Kaspersky Virus Removal Tool 2010 9.0.0.722 (database released 06/05/2011; 10:58)
| File name | PID | Description | Copyright | MD5 | Information
| c:\windows\explorer.exe | Script: Quarantine, Delete, BC delete, Terminate 556 | Windows Explorer | © Microsoft Corporation. All rights reserved. | ?? | 1009.50 kb, rsah, | created: 8/10/2004 2:51:06 PM, modified: 4/13/2008 8:12:19 PM Command line: C:\WINDOWS\Explorer.EXE c:\program files\adobe\adobe photoshop cs2\photoshop.exe | Script: Quarantine, Delete, BC delete, Terminate 2524 | Adobe Photoshop CS2 | Copyright 2005 Adobe Systems Inc. | ?? | 19088.00 kb, rsah, | created: 3/22/2005 5:29:36 AM, modified: 7/25/2006 12:33:54 PM Command line: "C:\Program Files\Adobe\Adobe Photoshop CS2\Photoshop.exe" Detected:57, recognized as trusted 57
| | |||||
| Module name | Handle | Description | Copyright | MD5 | Used by processes
| C:\DOCUME~1\Gibsons\LOCALS~1\Temp\Adobelm_Cleanup.0001.dir.0002\~de2fd8.tmp | Script: Quarantine, Delete, BC delete 1722810368 | FLEXnet | Copyright (c) 1998-2005 Macrovision Corp. | -- | 2524
| C:\DOCUME~1\Gibsons\LOCALS~1\Temp\Adobelm_Cleanup.0001.dir.0002\~df394b.tmp | Script: Quarantine, Delete, BC delete 1718616064 | | | -- | 2524
| C:\DOCUME~1\Gibsons\LOCALS~1\Temp\Adobelm_Cleanup.0001.dir.0003\~df394b.tmp | Script: Quarantine, Delete, BC delete 1129447424 | | | -- | 2524
| C:\Program Files\Common Files\Adobe\Plug-Ins\CS2\File Formats\Camera Raw.8BI | Script: Quarantine, Delete, BC delete 1336737792 | Photoshop Camera Raw Plug-in | © 2007 Adobe Systems Incorporated | -- | 2524
| C:\WINDOWS\system32\CDRTC.DLL | Script: Quarantine, Delete, BC delete 29949952 | Roxio CDR4VSD support DLL | Copyright (c) 1994-2005 Sonic Solutions | -- | 556
| Modules detected:646, recognized as trusted 641
| | |||||
| Module | Base address | Size in memory | Description | Manufacturer
| C:\WINDOWS\System32\Drivers\dump_atapi.sys | Script: Quarantine, Delete, BC delete A745B000 | 018000 (98304) |
| C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS | Script: Quarantine, Delete, BC delete BA5BE000 | 002000 (8192) |
| Modules detected - 147, recognized as trusted - 145
| | ||||||
| Service | Description | Status | File | Group | Dependencies
| Creative Service for CDROM Access | Service: Stop, Delete, Disable Creative Service for CDROM Access | Not started | C:\WINDOWS\system32\CTsvcCDA.exe | Script: Quarantine, Delete, BC delete |
| Detected - 111, recognized as trusted - 110
| | ||||||
| Service | Description | Status | File | Group | Dependencies
| Abiosdsk | Driver: Unload, Delete, Disable Abiosdsk | Not started | Abiosdsk.sys | Script: Quarantine, Delete, BC delete Primary disk |
| Atdisk | Driver: Unload, Delete, Disable Atdisk | Not started | Atdisk.sys | Script: Quarantine, Delete, BC delete Primary disk |
| catchme | Driver: Unload, Delete, Disable catchme | Not started | C:\DOCUME~1\Gibsons\LOCALS~1\Temp\catchme.sys | Script: Quarantine, Delete, BC delete Base |
| Changer | Driver: Unload, Delete, Disable Changer | Not started | Changer.sys | Script: Quarantine, Delete, BC delete Filter |
| lbrtfdc | Driver: Unload, Delete, Disable lbrtfdc | Not started | lbrtfdc.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| mfsdisk | Driver: Unload, Delete, Disable mfsdisk | Not started | C:\WINDOWS\system32\mfsdisk.sys | Script: Quarantine, Delete, BC delete |
| ouxori | Driver: Unload, Delete, Disable ouxori | Not started | C:\WINDOWS\System32\drivers\wlje.sys | Script: Quarantine, Delete, BC delete System Reserved |
| PCIDump | Driver: Unload, Delete, Disable PCIDump | Not started | PCIDump.sys | Script: Quarantine, Delete, BC delete PCI Configuration |
| PDCOMP | Driver: Unload, Delete, Disable PDCOMP | Not started | PDCOMP.sys | Script: Quarantine, Delete, BC delete |
| PDFRAME | Driver: Unload, Delete, Disable PDFRAME | Not started | PDFRAME.sys | Script: Quarantine, Delete, BC delete |
| PDRELI | Driver: Unload, Delete, Disable PDRELI | Not started | PDRELI.sys | Script: Quarantine, Delete, BC delete |
| PDRFRAME | Driver: Unload, Delete, Disable PDRFRAME | Not started | PDRFRAME.sys | Script: Quarantine, Delete, BC delete |
| Simbad | Driver: Unload, Delete, Disable Simbad | Not started | Simbad.sys | Script: Quarantine, Delete, BC delete Filter |
| WDICA | Driver: Unload, Delete, Disable WDICA | Not started | WDICA.sys | Script: Quarantine, Delete, BC delete |
| Detected - 230, recognized as trusted - 216
| | ||||||
| File name | Status | Startup method | Description
| C:\Documents and Settings\Gibsons\Desktop\TORRENT FINISHED\Adobe Dreamweaver CS3 v9.0 Build 3453 (Portable)+HeartBug\DreamweaverPortable\DreamweaverPortable.exe | Script: Quarantine, Delete, BC delete Active | Shortcut in Autoruns folder | C:\Documents and Settings\Gibsons\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\Gibsons\Application Data\Microsoft\Internet Explorer\Quick Launch\Shortcut to DreamweaverPortable.lnk,
| C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma.cpl | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cpls, Adobe Gamma | Delete C:\WINDOWS\Installer\{E3FEE4E7-4488-4A3F-A6BD-13745936EADB}\iTunesIco.exe | Script: Quarantine, Delete, BC delete Active | Shortcut in Autoruns folder | C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes.lnk,
| C:\WINDOWS\System32\appmgmts.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters, ServiceDll | Delete C:\WINDOWS\System32\appmgmts.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Application Management, EventMessageFile | Delete C:\WINDOWS\System32\appmgr.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Software Installation, EventMessageFile | Delete C:\WINDOWS\System32\fdeploy.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\File Deployment, EventMessageFile | Delete C:\WINDOWS\System32\fdeploy.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Folder Redirection, EventMessageFile | Delete C:\WINDOWS\System32\igmpv2.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile | Delete C:\WINDOWS\System32\ipbootp.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile | Delete C:\WINDOWS\System32\iprip2.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile | Delete C:\WINDOWS\System32\ntbackup.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\ntbackup, EventMessageFile | Delete C:\WINDOWS\System32\ospf.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPF, EventMessageFile | Delete C:\WINDOWS\System32\ospfmib.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPFMib, EventMessageFile | Delete C:\WINDOWS\System32\polagent.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PolicyAgent, EventMessageFile | Delete C:\WINDOWS\System32\tssdis.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\TermServSessDir, EventMessageFile | Delete C:\WINDOWS\System\LVMaLogD.DLL | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\LOGITECH, EventMessageFile | Delete C:\WINDOWS\system32\CTsvcCDA.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Creative Service for CDROM Access, EventMessageFile | Delete C:\WINDOWS\system32\MsSip1.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 1, $DLL | Delete C:\WINDOWS\system32\MsSip2.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 2, $DLL | Delete C:\WINDOWS\system32\MsSip3.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 3, $DLL | Delete C:\WINDOWS\system32\asr_fmt.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR format utility for volumes | Delete C:\WINDOWS\system32\asr_ldm.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR utility for Logical Disk Manager | Delete C:\WINDOWS\system32\asr_pfu.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR protected file utility | Delete C:\WINDOWS\system32\psxss.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
| C:\WINDOWS\system32\stisvc.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System, EventMessageFile | Delete ResLuComServer_3_1.DLL | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\LiveUpdate, EventMessageFile | Delete appmgmts.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}, DLLName | Delete kbd101.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver JPN | Delete kbd101a.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver KOR | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, .DEFAULT\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-19\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-20\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-18\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-21-1577040387-431479505-303173195-1006\Control Panel\IOProcs, MVB | Delete vgafix.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon | Delete vgaoem.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon | Delete vgasys.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon | Delete Autoruns items detected - 574, recognized as trusted - 536
| | ||||||
| File name | Type | Description | Manufacturer | CLSID
| Toolbar | {710EB7A1-45ED-11D0-924A-0020AFC7AC4D} | Delete Elements detected - 17, recognized as trusted - 16
| | |||||||||
| File name | Destination | Description | Manufacturer | CLSID
| deskpan.dll | Script: Quarantine, Delete, BC delete Display Panning CPL Extension | {42071714-76d4-11d1-8b24-00a0c9068ff3} | Delete Shell extensions for file compression | {764BF0E1-F219-11ce-972D-00AA00A14F56} | Delete Encryption Context Menu | {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} | Delete Taskbar and Start Menu | {0DF44EAA-FF21-4412-828E-260A8728E7F1} | Delete rundll32.exe C:\WINDOWS\system32\shimgvw.dll,ImageView_COMServer {00E7B358-F65B-4dcf-83DF-CD026B94BFD4} | Script: Quarantine, Delete, BC delete Autoplay for SlideShow | {00E7B358-F65B-4dcf-83DF-CD026B94BFD4} | Delete User Accounts | {7A9D77BD-5403-11d2-8785-2E0420524153} | Delete Multiscan | {D9872D13-7651-4471-9EEE-F0A00218BEBB} | Delete AVG Find Extension | {9F97547E-460A-42C5-AE0C-81C61FFAEBC3} | Delete Elements detected - 210, recognized as trusted - 202
| | ||||||||||||||||||||||||||||
| File name | Type | Name | Description | Manufacturer
| Elements detected - 13, recognized as trusted - 13
| | ||||||
| File name | Job name | Job status | Description | Manufacturer
| Elements detected - 2, recognized as trusted - 2
| | ||||||
| Provider | Status | EXE file | Description | GUID
| Detected - 4, recognized as trusted - 4
| | ||||||
| Provider | EXE file | Description
| Detected - 13, recognized as trusted - 13
| | ||||||
| File name | Description | Manufacturer | CLSID | Source URL
| Elements detected - 12, recognized as trusted - 12
| | ||||||
| File name | Description | Manufacturer
| Elements detected - 28, recognized as trusted - 28
| | ||||||
| File name | Description | Manufacturer | CLSID
| Elements detected - 16, recognized as trusted - 16
| | ||||||
Hosts file record
|
| File name | Type | Description | Manufacturer | CLSID
| Elements detected - 34, recognized as trusted - 34
| | ||||||
| File | Description | Type
| C:\WINDOWS\System32\vsdatant.sys | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| |
Main script of analysis Windows version: Microsoft Windows XP, Build=2600, SP="Service Pack 3" System Restore: enabled 1.1 Searching for user-mode API hooks Analysis: kernel32.dll, export table found in section .text Function kernel32.dll:OpenProcess (632) intercepted, method APICodeHijack.JmpTo[20C78462] IAT modification detected: CreateProcessA - 00F00010<>7C80236B IAT modification detected: GetModuleFileNameA - 00F00080<>7C80B56F IAT modification detected: GetModuleFileNameW - 00F000F0<>7C80B475 IAT modification detected: CreateProcessW - 00F00160<>7C802336 IAT modification detected: LoadLibraryW - 00F00240<>7C80AEEB IAT modification detected: LoadLibraryA - 00F00320<>7C801D7B IAT modification detected: GetProcAddress - 00F00390<>7C80AE40 IAT modification detected: FreeLibrary - 00F00400<>7C80AC7E Analysis: ntdll.dll, export table found in section .text Function ntdll.dll:NtAccessCheckByType (89) intercepted, method APICodeHijack.JmpTo[20C78787] Function ntdll.dll:NtImpersonateClientOfPort (178) intercepted, method APICodeHijack.JmpTo[20C78D4E] Function ntdll.dll:NtSetInformationProcess (319) intercepted, method APICodeHijack.JmpTo[20C789A1] Function ntdll.dll:ZwAccessCheckByType (900) intercepted, method APICodeHijack.JmpTo[20C78787] Function ntdll.dll:ZwImpersonateClientOfPort (988) intercepted, method APICodeHijack.JmpTo[20C78D4E] Function ntdll.dll:ZwSetInformationProcess (1129) intercepted, method APICodeHijack.JmpTo[20C789A1] Analysis: user32.dll, export table found in section .text Function user32.dll:FindWindowA (228) intercepted, method APICodeHijack.JmpTo[20C78285] Function user32.dll:FindWindowW (231) intercepted, method APICodeHijack.JmpTo[20C78250] Analysis: advapi32.dll, export table found in section .text Function advapi32.dll:ImpersonateNamedPipeClient (304) intercepted, method APICodeHijack.JmpTo[20C78E53] Function advapi32.dll:SetThreadToken (574) intercepted, method APICodeHijack.JmpTo[20C7902C] Analysis: ws2_32.dll, export table found in section .text Analysis: wininet.dll, export table found in section .text Analysis: rasapi32.dll, export table found in section .text Analysis: urlmon.dll, export table found in section .text Analysis: netapi32.dll, export table found in section .text 1.2 Searching for kernel-mode API hooks Driver loaded successfully SDT found (RVA=085700) Kernel ntkrnlpa.exe found in memory at address 804D7000 SDT = 8055C700 KiST = 80504480 (284) Function NtConnectPort (1F) intercepted (805A45D0->A7671534), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateFile (25) intercepted (805790A8->A766B782), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateKey (29) intercepted (806240F0->A768A6DC), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreatePort (2E) intercepted (805A50EC->A7671CC0), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateProcess (2F) intercepted (805D1230->A7684EB4), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateProcessEx (30) intercepted (805D117A->A76852A2), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateSection (32) intercepted (805AB3C8->A768E916), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateWaitablePort (38) intercepted (805A5110->A7671DF6), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeleteFile (3E) intercepted (80576C50->A766C398), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeleteKey (3F) intercepted (8062458C->A768BFE4), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeleteValueKey (41) intercepted (8062475C->A768B93C), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDuplicateObject (44) intercepted (805BE008->A7683DF0), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtLoadKey (62) intercepted (80626314->A768C93C), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtLoadKey2 (63) intercepted (80625F20->A768CB44), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenFile (74) intercepted (8057A1A6->A766BFAA), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenProcess (7A) intercepted (805CB440->A76871CE), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenThread (80) intercepted (805CB6CC->A7686DF8), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtRenameKey (C0) intercepted (80623B12->A768D8D2), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtReplaceKey (C1) intercepted (806261C4->A768D208), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtRequestWaitReplyPort (C8) intercepted (805A2D76->A76710F4), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtRestoreKey (CC) intercepted (80625AD0->A768E2A4), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSecureConnectPort (D2) intercepted (805A3D64->A76717DC), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetInformationFile (E0) intercepted (8057B034->A766C75C), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetSecurityObject (ED) intercepted (805C062E->A768DE12), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetValueKey (F7) intercepted (80622662->A768B0C4), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSystemDebugControl (FF) intercepted (806180BA->A7685F0A), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtTerminateProcess (101) intercepted (805D29E2->A7685C86), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Functions checked: 284, intercepted: 27, restored: 27 1.3 Checking IDT and SYSENTER Analysis for CPU 1 Analysis for CPU 2 CmpCallCallBacks = 00093D84 Disable callback OK Checking IDT and SYSENTER - complete 1.4 Searching for masking processes and drivers Checking not performed: extended monitoring driver (AVZPM) is not installed Driver loaded successfully 1.5 Checking of IRP handlers \driver\tcpip[IRP_MJ_CREATE] = A765A434 -> C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted \driver\tcpip[IRP_MJ_CLOSE] = A765A434 -> C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted \driver\tcpip[IRP_MJ_DEVICE_CONTROL] = A765A434 -> C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted \driver\tcpip[IRP_MJ_INTERNAL_DEVICE_CONTROL] = A765A434 -> C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted \driver\tcpip[IRP_MJ_CLEANUP] = A765A434 -> C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted Checking - complete >> Services: potentially dangerous service allowed: TermService (Terminal Services) Error [2, SC_EXT_ADDITEMST] >> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery Service) Error [2, SC_EXT_ADDITEMST] >> Services: potentially dangerous service allowed: TlntSvr () Error [2, SC_EXT_ADDITEMST] >> Services: potentially dangerous service allowed: Schedule (Task Scheduler) Error [2, SC_EXT_ADDITEMST] >> Services: potentially dangerous service allowed: mnmsrvc (NetMeeting Remote Desktop Sharing) Error [2, SC_EXT_ADDITEMST] >> Services: potentially dangerous service allowed: RDSessMgr (Remote Desktop Help Session Manager) Error [2, SC_EXT_ADDITEMST] > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)! >> Security: disk drives' autorun is enabled Error [2, SC_EXT_ADDITEMST] >> Security: administrative shares (C$, D$ ...) are enabled Error [2, SC_EXT_ADDITEMST] >> Security: anonymous user access is enabled Error [2, SC_EXT_ADDITEMST] Error [2, SC_EXT_ADDITEMST] >> Security: sending Remote Assistant queries is enabled >> Disable HDD autorun >> Disable autorun from network drives >> Disable CD/DVD autorun >> Disable removable media autorun >> Windows Explorer - show extensions of known file types System Analysis in progressAdd commands to script:
System Analysis - complete
Script commands