0 \SystemRoot\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
Function IoIsOperationSynchronous (804EF912) - machine code modification Method of JmpTo. jmp A23B43AC \SystemRoot\system32\DRIVERS\9349176drv.sys, driver recognized as trusted
>>> Function restored successfully !
Functions checked: 284, intercepted: 72, restored: 74
1.3 Checking IDT and SYSENTER
 Analysis for CPU 1
 Analysis for CPU 2
CmpCallCallBacks = 00093D84
Disable callback OK
 Checking IDT and SYSENTER - complete
1.4 Searching for masking processes and drivers
 Checking not performed: extended monitoring driver (AVZPM) is not installed
1.5 Checking of IRP handlers
 Driver loaded successfully
 Checking - complete
>>> E:\autorun.inf HSC: suspicion for  hidden autorun (high degree of probability)
>> Services: potentially dangerous service allowed: RemoteRegistry (Remote Registry)
>> Services: potentially dangerous service allowed: TermService (Terminal Services)
>> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery Service)
>> Services: potentially dangerous service allowed: TlntSvr (Telnet)
>> Services: potentially dangerous service allowed: Schedule (Task Scheduler)
>> Services: potentially dangerous service allowed: mnmsrvc (NetMeeting Remote Desktop Sharing)
>> Services: potentially dangerous service allowed: RDSessMgr (Remote Desktop Help Session Manager)
> Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)!
>> Security: disk drives' autorun is enabled
>> Security: administrative shares (C$, D$ ...) are enabled
>> Security: anonymous user access is enabled
>> Security: terminal connections to the PC are allowed
>> Security: sending Remote Assistant queries is enabled
 >>  Boot-up message is enabled and defined
 >>  Elements of Start menu blocked
 >>  Service termination timeout is out of admissible values
 >>  Disable HDD autorun
 >>  Disable autorun from network drives
 >>  Disable CD/DVD autorun
 >>  Disable removable media autorun
 >>  Windows Explorer - show extensions of known file types
 >>  Option of installing and removing Windows components blocked
System Analysis in progress

 System Analysis - complete


Script commands 
Add commands to script:
Blocking hooks using Anti-Rootkit
Enable AVZGuard
Operations with AVZPM (true=enable,false=disable)
BootCleaner - import list of deleted files
BootCleaner - import all
Registry cleanup after deleting files
ExecuteWizard ('TSW',2,3,true) - Running Troubleshooting wizard
BootCleaner - activate
Reboot
Insert template for QuarantineFile() - quarantining file
Insert template for BC_QrFile() - quarantining file via BootCleaner
Insert template for DeleteFile() - deleting file
Insert template for DelCLSID() - deleting CLSID item from registry
Additional operations:Performance tweaking: disable service RemoteRegistry (Remote Registry)
Performance tweaking: disable service TermService (Terminal Services)
Performance tweaking: disable service SSDPSRV (SSDP Discovery Service)
Performance tweaking: disable service TlntSvr (Telnet)
Performance tweaking: disable service Schedule (Task Scheduler)
Performance tweaking: disable service mnmsrvc (NetMeeting Remote Desktop Sharing)
Performance tweaking: disable service RDSessMgr (Remote Desktop Help Session Manager)
Security tweaking: disable CD autorun
Security tweaking: disable administrative shares
Security tweaking: disable anonymous user access
Security: prevent terminal connections to the PC
Security: disable sending Remote Assistant queries

File list

Port	Status	Remote Host	Remote Port	Application	Notes
TCP ports
135	LISTENING	0.0.0.0	63592	[1284] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
445	LISTENING	0.0.0.0	32858	[4] System Script: Quarantine, Delete, BC delete, Terminate
1035	LISTENING	0.0.0.0	61674	[3824] c:\windows\system32\alg.exe Script: Quarantine, Delete, BC delete, Terminate
1067	LISTENING	0.0.0.0	28675	[3092] c:\program files\common files\symantec shared\ccapp.exe Script: Quarantine, Delete, BC delete, Terminate
1776	LISTENING	0.0.0.0	57446	[2392] c:\program files\1e\wakeup\agent\wakeupagt.exe Script: Quarantine, Delete, BC delete, Terminate
3100	ESTABLISHED	127.0.0.1	5354	[2384] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe Script: Quarantine, Delete, BC delete, Terminate
3109	ESTABLISHED	127.0.0.1	3110	[5972] c:\program files\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
3110	ESTABLISHED	127.0.0.1	3109	[5972] c:\program files\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
3389	LISTENING	0.0.0.0	39150	[1028] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
5152	LISTENING	0.0.0.0	47318	[324] c:\program files\java\jre6\bin\jqs.exe Script: Quarantine, Delete, BC delete, Terminate
5354	LISTENING	0.0.0.0	34908	[1952] c:\program files\bonjour\mdnsresponder.exe Script: Quarantine, Delete, BC delete, Terminate
5354	ESTABLISHED	127.0.0.1	3100	[1952] c:\program files\bonjour\mdnsresponder.exe Script: Quarantine, Delete, BC delete, Terminate
6968	LISTENING	0.0.0.0	2128	[2136] c:\program files\palm, inc\novacomd\x86\novacomd.exe Script: Quarantine, Delete, BC delete, Terminate
6969	LISTENING	0.0.0.0	8339	[2136] c:\program files\palm, inc\novacomd\x86\novacomd.exe Script: Quarantine, Delete, BC delete, Terminate
6970	LISTENING	0.0.0.0	2144	[2136] c:\program files\palm, inc\novacomd\x86\novacomd.exe Script: Quarantine, Delete, BC delete, Terminate
6971	LISTENING	0.0.0.0	16516	[2136] c:\program files\palm, inc\novacomd\x86\novacomd.exe Script: Quarantine, Delete, BC delete, Terminate
12311	LISTENING	0.0.0.0	16419	[2136] c:\program files\palm, inc\novacomd\x86\novacomd.exe Script: Quarantine, Delete, BC delete, Terminate
27015	LISTENING	0.0.0.0	2272	[2384] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe Script: Quarantine, Delete, BC delete, Terminate
62514	LISTENING	0.0.0.0	59644	[232] c:\program files\cisco systems\vpn client\cvpnd.exe Script: Quarantine, Delete, BC delete, Terminate
64022	LISTENING	0.0.0.0	210	[2136] c:\program files\palm, inc\novacomd\x86\novacomd.exe Script: Quarantine, Delete, BC delete, Terminate
UDP ports
123	LISTENING	--	--	[1324] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
445	LISTENING	--	--	[4] System Script: Quarantine, Delete, BC delete, Terminate
500	LISTENING	--	--	[832] c:\windows\system32\lsass.exe Script: Quarantine, Delete, BC delete, Terminate
1027	LISTENING	--	--	[1952] c:\program files\bonjour\mdnsresponder.exe Script: Quarantine, Delete, BC delete, Terminate
1038	LISTENING	--	--	[1504] c:\program files\symantec\symantec endpoint protection\smc.exe Script: Quarantine, Delete, BC delete, Terminate
1776	LISTENING	--	--	[2392] c:\program files\1e\wakeup\agent\wakeupagt.exe Script: Quarantine, Delete, BC delete, Terminate
1900	LISTENING	--	--	[1740] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
3098	LISTENING	--	--	[2384] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe Script: Quarantine, Delete, BC delete, Terminate
3099	LISTENING	--	--	[2384] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe Script: Quarantine, Delete, BC delete, Terminate
4500	LISTENING	--	--	[832] c:\windows\system32\lsass.exe Script: Quarantine, Delete, BC delete, Terminate
5353	LISTENING	--	--	[1952] c:\program files\bonjour\mdnsresponder.exe Script: Quarantine, Delete, BC delete, Terminate
39999	LISTENING	--	--	[1360] c:\program files\symantec\symantec endpoint protection\snac.exe Script: Quarantine, Delete, BC delete, Terminate
62514	LISTENING	--	--	[232] c:\program files\cisco systems\vpn client\cvpnd.exe Script: Quarantine, Delete, BC delete, Terminate