Results of system analysis

Kaspersky Virus Removal Tool 11.0.0.1245 (database released 23/11/2014; 15:06)

List of processes

File namePIDDescriptionCopyrightMD5Information
dlpwdnt.exe
Script: Quarantine, Delete, BC delete, Terminate		2380  ??error getting file info
Command line:
dlsdbnt.exe
Script: Quarantine, Delete, BC delete, Terminate		1684  ??error getting file info
Command line:
esClient.exe
Script: Quarantine, Delete, BC delete, Terminate		1808  ??error getting file info
Command line:
c:\program files (x86)\constant guard protection suite\idvault.exe
Script: Quarantine, Delete, BC delete, Terminate		5568Fast ConnectCopyright © 2006-2013 White Sky, Inc. All rights reserved.??2217.30 kb, rsAh,
created: 12.11.2014 15:27:04,
modified: 12.11.2014 15:27:08
Command line:
"C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe"
c:\program files (x86)\constant guard protection suite\idvaultsvc.exe
Script: Quarantine, Delete, BC delete, Terminate		1504Fast ConnectCopyright © 2006-2013 White Sky, Inc. All rights reserved.??39.30 kb, rsAh,
created: 12.11.2014 15:27:04,
modified: 12.11.2014 15:27:08
Command line:
"C:\Program Files (x86)\Constant Guard Protection Suite\IDVaultSvc.exe"
ielowutil.exe
Script: Quarantine, Delete, BC delete, Terminate		5952  ??error getting file info
Command line:
ipoint.exe
Script: Quarantine, Delete, BC delete, Terminate		2248  ??error getting file info
Command line:
itype.exe
Script: Quarantine, Delete, BC delete, Terminate		2024  ??error getting file info
Command line:
mDNSResponder.exe
Script: Quarantine, Delete, BC delete, Terminate		1656  ??error getting file info
Command line:
Microsoft.HomeServer.Archive.TransferService.exe
Script: Quarantine, Delete, BC delete, Terminate		2280  ??error getting file info
Command line:
nvtray.exe
Script: Quarantine, Delete, BC delete, Terminate		2588  ??error getting file info
Command line:
nvxdsync.exe
Script: Quarantine, Delete, BC delete, Terminate		1252  ??error getting file info
Command line:
PresentationFontCache.exe
Script: Quarantine, Delete, BC delete, Terminate		1944  ??error getting file info
Command line:
sqlwriter.exe
Script: Quarantine, Delete, BC delete, Terminate		2060  ??error getting file info
Command line:
TrustedInstaller.exe
Script: Quarantine, Delete, BC delete, Terminate		4468  ??error getting file info
Command line:
WDDMService.exe
Script: Quarantine, Delete, BC delete, Terminate		2144  ??error getting file info
Command line:
WDFME.exe
Script: Quarantine, Delete, BC delete, Terminate		2408  ??error getting file info
Command line:
WDRulesEngine.exe
Script: Quarantine, Delete, BC delete, Terminate		2176  ??error getting file info
Command line:
WHSConnector.exe
Script: Quarantine, Delete, BC delete, Terminate		2548  ??error getting file info
Command line:
WHSTrayApp.exe
Script: Quarantine, Delete, BC delete, Terminate		1128  ??error getting file info
Command line:
wmpnetwk.exe
Script: Quarantine, Delete, BC delete, Terminate		4696  ??error getting file info
Command line:
Detected:75, recognized as trusted 56
Module nameHandleDescriptionCopyrightMD5Used by processes
C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio4b37ff64#\9370714a38ae2805434296b26a9f5b14\PresentationFramework-SystemXmlLinq.ni.dll
Script: Quarantine, Delete, BC delete		1684209664PresentationFramework-SystemXmlLinq.dll© Microsoft Corporation. All rights reserved.--5568
C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio84a7b877#\4df6733efc348c009a4a6e0adccc42a6\PresentationFramework-SystemData.ni.dll
Script: Quarantine, Delete, BC delete		1574502400PresentationFramework-SystemData.dll© Microsoft Corporation. All rights reserved.--5568
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data\5d2c01ae1ca8c40ed74cdfd7b7b7dcb1\System.Data.ni.dll
Script: Quarantine, Delete, BC delete		1496645632.NET Framework© Microsoft Corporation. All rights reserved.--5568
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Serv759bfb78#\902843918d037f5f3511d679bf1e2216\System.ServiceProcess.ni.dll
Script: Quarantine, Delete, BC delete		1927479296.NET Framework© Microsoft Corporation. All rights reserved.--5568, 1504
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Servf73e6522#\8c9f9e94e93956d68b43e34324790c6d\System.ServiceModel.Web.ni.dll
Script: Quarantine, Delete, BC delete		1570832384System.ServiceModel.Web.dll© Microsoft Corporation. All rights reserved.--5568
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Web.Services\db9cd60ed9ff9585b54d446f37392e8f\System.Web.Services.ni.dll
Script: Quarantine, Delete, BC delete		1516175360.NET Framework© Microsoft Corporation. All rights reserved.--5568
Modules detected:436, recognized as trusted 430

Kernel Space Modules Viewer

ModuleBase addressSize in memoryDescriptionManufacturer
C:\Windows\System32\Drivers\dump_atapi.sys
Script: Quarantine, Delete, BC delete		5FF3000009000 (36864)
C:\Windows\System32\Drivers\dump_dumpata.sys
Script: Quarantine, Delete, BC delete		5FE700000C000 (49152)
C:\Windows\System32\Drivers\dump_dumpfve.sys
Script: Quarantine, Delete, BC delete		5E00000013000 (77824)
Modules detected - 177, recognized as trusted - 174

Services

ServiceDescriptionStatusFileGroupDependencies
Detected - 177, recognized as trusted - 177

Drivers

ServiceDescriptionStatusFileGroupDependencies
ALSysIO
Driver: Unload, Delete, Disable, BC delete		ALSysIONot startedC:\Users\Willie\AppData\Local\Temp\ALSysIO64.sys
Script: Quarantine, Delete, BC delete		  
AntiLog32
Driver: Unload, Delete, Disable, BC delete		AntiLog32Not startedC:\Windows\system32\drivers\AntiLog64.sys
Script: Quarantine, Delete, BC delete		  
catchme
Driver: Unload, Delete, Disable, BC delete		catchmeNot startedC:\ComboFix\catchme.sys
Script: Quarantine, Delete, BC delete		Base 
keycrypt
Driver: Unload, Delete, Disable, BC delete		keycryptNot startedC:\Windows\system32\DRIVERS\KeyCrypt64.sys
Script: Quarantine, Delete, BC delete		Keyboard Classkbdclass
Detected - 270, recognized as trusted - 266

Autoruns

File nameStatusStartup methodDescription
C:\Program Files (x86)\SFT\GuardedID\events\events.dll
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\GIDTB, EventMessageFile
C:\Users\Willie\AppData\Local\Temp\_uninst_81202312.bat
Script: Quarantine, Delete, BC delete		ActiveShortcut in Autoruns folderC:\Users\Willie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\, C:\Users\Willie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_uninst_81202312.lnk,
C:\Users\Willie\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop (1).ini
Script: Quarantine, Delete, BC delete		ActiveFile in Autoruns folderC:\Users\Willie\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\, C:\Users\Willie\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop (1).ini,
C:\Windows\System32\MsSpellCheckingFacility.dll
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-Spell-Checking, EventMessageFile
C:\Windows\System32\MsSpellCheckingFacility.dll
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-SpellChecker, EventMessageFile
C:\Windows\System32\MsSpellCheckingFacility.dll
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Spell-Checking, EventMessageFile
C:\Windows\System32\MsSpellCheckingFacility.dll
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-SpellChecker, EventMessageFile
C:\Windows\System32\appmgmts.dll
Script: Quarantine, Delete, BC delete		ActiveRegistry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters, ServiceDll
Delete
C:\Windows\system32\drivers\N360\1506000.020\SYMEFA64.SYS
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\SymEFA, EventMessageFile
C:\Windows\system32\psxss.exe
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
auditcse.dll
Script: Quarantine, Delete, BC delete		ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{f3ccc681-b74c-4060-9f26-cd84525dca2a}, DLLName
Delete
c:\Program Files\Microsoft Mouse and Keyboard Center\dw15.exe
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\IntelliType Pro, EventMessageFile
rdpclip
Script: Quarantine, Delete, BC delete		ActiveRegistry keyHKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd, StartupPrograms
Delete
Autoruns items detected - 597, recognized as trusted - 584

Microsoft Internet Explorer extension modules (BHOs, Toolbars ...)

File nameTypeDescriptionManufacturerCLSID
Elements detected - 5, recognized as trusted - 5

Windows Explorer extension modules

File nameDestinationDescriptionManufacturerCLSID
WebCheck{E6FB5E20-DE35-11CF-9C87-00AA005127ED}
Delete
ColumnHandler{F9DB5320-233E-11D1-9F84-707F02C10627}
Delete
Elements detected - 20, recognized as trusted - 18

Printing system extensions (print monitors, providers)

File nameTypeNameDescriptionManufacturer
localspl.dll
Script: Quarantine, Delete, BC delete		MonitorLocal Port
FXSMON.DLL
Script: Quarantine, Delete, BC delete		MonitorMicrosoft Shared Fax Monitor
sdt1cl6.dll
Script: Quarantine, Delete, BC delete		Monitorsdt1c Langmon
STOFaxPort64.dll
Script: Quarantine, Delete, BC delete		MonitorSmarThru Office PC Fax Port
tcpmon.dll
Script: Quarantine, Delete, BC delete		MonitorStandard TCP/IP Port
DLXSOZIL.DLL
Script: Quarantine, Delete, BC delete		MonitorStatus Monitor Language Monitor for Dell Color Laser 1320c
usbmon.dll
Script: Quarantine, Delete, BC delete		MonitorUSB Monitor
WSDMon.dll
Script: Quarantine, Delete, BC delete		MonitorWSD Port
inetpp.dll
Script: Quarantine, Delete, BC delete		ProviderHTTP Print Services
Elements detected - 10, recognized as trusted - 1

Task Scheduler jobs

File nameJob nameJob statusDescriptionManufacturer
Elements detected - 3, recognized as trusted - 3

SPI/LSP settings

Namespace providers (NSP)
ProviderStatusEXE fileDescriptionGUID
Detected - 7, recognized as trusted - 7
Transport protocol providers (TSP, LSP)
ProviderEXE fileDescription
Detected - 10, recognized as trusted - 10
Results of automatic SPI settings check 
LSP settings checked. No errors detected

TCP/UDP ports

PortStatusRemote HostRemote PortApplicationNotes
TCP ports
135LISTENING0.0.0.00[836] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
139LISTENING0.0.0.00[4] System
Script: Quarantine, Delete, BC delete, Terminate		 
445LISTENING0.0.0.00[4] System
Script: Quarantine, Delete, BC delete, Terminate		 
554LISTENING0.0.0.00[4696] wmpnetwk.exe
Script: Quarantine, Delete, BC delete, Terminate		 
808LISTENING0.0.0.00[5568] c:\program files (x86)\constant guard protection suite\idvault.exe
Script: Quarantine, Delete, BC delete, Terminate		 
2559LISTENING0.0.0.00[2772] c:\program files (x86)\nvidia corporation\nvidia update core\daemonu.exe
Script: Quarantine, Delete, BC delete, Terminate		 
2869LISTENING0.0.0.00[4] System
Script: Quarantine, Delete, BC delete, Terminate		 
5354LISTENING0.0.0.00[1656] mDNSResponder.exe
Script: Quarantine, Delete, BC delete, Terminate		 
5357LISTENING0.0.0.00[4] System
Script: Quarantine, Delete, BC delete, Terminate		 
10243LISTENING0.0.0.00[4] System
Script: Quarantine, Delete, BC delete, Terminate		 
49152LISTENING0.0.0.00[468] wininit.exe
Script: Quarantine, Delete, BC delete, Terminate		 
49153LISTENING0.0.0.00[924] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
49154LISTENING0.0.0.00[304] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
49155LISTENING0.0.0.00[572] lsass.exe
Script: Quarantine, Delete, BC delete, Terminate		 
49158LISTENING0.0.0.00[2380] dlpwdnt.exe
Script: Quarantine, Delete, BC delete, Terminate		 
49159LISTENING0.0.0.00[1316] spoolsv.exe
Script: Quarantine, Delete, BC delete, Terminate		 
49160LISTENING0.0.0.00[528] services.exe
Script: Quarantine, Delete, BC delete, Terminate		 
49163LISTENING0.0.0.00[1852] c:\program files (x86)\norton security suite\engine\21.6.0.32\n360.exe
Script: Quarantine, Delete, BC delete, Terminate		 
49164LISTENING0.0.0.00[1852] c:\program files (x86)\norton security suite\engine\21.6.0.32\n360.exe
Script: Quarantine, Delete, BC delete, Terminate		 
49759ESTABLISHED74.125.20.12180[1716] c:\program files (x86)\google\chrome\application\chrome.exe
Script: Quarantine, Delete, BC delete, Terminate		 
49827SYN_SENT192.168.0.601138[2548] WHSConnector.exe
Script: Quarantine, Delete, BC delete, Terminate		 
49831ESTABLISHED184.84.183.21980[1852] c:\program files (x86)\norton security suite\engine\21.6.0.32\n360.exe
Script: Quarantine, Delete, BC delete, Terminate		 
49832ESTABLISHED184.84.183.21980[1852] c:\program files (x86)\norton security suite\engine\21.6.0.32\n360.exe
Script: Quarantine, Delete, BC delete, Terminate		 
49833ESTABLISHED184.84.183.21980[1852] c:\program files (x86)\norton security suite\engine\21.6.0.32\n360.exe
Script: Quarantine, Delete, BC delete, Terminate		 
49834ESTABLISHED184.84.183.21980[1852] c:\program files (x86)\norton security suite\engine\21.6.0.32\n360.exe
Script: Quarantine, Delete, BC delete, Terminate		 
UDP ports
137LISTENING----[4] System
Script: Quarantine, Delete, BC delete, Terminate		 
138LISTENING----[4] System
Script: Quarantine, Delete, BC delete, Terminate		 
500LISTENING----[304] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1434LISTENING----[1140] c:\program files (x86)\microsoft sql server\90\shared\sqlbrowser.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1900LISTENING----[1880] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1900LISTENING----[1880] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
3544LISTENING----[304] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
3702LISTENING----[1020] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
3702LISTENING----[1880] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
3702LISTENING----[1880] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
3702LISTENING----[1020] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
4500LISTENING----[304] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
5004LISTENING----[4696] wmpnetwk.exe
Script: Quarantine, Delete, BC delete, Terminate		 
5005LISTENING----[4696] wmpnetwk.exe
Script: Quarantine, Delete, BC delete, Terminate		 
5353LISTENING----[1656] mDNSResponder.exe
Script: Quarantine, Delete, BC delete, Terminate		 
5355LISTENING----[1108] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
48000LISTENING----[2772] c:\program files (x86)\nvidia corporation\nvidia update core\daemonu.exe
Script: Quarantine, Delete, BC delete, Terminate		 
48001LISTENING----[2588] nvtray.exe
Script: Quarantine, Delete, BC delete, Terminate		 
49442LISTENING----[1656] mDNSResponder.exe
Script: Quarantine, Delete, BC delete, Terminate		 
50632LISTENING----[1880] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
50633LISTENING----[1880] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
54208LISTENING----[1316] spoolsv.exe
Script: Quarantine, Delete, BC delete, Terminate		 
55676LISTENING----[1108] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
56118LISTENING----[304] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
57059LISTENING----[1880] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
58002LISTENING----[1020] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
58856LISTENING----[1020] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 

Downloaded Program Files (DPF)

File nameDescriptionManufacturerCLSIDSource URL
Elements detected - 0, recognized as trusted - 0

Control Panel Applets (CPL)

File nameDescriptionManufacturer
C:\Windows\system32\FlashPlayerCPLApp.cpl
Script: Quarantine, Delete, BC delete		Adobe Flash Player Control Panel AppletCopyright © 1996-2014 Adobe Systems Incorporated. All Rights Reserved. Adobe and Flash are either trademarks or registered trademarks in the United States and/or other countries.
Elements detected - 20, recognized as trusted - 19

Active Setup

File nameDescriptionManufacturerCLSID
Elements detected - 7, recognized as trusted - 7

HOSTS file

Hosts file record 
127.0.0.1       localhost
Clear Hosts file

Protocols and handlers

File nameTypeDescriptionManufacturerCLSID
mscoree.dll
Script: Quarantine, Delete, BC delete		ProtocolMicrosoft .NET Runtime Execution Engine ()© Microsoft Corporation. All rights reserved.{1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, BC delete		ProtocolMicrosoft .NET Runtime Execution Engine ()© Microsoft Corporation. All rights reserved.{1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, BC delete		ProtocolMicrosoft .NET Runtime Execution Engine ()© Microsoft Corporation. All rights reserved.{1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
Elements detected - 14, recognized as trusted - 11

Suspicious objects

FileDescriptionType 

Main script of analysis
Windows version: Windows 7 Home Premium, Build=7601, SP="Service Pack 1"
System Restore: enabled
>> Services: potentially dangerous service allowed: TermService (@%SystemRoot%\System32\termsrv.dll,-268)
>> Services: potentially dangerous service allowed: SSDPSRV (@%systemroot%\system32\ssdpsrv.dll,-100)
>> Services: potentially dangerous service allowed: Schedule (@%SystemRoot%\system32\schedsvc.dll,-100)
> Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)!
>> Security: disk drives' autorun is enabled
>> Security: administrative shares (C$, D$ ...) are enabled
>> Security: anonymous user access is enabled
>> Security: sending Remote Assistant queries is enabled
 >>  Disable HDD autorun
 >>  Disable autorun from network drives
 >>  Disable CD/DVD autorun
 >>  Disable removable media autorun
System Analysis in progress

 System Analysis - complete


Script commands
 

Add commands to script:
Additional operations:

File list