Kaspersky Virus Removal Tool 2010 9.0.0.722 (database released 22/02/2011; 14:28)
| File name | PID | Description | Copyright | MD5 | Information
| Detected:50, recognized as trusted 50
| | |||||
| Module name | Handle | Description | Copyright | MD5 | Used by processes
| Modules detected:568, recognized as trusted 568
| | |||||
| Module | Base address | Size in memory | Description | Manufacturer
| C:\Windows\System32\Drivers\dump_iaStor.sys | Script: Quarantine, Delete, BC delete 91472000 | 0D9000 (888832) |
| Modules detected - 155, recognized as trusted - 154
| | |||||
| Service | Description | Status | File | Group | Dependencies
| Detected - 150, recognized as trusted - 150
| | ||||||
| Service | Description | Status | File | Group | Dependencies
| catchme | Driver: Unload, Delete, Disable catchme | Not started | C:\Users\Owner\AppData\Local\Temp\catchme.sys | Script: Quarantine, Delete, BC delete Base |
| IpInIp | Driver: Unload, Delete, Disable IP in IP Tunnel Driver | Not started | C:\Windows\system32\DRIVERS\ipinip.sys | Script: Quarantine, Delete, BC delete | Tcpip
| NwlnkFlt | Driver: Unload, Delete, Disable IPX Traffic Filter Driver | Not started | C:\Windows\system32\DRIVERS\nwlnkflt.sys | Script: Quarantine, Delete, BC delete | NwlnkFwd
| NwlnkFwd | Driver: Unload, Delete, Disable IPX Traffic Forwarder Driver | Not started | C:\Windows\system32\DRIVERS\nwlnkfwd.sys | Script: Quarantine, Delete, BC delete |
| Detected - 248, recognized as trusted - 244
| | ||||||
| File name | Status | Startup method | Description
| C:\Users\Owner\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop (1).ini | Script: Quarantine, Delete, BC delete Active | File in Autoruns folder | C:\Users\Owner\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\, C:\Users\Owner\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop (1).ini,
| C:\WindowsSystem32\IoLogMsg.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\vsmraid, EventMessageFile | Delete C:\Windows\SoftwareDistribution\Download\Install\WGAER_M.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\WGA Scanner, EventMessageFile | Delete C:\Windows\System32\appmgmts.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters, ServiceDll | Delete C:\Windows\System32\igmpv2.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile | Delete C:\Windows\System32\ipbootp.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile | Delete C:\Windows\System32\iprip2.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile | Delete C:\Windows\system32\psxss.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
| progman.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, shell | Delete rdpclip | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd, StartupPrograms | Delete vgafix.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon | Delete vgaoem.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon | Delete vgasys.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon | Delete Autoruns items detected - 482, recognized as trusted - 469
| | ||||||
| File name | Type | Description | Manufacturer | CLSID
| Extension module | {2670000A-7350-4f3c-8081-5663EE0C6C49} | Delete Extension module | {92780B25-18CC-41C8-B9BE-3C9C571A8263} | Delete Extension module | {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} | Delete Elements detected - 5, recognized as trusted - 2
| | |||||||||||||||
| File name | Destination | Description | Manufacturer | CLSID
| IE User Assist | {FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} | Delete Color Control Panel Applet | {b2c761c6-29bc-4f19-9251-e6195265baf1} | Delete Add New Hardware | {7A979262-40CE-46ff-AEEE-7884AC3B6136} | Delete Get Programs Online | {3e7efb4c-faf1-453d-89eb-56026875ef90} | Delete Taskbar and Start Menu | {0DF44EAA-FF21-4412-828E-260A8728E7F1} | Delete ActiveDirectory Folder | {1b24a030-9b20-49bc-97ac-1be4426f9e59} | Delete ActiveDirectory Folder | {34449847-FD14-4fc8-A75A-7432F5181EFB} | Delete Sam Account Folder | {C8494E42-ACDD-4739-B0FB-217361E4894F} | Delete Sam Account Folder | {E29F9716-5C08-4FCD-955A-119FDB5A522D} | Delete Control Panel command object for Start menu | {5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0} | Delete Default Programs command object for Start menu | {E44E5D18-0652-4508-A4E2-8A090067BCB0} | Delete Folder Options | {6dfd7c5c-2451-11d3-a299-00c04f8ef6af} | Delete Explorer Query Band | {2C2577C2-63A7-40e3-9B7F-586602617ECB} | Delete View Available Networks | {38a98528-6cbf-4ca9-8dc0-b1e1d10f7b1b} | Delete Contacts folder | {0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} | Delete Windows Firewall | {4026492f-2f69-46b8-b9bf-5654fc07e423} | Delete Problem Reports and Solutions | {fcfeecae-ee1b-4849-ae50-685dcf7717ec} | Delete iSCSI Initiator | {a304259d-52b8-4526-8b1a-a1d6cecc8243} | Delete .cab or .zip files | {911051fa-c21c-4246-b470-070cd8df6dc4} | Delete Windows Search Shell Service | {da67b8ad-e81b-4c70-9b91b417b5e33527} | Delete Microsoft.ScannersAndCameras | {00f2886f-cd64-4fc9-8ec5-30ef6cdbe8c3} | Delete "C:\Windows\System32\rundll32.exe" "C:\Program Files\\Windows Photo Gallery\PhotoViewer.dll",ImageView_COMServer {9D687A4C-1404-41ef-A089-883B6FBECDE6} | Script: Quarantine, Delete, BC delete Windows Photo Gallery Viewer Autoplay Handler | {9D687A4C-1404-41ef-A089-883B6FBECDE6} | Delete Windows Sidebar Properties | {37efd44d-ef8d-41b1-940d-96973a50e9e0} | Delete Windows Features | {67718415-c450-4f3c-bf8a-b487642dc39b} | Delete Windows Defender | {d8559eb9-20c0-410e-beda-7ed416aecc2a} | Delete Mobility Center Control Panel | {5ea4f148-308c-46d7-98a9-49041b1dd468} | Delete "C:\Program Files\\Windows Media Player\wmprph.exe" | Script: Quarantine, Delete, BC delete Windows Media Player Rich Preview Handler | {031EE060-67BC-460d-8847-E4A7C5E45A27} | Delete User Accounts | {7A9D77BD-5403-11d2-8785-2E0420524153} | Delete epm-po.dll | Script: Quarantine, Delete, BC delete EPM-PO Shell Extension | {2b45bd21-71f8-4c8c-a87a-7eeb25a1a3e0} | Delete Elements detected - 300, recognized as trusted - 271
| | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| File name | Type | Name | Description | Manufacturer
| Elements detected - 8, recognized as trusted - 8
| | ||||||
| File name | Job name | Job status | Description | Manufacturer
| Elements detected - 2, recognized as trusted - 2
| | ||||||
| Provider | Status | EXE file | Description | GUID
| Detected - 7, recognized as trusted - 7
| | ||||||
| Provider | EXE file | Description
| Detected - 24, recognized as trusted - 24
| | ||||||
| File name | Description | Manufacturer | CLSID | Source URL
| Elements detected - 4, recognized as trusted - 4
| | ||||||
| File name | Description | Manufacturer
| Elements detected - 22, recognized as trusted - 22
| | ||||||
| File name | Description | Manufacturer | CLSID
| Elements detected - 9, recognized as trusted - 9
| | ||||||
Hosts file record
|
| File name | Type | Description | Manufacturer | CLSID
| mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| Elements detected - 20, recognized as trusted - 17
| | ||||||
| File | Description | Type |
Main script of analysis Windows version: Windows Vista (TM) Home Premium, Build=6002, SP="Service Pack 2" System Restore: enabled 1.1 Searching for user-mode API hooks Analysis: kernel32.dll, export table found in section .text IAT modification detected: CreateProcessA - 00C20010<>764D1C28 IAT modification detected: GetModuleFileNameA - 00C20080<>7651B6BD IAT modification detected: GetModuleFileNameW - 00C200F0<>7651B27E IAT modification detected: CreateProcessW - 00C20160<>764D1BF3 IAT modification detected: LoadLibraryW - 00C20240<>764F9362 IAT modification detected: LoadLibraryA - 00C20320<>764F94DC IAT modification detected: GetProcAddress - 00C20390<>7651903B IAT modification detected: FreeLibrary - 00C20400<>76513DB4 Analysis: ntdll.dll, export table found in section .text Analysis: user32.dll, export table found in section .text Analysis: advapi32.dll, export table found in section .text Analysis: ws2_32.dll, export table found in section .text Analysis: wininet.dll, export table found in section .text Analysis: rasapi32.dll, export table found in section .text Analysis: urlmon.dll, export table found in section .text Analysis: netapi32.dll, export table found in section .text 1.2 Searching for kernel-mode API hooks Driver loaded successfully SDT found (RVA=137B00) Kernel ntkrnlpa.exe found in memory at address 82404000 SDT = 8253BB00 KiST = 824B086C (391) Functions checked: 391, intercepted: 0, restored: 0 1.3 Checking IDT and SYSENTER Analysis for CPU 1 Analysis for CPU 2 Checking IDT and SYSENTER - complete 1.4 Searching for masking processes and drivers Checking not performed: extended monitoring driver (AVZPM) is not installed Driver loaded successfully 1.5 Checking of IRP handlers Checking - complete >> Services: potentially dangerous service allowed: TermService (@%SystemRoot%\System32\termsrv.dll,-268) Error [2, SC_EXT_ADDITEMST] >> Services: potentially dangerous service allowed: SSDPSRV (@%systemroot%\system32\ssdpsrv.dll,-100) Error [2, SC_EXT_ADDITEMST] >> Services: potentially dangerous service allowed: Schedule (@%SystemRoot%\system32\schedsvc.dll,-100) Error [2, SC_EXT_ADDITEMST] > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)! >> Security: disk drives' autorun is enabled Error [2, SC_EXT_ADDITEMST] >> Security: administrative shares (C$, D$ ...) are enabled Error [2, SC_EXT_ADDITEMST] >> Security: anonymous user access is enabled Error [2, SC_EXT_ADDITEMST] Error [2, SC_EXT_ADDITEMST] >> Security: sending Remote Assistant queries is enabled >> Process termination timeout is out of admissible values >> Service termination timeout is out of admissible values >> Disable HDD autorun >> Disable autorun from network drives >> Disable CD/DVD autorun >> Disable removable media autorun >> Windows Explorer - show extensions of known file types System Analysis in progressAdd commands to script:
System Analysis - complete
Script commands