Results of system analysis

Kaspersky Virus Removal Tool 11.0.0.1245 (database released 23/08/2012; 10:12)

List of processes

File namePIDDescriptionCopyrightMD5Information
c:\program files (x86)\freemake\capturelib\capturelibservice.exe
Script: Quarantine, Delete, BC delete, Terminate		1308CaptureLibServiceCopyright © Microsoft 2011??8.50 kb, rsAh,
created: 10.04.2012 14:08:51,
modified: 05.04.2012 20:18:12
Command line:
"C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe"
FolderSizeSvc.exe
Script: Quarantine, Delete, BC delete, Terminate		508  ??error getting file info
Command line:
ipoint.exe
Script: Quarantine, Delete, BC delete, Terminate		1404  ??error getting file info
Command line:
itype.exe
Script: Quarantine, Delete, BC delete, Terminate		2572  ??error getting file info
Command line:
RAVCpl64.exe
Script: Quarantine, Delete, BC delete, Terminate		2472  ??error getting file info
Command line:
SASCORE64.EXE
Script: Quarantine, Delete, BC delete, Terminate		1860  ??error getting file info
Command line:
c:\program files (x86)\screensaver control\screensavercontrol.exe
Script: Quarantine, Delete, BC delete, Terminate		1548 (C) 2003-2005 Neuhaus13 Software??210.00 kb, rsAh,
created: 29.08.2010 17:41:47,
modified: 29.08.2010 17:41:47
Command line:
"C:\Program Files (x86)\Screensaver Control\ScreensaverControl.exe"
wmpnetwk.exe
Script: Quarantine, Delete, BC delete, Terminate		3580  ??error getting file info
Command line:
Detected:67, recognized as trusted 60
Module nameHandleDescriptionCopyrightMD5Used by processes
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuratio#\0a0d6610975706aee94ec9f44191bab8\System.Configuration.Install.ni.dll
Script: Quarantine, Delete, BC delete		1910702080.NET Framework© Microsoft Corporation. All rights reserved.--1308
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\4f8ecf03aa4a4165e6850d1d67dc445f\System.ServiceModel.ni.dll
Script: Quarantine, Delete, BC delete		1833500672System.ServiceModel.dll© Microsoft Corporation. All rights reserved.--1308
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\9ae3a257c347602d42ab80bb7a5ca3bb\System.ServiceProcess.ni.dll
Script: Quarantine, Delete, BC delete		1913389056.NET Framework© Microsoft Corporation. All rights reserved.--1308
Modules detected:346, recognized as trusted 343

Kernel Space Modules Viewer

ModuleBase addressSize in memoryDescriptionManufacturer
C:\Windows\system32\DRIVERS\15766360.sys
Script: Quarantine, Delete, BC delete		101600075F000 (7729152)
C:\Windows\System32\Drivers\dump_atapi.sys
Script: Quarantine, Delete, BC delete		57CB000009000 (36864)
C:\Windows\System32\Drivers\dump_dumpata.sys
Script: Quarantine, Delete, BC delete		5A0000000C000 (49152)
C:\Windows\System32\Drivers\dump_dumpfve.sys
Script: Quarantine, Delete, BC delete		57D4000013000 (77824)
Modules detected - 213, recognized as trusted - 209

Services

ServiceDescriptionStatusFileGroupDependencies
WatAdminSvc
Service: Stop, Delete, Disable, BC delete		WatAdminSvcNot startedC:\Windows\system32\Wat\WatAdminSvc.exe
Script: Quarantine, Delete, BC delete		  
Detected - 163, recognized as trusted - 162

Drivers

ServiceDescriptionStatusFileGroupDependencies
catchme
Driver: Unload, Delete, Disable, BC delete		catchmeNot startedC:\ComboFix\catchme.sys
Script: Quarantine, Delete, BC delete		Base 
gdrv
Driver: Unload, Delete, Disable, BC delete		gdrvNot startedC:\Windows\gdrv.sys
Script: Quarantine, Delete, BC delete		  
Lavasoft Kernexplorer
Driver: Unload, Delete, Disable, BC delete		Lavasoft helper driverNot startedC:\Program Files (x86)\Lavasoft\Ad-Aware\KernExplorer64.sys
Script: Quarantine, Delete, BC delete		  
StarOpen
Driver: Unload, Delete, Disable, BC delete		StarOpenNot startedC:\Windows\system32\Drivers\StarOpen.sys
Script: Quarantine, Delete, BC delete		Extended Base 
Synth3dVsc
Driver: Unload, Delete, Disable, BC delete		Synth3dVscNot startedC:\Windows\system32\drivers\synth3dvsc.sys
Script: Quarantine, Delete, BC delete		  
tsusbhub
Driver: Unload, Delete, Disable, BC delete		tsusbhubNot startedC:\Windows\system32\drivers\tsusbhub.sys
Script: Quarantine, Delete, BC delete		  
VGPU
Driver: Unload, Delete, Disable, BC delete		VGPUNot startedC:\Windows\system32\drivers\rdvgkmd.sys
Script: Quarantine, Delete, BC delete		  
Detected - 276, recognized as trusted - 269

Autoruns

File nameStatusStartup methodDescription
C:\Microgaming\Poker\LadbrokesMPP\MPPoker.exe
Script: Quarantine, Delete, BC delete		ActiveShortcut in Autoruns folderC:\Users\Rob\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\, C:\Users\Rob\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Ladbrokes Poker.lnk,
C:\Program Files (x86)\Screensaver Control\ScreensaverControl.exe
Script: Quarantine, Delete, BC delete		ActiveRegistry keyHKEY_USERS, S-1-5-21-2469048996-4267459674-1519352151-1001\Software\Microsoft\Windows\CurrentVersion\Run, ScreensaverControl
Delete
C:\Program Files\Microsoft Device Center\dw15.exe
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\IntelliType Pro, EventMessageFile
C:\Users\Rob\AppData\Local\temp\_uninst_68645397.bat
Script: Quarantine, Delete, BC delete		ActiveShortcut in Autoruns folderC:\Users\Rob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\, C:\Users\Rob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_uninst_68645397.lnk,
C:\Windows\system32\Wat\WatUX.exe
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Windows Activation Technologies, EventMessageFile
C:\Windows\system32\drivers\NIS\1308000.00E\SYMEFA64.SYS
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\SymEFA, EventMessageFile
C:\Windows\system32\psxss.exe
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
D:\a399d26981367fbd2c65153a\DW\DW20.exe
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\VSSetup, EventMessageFile
auditcse.dll
Script: Quarantine, Delete, BC delete		ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{f3ccc681-b74c-4060-9f26-cd84525dca2a}, DLLName
Delete
rdpclip
Script: Quarantine, Delete, BC delete		ActiveRegistry keyHKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd, StartupPrograms
Delete
Autoruns items detected - 624, recognized as trusted - 614

Microsoft Internet Explorer extension modules (BHOs, Toolbars ...)

File nameTypeDescriptionManufacturerCLSID
Elements detected - 6, recognized as trusted - 6

Windows Explorer extension modules

File nameDestinationDescriptionManufacturerCLSID
WinRAR shell extension{B41DB860-8EE4-11D2-9906-E49FADC173CA}
Delete
{4380C993-0C43-4E02-9A7A-0D40B6EA7590}DefragglerShellExtension
Delete
ColumnHandler{F9DB5320-233E-11D1-9F84-707F02C10627}
Delete
Elements detected - 24, recognized as trusted - 21

Printing system extensions (print monitors, providers)

File nameTypeNameDescriptionManufacturer
CNBLM3_2.DLL
Script: Quarantine, Delete, BC delete		MonitorBJ Language Monitor3_2
CNBLM4.DLL
Script: Quarantine, Delete, BC delete		MonitorBJ Language Monitor4
CNMLM7K.DLL
Script: Quarantine, Delete, BC delete		MonitorCanon BJ Language Monitor MP150
localspl.dll
Script: Quarantine, Delete, BC delete		MonitorLocal Port
tcpmon.dll
Script: Quarantine, Delete, BC delete		MonitorStandard TCP/IP Port
usbmon.dll
Script: Quarantine, Delete, BC delete		MonitorUSB Monitor
WSDMon.dll
Script: Quarantine, Delete, BC delete		MonitorWSD Port
inetpp.dll
Script: Quarantine, Delete, BC delete		ProviderHTTP Print Services
Elements detected - 10, recognized as trusted - 2

Task Scheduler jobs

File nameJob nameJob statusDescriptionManufacturer
Elements detected - 5, recognized as trusted - 5

SPI/LSP settings

Namespace providers (NSP)
ProviderStatusEXE fileDescriptionGUID
Detected - 8, recognized as trusted - 8
Transport protocol providers (TSP, LSP)
ProviderEXE fileDescription
Detected - 10, recognized as trusted - 10
Results of automatic SPI settings check 
LSP settings checked. No errors detected

TCP/UDP ports

PortStatusRemote HostRemote PortApplicationNotes
TCP ports
135LISTENING0.0.0.00[808] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
139LISTENING0.0.0.00[4] System
Script: Quarantine, Delete, BC delete, Terminate		 
445LISTENING0.0.0.00[4] System
Script: Quarantine, Delete, BC delete, Terminate		 
554LISTENING0.0.0.00[3580] wmpnetwk.exe
Script: Quarantine, Delete, BC delete, Terminate		 
2552LISTENING0.0.0.00[1096] c:\program files (x86)\wifi protector\wifiprotservice.exe
Script: Quarantine, Delete, BC delete, Terminate		 
2869LISTENING0.0.0.00[4] System
Script: Quarantine, Delete, BC delete, Terminate		 
5357LISTENING0.0.0.00[4] System
Script: Quarantine, Delete, BC delete, Terminate		 
10243LISTENING0.0.0.00[4] System
Script: Quarantine, Delete, BC delete, Terminate		 
49152LISTENING0.0.0.00[500] wininit.exe
Script: Quarantine, Delete, BC delete, Terminate		 
49153LISTENING0.0.0.00[936] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
49154LISTENING0.0.0.00[120] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
49155LISTENING0.0.0.00[1580] spoolsv.exe
Script: Quarantine, Delete, BC delete, Terminate		 
49156LISTENING0.0.0.00[564] services.exe
Script: Quarantine, Delete, BC delete, Terminate		 
49157LISTENING0.0.0.00[572] lsass.exe
Script: Quarantine, Delete, BC delete, Terminate		 
49182LISTENING0.0.0.00[1200] c:\program files (x86)\norton internet security\engine\19.8.0.14\ccsvchst.exe
Script: Quarantine, Delete, BC delete, Terminate		 
50120TIME_WAIT88.221.88.1080[0]   
50131TIME_WAIT63.140.61.153443[0]   
50144ESTABLISHED62.254.26.198443[2072] c:\users\rob\appdata\local\google\chrome\application\chrome.exe
Script: Quarantine, Delete, BC delete, Terminate		 
50166TIME_WAIT84.53.132.7580[0]   
50215TIME_WAIT192.168.0.180[0]   
50216ESTABLISHED173.194.34.131443[2072] c:\users\rob\appdata\local\google\chrome\application\chrome.exe
Script: Quarantine, Delete, BC delete, Terminate		 
50221TIME_WAIT192.168.0.180[0]   
50222TIME_WAIT192.168.0.180[0]   
50223TIME_WAIT192.168.0.180[0]   
50224TIME_WAIT192.168.0.180[0]   
50225TIME_WAIT192.168.0.180[0]   
50226TIME_WAIT192.168.0.180[0]   
50227ESTABLISHED173.194.34.13180[2072] c:\users\rob\appdata\local\google\chrome\application\chrome.exe
Script: Quarantine, Delete, BC delete, Terminate		 
UDP ports
137LISTENING----[4] System
Script: Quarantine, Delete, BC delete, Terminate		 
138LISTENING----[4] System
Script: Quarantine, Delete, BC delete, Terminate		 
500LISTENING----[120] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1900LISTENING----[1980] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1900LISTENING----[1980] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
3544LISTENING----[120] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
3702LISTENING----[1980] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
3702LISTENING----[420] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
3702LISTENING----[1980] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
3702LISTENING----[420] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
4500LISTENING----[120] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
5004LISTENING----[3580] wmpnetwk.exe
Script: Quarantine, Delete, BC delete, Terminate		 
5005LISTENING----[3580] wmpnetwk.exe
Script: Quarantine, Delete, BC delete, Terminate		 
5355LISTENING----[1432] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
53839LISTENING----[1980] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
53840LISTENING----[1980] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
54880LISTENING----[420] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
56955LISTENING----[120] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
58337LISTENING----[420] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
62712LISTENING----[1980] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 

Downloaded Program Files (DPF)

File nameDescriptionManufacturerCLSIDSource URL
Elements detected - 0, recognized as trusted - 0

Control Panel Applets (CPL)

File nameDescriptionManufacturer
C:\Windows\system32\FlashPlayerCPLApp.cpl
Script: Quarantine, Delete, BC delete		Adobe Flash Player Control Panel AppletCopyright © 1996 Adobe Systems Incorporated. All Rights Reserved. Adobe and Flash are either trademarks or registered trademarks in the United States and/or other countries.
C:\Windows\system32\PCWizard.cpl
Script: Quarantine, Delete, BC delete		PC Wizard Control Panel Applet© 1996-2012 Laurent KUTIL & Franck DELATTRE
Elements detected - 20, recognized as trusted - 18

Active Setup

File nameDescriptionManufacturerCLSID
Elements detected - 9, recognized as trusted - 9

HOSTS file

Hosts file record 
127.0.0.1       localhost
Clear Hosts file

Protocols and handlers

File nameTypeDescriptionManufacturerCLSID
mscoree.dll
Script: Quarantine, Delete, BC delete		ProtocolMicrosoft .NET Runtime Execution Engine ()© Microsoft Corporation. All rights reserved.{1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, BC delete		ProtocolMicrosoft .NET Runtime Execution Engine ()© Microsoft Corporation. All rights reserved.{1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, BC delete		ProtocolMicrosoft .NET Runtime Execution Engine ()© Microsoft Corporation. All rights reserved.{1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
Elements detected - 14, recognized as trusted - 11

Suspicious objects

FileDescriptionType 

Main script of analysis
Windows version: Windows 7 Ultimate, Build=7601, SP="Service Pack 1"
System Restore: enabled
>> Services: potentially dangerous service allowed: RemoteRegistry (@regsvc.dll,-1)
>> Services: potentially dangerous service allowed: TermService (@%SystemRoot%\System32\termsrv.dll,-268)
>> Services: potentially dangerous service allowed: SSDPSRV (@%systemroot%\system32\ssdpsrv.dll,-100)
>> Services: potentially dangerous service allowed: TlntSvr ()
>> Services: potentially dangerous service allowed: Schedule (@%SystemRoot%\system32\schedsvc.dll,-100)
> Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)!
>> Security: disk drives' autorun is enabled
>> Security: administrative shares (C$, D$ ...) are enabled
>> Security: anonymous user access is enabled
>> Security: sending Remote Assistant queries is enabled
 >>  Disable HDD autorun
 >>  Disable autorun from network drives
 >>  Disable CD/DVD autorun
 >>  Disable removable media autorun
 >>  Windows Explorer - show extensions of known file types
System Analysis in progress

 System Analysis - complete


Script commands
 

Add commands to script:
Additional operations:

File list