Results of system analysis

Kaspersky Virus Removal Tool 11.0.0.1245 (database released 12/03/2013; 20:46)

List of processes

File name	PID	Description	Copyright	MD5	Information
ehmsas.exe Script: Quarantine, Delete, BC delete, Terminate	836			??	error getting file info Command line:
ehrecvr.exe Script: Quarantine, Delete, BC delete, Terminate	3612			??	error getting file info Command line:
ehsched.exe Script: Quarantine, Delete, BC delete, Terminate	3232			??	error getting file info Command line:
ehtray.exe Script: Quarantine, Delete, BC delete, Terminate	304			??	error getting file info Command line:
c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate	4024	Firefox	©Firefox and Mozilla Developers; available under the MPL 2 license.	??	895.90 kb, rsAh, created: 24.02.2013 12:38:45, modified: 08.03.2013 19:02:52 Command line: "C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
MsMpEng.exe Script: Quarantine, Delete, BC delete, Terminate	1020			??	error getting file info Command line:
msseces.exe Script: Quarantine, Delete, BC delete, Terminate	2908			??	error getting file info Command line:
NisSrv.exe Script: Quarantine, Delete, BC delete, Terminate	2364			??	error getting file info Command line:
PresentationFontCache.exe Script: Quarantine, Delete, BC delete, Terminate	932			??	error getting file info Command line:
sidebar.exe Script: Quarantine, Delete, BC delete, Terminate	1484			??	error getting file info Command line:
SynTPEnh.exe Script: Quarantine, Delete, BC delete, Terminate	1292			??	error getting file info Command line:
SynTPHelper.exe Script: Quarantine, Delete, BC delete, Terminate	3196			??	error getting file info Command line:
wmpnetwk.exe Script: Quarantine, Delete, BC delete, Terminate	676			??	error getting file info Command line:
wmpnscfg.exe Script: Quarantine, Delete, BC delete, Terminate	2924			??	error getting file info Command line:
Detected:57, recognized as trusted 44

Module name	Handle	Description	Copyright	MD5	Used by processes
C:\PROGRA~2\COMMON~1\ArcSoft\MPEGEN~1\ArcTSSpl.ax Script: Quarantine, Delete, BC delete	189005824	MPGSplitter Filter	Copyright (C) ArcSoft, Inc. 2002-2005	--	4024
C:\PROGRA~2\COMMON~1\ArcSoft\MPEGEN~1\ASViD.ax Script: Quarantine, Delete, BC delete	240189440	ArcSoft Video Decoder	Copyright (C) ArcSoft Inc. 2005-2007	--	4024
Modules detected:324, recognized as trusted 322

Kernel Space Modules Viewer

Module	Base address	Size in memory	Description	Manufacturer
C:\Windows\System32\Drivers\dump_dumpata.sys Script: Quarantine, Delete, BC delete	4A49000	00C000 (49152)
C:\Windows\System32\Drivers\dump_msahci.sys Script: Quarantine, Delete, BC delete	4A55000	00A000 (40960)
Modules detected - 164, recognized as trusted - 162

Services

Service	Description	Status	File	Group	Dependencies
Detected - 161, recognized as trusted - 161

Drivers

Service	Description	Status	File	Group	Dependencies
Beep Driver: Unload, Delete, Disable, BC delete	Beep	Not started	Beep.sys Script: Quarantine, Delete, BC delete	Base
catchme Driver: Unload, Delete, Disable, BC delete	catchme	Not started	C:\ComboFix\catchme.sys Script: Quarantine, Delete, BC delete	Base
IpInIp Driver: Unload, Delete, Disable, BC delete	IP in IP Tunnel Driver	Not started	C:\Windows\system32\DRIVERS\ipinip.sys Script: Quarantine, Delete, BC delete		Tcpip
NwlnkFlt Driver: Unload, Delete, Disable, BC delete	IPX Traffic Filter Driver	Not started	C:\Windows\system32\DRIVERS\nwlnkflt.sys Script: Quarantine, Delete, BC delete		NwlnkFwd
NwlnkFwd Driver: Unload, Delete, Disable, BC delete	IPX Traffic Forwarder Driver	Not started	C:\Windows\system32\DRIVERS\nwlnkfwd.sys Script: Quarantine, Delete, BC delete
Detected - 243, recognized as trusted - 238

Autoruns

File name	Status	Startup method	Description
C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-21-2688393006-2681721238-2150527008-1000\Software\Microsoft\Windows\CurrentVersion\Run, WMPNSCFG Delete
C:\Users\BJs\AppData\Local\temp\_uninst_34162052.bat Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	C:\Users\BJs\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\, C:\Users\BJs\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_uninst_34162052.lnk,
C:\WindowsSystem32\IoLogMsg.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\vsmraid, EventMessageFile
C:\Windows\System32\appmgmts.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters, ServiceDll Delete
C:\Windows\System32\igmpv2.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile
C:\Windows\System32\ipbootp.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile
C:\Windows\System32\iprip2.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile
C:\Windows\System32\ws03res.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPNATHLP, EventMessageFile
C:\Windows\system32\psxss.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
lvcod64.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, vidc.i420 Delete
rdpclip Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd, StartupPrograms Delete
Autoruns items detected - 662, recognized as trusted - 651

Microsoft Internet Explorer extension modules (BHOs, Toolbars ...)

File name	Type	Description	Manufacturer	CLSID
C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll Script: Quarantine, Delete, BC delete	BHO			{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} Delete
Elements detected - 4, recognized as trusted - 3

Windows Explorer extension modules

File name	Destination	Description	Manufacturer	CLSID
	IE User Assist			{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} Delete
	lnkfile			{00020d75-0000-0000-c000-000000000046} Delete
	Color Control Panel Applet			{b2c761c6-29bc-4f19-9251-e6195265baf1} Delete
	Add New Hardware			{7A979262-40CE-46ff-AEEE-7884AC3B6136} Delete
	Get Programs Online			{3e7efb4c-faf1-453d-89eb-56026875ef90} Delete
	Taskbar and Start Menu			{0DF44EAA-FF21-4412-828E-260A8728E7F1} Delete
	ActiveDirectory Folder			{1b24a030-9b20-49bc-97ac-1be4426f9e59} Delete
	ActiveDirectory Folder			{34449847-FD14-4fc8-A75A-7432F5181EFB} Delete
	Sam Account Folder			{C8494E42-ACDD-4739-B0FB-217361E4894F} Delete
	Sam Account Folder			{E29F9716-5C08-4FCD-955A-119FDB5A522D} Delete
	Control Panel command object for Start menu			{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0} Delete
	Default Programs command object for Start menu			{E44E5D18-0652-4508-A4E2-8A090067BCB0} Delete
	Folder Options			{6dfd7c5c-2451-11d3-a299-00c04f8ef6af} Delete
	Explorer Query Band			{2C2577C2-63A7-40e3-9B7F-586602617ECB} Delete
	View Available Networks			{38a98528-6cbf-4ca9-8dc0-b1e1d10f7b1b} Delete
	Contacts folder			{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} Delete
	Problem Reports and Solutions			{fcfeecae-ee1b-4849-ae50-685dcf7717ec} Delete
	Windows Firewall			{4026492f-2f69-46b8-b9bf-5654fc07e423} Delete
	iSCSI Initiator			{a304259d-52b8-4526-8b1a-a1d6cecc8243} Delete
	.cab or .zip files			{911051fa-c21c-4246-b470-070cd8df6dc4} Delete
	Windows Search Shell Service			{da67b8ad-e81b-4c70-9b91b417b5e33527} Delete
	Microsoft.ScannersAndCameras			{00f2886f-cd64-4fc9-8ec5-30ef6cdbe8c3} Delete
emdmgmt.dll Script: Quarantine, Delete, BC delete	EMDFileProperties			{BB6B2374-3D79-41DB-87F4-896C91846510} Delete
	Windows Sidebar Properties			{37efd44d-ef8d-41b1-940d-96973a50e9e0} Delete
	Windows Features			{67718415-c450-4f3c-bf8a-b487642dc39b} Delete
	Windows Defender			{d8559eb9-20c0-410e-beda-7ed416aecc2a} Delete
	Mobility Center Control Panel			{5ea4f148-308c-46d7-98a9-49041b1dd468} Delete
C:\Program Files (x86)\Common Files\microsoft shared\ink\TipBand.dll Script: Quarantine, Delete, BC delete	Tablet PC Input Panel			{15D633E2-AD00-465b-9EC7-F56B7CDF8E27} Delete
	User Accounts			{7A9D77BD-5403-11d2-8785-2E0420524153} Delete
	ColumnHandler			{F9DB5320-233E-11D1-9F84-707F02C10627} Delete
Elements detected - 286, recognized as trusted - 256

Printing system extensions (print monitors, providers)

File name	Type	Name	Description	Manufacturer
inetpp.dll Script: Quarantine, Delete, BC delete	Provider	HTTP Print Services
Elements detected - 6, recognized as trusted - 5

Task Scheduler jobs

File name	Job name	Job status	Description	Manufacturer
Elements detected - 5, recognized as trusted - 5

SPI/LSP settings

Namespace providers (NSP)

Provider	Status	EXE file	Description	GUID
Detected - 6, recognized as trusted - 6

Transport protocol providers (TSP, LSP)

Provider EXE file Description
Detected - 10, recognized as trusted - 10
Results of automatic SPI settings check
LSP settings checked. No errors detected

TCP/UDP ports

Port Status Remote Host Remote Port Application Notes
TCP ports
135 LISTENING 0.0.0.0 0 [980] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
139 LISTENING 0.0.0.0 0 [4] System
Script: Quarantine, Delete, BC delete, Terminate
445 LISTENING 0.0.0.0 0 [4] System
Script: Quarantine, Delete, BC delete, Terminate
554 LISTENING 0.0.0.0 0 [676] wmpnetwk.exe
Script: Quarantine, Delete, BC delete, Terminate
2869 LISTENING 0.0.0.0 0 [4] System
Script: Quarantine, Delete, BC delete, Terminate
5357 LISTENING 0.0.0.0 0 [4] System
Script: Quarantine, Delete, BC delete, Terminate
10243 LISTENING 0.0.0.0 0 [4] System
Script: Quarantine, Delete, BC delete, Terminate
49152 LISTENING 0.0.0.0 0 [616] wininit.exe
Script: Quarantine, Delete, BC delete, Terminate
49153 LISTENING 0.0.0.0 0 [568] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
49154 LISTENING 0.0.0.0 0 [696] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
49155 LISTENING 0.0.0.0 0 [692] lsass.exe
Script: Quarantine, Delete, BC delete, Terminate
49156 LISTENING 0.0.0.0 0 [672] services.exe
Script: Quarantine, Delete, BC delete, Terminate
49192 ESTABLISHED 127.0.0.1 49193 [4024] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
49193 ESTABLISHED 127.0.0.1 49192 [4024] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
50651 ESTABLISHED 65.54.49.177 443 [2912] c:\program files (x86)\internet explorer\iexplore.exe
Script: Quarantine, Delete, BC delete, Terminate
50695 TIME_WAIT 64.12.132.55 80 [0]
UDP ports
123 LISTENING -- -- [1216] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
137 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
138 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
500 LISTENING -- -- [696] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
1900 LISTENING -- -- [1216] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
1900 LISTENING -- -- [1216] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
3702 LISTENING -- -- [1216] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
3702 LISTENING -- -- [1216] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
4500 LISTENING -- -- [696] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
5004 LISTENING -- -- [676] wmpnetwk.exe
Script: Quarantine, Delete, BC delete, Terminate
5005 LISTENING -- -- [676] wmpnetwk.exe
Script: Quarantine, Delete, BC delete, Terminate
5355 LISTENING -- -- [1380] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
49472 LISTENING -- -- [1484] sidebar.exe
Script: Quarantine, Delete, BC delete, Terminate
53487 LISTENING -- -- [292] c:\program files (x86)\internet explorer\iexplore.exe
Script: Quarantine, Delete, BC delete, Terminate
54929 LISTENING -- -- [3612] ehrecvr.exe
Script: Quarantine, Delete, BC delete, Terminate
56519 LISTENING -- -- [2912] c:\program files (x86)\internet explorer\iexplore.exe
Script: Quarantine, Delete, BC delete, Terminate
56651 LISTENING -- -- [824] c:\program files (x86)\internet explorer\iexplore.exe
Script: Quarantine, Delete, BC delete, Terminate
58947 LISTENING -- -- [1216] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
58948 LISTENING -- -- [1216] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
60068 LISTENING -- -- [1216] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate

Downloaded Program Files (DPF)

File name Description Manufacturer CLSID Source URL
Elements detected - 0, recognized as trusted - 0

Control Panel Applets (CPL)

File name Description Manufacturer
C:\Windows\system32\FlashPlayerCPLApp.cpl
Script: Quarantine, Delete, BC delete Adobe Flash Player Control Panel Applet Copyright © 1996 Adobe Systems Incorporated. All Rights Reserved. Adobe and Flash are either trademarks or registered trademarks in the United States and/or other countries.
Elements detected - 19, recognized as trusted - 18

Active Setup

File name Description Manufacturer CLSID
Elements detected - 9, recognized as trusted - 9

HOSTS file

Hosts file record
127.0.0.1 localhost
Clear Hosts file

Protocols and handlers

File name Type Description Manufacturer CLSID
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
C:\Program Files (x86)\AVG\AVG2012\avgppa.dll
Script: Quarantine, Delete, BC delete Handler (linkscanner: ExPLabs.com Pluggable Protocol) {F274614C-63F8-47D5-A4D1-FBDDE494F8D1}
Delete
Elements detected - 15, recognized as trusted - 11

Suspicious objects

File Description Type

Main script of analysis
Windows version: Windows Vista (TM) Home Premium, Build=6002, SP="Service Pack 2"
System Restore: enabled
>> Services: potentially dangerous service allowed: TermService (@%SystemRoot%\System32\termsrv.dll,-268)
>> Services: potentially dangerous service allowed: SSDPSRV (@%systemroot%\system32\ssdpsrv.dll,-100)
>> Services: potentially dangerous service allowed: Schedule (@%SystemRoot%\system32\schedsvc.dll,-100)
> Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)!
>> Security: disk drives' autorun is enabled
>> Security: administrative shares (C$, D$ ...) are enabled
>> Security: anonymous user access is enabled
>> Security: sending Remote Assistant queries is enabled
 >>  Disable HDD autorun
 >>  Disable autorun from network drives
 >>  Disable CD/DVD autorun
 >>  Disable removable media autorun
 >>  Windows Explorer - show extensions of known file types
System Analysis in progress

 System Analysis - complete


Script commands 
Add commands to script:
Blocking hooks using Anti-Rootkit
Enable AVZGuard
Operations with AVZPM (true=enable,false=disable)
BootCleaner - import list of deleted files
BootCleaner - import all
Registry cleanup after deleting files
ExecuteWizard ('TSW',2,3,true) - Running Troubleshooting wizard
BootCleaner - activate
Reboot
Insert template for QuarantineFile() - quarantining file
Insert template for BC_QrFile() - quarantining file via BootCleaner
Insert template for DeleteFile() - deleting file
Insert template for DelCLSID() - deleting CLSID item from registry
Additional operations:Performance tweaking: disable service TermService (@%SystemRoot%\System32\termsrv.dll,-268)
Performance tweaking: disable service SSDPSRV (@%systemroot%\system32\ssdpsrv.dll,-100)
Performance tweaking: disable service Schedule (@%SystemRoot%\system32\schedsvc.dll,-100)
Security tweaking: disable CD autorun
Security tweaking: disable administrative shares
Security tweaking: disable anonymous user access
Security: disable sending Remote Assistant queries

File list

Port	Status	Remote Host	Remote Port	Application	Notes
TCP ports
135	LISTENING	0.0.0.0	0	[980] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
139	LISTENING	0.0.0.0	0	[4] System Script: Quarantine, Delete, BC delete, Terminate
445	LISTENING	0.0.0.0	0	[4] System Script: Quarantine, Delete, BC delete, Terminate
554	LISTENING	0.0.0.0	0	[676] wmpnetwk.exe Script: Quarantine, Delete, BC delete, Terminate
2869	LISTENING	0.0.0.0	0	[4] System Script: Quarantine, Delete, BC delete, Terminate
5357	LISTENING	0.0.0.0	0	[4] System Script: Quarantine, Delete, BC delete, Terminate
10243	LISTENING	0.0.0.0	0	[4] System Script: Quarantine, Delete, BC delete, Terminate
49152	LISTENING	0.0.0.0	0	[616] wininit.exe Script: Quarantine, Delete, BC delete, Terminate
49153	LISTENING	0.0.0.0	0	[568] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
49154	LISTENING	0.0.0.0	0	[696] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
49155	LISTENING	0.0.0.0	0	[692] lsass.exe Script: Quarantine, Delete, BC delete, Terminate
49156	LISTENING	0.0.0.0	0	[672] services.exe Script: Quarantine, Delete, BC delete, Terminate
49192	ESTABLISHED	127.0.0.1	49193	[4024] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
49193	ESTABLISHED	127.0.0.1	49192	[4024] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
50651	ESTABLISHED	65.54.49.177	443	[2912] c:\program files (x86)\internet explorer\iexplore.exe Script: Quarantine, Delete, BC delete, Terminate
50695	TIME_WAIT	64.12.132.55	80	[0]
UDP ports
123	LISTENING	--	--	[1216] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
137	LISTENING	--	--	[4] System Script: Quarantine, Delete, BC delete, Terminate
138	LISTENING	--	--	[4] System Script: Quarantine, Delete, BC delete, Terminate
500	LISTENING	--	--	[696] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
1900	LISTENING	--	--	[1216] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
1900	LISTENING	--	--	[1216] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
3702	LISTENING	--	--	[1216] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
3702	LISTENING	--	--	[1216] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
4500	LISTENING	--	--	[696] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
5004	LISTENING	--	--	[676] wmpnetwk.exe Script: Quarantine, Delete, BC delete, Terminate
5005	LISTENING	--	--	[676] wmpnetwk.exe Script: Quarantine, Delete, BC delete, Terminate
5355	LISTENING	--	--	[1380] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
49472	LISTENING	--	--	[1484] sidebar.exe Script: Quarantine, Delete, BC delete, Terminate
53487	LISTENING	--	--	[292] c:\program files (x86)\internet explorer\iexplore.exe Script: Quarantine, Delete, BC delete, Terminate
54929	LISTENING	--	--	[3612] ehrecvr.exe Script: Quarantine, Delete, BC delete, Terminate
56519	LISTENING	--	--	[2912] c:\program files (x86)\internet explorer\iexplore.exe Script: Quarantine, Delete, BC delete, Terminate
56651	LISTENING	--	--	[824] c:\program files (x86)\internet explorer\iexplore.exe Script: Quarantine, Delete, BC delete, Terminate
58947	LISTENING	--	--	[1216] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
58948	LISTENING	--	--	[1216] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
60068	LISTENING	--	--	[1216] svchost.exe Script: Quarantine, Delete, BC delete, Terminate