Results of system analysis

Kaspersky Virus Removal Tool 11.0.0.1245 (database released 13/01/2014; 16:02)

List of processes

File namePIDDescriptionCopyrightMD5Information
ehmsas.exe
Script: Quarantine, Delete, BC delete, Terminate		3620  ??error getting file info
Command line:
ehtray.exe
Script: Quarantine, Delete, BC delete, Terminate		3504  ??error getting file info
Command line:
nvxdsync.exe
Script: Quarantine, Delete, BC delete, Terminate		1092  ??error getting file info
Command line:
pcCMService.exe
Script: Quarantine, Delete, BC delete, Terminate		2080  ??error getting file info
Command line:
Detected:48, recognized as trusted 44
Module nameHandleDescriptionCopyrightMD5Used by processes
Modules detected:412, recognized as trusted 412

Kernel Space Modules Viewer

ModuleBase addressSize in memoryDescriptionManufacturer
C:\Windows\System32\Drivers\dump_atapi.sys
Script: Quarantine, Delete, BC delete		50EA000008000 (32768)
C:\Windows\System32\Drivers\dump_dumpata.sys
Script: Quarantine, Delete, BC delete		50DE00000C000 (49152)
Modules detected - 150, recognized as trusted - 148

Services

ServiceDescriptionStatusFileGroupDependencies
msiserver
Service: Stop, Delete, Disable, BC delete		Windows InstallerNot startedC:\Windows\system32\msiexec
Script: Quarantine, Delete, BC delete		 rpcss
PnkBstrA
Service: Stop, Delete, Disable, BC delete		PnkBstrANot startedC:\Windows\system32\PnkBstrA.exe
Script: Quarantine, Delete, BC delete		  
Detected - 149, recognized as trusted - 147

Drivers

ServiceDescriptionStatusFileGroupDependencies
EagleX64
Driver: Unload, Delete, Disable, BC delete		EagleX64Not startedC:\Windows\system32\drivers\EagleX64.sys
Script: Quarantine, Delete, BC delete		  
esgiguard
Driver: Unload, Delete, Disable, BC delete		esgiguardNot startedC:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys
Script: Quarantine, Delete, BC delete		  
IpInIp
Driver: Unload, Delete, Disable, BC delete		IP in IP Tunnel DriverNot startedC:\Windows\system32\DRIVERS\ipinip.sys
Script: Quarantine, Delete, BC delete		 Tcpip
MREMP50a64
Driver: Unload, Delete, Disable, BC delete		MREMP50a64 NDIS Protocol DriverNot startedC:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS
Script: Quarantine, Delete, BC delete		PNP_TDI 
MREMPR5
Driver: Unload, Delete, Disable, BC delete		MREMPR5 NDIS Protocol DriverNot startedC:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS
Script: Quarantine, Delete, BC delete		PNP_TDI 
MRENDIS5
Driver: Unload, Delete, Disable, BC delete		MRENDIS5 NDIS Protocol DriverNot startedC:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS
Script: Quarantine, Delete, BC delete		PNP_TDI 
MRESP50a64
Driver: Unload, Delete, Disable, BC delete		MRESP50a64 NDIS Protocol DriverNot startedC:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS
Script: Quarantine, Delete, BC delete		PNP_TDI 
NwlnkFlt
Driver: Unload, Delete, Disable, BC delete		IPX Traffic Filter DriverNot startedC:\Windows\system32\DRIVERS\nwlnkflt.sys
Script: Quarantine, Delete, BC delete		 NwlnkFwd
NwlnkFwd
Driver: Unload, Delete, Disable, BC delete		IPX Traffic Forwarder DriverNot startedC:\Windows\system32\DRIVERS\nwlnkfwd.sys
Script: Quarantine, Delete, BC delete		  
Detected - 249, recognized as trusted - 240

Autoruns

File nameStatusStartup methodDescription
C:\Program Files (x86)\Common Files\Microsoft Shared\DW\DW20.exe
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\HotFixInstaller, EventMessageFile
C:\Program Files (x86)\Common Files\Microsoft Shared\DW\DW20.exe
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\SPInstaller, EventMessageFile
C:\Program Files (x86)\Norton Security Suite\MUI\6.4.0.9\09\01\rcSvcHst.dll
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\ccCommon, EventMessageFile
C:\Program Files (x86)\SFT\GuardedID\events\events.dll
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\GIDTB, EventMessageFile
C:\Program Files\Dell Support Center\LoggerMessage.dll
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\PC-Doctor, EventMessageFile
C:\Users\tonyg\AppData\Local\Temp\SystemCheckup\EventMsg.dll
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\iolo Applications\ActiveCare, EventMessageFile
C:\Users\tonyg\AppData\Local\Temp\SystemCheckup\EventMsg.dll
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\iolo Applications\DriveScrubber, EventMessageFile
C:\Users\tonyg\AppData\Local\Temp\SystemCheckup\EventMsg.dll
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\iolo Applications\Installer, EventMessageFile
C:\Users\tonyg\AppData\Local\Temp\SystemCheckup\EventMsg.dll
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\iolo Applications\Launch Manager, EventMessageFile
C:\Users\tonyg\AppData\Local\Temp\SystemCheckup\EventMsg.dll
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\iolo Applications\Search and Recover, EventMessageFile
C:\Users\tonyg\AppData\Local\Temp\SystemCheckup\EventMsg.dll
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\iolo Applications\Service Manager, EventMessageFile
C:\Users\tonyg\AppData\Local\Temp\SystemCheckup\EventMsg.dll
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\iolo Applications\System Guard, EventMessageFile
C:\Users\tonyg\AppData\Local\Temp\SystemCheckup\EventMsg.dll
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\iolo Applications\System Mechanic, EventMessageFile
C:\Users\tonyg\AppData\Local\Temp\SystemCheckup\EventMsg.dll
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\iolo Applications\System Shield, EventMessageFile
C:\Users\tonyg\AppData\Local\Temp\SystemCheckup\EventMsg.dll
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\iolo Applications\Tune-Up Definitions, EventMessageFile
C:\Users\tonyg\AppData\Local\Temp\_uninst_14778425.bat
Script: Quarantine, Delete, BC delete		ActiveShortcut in Autoruns folderC:\Users\tonyg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\, C:\Users\tonyg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_uninst_14778425.lnk,
C:\Users\tonyg\AppData\Local\VirtualStore\Google\uksuud.dll
Script: Quarantine, Delete, BC delete		ActiveRegistry keyHKEY_USERS, S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run, Google
Delete
C:\Users\tonyg\AppData\Local\VirtualStore\Google\uksuud.dll
Script: Quarantine, Delete, BC delete		ActiveRegistry keyHKEY_USERS, S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run, Google
Delete
C:\Users\tonyg\AppData\Local\VirtualStore\Google\uksuud.dll
Script: Quarantine, Delete, BC delete		ActiveRegistry keyHKEY_USERS, S-1-5-21-2530642619-985529084-3126391969-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Run, Google
Delete
C:\Users\tonyg\AppData\Local\VirtualStore\PunkBuster\xljndskn.dll
Script: Quarantine, Delete, BC delete		ActiveRegistry keyHKEY_USERS, S-1-5-21-2530642619-985529084-3126391969-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Run, PunkBuster
Delete
C:\WindowsSystem32\IoLogMsg.dll
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\vsmraid, EventMessageFile
C:\Windows\System32\drivers\ssadbus.sys
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\ssadbus, EventMessageFile
C:\Windows\System32\drivers\sscdbus.sys
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\sscdbus, EventMessageFile
C:\Windows\System32\drivers\sscdmdm.sys
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\sscdmdm, EventMessageFile
C:\Windows\System32\igmpv2.dll
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile
C:\Windows\System32\ipbootp.dll
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile
C:\Windows\System32\iprip2.dll
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile
C:\Windows\System32\ws03res.dll
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPNATHLP, EventMessageFile
C:\Windows\system32\drivers\N360\1501000.012\SYMEFA64.SYS
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\SymEFA, EventMessageFile
C:\Windows\system32\psxss.exe
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
C:\c465878ff035ef76d3c1b206c5\DW\DW20.exe
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\VSSetup, EventMessageFile
c:\Program Files\Microsoft Security Client\MpEvMsg.dll
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft Antimalware, EventMessageFile
frapsv64.dll
Script: Quarantine, Delete, BC delete		ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, VIDC.FPS1
Delete
rdpclip
Script: Quarantine, Delete, BC delete		ActiveRegistry keyHKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd, StartupPrograms
Delete
Autoruns items detected - 680, recognized as trusted - 646

Microsoft Internet Explorer extension modules (BHOs, Toolbars ...)

File nameTypeDescriptionManufacturerCLSID
C:\Program Files\AOL Toolbar\aoltb.dll
Script: Quarantine, Delete, BC delete		BHO{3ef64538-8b54-4573-b48f-4d34b0238ab2}
Delete
C:\Program Files\AOL Toolbar\aoltb.dll
Script: Quarantine, Delete, BC delete		Toolbar{ba00b7b1-0351-477a-b948-23e3ee5a73d4}
Delete
Extension module{68BCFFE1-A2DA-4B40-9068-87ECBFC19D16}
Delete
Elements detected - 5, recognized as trusted - 2

Windows Explorer extension modules

File nameDestinationDescriptionManufacturerCLSID
lnkfile{00020d75-0000-0000-c000-000000000046}
Delete
Color Control Panel Applet{b2c761c6-29bc-4f19-9251-e6195265baf1}
Delete
Add New Hardware{7A979262-40CE-46ff-AEEE-7884AC3B6136}
Delete
Get Programs Online{3e7efb4c-faf1-453d-89eb-56026875ef90}
Delete
Taskbar and Start Menu{0DF44EAA-FF21-4412-828E-260A8728E7F1}
Delete
Control Panel command object for Start menu{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}
Delete
Default Programs command object for Start menu{E44E5D18-0652-4508-A4E2-8A090067BCB0}
Delete
Folder Options{6dfd7c5c-2451-11d3-a299-00c04f8ef6af}
Delete
View Available Networks{38a98528-6cbf-4ca9-8dc0-b1e1d10f7b1b}
Delete
Problem Reports and Solutions{fcfeecae-ee1b-4849-ae50-685dcf7717ec}
Delete
Windows Firewall{4026492f-2f69-46b8-b9bf-5654fc07e423}
Delete
iSCSI Initiator{a304259d-52b8-4526-8b1a-a1d6cecc8243}
Delete
Microsoft.ScannersAndCameras{00f2886f-cd64-4fc9-8ec5-30ef6cdbe8c3}
Delete
emdmgmt.dll
Script: Quarantine, Delete, BC delete		EMDFileProperties{BB6B2374-3D79-41DB-87F4-896C91846510}
Delete
Windows Sidebar Properties{37efd44d-ef8d-41b1-940d-96973a50e9e0}
Delete
Windows Features{67718415-c450-4f3c-bf8a-b487642dc39b}
Delete
Windows Defender{d8559eb9-20c0-410e-beda-7ed416aecc2a}
Delete
Mobility Center Control Panel{5ea4f148-308c-46d7-98a9-49041b1dd468}
Delete
C:\Program Files (x86)\Common Files\microsoft shared\ink\TipBand.dll
Script: Quarantine, Delete, BC delete		Tablet PC Input Panel{15D633E2-AD00-465b-9EC7-F56B7CDF8E27}
Delete
User Accounts{7A9D77BD-5403-11d2-8785-2E0420524153}
Delete
Auto Update Property Sheet Extension{5F327514-6C5E-4d60-8F16-D07FA08A78ED}
Delete
WinRAR shell extension{B41DB860-8EE4-11D2-9906-E49FADC173CA}
Delete
ColumnHandler{F9DB5320-233E-11D1-9F84-707F02C10627}
Delete
Elements detected - 274, recognized as trusted - 251

Printing system extensions (print monitors, providers)

File nameTypeNameDescriptionManufacturer
hpinksts8911LM.dll
Script: Quarantine, Delete, BC delete		MonitorHP 8911 Status Monitor
inetpp.dll
Script: Quarantine, Delete, BC delete		ProviderHTTP Print Services
Elements detected - 7, recognized as trusted - 5

Task Scheduler jobs

File nameJob nameJob statusDescriptionManufacturer
Elements detected - 5, recognized as trusted - 5

SPI/LSP settings

Namespace providers (NSP)
ProviderStatusEXE fileDescriptionGUID
Detected - 7, recognized as trusted - 7
Transport protocol providers (TSP, LSP)
ProviderEXE fileDescription
Detected - 19, recognized as trusted - 19
Results of automatic SPI settings check 
LSP settings checked. No errors detected

TCP/UDP ports

PortStatusRemote HostRemote PortApplicationNotes
TCP ports
135LISTENING0.0.0.00[924] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
139LISTENING0.0.0.00[4] System
Script: Quarantine, Delete, BC delete, Terminate		 
445LISTENING0.0.0.00[4] System
Script: Quarantine, Delete, BC delete, Terminate		 
2869LISTENING0.0.0.00[4] System
Script: Quarantine, Delete, BC delete, Terminate		 
5357LISTENING0.0.0.00[4] System
Script: Quarantine, Delete, BC delete, Terminate		 
27015LISTENING0.0.0.00[2032] c:\program files (x86)\common files\apple\mobile device support\applemobiledeviceservice.exe
Script: Quarantine, Delete, BC delete, Terminate		 
49152LISTENING0.0.0.00[564] wininit.exe
Script: Quarantine, Delete, BC delete, Terminate		 
49153LISTENING0.0.0.00[308] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
49154LISTENING0.0.0.00[436] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
49155LISTENING0.0.0.00[684] lsass.exe
Script: Quarantine, Delete, BC delete, Terminate		 
49157LISTENING0.0.0.00[620] services.exe
Script: Quarantine, Delete, BC delete, Terminate		 
49158LISTENING0.0.0.00[1276] c:\program files (x86)\norton security suite\engine\21.1.0.18\n360.exe
Script: Quarantine, Delete, BC delete, Terminate		 
49288CLOSE_WAIT23.73.160.60443[3636] c:\program files (x86)\common files\java\java update\jusched.exe
Script: Quarantine, Delete, BC delete, Terminate		 
51001TIME_WAIT74.125.196.12180[0]   
51004TIME_WAIT74.125.196.15680[0]   
51010TIME_WAIT74.125.21.13280[0]   
UDP ports
123LISTENING----[1204] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
137LISTENING----[4] System
Script: Quarantine, Delete, BC delete, Terminate		 
138LISTENING----[4] System
Script: Quarantine, Delete, BC delete, Terminate		 
1900LISTENING----[1204] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1900LISTENING----[1204] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
3702LISTENING----[1204] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
3702LISTENING----[1204] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
5355LISTENING----[1308] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
49160LISTENING----[1204] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
58690LISTENING----[2032] c:\program files (x86)\common files\apple\mobile device support\applemobiledeviceservice.exe
Script: Quarantine, Delete, BC delete, Terminate		 
58691LISTENING----[2032] c:\program files (x86)\common files\apple\mobile device support\applemobiledeviceservice.exe
Script: Quarantine, Delete, BC delete, Terminate		 
58692LISTENING----[1204] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
59055LISTENING----[284] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
60176LISTENING----[1204] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
61139LISTENING----[436] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
64003LISTENING----[3360] c:\program files (x86)\internet explorer\iexplore.exe
Script: Quarantine, Delete, BC delete, Terminate		 

Downloaded Program Files (DPF)

File nameDescriptionManufacturerCLSIDSource URL
Elements detected - 2, recognized as trusted - 2

Control Panel Applets (CPL)

File nameDescriptionManufacturer
C:\Windows\system32\FlashPlayerCPLApp.cpl
Script: Quarantine, Delete, BC delete		Adobe Flash Player Control Panel AppletCopyright © 1996 Adobe Systems Incorporated. All Rights Reserved. Adobe and Flash are either trademarks or registered trademarks in the United States and/or other countries.
Elements detected - 19, recognized as trusted - 18

Active Setup

File nameDescriptionManufacturerCLSID
Elements detected - 10, recognized as trusted - 10

HOSTS file

Hosts file record 
ÿþ1
Clear Hosts file

Protocols and handlers

File nameTypeDescriptionManufacturerCLSID
mscoree.dll
Script: Quarantine, Delete, BC delete		ProtocolMicrosoft .NET Runtime Execution Engine ()© Microsoft Corporation. All rights reserved.{1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, BC delete		ProtocolMicrosoft .NET Runtime Execution Engine ()© Microsoft Corporation. All rights reserved.{1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, BC delete		ProtocolMicrosoft .NET Runtime Execution Engine ()© Microsoft Corporation. All rights reserved.{1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
Elements detected - 13, recognized as trusted - 10

Suspicious objects

FileDescriptionType 

Main script of analysis
Windows version: Windows Vista (TM) Home Premium, Build=6002, SP="Service Pack 2"
System Restore: enabled
>> Services: potentially dangerous service allowed: TermService (@%SystemRoot%\System32\termsrv.dll,-268)
>> Services: potentially dangerous service allowed: SSDPSRV (@%systemroot%\system32\ssdpsrv.dll,-100)
>> Services: potentially dangerous service allowed: Schedule (@%SystemRoot%\system32\schedsvc.dll,-100)
> Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)!
>> Security: disk drives' autorun is enabled
>> Security: administrative shares (C$, D$ ...) are enabled
>> Security: anonymous user access is enabled
>> Security: sending Remote Assistant queries is enabled
 >>  Process termination timeout is out of admissible values
 >>  Service termination timeout is out of admissible values
 >>  Disable HDD autorun
 >>  Disable autorun from network drives
 >>  Disable CD/DVD autorun
 >>  Disable removable media autorun
 >>  Windows Explorer - show extensions of known file types
System Analysis in progress

 System Analysis - complete


Script commands
 

Add commands to script:
Additional operations:

File list