Kaspersky Virus Removal Tool 11.0.0.1245 (database released 07/08/2012; 11:50)
| File name | PID | Description | Copyright | MD5 | Information
| c:\program files\avast software\avast\avastsvc.exe | Script: Quarantine, Delete, BC delete, Terminate 1036 | avast! Service | Copyright (c) 2012 AVAST Software | ?? | 43.76 kb, rsAh, | created: 22.07.2012 12:32:04, modified: 03.07.2012 12:21:29 Command line: "C:\Program Files\AVAST Software\Avast\AvastSvc.exe" c:\program files\heavyweatherwv5\backend.exe | Script: Quarantine, Delete, BC delete, Terminate 2420 | WV5Communcation service | Copyright (C) 2009 | ?? | 1800.00 kb, rsAh, | created: 02.01.2011 17:25:54, modified: 19.05.2010 12:02:28 Command line: "C:\Program Files\HeavyWeatherWV5\BackEnd.exe" c:\documents and settings\marty\my documents\downloads\pc fix cleaner 2011 v3.0.6 [h33t.com] full\crack-laxity\pcfix.exe | Script: Quarantine, Delete, BC delete, Terminate 5672 | PC Fix 2011 | Registry Cleaner | Dubai Click LLC 2011 All rights reserved. | ?? | 1090.00 kb, rsAh, | created: 26.05.2012 22:32:57, modified: 26.05.2012 22:33:16 Command line: "C:\Documents and Settings\Marty\My Documents\Downloads\PC Fix Cleaner 2011 v3.0.6 [h33t.com] Full\Crack-LAXiTY\PCFix.exe" -scan Detected:67, recognized as trusted 65
| | |||||
| Module name | Handle | Description | Copyright | MD5 | Used by processes
| C:\Program Files\AVAST Software\Avast\defs\12080701\algo.dll | Script: Quarantine, Delete, BC delete 1665138688 | | | -- | 1036
| C:\Program Files\HeavyWeatherWV5\sHID.dll | Script: Quarantine, Delete, BC delete 268435456 | | | -- | 2420
| Modules detected:646, recognized as trusted 644
| | |||||
| Module | Base address | Size in memory | Description | Manufacturer
| C:\WINDOWS\System32\Drivers\dump_atapi.sys | Script: Quarantine, Delete, BC delete B0FAA000 | 018000 (98304) |
| C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS | Script: Quarantine, Delete, BC delete B85CC000 | 002000 (8192) |
| C:\WINDOWS\system32\Drivers\rikvm_B91CB6D3.sys | Script: Quarantine, Delete, BC delete B00E7000 | 1DA000 (1941504) |
| Modules detected - 164, recognized as trusted - 161
| | |||||||
| Service | Description | Status | File | Group | Dependencies
| WV5Communication | Service: Stop, Delete, Disable, BC delete WV5Communication | Running | C:\Program Files\HeavyWeatherWV5\BackEnd.exe | Script: Quarantine, Delete, BC delete |
| Detected - 135, recognized as trusted - 134
| | ||||||
| Service | Description | Status | File | Group | Dependencies
| Abiosdsk | Driver: Unload, Delete, Disable, BC delete Abiosdsk | Not started | Abiosdsk.sys | Script: Quarantine, Delete, BC delete Primary disk |
| abp480n5 | Driver: Unload, Delete, Disable, BC delete abp480n5 | Not started | abp480n5.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| adpu160m | Driver: Unload, Delete, Disable, BC delete adpu160m | Not started | adpu160m.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Aha154x | Driver: Unload, Delete, Disable, BC delete Aha154x | Not started | Aha154x.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| aic78u2 | Driver: Unload, Delete, Disable, BC delete aic78u2 | Not started | aic78u2.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| aic78xx | Driver: Unload, Delete, Disable, BC delete aic78xx | Not started | aic78xx.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| AliIde | Driver: Unload, Delete, Disable, BC delete AliIde | Not started | AliIde.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| amsint | Driver: Unload, Delete, Disable, BC delete amsint | Not started | amsint.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| asc | Driver: Unload, Delete, Disable, BC delete asc | Not started | asc.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| asc3350p | Driver: Unload, Delete, Disable, BC delete asc3350p | Not started | asc3350p.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| asc3550 | Driver: Unload, Delete, Disable, BC delete asc3550 | Not started | asc3550.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Atdisk | Driver: Unload, Delete, Disable, BC delete Atdisk | Not started | Atdisk.sys | Script: Quarantine, Delete, BC delete Primary disk |
| cd20xrnt | Driver: Unload, Delete, Disable, BC delete cd20xrnt | Not started | cd20xrnt.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Changer | Driver: Unload, Delete, Disable, BC delete Changer | Not started | Changer.sys | Script: Quarantine, Delete, BC delete Filter |
| CmdIde | Driver: Unload, Delete, Disable, BC delete CmdIde | Not started | CmdIde.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| Cpqarray | Driver: Unload, Delete, Disable, BC delete Cpqarray | Not started | Cpqarray.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| dac960nt | Driver: Unload, Delete, Disable, BC delete dac960nt | Not started | dac960nt.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| dpti2o | Driver: Unload, Delete, Disable, BC delete dpti2o | Not started | dpti2o.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| hpn | Driver: Unload, Delete, Disable, BC delete hpn | Not started | hpn.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| i2omgmt | Driver: Unload, Delete, Disable, BC delete i2omgmt | Not started | i2omgmt.sys | Script: Quarantine, Delete, BC delete SCSI Class |
| i2omp | Driver: Unload, Delete, Disable, BC delete i2omp | Not started | i2omp.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ini910u | Driver: Unload, Delete, Disable, BC delete ini910u | Not started | ini910u.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| IntelIde | Driver: Unload, Delete, Disable, BC delete IntelIde | Not started | IntelIde.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| lbrtfdc | Driver: Unload, Delete, Disable, BC delete lbrtfdc | Not started | lbrtfdc.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| MCSTRM | Driver: Unload, Delete, Disable, BC delete MCSTRM | Not started | MCSTRM.sys | Script: Quarantine, Delete, BC delete MCSTRM |
| mraid35x | Driver: Unload, Delete, Disable, BC delete mraid35x | Not started | mraid35x.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| NgFilter | Driver: Unload, Delete, Disable, BC delete Aventail VPN Filter | Not started | NgFilter.sys | Script: Quarantine, Delete, BC delete |
| NgLog | Driver: Unload, Delete, Disable, BC delete Aventail VPN Logging | Not started | NgLog.sys | Script: Quarantine, Delete, BC delete |
| NgVpn | Driver: Unload, Delete, Disable, BC delete Aventail VPN Adapter | Not started | NgVpn.sys | Script: Quarantine, Delete, BC delete NDIS |
| NgWfp | Driver: Unload, Delete, Disable, BC delete Aventail VPN Callout | Not started | NgWfp.sys | Script: Quarantine, Delete, BC delete |
| PCIDump | Driver: Unload, Delete, Disable, BC delete PCIDump | Not started | PCIDump.sys | Script: Quarantine, Delete, BC delete PCI Configuration |
| PDCOMP | Driver: Unload, Delete, Disable, BC delete PDCOMP | Not started | PDCOMP.sys | Script: Quarantine, Delete, BC delete |
| PDFRAME | Driver: Unload, Delete, Disable, BC delete PDFRAME | Not started | PDFRAME.sys | Script: Quarantine, Delete, BC delete |
| PDRELI | Driver: Unload, Delete, Disable, BC delete PDRELI | Not started | PDRELI.sys | Script: Quarantine, Delete, BC delete |
| PDRFRAME | Driver: Unload, Delete, Disable, BC delete PDRFRAME | Not started | PDRFRAME.sys | Script: Quarantine, Delete, BC delete |
| perc2 | Driver: Unload, Delete, Disable, BC delete perc2 | Not started | perc2.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| perc2hib | Driver: Unload, Delete, Disable, BC delete perc2hib | Not started | perc2hib.sys | Script: Quarantine, Delete, BC delete Filter |
| ql1080 | Driver: Unload, Delete, Disable, BC delete ql1080 | Not started | ql1080.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Ql10wnt | Driver: Unload, Delete, Disable, BC delete Ql10wnt | Not started | Ql10wnt.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ql12160 | Driver: Unload, Delete, Disable, BC delete ql12160 | Not started | ql12160.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ql1240 | Driver: Unload, Delete, Disable, BC delete ql1240 | Not started | ql1240.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ql1280 | Driver: Unload, Delete, Disable, BC delete ql1280 | Not started | ql1280.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| SDDMI2 | Driver: Unload, Delete, Disable, BC delete SDDMI2 | Not started | SDDMI2.sys | Script: Quarantine, Delete, BC delete |
| Simbad | Driver: Unload, Delete, Disable, BC delete Simbad | Not started | Simbad.sys | Script: Quarantine, Delete, BC delete Filter |
| Sparrow | Driver: Unload, Delete, Disable, BC delete Sparrow | Not started | Sparrow.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| sym_hi | Driver: Unload, Delete, Disable, BC delete sym_hi | Not started | sym_hi.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| sym_u3 | Driver: Unload, Delete, Disable, BC delete sym_u3 | Not started | sym_u3.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| symc810 | Driver: Unload, Delete, Disable, BC delete symc810 | Not started | symc810.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| symc8xx | Driver: Unload, Delete, Disable, BC delete symc8xx | Not started | symc8xx.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| TosIde | Driver: Unload, Delete, Disable, BC delete TosIde | Not started | TosIde.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| ultra | Driver: Unload, Delete, Disable, BC delete ultra | Not started | ultra.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ViaIde | Driver: Unload, Delete, Disable, BC delete ViaIde | Not started | ViaIde.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| WDICA | Driver: Unload, Delete, Disable, BC delete WDICA | Not started | WDICA.sys | Script: Quarantine, Delete, BC delete |
| Detected - 233, recognized as trusted - 180
| | ||||||
| File name | Status | Startup method | Description
| C:\Documents and Settings\Marty\Local Settings\Application Data\Apple Computer\Apple\mgxtn.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-19_Classes\Software\Microsoft\Windows\CurrentVersion\Run, Apple | Delete C:\Documents and Settings\Marty\Local Settings\Application Data\Apple Computer\Apple\mgxtn.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-20_Classes\Software\Microsoft\Windows\CurrentVersion\Run, Apple | Delete C:\Documents and Settings\Marty\Local Settings\temp\_uninst_91272838.bat | Script: Quarantine, Delete, BC delete Active | Shortcut in Autoruns folder | C:\Documents and Settings\Marty\Start Menu\Programs\Startup\, C:\Documents and Settings\Marty\Start Menu\Programs\Startup\_uninst_91272838.lnk,
| C:\Documents and Settings\Marty\My Documents\Downloads\PC Fix Cleaner 2011 v3.0.6 [h33t.com] Full\Crack-LAXiTY\PCFix.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, PCFix | Delete C:\WINDOWS\System32\Drivers\AliIde.sys | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\aliide, EventMessageFile
| C:\WINDOWS\System32\Drivers\CmdIde.sys | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\cmdide, EventMessageFile
| C:\WINDOWS\System32\Drivers\IntelIde.sys | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\intelide, EventMessageFile
| C:\WINDOWS\System32\Drivers\TosIde.sys | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\toside, EventMessageFile
| C:\WINDOWS\System32\Drivers\ViaIde.sys | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\viaide, EventMessageFile
| C:\WINDOWS\System32\Drivers\lbrtfdc.sys | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\lbrtfdc, EventMessageFile
| C:\WINDOWS\System32\PrintFilterPipelineSvc.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PrintFilterPipelineSvc, EventMessageFile
| C:\WINDOWS\System32\igmpv2.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile
| C:\WINDOWS\System32\ipbootp.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile
| C:\WINDOWS\System32\iprip2.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile
| C:\WINDOWS\System32\ospf.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPF, EventMessageFile
| C:\WINDOWS\System32\ospfmib.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPFMib, EventMessageFile
| C:\WINDOWS\System32\polagent.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PolicyAgent, EventMessageFile
| C:\WINDOWS\System32\tssdis.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\TermServSessDir, EventMessageFile
| C:\WINDOWS\system32\AegisE5.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\AegisP, EventMessageFile
| C:\WINDOWS\system32\MsSip1.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 1, $DLL | Delete C:\WINDOWS\system32\MsSip2.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 2, $DLL | Delete C:\WINDOWS\system32\MsSip3.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 3, $DLL | Delete C:\WINDOWS\system32\psxss.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
| C:\WINDOWS\system32\stisvc.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System, EventMessageFile
| LCODCCMP.DLL | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, vidc.LEAD | Delete SDEvents.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Spybot - Search & Destroy 2, EventMessageFile
| SDWinLogon.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SDWinLogon, DLLName | Delete c:\16100828e1c29876ca443ad22ecf78\wgasetup.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\WgaSetup, EventMessageFile
| kbd101.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver JPN | Delete kbd101a.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver KOR | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, .DEFAULT\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-19\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-20\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-18\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-21-1202660629-343818398-725345543-1003\Control Panel\IOProcs, MVB | Delete vgafix.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon | Delete vgaoem.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon | Delete vgasys.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon | Delete Autoruns items detected - 1000, recognized as trusted - 962
| | ||||||
| File name | Type | Description | Manufacturer | CLSID
| C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll | Script: Quarantine, Delete, BC delete BHO | {02478D38-C3F9-4efb-9B51-7695ECA05670} | Delete BHO | {5C255C8A-E604-49b4-9D64-90988571CECB} | Delete C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll | Script: Quarantine, Delete, BC delete BHO | {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} | Delete C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll | Script: Quarantine, Delete, BC delete Toolbar | {EF99BD32-C1FB-11D2-892F-0090271D4F88} | Delete Extension module | {2670000A-7350-4f3c-8081-5663EE0C6C49} | Delete Extension module | {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} | Delete Extension module | {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} | Delete Extension module | {92780B25-18CC-41C8-B9BE-3C9C571A8263} | Delete Extension module | {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} | Delete URLSearchHook | {2558d83c-097c-4cf1-9163-ce5ecc36ace2} | Delete C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll | Script: Quarantine, Delete, BC delete URLSearchHook | {EF99BD32-C1FB-11D2-892F-0090271D4F88} | Delete Elements detected - 33, recognized as trusted - 22
| | |||||||||||||||||||||||||||||||||||
| File name | Destination | Description | Manufacturer | CLSID
| Display Panning CPL Extension | {42071714-76d4-11d1-8b24-00a0c9068ff3} | Delete Shell extensions for file compression | {764BF0E1-F219-11ce-972D-00AA00A14F56} | Delete Encryption Context Menu | {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} | Delete Taskbar and Start Menu | {0DF44EAA-FF21-4412-828E-260A8728E7F1} | Delete User Accounts | {7A9D77BD-5403-11d2-8785-2E0420524153} | Delete IE User Assist | {FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} | Delete Windows Search Shell Service | {da67b8ad-e81b-4c70-9b91b417b5e33527} | Delete {CF0E379A-B19F-49ce-9EE1-04F3C374E129} | WinZip System Utilities Suite - SecureDeleteShellExt extension | Delete Elements detected - 243, recognized as trusted - 235
| | ||||||||||||||||||||||||||||||
| File name | Type | Name | Description | Manufacturer
| Elements detected - 12, recognized as trusted - 12
| | ||||||
| File name | Job name | Job status | Description | Manufacturer
| C:\Documents and Settings\Marty\My Documents\Downloads\PC Fix Cleaner 2011 v3.0.6 [h33t.com] Full\Crack-LAXiTY\PCFix.exe | Script: Quarantine, Delete, BC delete PCFix.job | The task is currently running. | PC Fix 2011 | Registry Cleaner | Dubai Click LLC 2011 All rights reserved.
| Elements detected - 14, recognized as trusted - 13
| | ||||||
| Provider | Status | EXE file | Description | GUID
| Detected - 6, recognized as trusted - 6
| | ||||||
| Provider | EXE file | Description
| Detected - 44, recognized as trusted - 44
| | ||||||
| File name | Description | Manufacturer | CLSID | Source URL
| Garmin Communicator Plug-In | Delete https://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB
| {E2883E8F-472F-4FB0-9522-AC9BF37916A7} | Delete http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
| Elements detected - 14, recognized as trusted - 12
| | ||||||||||||
| File name | Description | Manufacturer
| Elements detected - 33, recognized as trusted - 33
| | ||||||
| File name | Description | Manufacturer | CLSID
| Elements detected - 16, recognized as trusted - 16
| | ||||||
Hosts file record
|
| File name | Type | Description | Manufacturer | CLSID
| mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D} | Delete mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D} | Delete mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D} | Delete Elements detected - 33, recognized as trusted - 30
| | ||||||
| File | Description | Type
| C:\WINDOWS\System32\Drivers\aswSnx.SYS | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| C:\WINDOWS\system32\DRIVERS\7733022drv.sys | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| C:\WINDOWS\System32\Drivers\aswSP.SYS | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| \SystemRoot\System32\Drivers\aswSP.SYS | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| \SystemRoot\system32\DRIVERS\7733022drv.sys | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| |
Main script of analysis Windows version: Microsoft Windows XP, Build=2600, SP="Service Pack 3" System Restore: enabled 1.1 Searching for user-mode API hooks Analysis: kernel32.dll, export table found in section .text IAT modification detected: CreateProcessA - 00B90010<>7C80236B IAT modification detected: GetModuleFileNameA - 00B90080<>7C80B56F IAT modification detected: FreeLibrary - 00B900F0<>7C80AC7E IAT modification detected: GetModuleFileNameW - 00B90160<>7C80B475 IAT modification detected: CreateProcessW - 00B901D0<>7C802336 IAT modification detected: LoadLibraryW - 00B902B0<>7C80AEEB IAT modification detected: LoadLibraryA - 00B90320<>7C801D7B IAT modification detected: GetProcAddress - 00B90390<>7C80AE40 Analysis: ntdll.dll, export table found in section .text Function ntdll.dll:LdrLoadDll (70) intercepted, method APICodeHijack.JmpTo[001501EE] Function ntdll.dll:LdrUnloadDll (80) intercepted, method APICodeHijack.JmpTo[001503F2] Analysis: user32.dll, export table found in section .text Function user32.dll:SetWinEventHook (639) intercepted, method APICodeHijack.JmpTo[003D01EE] Function user32.dll:SetWindowsHookExA (651) intercepted, method APICodeHijack.JmpTo[003D05F6] Function user32.dll:SetWindowsHookExW (652) intercepted, method APICodeHijack.JmpTo[003D07FA] Function user32.dll:UnhookWinEvent (685) intercepted, method APICodeHijack.JmpTo[003D03F2] Function user32.dll:UnhookWindowsHookEx (687) intercepted, method APICodeHijack.JmpTo[003D09FE] Analysis: advapi32.dll, export table found in section .text Function advapi32.dll:ChangeServiceConfig2A (54) intercepted, method APICodeHijack.JmpTo[003C0C02] Function advapi32.dll:ChangeServiceConfig2W (55) intercepted, method APICodeHijack.JmpTo[003C0E06] Function advapi32.dll:ChangeServiceConfigA (56) intercepted, method APICodeHijack.JmpTo[003C07FA] Function advapi32.dll:ChangeServiceConfigW (57) intercepted, method APICodeHijack.JmpTo[003C09FE] Function advapi32.dll:CreateServiceA (102) intercepted, method APICodeHijack.JmpTo[003C01EE] Function advapi32.dll:CreateServiceW (103) intercepted, method APICodeHijack.JmpTo[003C03F2] Function advapi32.dll:DeleteService (177) intercepted, method APICodeHijack.JmpTo[003C05F6] Function advapi32.dll:SetServiceObjectSecurity (572) intercepted, method APICodeHijack.JmpTo[003C100A] Analysis: ws2_32.dll, export table found in section .text Analysis: wininet.dll, export table found in section .text Analysis: rasapi32.dll, export table found in section .text Analysis: urlmon.dll, export table found in section .text Analysis: netapi32.dll, export table found in section .text 1.2 Searching for kernel-mode API hooks Driver loaded successfully SDT found (RVA=085700) Kernel ntkrnlpa.exe found in memory at address 804D7000 SDT = 8055C700 KiST = 80504494 (284) Function NtAddBootEntry (09) intercepted (80616E50->B1728536), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtAdjustPrivilegesToken (0B) intercepted (805EC336->AD799690), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtAllocateVirtualMemory (11) intercepted (805A8AC2->B17F97BA), hook C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtAssignProcessToJobObject (13) intercepted (805D66A0->B1728F52), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtClose (19) intercepted (805BC538->AD799F94), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtConnectPort (1F) intercepted (805A45D8->AD79ADC8), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateEvent (23) intercepted (8060EE4C->AD79B312), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateEventPair (24) intercepted (80617196->B1733DC6), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateFile (25) intercepted (805790A2->AD79A270), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateIoCompletion (26) intercepted (80578A80->B1733F48), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateKey (29) intercepted (80623FD6->AD798500), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateMutant (2B) intercepted (8061758E->AD79B1F8), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateNamedPipeFile (2C) intercepted (805790DC->AD79927E), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreatePort (2E) intercepted (805A50F4->AD79B0CC), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateProcessEx (30) - machine code modification Method of JmpTo. jmp B1811748\SystemRoot\System32\Drivers\aswSP.SYS, driver recognized as trusted >>> Function restored successfully ! Function NtCreateSection (32) intercepted (805AB3D0->AD799426), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateSemaphore (33) intercepted (80614F4C->AD79B432), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateThread (35) intercepted (805D1038->AD799C1C), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateTimer (36) intercepted (80616E5E->B1733F02), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateWaitablePort (38) intercepted (805A5118->AD79B162), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDebugActiveProcess (39) intercepted (80643A1C->AD79CB1A), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeleteBootEntry (3D) intercepted (805C8678->B1728584), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeleteKey (3F) intercepted (80624472->AD798B0A), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeleteValueKey (41) intercepted (80624642->AD798EBE), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeviceIoControlFile (42) intercepted (80579268->AD79A6F2), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDuplicateObject (44) intercepted (805BE010->AD79DD26), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtEnumerateKey (47) intercepted (80624822->AD79900A), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtEnumerateValueKey (49) intercepted (80624A8C->AD7990A2), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtFreeVirtualMemory (53) intercepted (805B2FBA->B17F989E), hook C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtFsControlFile (54) intercepted (8057929C->AD79A500), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtLoadDriver (61) intercepted (80584172->AD79CC0C), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtLoadKey (62) intercepted (806261FA->AD7984DC), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtLoadKey2 (63) intercepted (80625E06->AD7984EE), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtMapViewOfSection (6C) intercepted (805B2042->AD79D374), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtModifyBootEntry (6D) intercepted (805C8678->B17285D2), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtNotifyChangeKey (6F) intercepted (806261C4->AD7991CE), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtNotifyChangeMultipleKeys (70) intercepted (80624DF8->B172A292), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenEvent (72) intercepted (8060EF4C->AD79B3A8), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenEventPair (73) intercepted (8061726E->B1733DE8), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenFile (74) intercepted (8057A1A0->AD79A016), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenIoCompletion (75) intercepted (80578B58->B1733F6C), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenKey (77) intercepted (806253B4->AD7986C0), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenMutant (78) intercepted (80617666->AD79B288), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenProcess (7A) intercepted (805CB456->AD7998CC), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenSection (7D) intercepted (805AA3F4->AD79D10E), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenSemaphore (7E) intercepted (80615046->AD79B4C8), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenThread (80) intercepted (805CB6E2->AD7997BE), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenTimer (83) intercepted (80616F80->B1733F26), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtProtectVirtualMemory (89) intercepted (805B8426->B17F9A1E), hook C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueryKey (A0) intercepted (806256F6->AD79913A), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueryMultipleValueKey (A1) intercepted (80623124->AD798D72), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueryObject (A3) intercepted (805C52D4->B172A15E), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQuerySection (A7) intercepted (805B85E8->AD79D6AE), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueryValueKey (B1) intercepted (806221FA->AD79899C), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueueApcThread (B4) intercepted (805D2756->AD79CFA0), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtRenameKey (C0) intercepted (806239F8->AD798C2C), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtReplaceKey (C1) intercepted (806260AA->AD797F16), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtReplyPort (C2) intercepted (805A54F4->AD79B82C), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtReplyWaitReceivePort (C3) intercepted (805A64BC->AD79B6F2), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtRequestWaitReplyPort (C8) intercepted (805A2D7E->AD79C8B4), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtRestoreKey (CC) intercepted (806259B6->AD79828E), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtResumeThread (CE) intercepted (805D4A18->AD79DBC8), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSaveKey (CF) intercepted (80625AB2->AD797EAE), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSecureConnectPort (D2) intercepted (805A3D6C->AD79AB0E), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetBootEntryOrder (D3) intercepted (80616E50->B1728620), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetBootOptions (D4) intercepted (80616E50->B172866E), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetContextThread (D5) intercepted (805D2C1A->AD799E38), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetInformationToken (E6) intercepted (805FA686->AD79C154), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetSecurityObject (ED) intercepted (805C0636->AD79CDAA), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetSystemInformation (F0) intercepted (8060FC04->AD79D7FE), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetSystemPowerState (F1) intercepted (80653E18->B1728426), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetValueKey (F7) intercepted (80622548->AD798816), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtShutdownSystem (F9) intercepted (80612E8E->B17283CC), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSuspendProcess (FD) intercepted (805D4AE0->AD79D8F0), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSuspendThread (FE) intercepted (805D4952->AD79DA2A), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSystemDebugControl (FF) intercepted (80617FAA->AD79CA3E), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtTerminateProcess (101) intercepted (805D22D8->AD799A68), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtTerminateThread (102) intercepted (805D24D2->AD7999C8), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtUnmapViewOfSection (10B) intercepted (805B2E50->AD79D552), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtVdmControl (10C) intercepted (805FBA3E->B17286BC), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtWriteVirtualMemory (115) intercepted (805B43D4->AD799B52), hook C:\WINDOWS\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function FsRtlCheckLockForReadAccess (804EAF84) - machine code modification Method of JmpTo. jmp AD78BFD0 \SystemRoot\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! Function IoIsOperationSynchronous (804EF92C) - machine code modification Method of JmpTo. jmp AD78C3AC \SystemRoot\system32\DRIVERS\7733022drv.sys, driver recognized as trusted >>> Function restored successfully ! Function ObInsertObject (805C2FE2) - machine code modification Method of JmpTo. jmp B18100FE \SystemRoot\System32\Drivers\aswSP.SYS, driver recognized as trusted >>> Function restored successfully ! Function ObMakeTemporaryObject (805BC55E) - machine code modification Method of JmpTo. jmp B180E61C \SystemRoot\System32\Drivers\aswSP.SYS, driver recognized as trusted >>> Function restored successfully ! Functions checked: 284, intercepted: 80, restored: 85 1.3 Checking IDT and SYSENTER Analysis for CPU 1 Analysis for CPU 2 CmpCallCallBacks = 00093D84 Disable callback OK Checking IDT and SYSENTER - complete 1.4 Searching for masking processes and drivers Checking not performed: extended monitoring driver (AVZPM) is not installed 1.5 Checking of IRP handlers Driver loaded successfully \FileSystem\ntfs[IRP_MJ_CREATE] = B1811262 -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted \FileSystem\ntfs[IRP_MJ_CLOSE] = B18112A2 -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted \FileSystem\ntfs[IRP_MJ_WRITE] = B181136A -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted \FileSystem\ntfs[IRP_MJ_SET_INFORMATION] = B18113AA -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted Checking - complete >> Services: potentially dangerous service allowed: RemoteRegistry (Remote Registry) >> Services: potentially dangerous service allowed: TermService (Terminal Services) >> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery Service) >> Services: potentially dangerous service allowed: TlntSvr (Telnet) >> Services: potentially dangerous service allowed: Schedule (Task Scheduler) >> Services: potentially dangerous service allowed: mnmsrvc (NetMeeting Remote Desktop Sharing) >> Services: potentially dangerous service allowed: RDSessMgr (Remote Desktop Help Session Manager) > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)! >> Security: disk drives' autorun is enabled >> Security: administrative shares (C$, D$ ...) are enabled >> Security: anonymous user access is enabled >> Disable HDD autorun >> Disable autorun from network drives >> Disable CD/DVD autorun >> Disable removable media autorun >> Windows Explorer - show extensions of known file types System Analysis in progressAdd commands to script:
System Analysis - complete
Script commands