Kaspersky Virus Removal Tool 11.0.0.1245 (database released 28/06/2013; 08:54)
| File name | PID | Description | Copyright | MD5 | Information
| c:\windows\microsoft.net\framework\v3.0\wpf\presentationfontcache.exe | Script: Quarantine, Delete, BC delete, Terminate 200 | PresentationFontCache.exe | © Microsoft Corporation. All rights reserved. | ?? | 45.02 kb, rsAh, | created: 29.07.2008 22:10:04, modified: 29.07.2008 22:10:04 Command line: c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe Detected:34, recognized as trusted 34
| | |||||
| Module | Base address | Size in memory | Description | Manufacturer
| C:\WINDOWS\System32\Drivers\dump_atapi.sys | Script: Quarantine, Delete, BC delete B0B13000 | 018000 (98304) |
| C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS | Script: Quarantine, Delete, BC delete B5414000 | 002000 (8192) |
| C:\WINDOWS\system32\Drivers\uphcleanhlp.sys | Script: Quarantine, Delete, BC delete AF880000 | 003000 (12288) |
| Modules detected - 127, recognized as trusted - 124
| | |||||||
| Service | Description | Status | File | Group | Dependencies
| Detected - 100, recognized as trusted - 100
| | ||||||
| Service | Description | Status | File | Group | Dependencies
| Abiosdsk | Driver: Unload, Delete, Disable, BC delete Abiosdsk | Not started | Abiosdsk.sys | Script: Quarantine, Delete, BC delete Primary disk |
| abp480n5 | Driver: Unload, Delete, Disable, BC delete abp480n5 | Not started | abp480n5.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| adpu160m | Driver: Unload, Delete, Disable, BC delete adpu160m | Not started | adpu160m.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Aha154x | Driver: Unload, Delete, Disable, BC delete Aha154x | Not started | Aha154x.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| aic78u2 | Driver: Unload, Delete, Disable, BC delete aic78u2 | Not started | aic78u2.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| aic78xx | Driver: Unload, Delete, Disable, BC delete aic78xx | Not started | aic78xx.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| AliIde | Driver: Unload, Delete, Disable, BC delete AliIde | Not started | AliIde.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| amsint | Driver: Unload, Delete, Disable, BC delete amsint | Not started | amsint.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| asc | Driver: Unload, Delete, Disable, BC delete asc | Not started | asc.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| asc3350p | Driver: Unload, Delete, Disable, BC delete asc3350p | Not started | asc3350p.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| asc3550 | Driver: Unload, Delete, Disable, BC delete asc3550 | Not started | asc3550.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Atdisk | Driver: Unload, Delete, Disable, BC delete Atdisk | Not started | Atdisk.sys | Script: Quarantine, Delete, BC delete Primary disk |
| catchme | Driver: Unload, Delete, Disable, BC delete catchme | Not started | C:\DOCUME~1\johnt\LOCALS~1\Temp\catchme.sys | Script: Quarantine, Delete, BC delete Base |
| cd20xrnt | Driver: Unload, Delete, Disable, BC delete cd20xrnt | Not started | cd20xrnt.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Changer | Driver: Unload, Delete, Disable, BC delete Changer | Not started | Changer.sys | Script: Quarantine, Delete, BC delete Filter |
| CmdIde | Driver: Unload, Delete, Disable, BC delete CmdIde | Not started | CmdIde.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| Cpqarray | Driver: Unload, Delete, Disable, BC delete Cpqarray | Not started | Cpqarray.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| dac960nt | Driver: Unload, Delete, Disable, BC delete dac960nt | Not started | dac960nt.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| dpti2o | Driver: Unload, Delete, Disable, BC delete dpti2o | Not started | dpti2o.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| hpn | Driver: Unload, Delete, Disable, BC delete hpn | Not started | hpn.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| i2omgmt | Driver: Unload, Delete, Disable, BC delete i2omgmt | Not started | i2omgmt.sys | Script: Quarantine, Delete, BC delete SCSI Class |
| i2omp | Driver: Unload, Delete, Disable, BC delete i2omp | Not started | i2omp.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ini910u | Driver: Unload, Delete, Disable, BC delete ini910u | Not started | ini910u.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| lbrtfdc | Driver: Unload, Delete, Disable, BC delete lbrtfdc | Not started | lbrtfdc.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| mraid35x | Driver: Unload, Delete, Disable, BC delete mraid35x | Not started | mraid35x.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| PCIDump | Driver: Unload, Delete, Disable, BC delete PCIDump | Not started | PCIDump.sys | Script: Quarantine, Delete, BC delete PCI Configuration |
| PDCOMP | Driver: Unload, Delete, Disable, BC delete PDCOMP | Not started | PDCOMP.sys | Script: Quarantine, Delete, BC delete |
| PDFRAME | Driver: Unload, Delete, Disable, BC delete PDFRAME | Not started | PDFRAME.sys | Script: Quarantine, Delete, BC delete |
| PDRELI | Driver: Unload, Delete, Disable, BC delete PDRELI | Not started | PDRELI.sys | Script: Quarantine, Delete, BC delete |
| PDRFRAME | Driver: Unload, Delete, Disable, BC delete PDRFRAME | Not started | PDRFRAME.sys | Script: Quarantine, Delete, BC delete |
| perc2 | Driver: Unload, Delete, Disable, BC delete perc2 | Not started | perc2.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| perc2hib | Driver: Unload, Delete, Disable, BC delete perc2hib | Not started | perc2hib.sys | Script: Quarantine, Delete, BC delete Filter |
| ql1080 | Driver: Unload, Delete, Disable, BC delete ql1080 | Not started | ql1080.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Ql10wnt | Driver: Unload, Delete, Disable, BC delete Ql10wnt | Not started | Ql10wnt.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ql12160 | Driver: Unload, Delete, Disable, BC delete ql12160 | Not started | ql12160.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ql1240 | Driver: Unload, Delete, Disable, BC delete ql1240 | Not started | ql1240.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ql1280 | Driver: Unload, Delete, Disable, BC delete ql1280 | Not started | ql1280.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Simbad | Driver: Unload, Delete, Disable, BC delete Simbad | Not started | Simbad.sys | Script: Quarantine, Delete, BC delete Filter |
| Sparrow | Driver: Unload, Delete, Disable, BC delete Sparrow | Not started | Sparrow.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| sym_hi | Driver: Unload, Delete, Disable, BC delete sym_hi | Not started | sym_hi.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| sym_u3 | Driver: Unload, Delete, Disable, BC delete sym_u3 | Not started | sym_u3.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| symc810 | Driver: Unload, Delete, Disable, BC delete symc810 | Not started | symc810.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| symc8xx | Driver: Unload, Delete, Disable, BC delete symc8xx | Not started | symc8xx.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| TosIde | Driver: Unload, Delete, Disable, BC delete TosIde | Not started | TosIde.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| ultra | Driver: Unload, Delete, Disable, BC delete ultra | Not started | ultra.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ViaIde | Driver: Unload, Delete, Disable, BC delete ViaIde | Not started | ViaIde.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| WDICA | Driver: Unload, Delete, Disable, BC delete WDICA | Not started | WDICA.sys | Script: Quarantine, Delete, BC delete |
| Detected - 189, recognized as trusted - 142
| | ||||||
| File name | Status | Startup method | Description
| C:\Documents and Settings\johnt | Script: Quarantine, Delete, BC delete Active | Shortcut in Autoruns folder | C:\Documents and Settings\johnt\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\johnt\Application Data\Microsoft\Internet Explorer\Quick Launch\All Docs.lnk,
| C:\Documents and Settings\johnt\Application Data\Microsoft\Internet Explorer\Quick Launch\13 NVIDIA.lnk | Script: Quarantine, Delete, BC delete Active | File in Autoruns folder | C:\Documents and Settings\johnt\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\johnt\Application Data\Microsoft\Internet Explorer\Quick Launch\13 NVIDIA.lnk,
| C:\Documents and Settings\johnt\Application Data\Microsoft\Internet Explorer\Quick Launch\Dictionary and Thesaurus - Merriam-Webster Online.url | Script: Quarantine, Delete, BC delete Active | File in Autoruns folder | C:\Documents and Settings\johnt\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\johnt\Application Data\Microsoft\Internet Explorer\Quick Launch\Dictionary and Thesaurus - Merriam-Webster Online.url,
| C:\Documents and Settings\johnt\Application Data\Microsoft\Internet Explorer\Quick Launch\Google AdvBrit.url | Script: Quarantine, Delete, BC delete Active | File in Autoruns folder | C:\Documents and Settings\johnt\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\johnt\Application Data\Microsoft\Internet Explorer\Quick Launch\Google AdvBrit.url,
| C:\Documents and Settings\johnt\Application Data\Microsoft\Internet Explorer\Quick Launch\Google AdvUSA.url | Script: Quarantine, Delete, BC delete Active | File in Autoruns folder | C:\Documents and Settings\johnt\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\johnt\Application Data\Microsoft\Internet Explorer\Quick Launch\Google AdvUSA.url,
| C:\Documents and Settings\johnt\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Advanced Web Search.url | Script: Quarantine, Delete, BC delete Active | File in Autoruns folder | C:\Documents and Settings\johnt\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\johnt\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Advanced Web Search.url,
| C:\Documents and Settings\johnt\Application Data\iolo\EventMsg.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\iolo Applications\Active Care, EventMessageFile
| C:\Documents and Settings\johnt\Application Data\iolo\EventMsg.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\iolo Applications\Drive Scrubber, EventMessageFile
| C:\Documents and Settings\johnt\Application Data\iolo\EventMsg.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\iolo Applications\Installer, EventMessageFile
| C:\Documents and Settings\johnt\Application Data\iolo\EventMsg.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\iolo Applications\Search Recover, EventMessageFile
| C:\Documents and Settings\johnt\Application Data\iolo\EventMsg.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\iolo Applications\Service Manager, EventMessageFile
| C:\Documents and Settings\johnt\Application Data\iolo\EventMsg.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\iolo Applications\System Guard, EventMessageFile
| C:\Documents and Settings\johnt\Application Data\iolo\EventMsg.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\iolo Applications\System Mechanich, EventMessageFile
| C:\Documents and Settings\johnt\Application Data\iolo\EventMsg.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\iolo Applications\System Shield, EventMessageFile
| C:\Documents and Settings\johnt\Local Settings\temp\_uninst_08349647.bat | Script: Quarantine, Delete, BC delete Active | Shortcut in Autoruns folder | C:\Documents and Settings\johnt\Start Menu\Programs\Startup\, C:\Documents and Settings\johnt\Start Menu\Programs\Startup\_uninst_08349647.lnk,
| C:\Documents and Settings\johnt\My Documents | Script: Quarantine, Delete, BC delete Active | Shortcut in Autoruns folder | C:\Documents and Settings\johnt\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\johnt\Application Data\Microsoft\Internet Explorer\Quick Launch\My Documents.lnk,
| C:\Documents and Settings\johnt\My Documents\Paint Documents | Script: Quarantine, Delete, BC delete Active | Shortcut in Autoruns folder | C:\Documents and Settings\johnt\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\johnt\Application Data\Microsoft\Internet Explorer\Quick Launch\Paint Docs.lnk,
| C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\HssSrv, EventMessageFile
| C:\Program Files\Hotspot Shield\bin\hsswd.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\HssWd, EventMessageFile
| C:\WINDOWS\System32\Drivers\AliIde.sys | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\aliide, EventMessageFile
| C:\WINDOWS\System32\Drivers\CmdIde.sys | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\cmdide, EventMessageFile
| C:\WINDOWS\System32\Drivers\TosIde.sys | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\toside, EventMessageFile
| C:\WINDOWS\System32\Drivers\ViaIde.sys | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\viaide, EventMessageFile
| C:\WINDOWS\System32\Drivers\lbrtfdc.sys | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\lbrtfdc, EventMessageFile
| C:\WINDOWS\System32\appmgmts.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters, ServiceDll | Delete C:\WINDOWS\System32\appmgmts.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Application Management, EventMessageFile
| C:\WINDOWS\System32\appmgr.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Software Installation, EventMessageFile
| C:\WINDOWS\System32\fdeploy.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\File Deployment, EventMessageFile
| C:\WINDOWS\System32\fdeploy.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Folder Redirection, EventMessageFile
| C:\WINDOWS\System32\igmpv2.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile
| C:\WINDOWS\System32\ipbootp.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile
| C:\WINDOWS\System32\iprip2.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile
| C:\WINDOWS\System32\ospf.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPF, EventMessageFile
| C:\WINDOWS\System32\ospfmib.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPFMib, EventMessageFile
| C:\WINDOWS\System32\polagent.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PolicyAgent, EventMessageFile
| C:\WINDOWS\System32\tssdis.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\TermServSessDir, EventMessageFile
| C:\WINDOWS\system32\MsSip1.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 1, $DLL | Delete C:\WINDOWS\system32\MsSip2.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 2, $DLL | Delete C:\WINDOWS\system32\MsSip3.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 3, $DLL | Delete C:\WINDOWS\system32\psxss.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
| C:\WINDOWS\system32\stisvc.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System, EventMessageFile
| DivX.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, vidc.DIVX | Delete DivX.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, vidc.yv12 | Delete SDEvents.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Spybot - Search & Destroy 2, EventMessageFile
| appmgmts.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}, DLLName | Delete c:\5ab51315464e508848570f\wgasetup.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\WgaSetup, EventMessageFile
| kbd101.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver JPN | Delete kbd101a.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver KOR | Delete mirpywre.dll | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\SecurityProviders, SecurityProviders
| mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, .DEFAULT\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-19\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-20\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-18\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-21-1614895754-1004336348-725345543-1004\Control Panel\IOProcs, MVB | Delete vgafix.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon | Delete vgaoem.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon | Delete vgasys.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon | Delete Autoruns items detected - 899, recognized as trusted - 842
| | ||||||
| File name | Type | Description | Manufacturer | CLSID
| Toolbar | {710EB7A1-45ED-11D0-924A-0020AFC7AC4D} | Delete Elements detected - 13, recognized as trusted - 12
| | |||||||||
| File name | Destination | Description | Manufacturer | CLSID
| Display Panning CPL Extension | {42071714-76d4-11d1-8b24-00a0c9068ff3} | Delete Shell extensions for file compression | {764BF0E1-F219-11ce-972D-00AA00A14F56} | Delete Encryption Context Menu | {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} | Delete Taskbar and Start Menu | {0DF44EAA-FF21-4412-828E-260A8728E7F1} | Delete Avi Properties Handler | {87D62D94-71B3-4b9a-9489-5FE6850DC73E} | Delete User Accounts | {7A9D77BD-5403-11d2-8785-2E0420524153} | Delete IE User Assist | {FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} | Delete Auslogics Products Context Menu Shell Extension | {EBDF1F20-C829-11D1-8233-0020AF3E97A9} | Delete Elements detected - 214, recognized as trusted - 206
| | ||||||||||||||||||||||||||||||
| File name | Type | Name | Description | Manufacturer
| Elements detected - 7, recognized as trusted - 7
| | ||||||
| File name | Job name | Job status | Description | Manufacturer
| Elements detected - 4, recognized as trusted - 4
| | ||||||
| Provider | Status | EXE file | Description | GUID
| Detected - 4, recognized as trusted - 4
| | ||||||
| Provider | EXE file | Description
| Detected - 11, recognized as trusted - 11
| | ||||||
| File name | Description | Manufacturer | CLSID | Source URL
| {1E54D648-B804-468d-BC78-4AFFED8E262F} | Delete http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
| {E2883E8F-472F-4FB0-9522-AC9BF37916A7} | Delete http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
| Elements detected - 4, recognized as trusted - 2
| | ||||||||||||
| File name | Description | Manufacturer
| Elements detected - 28, recognized as trusted - 28
| | ||||||
| File name | Description | Manufacturer | CLSID
| Elements detected - 15, recognized as trusted - 15
| | ||||||
Hosts file record
|
| File name | Type | Description | Manufacturer | CLSID
| mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D} | Delete mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D} | Delete mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D} | Delete Elements detected - 29, recognized as trusted - 26
| | ||||||
| File | Description | Type
| C:\WINDOWS\system32\DRIVERS\2228459drv.sys | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| C:\WINDOWS\System32\vsdatant.sys | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| C:\WINDOWS\system32\DRIVERS\klif.sys | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| C:\WINDOWS\system32\Drivers\uphcleanhlp.sys | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| \SystemRoot\system32\DRIVERS\klif.sys | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| C:\Program Files\CheckPoint\ZAForceField\AK\icsak.sys | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| |
Main script of analysis Windows version: Microsoft Windows XP, Build=2600, SP="Service Pack 3" System Restore: enabled 1.1 Searching for user-mode API hooks Analysis: kernel32.dll, export table found in section .text Function kernel32.dll:OpenProcess (632) intercepted, method APICodeHijack.JmpTo[20CB8462] IAT modification detected: CreateProcessA - 01240010<>7C80236B IAT modification detected: GetModuleFileNameA - 01240080<>7C80B56F IAT modification detected: FreeLibrary - 012400F0<>7C80AC7E IAT modification detected: GetModuleFileNameW - 01240160<>7C80B475 IAT modification detected: CreateProcessW - 012401D0<>7C802336 IAT modification detected: LoadLibraryW - 012402B0<>7C80AEEB IAT modification detected: LoadLibraryA - 01240320<>7C801D7B IAT modification detected: GetProcAddress - 01240390<>7C80AE40 Analysis: ntdll.dll, export table found in section .text Function ntdll.dll:NtAccessCheckByType (89) intercepted, method APICodeHijack.JmpTo[20CB8787] Function ntdll.dll:NtImpersonateClientOfPort (178) intercepted, method APICodeHijack.JmpTo[20CB8D4E] Function ntdll.dll:NtSetInformationProcess (319) intercepted, method APICodeHijack.JmpTo[20CB89A1] Function ntdll.dll:ZwAccessCheckByType (900) intercepted, method APICodeHijack.JmpTo[20CB8787] Function ntdll.dll:ZwImpersonateClientOfPort (988) intercepted, method APICodeHijack.JmpTo[20CB8D4E] Function ntdll.dll:ZwSetInformationProcess (1129) intercepted, method APICodeHijack.JmpTo[20CB89A1] Analysis: user32.dll, export table found in section .text Function user32.dll:FindWindowA (228) intercepted, method APICodeHijack.JmpTo[20CB8285] Function user32.dll:FindWindowW (231) intercepted, method APICodeHijack.JmpTo[20CB8250] Function user32.dll:SendInput (571) intercepted, method APICodeHijack.JmpTo[2000A556] Analysis: advapi32.dll, export table found in section .text Function advapi32.dll:ImpersonateNamedPipeClient (304) intercepted, method APICodeHijack.JmpTo[20CB8E53] Function advapi32.dll:SetThreadToken (574) intercepted, method APICodeHijack.JmpTo[20CB902C] Analysis: ws2_32.dll, export table found in section .text Analysis: wininet.dll, export table found in section .text Analysis: rasapi32.dll, export table found in section .text Analysis: urlmon.dll, export table found in section .text Analysis: netapi32.dll, export table found in section .text 1.2 Searching for kernel-mode API hooks Driver loaded successfully SDT found (RVA=08B520) Kernel ntoskrnl.exe found in memory at address 804D7000 SDT = 80562520 KiST = 804E4820 (284) Function NtAdjustPrivilegesToken (0B) intercepted (805965E5->AD868690), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtClose (19) intercepted (8056F8D7->AD868F94), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtConnectPort (1F) intercepted (80590E73->AD869DC8), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateEvent (23) intercepted (80574506->AD86A312), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateFile (25) intercepted (80573E0B->AD869270), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateKey (29) intercepted (80578ACE->AD867500), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateMutant (2B) intercepted (805840AD->AD86A1F8), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateNamedPipeFile (2C) intercepted (80588FDA->AD86827E), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreatePort (2E) intercepted (8059B168->AD86A0CC), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateProcess (2F) intercepted (805B6DCD->B3BC70B4), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateProcessEx (30) intercepted (8058BA0C->B3BC74A2), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateSection (32) intercepted (8056DB66->AD868426), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateSemaphore (33) intercepted (8057FD1F->AD86A432), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateSymbolicLinkObject (34) intercepted (805DFB02->B54DE490), hook C:\WINDOWS\system32\DRIVERS\klif.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateThread (35) intercepted (80584D59->AD868C1C), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateWaitablePort (38) intercepted (805B0E8A->AD86A162), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDebugActiveProcess (39) intercepted (80663419->AD86BB1A), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeleteFile (3E) intercepted (805DBFE4->B3BAE1E0), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeleteKey (3F) intercepted (8059978F->AD867B0A), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeleteValueKey (41) intercepted (805983AE->AD867EBE), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeviceIoControlFile (42) intercepted (80588CD6->AD8696F2), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDuplicateObject (44) intercepted (8057F1A9->AD86CD26), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtEnumerateKey (47) intercepted (8057F01E->AD86800A), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtEnumerateValueKey (49) intercepted (80590252->AD8680A2), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtFsControlFile (54) intercepted (80582B0E->AD869500), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtLoadDriver (61) intercepted (805AF8CE->AD86BC0C), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtLoadKey (62) intercepted (805D526B->AD8674DC), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtLoadKey2 (63) intercepted (805D53CA->AD8674EE), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtMapViewOfSection (6C) intercepted (8057AC39->AD86C374), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtNotifyChangeKey (6F) intercepted (805E4E96->AD8681CE), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenEvent (72) intercepted (80589D81->AD86A3A8), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenFile (74) intercepted (8057A0B1->AD869016), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenKey (77) intercepted (80572BF0->AD8676C0), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenMutant (78) intercepted (8058415B->AD86A288), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenProcess (7A) intercepted (8057F956->AD8688CC), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenSection (7D) intercepted (805791AE->AD86C10E), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenSemaphore (7E) intercepted (805DFE76->AD86A4C8), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenThread (80) intercepted (805E484F->AD8687BE), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtPlugPlayControl (84) intercepted (8059F67D->B54DE4A0), hook C:\WINDOWS\system32\DRIVERS\klif.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtProtectVirtualMemory (89) intercepted (8057F587->B3BDD2F6), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueryKey (A0) intercepted (8057EC1E->AD86813A), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueryMultipleValueKey (A1) intercepted (806565B3->AD867D72), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueryObject (A3) intercepted (8058A67E->B54DB8A4), hook C:\WINDOWS\system32\DRIVERS\klif.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQuerySection (A7) intercepted (80587093->AD86C6AE), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueryValueKey (B1) intercepted (80572F2A->AD86799C), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueueApcThread (B4) intercepted (80599AAA->AD86BFA0), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtRenameKey (C0) intercepted (80656A32->AD867C2C), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtReplaceKey (C1) intercepted (8065738E->AD866F16), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtReplyPort (C2) intercepted (80586318->AD86A82C), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtReplyWaitReceivePort (C3) intercepted (80576831->AD86A6F2), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtRequestWaitReplyPort (C8) intercepted (8057D153->AD86B8B4), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtRestoreKey (CC) intercepted (80656F25->AD86728E), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtResumeThread (CE) intercepted (805853D0->AD86CBC8), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSaveKey (CF) intercepted (80657026->AD866EAE), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSaveKeyEx (D0) intercepted (80657111->B54D7878), hook C:\WINDOWS\system32\DRIVERS\klif.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSaveMergedKeys (D1) intercepted (8065723E->B54D7A14), hook C:\WINDOWS\system32\DRIVERS\klif.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSecureConnectPort (D2) intercepted (80587E2A->AD869B0E), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetContextThread (D5) intercepted (806363E9->AD868E38), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetInformationFile (E0) intercepted (805830F1->B3BAE5A4), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetInformationObject (E3) intercepted (80589E69->B3BDD1E2), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetInformationToken (E6) intercepted (805ACAAC->AD86B154), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetSecurityObject (ED) intercepted (8059DDEB->AD86BDAA), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetSystemInformation (F0) intercepted (805B1500->AD86C7FE), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetValueKey (F7) intercepted (805800A4->AD867816), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSuspendProcess (FD) intercepted (80637CC7->AD86C8F0), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSuspendThread (FE) intercepted (80637BE3->AD86CA2A), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSystemDebugControl (FF) intercepted (80651C59->AD86BA3E), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtTerminateProcess (101) intercepted (8058E8D1->AD868A68), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtTerminateThread (102) intercepted (80584986->AD8689C8), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtUnloadDriver (106) intercepted (80624D04->B3BA929C), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtUnloadKey (107) intercepted (80655C7A->AF8806D0), hook C:\WINDOWS\system32\Drivers\uphcleanhlp.sys >>> Function restored successfully ! >>> Hook code blocked Function NtUnmapViewOfSection (10B) intercepted (8057A7C1->AD86C552), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtWriteVirtualMemory (115) intercepted (8058760F->AD868B52), hook C:\WINDOWS\system32\DRIVERS\2228459drv.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function FsRtlCheckLockForReadAccess (804F756E) - machine code modification Method of JmpTo. jmp B54B7AE0 \SystemRoot\system32\DRIVERS\klif.sys, driver recognized as trusted >>> Function restored successfully ! Function IoAllocateIrp (804EB06D) - machine code modification Method not defined., embedding from byte 15 >>> Function restored successfully ! Function IoIsOperationSynchronous (804EB07E) - machine code modification Method of JmpTo. jmp B54B7EBC \SystemRoot\system32\DRIVERS\klif.sys, driver recognized as trusted >>> Function restored successfully ! Functions checked: 284, intercepted: 73, restored: 76 1.3 Checking IDT and SYSENTER Analysis for CPU 1 CmpCallCallBacks = 0014561C Disable callback OK Checking IDT and SYSENTER - complete 1.4 Searching for masking processes and drivers Checking not performed: extended monitoring driver (AVZPM) is not installed 1.5 Checking of IRP handlers Driver loaded successfully \FileSystem\ntfs[IRP_MJ_CREATE] = F77A92E0 -> C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys, driver recognized as trusted \driver\tcpip[IRP_MJ_CREATE] = B3B9BF5E -> C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted \driver\tcpip[IRP_MJ_CLOSE] = B3B9BF5E -> C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted \driver\tcpip[IRP_MJ_DEVICE_CONTROL] = B3B9BF5E -> C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted \driver\tcpip[IRP_MJ_INTERNAL_DEVICE_CONTROL] = B3B9BF5E -> C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted \driver\tcpip[IRP_MJ_CLEANUP] = B3B9BF5E -> C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted \driver\Kbdclass[IRP_MJ_READ] = B1E75A40 -> C:\Program Files\CheckPoint\ZAForceField\AK\icsak.sys, driver recognized as trusted Checking - complete >> Services: potentially dangerous service allowed: TermService (Terminal Services) >> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery Service) >> Services: potentially dangerous service allowed: TlntSvr () >> Services: potentially dangerous service allowed: Schedule (Task Scheduler) > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)! >> Security: disk drives' autorun is enabled >> Security: administrative shares (C$, D$ ...) are enabled >> Security: anonymous user access is enabled >> Process termination timeout is out of admissible values >> Service termination timeout is out of admissible values >> Disable HDD autorun >> Disable autorun from network drives >> Disable CD/DVD autorun >> Disable removable media autorun >> Windows Explorer - show extensions of known file types System Analysis in progressAdd commands to script:
System Analysis - complete
Script commands