Kaspersky Virus Removal Tool 2010 9.0.0.722 (database released 05/06/2011; 14:14)
| File name | PID | Description | Copyright | MD5 | Information
| c:\program files\kodak\mediaimpression\arcmonitor.exe | Script: Quarantine, Delete, BC delete, Terminate 264 | ArcMonitor | Copyright (C) 2010, ArcSoft, Inc. All rights reserved. | ?? | 78.50 kb, rsAh, | created: 3/19/2011 3:40:57 PM, modified: 7/20/2010 9:09:40 AM Command line: "C:\Program Files\Kodak\MediaImpression\ArcMonitor.exe" c:\program files\alwil software\avast5\avastsvc.exe | Script: Quarantine, Delete, BC delete, Terminate 1576 | avast! Service | Copyright (c) 2011 AVAST Software | ?? | 41.20 kb, rsAh, | created: 7/10/2010 2:01:20 PM, modified: 5/10/2011 8:10:57 AM Command line: "C:\Program Files\Alwil Software\Avast5\AvastSvc.exe" c:\program files\ati technologies\ati.ace\core-static\ccc.exe | Script: Quarantine, Delete, BC delete, Terminate 2520 | Catalyst Control Center: Host application | 2002-2010 | ?? | 64.00 kb, rsAh, | created: 9/15/2010 12:20:52 PM, modified: 9/15/2010 12:20:52 PM Command line: "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe" 0 c:\program files\iogear\ion\ioback.exe | Script: Quarantine, Delete, BC delete, Terminate 464 | | | ?? | 1654.00 kb, rsAh, | created: 1/13/2005 10:18:00 PM, modified: 1/13/2005 10:18:00 PM Command line: "C:\Program Files\IOGear\ION\ioback.exe" c:\program files\juniper\netscreen-remote\ipsecmon.exe | Script: Quarantine, Delete, BC delete, Terminate 1196 | IPSecMon Service Application | (c) 1997-2007 SafeNet, Inc. All rights reserved. | ?? | 72.05 kb, rsAh, | created: 7/30/2010 6:42:46 AM, modified: 11/9/2007 1:35:04 PM Command line: "C:\Program Files\Juniper\NetScreen-Remote\IPSecMon.exe" c:\program files\juniper\netscreen-remote\ireike.exe | Script: Quarantine, Delete, BC delete, Terminate 1264 | IreIke Service Application | (c) 1997-2007 SafeNet, Inc. All rights reserved. | ?? | 404.05 kb, rsAh, | created: 7/30/2010 6:43:15 AM, modified: 11/9/2007 1:35:04 PM Command line: "C:\Program Files\Juniper\NetScreen-Remote\IreIKE.exe" c:\windows\mhotkey.exe | Script: Quarantine, Delete, BC delete, Terminate 1832 | Multimedia Keyboard Driver | Copyright (c) 2007. | ?? | 539.50 kb, rsAh, | created: 1/30/2011 11:18:07 AM, modified: 4/4/2007 7:08:56 PM Command line: C:\WINDOWS\MHotkey.exe c:\program files\common files\pure networks shared\platform\nmctxth.exe | Script: Quarantine, Delete, BC delete, Terminate 272 | Pure Networks Platform Assistant | Copyright © 2002-2008 Cisco Systems, Inc. All rights reserved. | ?? | 627.79 kb, rsAh, | created: 12/12/2008 6:06:40 PM, modified: 12/12/2008 6:06:40 PM Command line: "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" c:\windows\system32\printdisp.exe | Script: Quarantine, Delete, BC delete, Terminate 140 | PrintDisp | Copyright 1998-2009 ActMask Co.,Ltd | ?? | 857.50 kb, rsAh, | created: 1/6/2011 10:41:49 AM, modified: 9/15/2009 8:47:44 PM Command line: "C:\WINDOWS\system32\PrintDisp.exe" c:\program files\juniper\netscreen-remote\safecfg.exe | Script: Quarantine, Delete, BC delete, Terminate 664 | Secure VPN Client | (c) 1997-2007 SafeNet, Inc. All rights reserved. | ?? | 76.05 kb, rsAh, | created: 7/30/2010 6:42:45 AM, modified: 11/9/2007 1:35:06 PM Command line: "C:\Program Files\Juniper\NetScreen-Remote\SafeCfg.exe" c:\windows\system32\spoolsv.exe | Script: Quarantine, Delete, BC delete, Terminate 1764 | Spooler SubSystem App | © Microsoft Corporation. All rights reserved. | ?? | 57.50 kb, rsAh, | created: 8/4/2004 8:00:00 AM, modified: 8/17/2010 9:17:06 AM Command line: C:\WINDOWS\system32\spoolsv.exe Detected:55, recognized as trusted 49
| | |||||
| Module name | Handle | Description | Copyright | MD5 | Used by processes
| C:\Program Files\Alwil Software\Avast5\defs\11060500\algo.dll | Script: Quarantine, Delete, BC delete 1665138688 | | | -- | 1576
| C:\Program Files\Alwil Software\Avast5\defs\11060501\algo.dll | Script: Quarantine, Delete, BC delete 150208512 | | | -- | 1576
| C:\Program Files\Common Files\ATI Technologies\Multimedia\atixcode.dll | Script: Quarantine, Delete, BC delete 473956352 | ATI Video Transcoder | Copyright © Advanced Micro Devices Inc., 2009 | -- | 2520
| C:\Program Files\Common Files\Pure Networks Shared\Platform\CAntiVirusCOM.dll | Script: Quarantine, Delete, BC delete 268435456 | | (c) OPSWAT, Inc. All rights reserved. | -- | 272
| C:\PROGRAM FILES\COMMON FILES\PURE NETWORKS SHARED\PLATFORM\FWManager.dll | Script: Quarantine, Delete, BC delete 26017792 | | Copyright (C) 2004 | -- | 272
| C:\Program Files\IOGear\ION\ioback.exe | Script: Quarantine, Delete, BC delete 4194304 | | | ?? | 464
| C:\Program Files\IOGear\ION\PLX507.dll | Script: Quarantine, Delete, BC delete 268435456 | PLX507 Dynamic Link Library | Copyright (C) 2005 Prolific Technology Inc. | -- | 464
| C:\Program Files\Juniper\NetScreen-Remote\EmDll.dll | Script: Quarantine, Delete, BC delete 17432576 | Event Monitoring Library | (c) 1997-2007 SafeNet, Inc. All rights reserved. | -- | 1264
| C:\Program Files\Juniper\NetScreen-Remote\IPSecMon.exe | Script: Quarantine, Delete, BC delete 4194304 | IPSecMon Service Application | (c) 1997-2007 SafeNet, Inc. All rights reserved. | ?? | 1196
| C:\Program Files\Juniper\NetScreen-Remote\IreGUI.dll | Script: Quarantine, Delete, BC delete 3473408 | IreGUI.DLL | (c) 1997-2007 SafeNet, Inc. All rights reserved. | -- | 1196
| C:\Program Files\Juniper\NetScreen-Remote\IreIKE.exe | Script: Quarantine, Delete, BC delete 4194304 | IreIke Service Application | (c) 1997-2007 SafeNet, Inc. All rights reserved. | ?? | 1264
| C:\Program Files\Juniper\NetScreen-Remote\OemRes.dll | Script: Quarantine, Delete, BC delete 12451840 | OemRes DLL | (c) 1997-2007 SafeNet, Inc. All rights reserved. | -- | 1196, 664
| C:\Program Files\Juniper\NetScreen-Remote\SafeCfg.exe | Script: Quarantine, Delete, BC delete 4194304 | Secure VPN Client | (c) 1997-2007 SafeNet, Inc. All rights reserved. | ?? | 664
| C:\Program Files\Kodak\MediaImpression\USBStorageManager.dll | Script: Quarantine, Delete, BC delete 268435456 | ArcSoft USBStorageManager | Copyright (C) ArcSoft Inc. 2007-2009. All rights reserved. | -- | 264
| C:\WINDOWS\MHotkey.exe | Script: Quarantine, Delete, BC delete 4194304 | Multimedia Keyboard Driver | Copyright (c) 2007. | ?? | 1832
| C:\WINDOWS\system32\cmondll.dll | Script: Quarantine, Delete, BC delete 4980736 | Cmondll DLL | (c) 1997-2007 SafeNet, Inc. All rights reserved. | -- | 1196, 664
| C:\WINDOWS\System32\IreBase.dll | Script: Quarantine, Delete, BC delete 17629184 | SafeNet IreBase DLL | (c) 1997-2005 SafeNet, Inc. All rights reserved. | -- | 1264
| C:\WINDOWS\System32\IreCgx.dll | Script: Quarantine, Delete, BC delete 17825792 | SafeNet CGX DLL | (c) 1997-2005 SafeNet, Inc. All rights reserved. | -- | 1264
| C:\WINDOWS\system32\IreComn.dll | Script: Quarantine, Delete, BC delete 268435456 | IreCommon Dll | (c) 1997-2007 SafeNet, Inc. All rights reserved. | -- | 1196, 1264, 664
| C:\WINDOWS\system32\IreMgmt.dll | Script: Quarantine, Delete, BC delete 4325376 | IreMgmt DLL | (c) 1997-2007 SafeNet, Inc. All rights reserved. | -- | 1196
| C:\WINDOWS\System32\IreSC.dll | Script: Quarantine, Delete, BC delete 19333120 | SafeNet IRESC DLL | (c) 1997-2005 SafeNet, Inc. All rights reserved. | -- | 1264
| C:\WINDOWS\system32\PrintDisp.exe | Script: Quarantine, Delete, BC delete 4194304 | PrintDisp | Copyright 1998-2009 ActMask Co.,Ltd | ?? | 140
| C:\WINDOWS\System32\spool\PRTPROCS\W32X86\ActPrint.dll | Script: Quarantine, Delete, BC delete 10485760 | ActMask Virtual Printer Driver | Copyright 1998-2007 ActMask Co.,Ltd | -- | 1764
| Modules detected:686, recognized as trusted 663
| | |||||
| Module | Base address | Size in memory | Description | Manufacturer
| C:\WINDOWS\System32\Drivers\ArcCD.SYS | Script: Quarantine, Delete, BC delete F7687000 | 009000 (36864) | ArcCD.sys ReadOnly | Copyright (C) 2006-2007, ArcSoft, Inc. All rights reserved.
| C:\WINDOWS\System32\Drivers\ArcRec.SYS | Script: Quarantine, Delete, BC delete F79DB000 | 002000 (8192) | File System Recognizer for ArcUdfs | Copyright (C) 2006-2007, ArcSoft, Inc. All rights reserved.
| C:\WINDOWS\system32\Drivers\Crypto.sys | Script: Quarantine, Delete, BC delete A96B3000 | 09A000 (630784) | SafeNet Crypto Driver | (c) 1997-2005 SafeNet, Inc. All rights reserved.
| C:\WINDOWS\System32\Drivers\dump_diskdump.sys | Script: Quarantine, Delete, BC delete EEE5D000 | 004000 (16384) |
| C:\WINDOWS\System32\Drivers\dump_nvgts.sys | Script: Quarantine, Delete, BC delete AC2EE000 | 02B000 (176128) |
| C:\WINDOWS\system32\Drivers\IPSECDRV.sys | Script: Quarantine, Delete, BC delete AC5D1000 | 028000 (163840) | SafeNet IPSec Plugin | (c) 1997-2007 SafeNet, Inc. All rights reserved.
| Modules detected - 146, recognized as trusted - 140
| | ||||||
| Service | Description | Status | File | Group | Dependencies
| IPSECMON | Service: Stop, Delete, Disable SafeNet Monitor Service | Running | C:\Program Files\Juniper\NetScreen-Remote\IPSecMon.exe | Script: Quarantine, Delete, BC delete TDI |
| IreIKE | Service: Stop, Delete, Disable SafeNet IKE Service | Running | C:\Program Files\Juniper\NetScreen-Remote\IreIKE.exe | Script: Quarantine, Delete, BC delete TDI | CRYPTO
| Detected - 118, recognized as trusted - 116
| | ||||||
| Service | Description | Status | File | Group | Dependencies
| ArcCD | Driver: Unload, Delete, Disable ArcCD Filter Driver Service | Running | C:\WINDOWS\system32\Drivers\ArcCD.sys | Script: Quarantine, Delete, BC delete |
| Crypto | Driver: Unload, Delete, Disable Crypto | Running | C:\WINDOWS\system32\Drivers\Crypto.sys | Script: Quarantine, Delete, BC delete TDI |
| IPSECDRV | Driver: Unload, Delete, Disable SafeNet IPSec Plugin | Running | C:\WINDOWS\system32\Drivers\IPSECDRV.sys | Script: Quarantine, Delete, BC delete PNP_TDI |
| Abiosdsk | Driver: Unload, Delete, Disable Abiosdsk | Not started | Abiosdsk.sys | Script: Quarantine, Delete, BC delete Primary disk |
| abp480n5 | Driver: Unload, Delete, Disable abp480n5 | Not started | abp480n5.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| adpu160m | Driver: Unload, Delete, Disable adpu160m | Not started | adpu160m.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Aha154x | Driver: Unload, Delete, Disable Aha154x | Not started | Aha154x.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| aic78u2 | Driver: Unload, Delete, Disable aic78u2 | Not started | aic78u2.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| aic78xx | Driver: Unload, Delete, Disable aic78xx | Not started | aic78xx.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| AliIde | Driver: Unload, Delete, Disable AliIde | Not started | AliIde.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| amsint | Driver: Unload, Delete, Disable amsint | Not started | amsint.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ArcUdfs | Driver: Unload, Delete, Disable ArcUdfs FileSystem Driver Service | Not started | C:\WINDOWS\system32\Drivers\ArcUdfs.sys | Script: Quarantine, Delete, BC delete File system |
| asc | Driver: Unload, Delete, Disable asc | Not started | asc.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| asc3350p | Driver: Unload, Delete, Disable asc3350p | Not started | asc3350p.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| asc3550 | Driver: Unload, Delete, Disable asc3550 | Not started | asc3550.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Atdisk | Driver: Unload, Delete, Disable Atdisk | Not started | Atdisk.sys | Script: Quarantine, Delete, BC delete Primary disk |
| catchme | Driver: Unload, Delete, Disable catchme | Not started | C:\DOCUME~1\Dad\LOCALS~1\Temp\catchme.sys | Script: Quarantine, Delete, BC delete Base |
| cd20xrnt | Driver: Unload, Delete, Disable cd20xrnt | Not started | cd20xrnt.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Changer | Driver: Unload, Delete, Disable Changer | Not started | Changer.sys | Script: Quarantine, Delete, BC delete Filter |
| CmdIde | Driver: Unload, Delete, Disable CmdIde | Not started | CmdIde.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| Cpqarray | Driver: Unload, Delete, Disable Cpqarray | Not started | Cpqarray.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| dac960nt | Driver: Unload, Delete, Disable dac960nt | Not started | dac960nt.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| dpti2o | Driver: Unload, Delete, Disable dpti2o | Not started | dpti2o.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| hpn | Driver: Unload, Delete, Disable hpn | Not started | hpn.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| i2omgmt | Driver: Unload, Delete, Disable i2omgmt | Not started | i2omgmt.sys | Script: Quarantine, Delete, BC delete SCSI Class |
| i2omp | Driver: Unload, Delete, Disable i2omp | Not started | i2omp.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ini910u | Driver: Unload, Delete, Disable ini910u | Not started | ini910u.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| IntelIde | Driver: Unload, Delete, Disable IntelIde | Not started | IntelIde.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| lbrtfdc | Driver: Unload, Delete, Disable lbrtfdc | Not started | lbrtfdc.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| mraid35x | Driver: Unload, Delete, Disable mraid35x | Not started | mraid35x.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| PCIDump | Driver: Unload, Delete, Disable PCIDump | Not started | PCIDump.sys | Script: Quarantine, Delete, BC delete PCI Configuration |
| PDCOMP | Driver: Unload, Delete, Disable PDCOMP | Not started | PDCOMP.sys | Script: Quarantine, Delete, BC delete |
| PDFRAME | Driver: Unload, Delete, Disable PDFRAME | Not started | PDFRAME.sys | Script: Quarantine, Delete, BC delete |
| PDRELI | Driver: Unload, Delete, Disable PDRELI | Not started | PDRELI.sys | Script: Quarantine, Delete, BC delete |
| PDRFRAME | Driver: Unload, Delete, Disable PDRFRAME | Not started | PDRFRAME.sys | Script: Quarantine, Delete, BC delete |
| perc2 | Driver: Unload, Delete, Disable perc2 | Not started | perc2.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| perc2hib | Driver: Unload, Delete, Disable perc2hib | Not started | perc2hib.sys | Script: Quarantine, Delete, BC delete Filter |
| ql1080 | Driver: Unload, Delete, Disable ql1080 | Not started | ql1080.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Ql10wnt | Driver: Unload, Delete, Disable Ql10wnt | Not started | Ql10wnt.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ql12160 | Driver: Unload, Delete, Disable ql12160 | Not started | ql12160.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ql1240 | Driver: Unload, Delete, Disable ql1240 | Not started | ql1240.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ql1280 | Driver: Unload, Delete, Disable ql1280 | Not started | ql1280.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Simbad | Driver: Unload, Delete, Disable Simbad | Not started | Simbad.sys | Script: Quarantine, Delete, BC delete Filter |
| Sparrow | Driver: Unload, Delete, Disable Sparrow | Not started | Sparrow.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| sym_hi | Driver: Unload, Delete, Disable sym_hi | Not started | sym_hi.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| sym_u3 | Driver: Unload, Delete, Disable sym_u3 | Not started | sym_u3.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| symc810 | Driver: Unload, Delete, Disable symc810 | Not started | symc810.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| symc8xx | Driver: Unload, Delete, Disable symc8xx | Not started | symc8xx.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| TosIde | Driver: Unload, Delete, Disable TosIde | Not started | TosIde.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| ultra | Driver: Unload, Delete, Disable ultra | Not started | ultra.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ViaIde | Driver: Unload, Delete, Disable ViaIde | Not started | ViaIde.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| Video3D | Driver: Unload, Delete, Disable ASUS Video3D Service | Not started | C:\WINDOWS\system32\Drivers\Video3D32.sys | Script: Quarantine, Delete, BC delete |
| WDICA | Driver: Unload, Delete, Disable WDICA | Not started | WDICA.sys | Script: Quarantine, Delete, BC delete |
| WINIO | Driver: Unload, Delete, Disable WINIO | Not started | D:\winio.sys | Script: Quarantine, Delete, BC delete |
| Detected - 208, recognized as trusted - 154
| | ||||||
| File name | Status | Startup method | Description
| C:\Program Files\Juniper\NetScreen-Remote\SafeCfg.exe | Script: Quarantine, Delete, BC delete Active | Shortcut in Autoruns folder | C:\Documents and Settings\All Users\Start Menu\Programs\Startup\, C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NetScreen-Remote.lnk,
| C:\WINDOWS\Installer\{586C47A4-6917-4332-B33F-EEC8D6841DF7}\NewShortcut2_586C47A469174332B33FEEC8D6841DF7.exe | Script: Quarantine, Delete, BC delete Active | Shortcut in Autoruns folder | C:\Documents and Settings\All Users\Start Menu\Programs\Startup\, C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ION Backup Tool.lnk,
| C:\WINDOWS\System32\IreBase.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SOFTWARE\Microsoft\Cryptography\Defaults\Provider\IRE Cryptographic Service Provider, Image Path | Delete C:\WINDOWS\System32\PrintFilterPipelineSvc.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PrintFilterPipelineSvc, EventMessageFile | Delete C:\WINDOWS\System32\appmgmts.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters, ServiceDll | Delete C:\WINDOWS\System32\appmgmts.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Application Management, EventMessageFile | Delete C:\WINDOWS\System32\appmgr.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Software Installation, EventMessageFile | Delete C:\WINDOWS\System32\fdeploy.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\File Deployment, EventMessageFile | Delete C:\WINDOWS\System32\fdeploy.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Folder Redirection, EventMessageFile | Delete C:\WINDOWS\System32\igmpv2.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile | Delete C:\WINDOWS\System32\ipbootp.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile | Delete C:\WINDOWS\System32\iprip2.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile | Delete C:\WINDOWS\System32\ntbackup.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\ntbackup, EventMessageFile | Delete C:\WINDOWS\System32\ospf.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPF, EventMessageFile | Delete C:\WINDOWS\System32\ospfmib.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPFMib, EventMessageFile | Delete C:\WINDOWS\System32\polagent.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PolicyAgent, EventMessageFile | Delete C:\WINDOWS\System32\tssdis.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\TermServSessDir, EventMessageFile | Delete C:\WINDOWS\system32\MsSip1.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 1, $DLL | Delete C:\WINDOWS\system32\MsSip2.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 2, $DLL | Delete C:\WINDOWS\system32\MsSip3.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 3, $DLL | Delete C:\WINDOWS\system32\PrintDisp.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, PrintDisp | Delete C:\WINDOWS\system32\asr_fmt.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR format utility for volumes | Delete C:\WINDOWS\system32\asr_ldm.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR utility for Logical Disk Manager | Delete C:\WINDOWS\system32\asr_pfu.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR protected file utility | Delete C:\WINDOWS\system32\psxss.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
| C:\WINDOWS\system32\stisvc.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System, EventMessageFile | Delete appmgmts.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}, DLLName | Delete c:\WINDOWS\system32\sqlncli.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\SQLNCLI10, EventMessageFile | Delete kbd101.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver JPN | Delete kbd101a.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver KOR | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, .DEFAULT\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-19\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-20\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-18\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-21-1757981266-1450960922-725345543-1004\Control Panel\IOProcs, MVB | Delete vgafix.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon | Delete vgaoem.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon | Delete vgasys.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon | Delete Autoruns items detected - 656, recognized as trusted - 618
| | ||||||
| File name | Type | Description | Manufacturer | CLSID
| Extension module | {2670000A-7350-4f3c-8081-5663EE0C6C49} | Delete Extension module | {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} | Delete Extension module | {E0B8C461-F8FB-49b4-8373-FE32E92528A6} | Delete Elements detected - 12, recognized as trusted - 9
| | |||||||||||||||
| File name | Destination | Description | Manufacturer | CLSID
| deskpan.dll | Script: Quarantine, Delete, BC delete Display Panning CPL Extension | {42071714-76d4-11d1-8b24-00a0c9068ff3} | Delete Shell extensions for file compression | {764BF0E1-F219-11ce-972D-00AA00A14F56} | Delete Encryption Context Menu | {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} | Delete Taskbar and Start Menu | {0DF44EAA-FF21-4412-828E-260A8728E7F1} | Delete rundll32.exe C:\WINDOWS\system32\shimgvw.dll,ImageView_COMServer {00E7B358-F65B-4dcf-83DF-CD026B94BFD4} | Script: Quarantine, Delete, BC delete Autoplay for SlideShow | {00E7B358-F65B-4dcf-83DF-CD026B94BFD4} | Delete User Accounts | {7A9D77BD-5403-11d2-8785-2E0420524153} | Delete IE User Assist | {FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} | Delete Windows Search Shell Service | {da67b8ad-e81b-4c70-9b91b417b5e33527} | Delete "C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll" | Script: Quarantine, Delete, BC delete OpenOffice.org Column Handler | {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} | Delete "C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll" | Script: Quarantine, Delete, BC delete OpenOffice.org Infotip Handler | {087B3AE3-E237-4467-B8DB-5A38AB959AC9} | Delete "C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll" | Script: Quarantine, Delete, BC delete OpenOffice.org Property Sheet Handler | {63542C48-9552-494A-84F7-73AA6A7C99C1} | Delete "C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll" | Script: Quarantine, Delete, BC delete OpenOffice.org Thumbnail Viewer | {3B092F0C-7696-40E3-A80F-68D74DA84210} | Delete "C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll" | Script: Quarantine, Delete, BC delete ColumnHandler | {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} | Delete Elements detected - 238, recognized as trusted - 225
| | ||||||||||||||||||||||||||||||||||||||
| File name | Type | Name | Description | Manufacturer
| Elements detected - 7, recognized as trusted - 7
| | ||||||
| File name | Job name | Job status | Description | Manufacturer
| Elements detected - 3, recognized as trusted - 3
| | ||||||
| Provider | Status | EXE file | Description | GUID
| Detected - 4, recognized as trusted - 4
| | ||||||
| Provider | EXE file | Description
| Detected - 23, recognized as trusted - 23
| | ||||||
| File name | Description | Manufacturer | CLSID | Source URL
| Elements detected - 7, recognized as trusted - 7
| | ||||||
| File name | Description | Manufacturer
| Elements detected - 27, recognized as trusted - 27
| | ||||||
| File name | Description | Manufacturer | CLSID
| Elements detected - 15, recognized as trusted - 15
| | ||||||
Hosts file record
|
| File name | Type | Description | Manufacturer | CLSID
| mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| Elements detected - 31, recognized as trusted - 28
| | ||||||
| File | Description | Type
| C:\WINDOWS\System32\Drivers\aswSnx.SYS | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| C:\WINDOWS\System32\Drivers\aswSP.SYS | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| C:\WINDOWS\system32\Drivers\Crypto.sys | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| \SystemRoot\System32\Drivers\aswSP.SYS | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| E:\autorun.inf | Script: Quarantine, Delete, BC delete Suspicion by Heuristic analysis | HSC: suspicion for hidden autorun (high degree of probability)
| |
Main script of analysis Windows version: Microsoft Windows XP, Build=2600, SP="Service Pack 3" System Restore: enabled 1.1 Searching for user-mode API hooks Analysis: kernel32.dll, export table found in section .text IAT modification detected: CreateProcessA - 00B70010<>7C80236B IAT modification detected: GetModuleFileNameA - 00B70080<>7C80B56F IAT modification detected: GetModuleFileNameW - 00B700F0<>7C80B475 IAT modification detected: CreateProcessW - 00B70160<>7C802336 IAT modification detected: LoadLibraryW - 00B70240<>7C80AEEB IAT modification detected: LoadLibraryA - 00B70320<>7C801D7B IAT modification detected: GetProcAddress - 00B70390<>7C80AE40 IAT modification detected: FreeLibrary - 00B70400<>7C80AC7E Analysis: ntdll.dll, export table found in section .text Function ntdll.dll:LdrLoadDll (70) intercepted, method APICodeHijack.JmpTo[001501EE] Function ntdll.dll:LdrUnloadDll (80) intercepted, method APICodeHijack.JmpTo[001503F2] Analysis: user32.dll, export table found in section .text Function user32.dll:SetWinEventHook (639) intercepted, method APICodeHijack.JmpTo[003D01EE] Function user32.dll:SetWindowsHookExA (651) intercepted, method APICodeHijack.JmpTo[003D05F6] Function user32.dll:SetWindowsHookExW (652) intercepted, method APICodeHijack.JmpTo[003D07FA] Function user32.dll:UnhookWinEvent (685) intercepted, method APICodeHijack.JmpTo[003D03F2] Function user32.dll:UnhookWindowsHookEx (687) intercepted, method APICodeHijack.JmpTo[003D09FE] Analysis: advapi32.dll, export table found in section .text Function advapi32.dll:ChangeServiceConfig2A (54) intercepted, method APICodeHijack.JmpTo[003C0C02] Function advapi32.dll:ChangeServiceConfig2W (55) intercepted, method APICodeHijack.JmpTo[003C0E06] Function advapi32.dll:ChangeServiceConfigA (56) intercepted, method APICodeHijack.JmpTo[003C07FA] Function advapi32.dll:ChangeServiceConfigW (57) intercepted, method APICodeHijack.JmpTo[003C09FE] Function advapi32.dll:CreateServiceA (102) intercepted, method APICodeHijack.JmpTo[003C01EE] Function advapi32.dll:CreateServiceW (103) intercepted, method APICodeHijack.JmpTo[003C03F2] Function advapi32.dll:DeleteService (177) intercepted, method APICodeHijack.JmpTo[003C05F6] Function advapi32.dll:SetServiceObjectSecurity (572) intercepted, method APICodeHijack.JmpTo[003C100A] Analysis: ws2_32.dll, export table found in section .text Analysis: wininet.dll, export table found in section .text Analysis: rasapi32.dll, export table found in section .text Analysis: urlmon.dll, export table found in section .text Analysis: netapi32.dll, export table found in section .text 1.2 Searching for kernel-mode API hooks Driver loaded successfully SDT found (RVA=085700) Kernel ntkrnlpa.exe found in memory at address 804D7000 SDT = 8055C700 KiST = 80504480 (284) Function NtAddBootEntry (09) intercepted (80616A30->AC3C6202), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtAllocateVirtualMemory (11) intercepted (805A8ABA->AC42CCB2), hook C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtClose (19) intercepted (805BC530->A96CFB2F), hook C:\WINDOWS\system32\Drivers\Crypto.sys >>> Function restored successfully ! >>> Hook code blocked Function NtCreateDirectoryObject (22) intercepted (805BE4E0->A96CFB5B), hook C:\WINDOWS\system32\Drivers\Crypto.sys >>> Function restored successfully ! >>> Hook code blocked Function NtCreateEvent (23) intercepted (8060EF4E->AC3C881C), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateEventPair (24) intercepted (806172A6->AC3C8874), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateFile (25) intercepted (805790A8->A96CFB8F), hook C:\WINDOWS\system32\Drivers\Crypto.sys >>> Function restored successfully ! >>> Hook code blocked Function NtCreateIoCompletion (26) intercepted (80578A86->AC3C898A), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateKey (29) intercepted (806240F0->A96CFBE3), hook C:\WINDOWS\system32\Drivers\Crypto.sys >>> Function restored successfully ! >>> Hook code blocked Function NtCreateMutant (2B) intercepted (8061769E->AC3C8772), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateProcessEx (30) - machine code modification Method of JmpTo. jmp AC442906\SystemRoot\System32\Drivers\aswSP.SYS, driver recognized as trusted >>> Function restored successfully ! Function NtCreateSection (32) intercepted (805AB3C8->AC3C88C4), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateSemaphore (33) intercepted (8061504E->AC3C87C6), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtCreateTimer (36) intercepted (80616F6E->AC3C8938), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeleteBootEntry (3D) intercepted (80616A22->AC3C6226), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDeleteKey (3F) intercepted (8062458C->A96CFC27), hook C:\WINDOWS\system32\Drivers\Crypto.sys >>> Function restored successfully ! >>> Hook code blocked Function NtDeleteValueKey (41) intercepted (8062475C->AC3EB03D), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtDuplicateObject (44) intercepted (805BE008->AC3C8C0E), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtEnumerateKey (47) intercepted (8062493C->A96CFC53), hook C:\WINDOWS\system32\Drivers\Crypto.sys >>> Function restored successfully ! >>> Hook code blocked Function NtEnumerateValueKey (49) intercepted (80624BA6->A96CFC93), hook C:\WINDOWS\system32\Drivers\Crypto.sys >>> Function restored successfully ! >>> Hook code blocked Function NtFlushKey (4F) intercepted (80624E10->A96CFCD3), hook C:\WINDOWS\system32\Drivers\Crypto.sys >>> Function restored successfully ! >>> Hook code blocked Function NtFreeVirtualMemory (53) intercepted (805B2FB2->AC42CD62), hook C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtLoadDriver (61) intercepted (80584160->AC3C5FF0), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtMakeTemporaryObject (69) intercepted (805BC5D4->A96CFCFF), hook C:\WINDOWS\system32\Drivers\Crypto.sys >>> Function restored successfully ! >>> Hook code blocked Function NtMapViewOfSection (6C) intercepted (805B203A->A96CFD2B), hook C:\WINDOWS\system32\Drivers\Crypto.sys >>> Function restored successfully ! >>> Hook code blocked Function NtModifyBootEntry (6D) intercepted (80616A22->AC3C624A), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtNotifyChangeKey (6F) intercepted (806262DE->AC3C8D82), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtNotifyChangeMultipleKeys (70) intercepted (80624F12->AC3C6CDA), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenEvent (72) intercepted (8060F04E->AC3C884C), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenEventPair (73) intercepted (8061737E->AC3C889C), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenIoCompletion (75) intercepted (80578B5E->AC3C89B4), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenKey (77) intercepted (806254CE->A96CFD7B), hook C:\WINDOWS\system32\Drivers\Crypto.sys >>> Function restored successfully ! >>> Hook code blocked Function NtOpenMutant (78) intercepted (80617776->AC3C879E), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenProcess (7A) intercepted (805CB440->AC3C8A46), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenSection (7D) intercepted (805AA3EC->A96CFDAF), hook C:\WINDOWS\system32\Drivers\Crypto.sys >>> Function restored successfully ! >>> Hook code blocked Function NtOpenSemaphore (7E) intercepted (80615148->AC3C87F4), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenThread (80) intercepted (805CB6CC->AC3C8B2A), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtOpenTimer (83) intercepted (80617090->AC3C8962), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtProtectVirtualMemory (89) intercepted (805B841E->AC42CDFA), hook C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueryInformationFile (97) intercepted (8057AA42->A96CFDE3), hook C:\WINDOWS\system32\Drivers\Crypto.sys >>> Function restored successfully ! >>> Hook code blocked Function NtQueryKey (A0) intercepted (80625810->A96CFE1F), hook C:\WINDOWS\system32\Drivers\Crypto.sys >>> Function restored successfully ! >>> Hook code blocked Function NtQueryObject (A3) intercepted (805C52CC->AC3C6BA0), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtQueryValueKey (B1) intercepted (80622314->A96CFE5B), hook C:\WINDOWS\system32\Drivers\Crypto.sys >>> Function restored successfully ! >>> Hook code blocked Function NtReadFile (B7) intercepted (8057C4AE->A96CFE9B), hook C:\WINDOWS\system32\Drivers\Crypto.sys >>> Function restored successfully ! >>> Hook code blocked Function NtRenameKey (C0) intercepted (80623B12->AC435E48), hook C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtRestoreKey (CC) intercepted (80625AD0->AC3E96E8), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetBootEntryOrder (D3) intercepted (80616A30->AC3C626E), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetBootOptions (D4) intercepted (80616A30->AC3C6292), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetInformationFile (E0) intercepted (8057B034->A96CFEE7), hook C:\WINDOWS\system32\Drivers\Crypto.sys >>> Function restored successfully ! >>> Hook code blocked Function NtSetInformationThread (E5) intercepted (805CC10E->A96CFF23), hook C:\WINDOWS\system32\Drivers\Crypto.sys >>> Function restored successfully ! >>> Hook code blocked Function NtSetSystemInformation (F0) intercepted (8060FD06->AC3C604A), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetSystemPowerState (F1) intercepted (80653E18->AC3C6186), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSetValueKey (F7) intercepted (80622662->A96CFF5B), hook C:\WINDOWS\system32\Drivers\Crypto.sys >>> Function restored successfully ! >>> Hook code blocked Function NtShutdownSystem (F9) intercepted (80612F90->AC3C6162), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtSystemDebugControl (FF) intercepted (806180BA->AC3C61AA), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtUnmapViewOfSection (10B) intercepted (805B2E48->A96CFF9B), hook C:\WINDOWS\system32\Drivers\Crypto.sys >>> Function restored successfully ! >>> Hook code blocked Function NtVdmControl (10C) intercepted (805FBB6C->AC3C62B6), hook C:\WINDOWS\System32\Drivers\aswSnx.SYS, driver recognized as trusted >>> Function restored successfully ! >>> Hook code blocked Function NtWriteFile (112) intercepted (8057CF16->A96CFFCB), hook C:\WINDOWS\system32\Drivers\Crypto.sys >>> Function restored successfully ! >>> Hook code blocked Function ObInsertObject (805C2FDA) - machine code modification Method of JmpTo. jmp AC43FD5C \SystemRoot\System32\Drivers\aswSP.SYS, driver recognized as trusted >>> Function restored successfully ! Function ObMakeTemporaryObject (805BC556) - machine code modification Method of JmpTo. jmp AC43E2BE \SystemRoot\System32\Drivers\aswSP.SYS, driver recognized as trusted >>> Function restored successfully ! Functions checked: 284, intercepted: 57, restored: 60 1.3 Checking IDT and SYSENTER Analysis for CPU 1 Analysis for CPU 2 CmpCallCallBacks = 00093D84 Disable callback OK Checking IDT and SYSENTER - complete 1.4 Searching for masking processes and drivers Checking not performed: extended monitoring driver (AVZPM) is not installed Driver loaded successfully 1.5 Checking of IRP handlers \FileSystem\ntfs[IRP_MJ_CREATE] = AC4423F2 -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted \FileSystem\ntfs[IRP_MJ_CLOSE] = AC442432 -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted \FileSystem\ntfs[IRP_MJ_WRITE] = AC44250E -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted \FileSystem\ntfs[IRP_MJ_SET_INFORMATION] = AC44254E -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted \FileSystem\FastFat[IRP_MJ_CREATE] = AC44258E -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted \FileSystem\FastFat[IRP_MJ_CLOSE] = AC4425CE -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted \FileSystem\FastFat[IRP_MJ_WRITE] = AC4426AA -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted \FileSystem\FastFat[IRP_MJ_SET_INFORMATION] = AC4426EA -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted Checking - complete >>> E:\autorun.inf HSC: suspicion for hidden autorun (high degree of probability) >> Services: potentially dangerous service allowed: TermService (Terminal Services) Error [2, SC_EXT_ADDITEMST] >> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery Service) Error [2, SC_EXT_ADDITEMST] >> Services: potentially dangerous service allowed: TlntSvr () Error [2, SC_EXT_ADDITEMST] >> Services: potentially dangerous service allowed: Schedule (Task Scheduler) Error [2, SC_EXT_ADDITEMST] >> Services: potentially dangerous service allowed: mnmsrvc (NetMeeting Remote Desktop Sharing) Error [2, SC_EXT_ADDITEMST] >> Services: potentially dangerous service allowed: RDSessMgr (Remote Desktop Help Session Manager) Error [2, SC_EXT_ADDITEMST] > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)! >> Security: disk drives' autorun is enabled Error [2, SC_EXT_ADDITEMST] >> Security: administrative shares (C$, D$ ...) are enabled Error [2, SC_EXT_ADDITEMST] >> Security: anonymous user access is enabled Error [2, SC_EXT_ADDITEMST] Error [2, SC_EXT_ADDITEMST] >> Security: sending Remote Assistant queries is enabled >> Disable HDD autorun >> Disable autorun from network drives >> Disable CD/DVD autorun >> Disable removable media autorun >> Windows Explorer - show extensions of known file types System Analysis in progressAdd commands to script:
System Analysis - complete
Script commands