Results of system analysis

Kaspersky Virus Removal Tool 11.0.0.1245 (database released 24/01/2012; 02:26)

List of processes

File name	PID	Description	Copyright	MD5	Information
c:\program files\blubster\bgcheck.exe Script: Quarantine, Delete, BC delete, Terminate	460			??	124.00 kb, rsAh, created: 05.09.2008 03:28:20, modified: 05.09.2008 03:28:20 Command line: "C:\Program Files\Blubster\BGCheck.exe"
c:\program files\blubster\blubster.exe Script: Quarantine, Delete, BC delete, Terminate	124	MP2P servent main executable	Copyright 1999 - 2008 Pablo Soto. All rights reserved.	??	2799.00 kb, rsAh, created: 27.11.2009 06:23:46, modified: 27.11.2009 06:23:46 Command line: "C:\Program Files\Blubster\Blubster.exe" SILENT
Detected:26, recognized as trusted 24

Module name	Handle	Description	Copyright	MD5	Used by processes
C:\Program Files\Blubster\EBCRYPT.DLL Script: Quarantine, Delete, BC delete	30605312	ebCrypt Module	Copyright 2000, EB Design Pty Ltd	--	124
C:\Program Files\Blubster\NCTAudioFile.dll Script: Quarantine, Delete, BC delete	35913728	NCTAudioFile ActiveX DLL	NCT Company Copyright 1999-2002	--	124
C:\Program Files\Blubster\NCTAudioInformation.dll Script: Quarantine, Delete, BC delete	268435456	NCTAudioInformation ActiveX DLL	NCT Company Copyright 1999-2002	--	124
C:\Program Files\Blubster\NCTAudioPlayer.DLL Script: Quarantine, Delete, BC delete	38600704	NCTAudioPlayer ActiveX DLL	NCT Company Copyright 1999-2002	--	124
C:\Program Files\Blubster\NCTAudioVisualization.dll Script: Quarantine, Delete, BC delete	42532864	NCTAudioVisualization ActiveX DLL	NCT Company Copyright 1999-2002	--	124
C:\Program Files\Blubster\Softwrap.dll Script: Quarantine, Delete, BC delete	268435456			--	460
Modules detected:354, recognized as trusted 348

Kernel Space Modules Viewer

Module	Base address	Size in memory	Description	Manufacturer
32574467.sys Script: Quarantine, Delete, BC delete	F82BF000	522000 (5382144)
C:\WINDOWS\System32\Drivers\dump_atapi.sys Script: Quarantine, Delete, BC delete	EEC80000	018000 (98304)
C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Script: Quarantine, Delete, BC delete	F8D4A000	002000 (8192)
Modules detected - 141, recognized as trusted - 138

Services

Service	Description	Status	File	Group	Dependencies
ekrn Service: Stop, Delete, Disable, BC delete	ESET Service	Not started	C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe Script: Quarantine, Delete, BC delete
Detected - 89, recognized as trusted - 88

Drivers

Service	Description	Status	File	Group	Dependencies
Abiosdsk Driver: Unload, Delete, Disable, BC delete	Abiosdsk	Not started	Abiosdsk.sys Script: Quarantine, Delete, BC delete	Primary disk
Atdisk Driver: Unload, Delete, Disable, BC delete	Atdisk	Not started	Atdisk.sys Script: Quarantine, Delete, BC delete	Primary disk
catchme Driver: Unload, Delete, Disable, BC delete	catchme	Not started	C:\ComboFix\catchme.sys Script: Quarantine, Delete, BC delete	Base
Changer Driver: Unload, Delete, Disable, BC delete	Changer	Not started	Changer.sys Script: Quarantine, Delete, BC delete	Filter
IntelIde Driver: Unload, Delete, Disable, BC delete	IntelIde	Not started	C:\WINDOWS\system32\DRIVERS\intelide.sys Script: Quarantine, Delete, BC delete	System Bus Extender
lbrtfdc Driver: Unload, Delete, Disable, BC delete	lbrtfdc	Not started	lbrtfdc.sys Script: Quarantine, Delete, BC delete	System Bus Extender
PCIDump Driver: Unload, Delete, Disable, BC delete	PCIDump	Not started	PCIDump.sys Script: Quarantine, Delete, BC delete	PCI Configuration
PDCOMP Driver: Unload, Delete, Disable, BC delete	PDCOMP	Not started	PDCOMP.sys Script: Quarantine, Delete, BC delete
PDFRAME Driver: Unload, Delete, Disable, BC delete	PDFRAME	Not started	PDFRAME.sys Script: Quarantine, Delete, BC delete
PDRELI Driver: Unload, Delete, Disable, BC delete	PDRELI	Not started	PDRELI.sys Script: Quarantine, Delete, BC delete
PDRFRAME Driver: Unload, Delete, Disable, BC delete	PDRFRAME	Not started	PDRFRAME.sys Script: Quarantine, Delete, BC delete
Simbad Driver: Unload, Delete, Disable, BC delete	Simbad	Not started	Simbad.sys Script: Quarantine, Delete, BC delete	Filter
WDICA Driver: Unload, Delete, Disable, BC delete	WDICA	Not started	WDICA.sys Script: Quarantine, Delete, BC delete
Detected - 204, recognized as trusted - 191

Autoruns

File name	Status	Startup method	Description
C:\Documents and Settings\Ricky\Local Settings\temp\_uninst_32574467.bat Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	C:\Documents and Settings\Ricky\Start Menu\Programs\Startup\, C:\Documents and Settings\Ricky\Start Menu\Programs\Startup\_uninst_32574467.lnk,
C:\Program Files\Blubster\Blubster.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, Blubster Delete
C:\Program Files\Internet Explorer\iexplore.exe Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	C:\Documents and Settings\Ricky\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\Ricky\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk,
C:\Program Files\Java\jre6\bin\jqs.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\JavaQuickStarterService, EventMessageFile
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mmjb.exe Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	C:\Documents and Settings\Ricky\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\Ricky\Application Data\Microsoft\Internet Explorer\Quick Launch\Musicmatch Jukebox.lnk,
C:\Program Files\MySpace\IM\MySpaceIM.exe Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\Quick Launch\MySpaceIM.lnk,
C:\Program Files\MySpace\IM\MySpaceIM.exe Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\Quick Launch\MySpaceIM.lnk,
C:\Program Files\MySpace\IM\MySpaceIM.exe Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	C:\Documents and Settings\Ricky\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\Ricky\Application Data\Microsoft\Internet Explorer\Quick Launch\MySpaceIM.lnk,
C:\WINDOWS\Installer\{D103C4BA-F905-437A-8049-DB24763BBE36}\SkypeIcon.exe Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	C:\Documents and Settings\Ricky\Start Menu\Programs\Startup\, C:\Documents and Settings\Ricky\Start Menu\Programs\Startup\Skype.lnk,
C:\WINDOWS\System32\Drivers\IntelIde.sys Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\intelide, EventMessageFile
C:\WINDOWS\System32\Drivers\lbrtfdc.sys Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\lbrtfdc, EventMessageFile
C:\WINDOWS\System32\PrintFilterPipelineSvc.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PrintFilterPipelineSvc, EventMessageFile
C:\WINDOWS\System32\appmgmts.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters, ServiceDll Delete
C:\WINDOWS\System32\appmgmts.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Application Management, EventMessageFile
C:\WINDOWS\System32\appmgr.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Software Installation, EventMessageFile
C:\WINDOWS\System32\fdeploy.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\File Deployment, EventMessageFile
C:\WINDOWS\System32\fdeploy.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Folder Redirection, EventMessageFile
C:\WINDOWS\System32\igmpv2.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile
C:\WINDOWS\System32\ipbootp.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile
C:\WINDOWS\System32\iprip2.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile
C:\WINDOWS\System32\ntbackup.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\ntbackup, EventMessageFile
C:\WINDOWS\System32\ospf.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPF, EventMessageFile
C:\WINDOWS\System32\ospfmib.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPFMib, EventMessageFile
C:\WINDOWS\System32\polagent.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PolicyAgent, EventMessageFile
C:\WINDOWS\System32\tssdis.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\TermServSessDir, EventMessageFile
C:\WINDOWS\system32\MsSip1.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 1, $DLL Delete
C:\WINDOWS\system32\MsSip2.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 2, $DLL Delete
C:\WINDOWS\system32\MsSip3.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 3, $DLL Delete
C:\WINDOWS\system32\asr_fmt.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR format utility for volumes Delete
C:\WINDOWS\system32\asr_ldm.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR utility for Logical Disk Manager Delete
C:\WINDOWS\system32\asr_pfu.exe Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR protected file utility Delete
C:\WINDOWS\system32\psxss.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
C:\WINDOWS\system32\stisvc.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System, EventMessageFile
appmgmts.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}, DLLName Delete
deskpan.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {42071714-76d4-11d1-8b24-00a0c9068ff3} Delete
kbd101.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver JPN Delete
kbd101a.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver KOR Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, .DEFAULT\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-19\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-20\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-18\Control Panel\IOProcs, MVB Delete
mvfs32.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_USERS, S-1-5-21-2379642614-4113044259-601262879-1007\Control Panel\IOProcs, MVB Delete
vgafix.fon Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon Delete
vgaoem.fon Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon Delete
vgasys.fon Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon Delete
Autoruns items detected - 815, recognized as trusted - 770

Microsoft Internet Explorer extension modules (BHOs, Toolbars ...)

File name	Type	Description	Manufacturer	CLSID
	BHO			Software Delete
Elements detected - 11, recognized as trusted - 10

Windows Explorer extension modules

File name	Destination	Description	Manufacturer	CLSID
deskpan.dll Script: Quarantine, Delete, BC delete	Display Panning CPL Extension			{42071714-76d4-11d1-8b24-00a0c9068ff3} Delete
	Shell extensions for file compression			{764BF0E1-F219-11ce-972D-00AA00A14F56} Delete
	Encryption Context Menu			{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} Delete
	Taskbar and Start Menu			{0DF44EAA-FF21-4412-828E-260A8728E7F1} Delete
	User Accounts			{7A9D77BD-5403-11d2-8785-2E0420524153} Delete
Elements detected - 208, recognized as trusted - 203

Printing system extensions (print monitors, providers)

File name	Type	Name	Description	Manufacturer
C:\DOCUME~1\MARYKA~1\LOCALS~1\Temp\33F1.tmp Script: Quarantine, Delete, BC delete	Provider
Elements detected - 10, recognized as trusted - 9

Task Scheduler jobs

File name	Job name	Job status	Description	Manufacturer
Elements detected - 0, recognized as trusted - 0

SPI/LSP settings

Namespace providers (NSP)

Provider	Status	EXE file	Description	GUID
Detected - 3, recognized as trusted - 3

Transport protocol providers (TSP, LSP)

Provider EXE file Description
Detected - 15, recognized as trusted - 15
Results of automatic SPI settings check
LSP settings checked. No errors detected

TCP/UDP ports

Port Status Remote Host Remote Port Application Notes
TCP ports
135 LISTENING 0.0.0.0 41190 [960] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
445 LISTENING 0.0.0.0 39022 [4] System
Script: Quarantine, Delete, BC delete, Terminate
701 LISTENING 0.0.0.0 36934 [124] c:\program files\blubster\blubster.exe
Script: Quarantine, Delete, BC delete, Terminate
1026 LISTENING 0.0.0.0 55381 [188] c:\windows\system32\alg.exe
Script: Quarantine, Delete, BC delete, Terminate
UDP ports
123 LISTENING -- -- [1016] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
445 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
500 LISTENING -- -- [708] c:\windows\system32\lsass.exe
Script: Quarantine, Delete, BC delete, Terminate
1030 LISTENING -- -- [124] c:\program files\blubster\blubster.exe
Script: Quarantine, Delete, BC delete, Terminate
1434 LISTENING -- -- [1508] c:\program files\microsoft sql server\90\shared\sqlbrowser.exe
Script: Quarantine, Delete, BC delete, Terminate
1900 LISTENING -- -- [1148] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
4500 LISTENING -- -- [708] c:\windows\system32\lsass.exe
Script: Quarantine, Delete, BC delete, Terminate
41169 LISTENING -- -- [124] c:\program files\blubster\blubster.exe
Script: Quarantine, Delete, BC delete, Terminate
41170 LISTENING -- -- [124] c:\program files\blubster\blubster.exe
Script: Quarantine, Delete, BC delete, Terminate

Downloaded Program Files (DPF)

File name Description Manufacturer CLSID Source URL
ActiveGS.cab
Delete http://www.virtualapple.org/gs.cab
{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}
Delete http://forms.real.com/real/player/download.html?f=windows/mrkt/rhapx/RhapsodyPlayerEngine_Inst_Win.cab
C:\WINDOWS\DOWNLO~1\TESTGE~1.DLL
Script: Quarantine, Delete, BC delete {37A273C2-5129-11D5-BF37-00A0CCE8754B}
Delete http://asp.mathxl.com/wizmodules/testgen/installers/TestGenXInstall.cab
{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
Delete http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
C:\WINDOWS\DOWNLO~1\PEARSO~1.OCX
Script: Quarantine, Delete, BC delete {95D88B35-A521-472B-A182-BB1A98356421}
Delete http://asp.mathxl.com/books/_Players/PearsonInstallAsst2.cab
{E2883E8F-472F-4FB0-9522-AC9BF37916A7}
Delete http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
C:\WINDOWS\DOWNLO~1\MATHPL~1.OCX
Script: Quarantine, Delete, BC delete {E6D23284-0E9B-417D-A782-03E4487FC947}
Delete http://asp.mathxl.com/books/_Players/MathPlayer.cab
Elements detected - 15, recognized as trusted - 8

Control Panel Applets (CPL)

File name Description Manufacturer
C:\WINDOWS\system32\B57exp.cpl
Script: Quarantine, Delete, BC delete Broadcom Advanced Control Suite Copyright(C) 2000-2003 Broadcom Corporation, All Rights Reserved
Elements detected - 30, recognized as trusted - 29

Active Setup

File name Description Manufacturer CLSID
Elements detected - 16, recognized as trusted - 16

HOSTS file

Hosts file record
127.0.0.1 localhost
Clear Hosts file

Protocols and handlers

File name Type Description Manufacturer CLSID
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
Elements detected - 32, recognized as trusted - 29

Suspicious objects

File Description Type
C:\WINDOWS\system32\DRIVERS\9333247drv.sys
Script: Quarantine, Delete, BC delete Suspicion for Rootkit Kernel-mode hook
\SystemRoot\system32\DRIVERS\9333247drv.sys
Script: Quarantine, Delete, BC delete Suspicion for Rootkit Kernel-mode hook

Main script of analysis
Windows version: Microshaft Winblows XP, Build=2600, SP="Service Pack 2"
System Restore: enabled
1.1 Searching for user-mode API hooks
 Analysis: kernel32.dll, export table found in section .text
IAT modification detected: CreateProcessA - 00B30010<>7C802367
IAT modification detected: GetModuleFileNameA - 00B30080<>7C80B4DF
IAT modification detected: FreeLibrary - 00B300F0<>7C80ABEE
IAT modification detected: GetModuleFileNameW - 00B30160<>7C80B3E5
IAT modification detected: CreateProcessW - 00B301D0<>7C802332
IAT modification detected: LoadLibraryW - 00B302B0<>7C80AE5B
IAT modification detected: LoadLibraryA - 00B30320<>7C801D77
IAT modification detected: GetProcAddress - 00B30390<>7C80ADB0
 Analysis: ntdll.dll, export table found in section .text
 Analysis: user32.dll, export table found in section .text
 Analysis: advapi32.dll, export table found in section .text
 Analysis: ws2_32.dll, export table found in section .text
 Analysis: wininet.dll, export table found in section .text
 Analysis: rasapi32.dll, export table found in section .text
 Analysis: urlmon.dll, export table found in section .text
 Analysis: netapi32.dll, export table found in section .text
1.2 Searching for kernel-mode API hooks
 Driver loaded successfully
 SDT found (RVA=082700)
 Kernel ntoskrnl.exe found in memory at address 804D7000
   SDT = 80559700
   KiST = 804E26B8 (284)
Function NtAdjustPrivilegesToken (0B) intercepted (8058C29C->EDDBC690), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtAssignProcessToJobObject (13) intercepted (805A34A9->82BFAC90), hook not defined
>>> Function restored successfully !
>>> Hook code blocked
Function NtClose (19) intercepted (80566DB9->EDDBCF94), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtConnectPort (1F) intercepted (8058BBA7->EDDBDDC8), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateEvent (23) intercepted (8056AEF0->EDDBE312), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateFile (25) intercepted (8056FE58->EDDBD270), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateKey (29) intercepted (8056EA01->EDDBB500), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateMutant (2B) intercepted (8057B469->EDDBE1F8), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateNamedPipeFile (2C) intercepted (8058031D->EDDBC27E), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreatePort (2E) intercepted (80596C21->EDDBE0CC), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateSection (32) intercepted (8056469B->EDDBC426), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateSemaphore (33) intercepted (80573AA7->EDDBE432), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateThread (35) intercepted (8057C713->EDDBCC1C), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateWaitablePort (38) intercepted (805A3DE3->EDDBE162), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDebugActiveProcess (39) intercepted (8065975D->EDDBFB1A), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDeleteKey (3F) intercepted (80594F21->EDDBBB0A), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDeleteValueKey (41) intercepted (8059295F->EDDBBEBE), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDeviceIoControlFile (42) intercepted (8057D4C9->EDDBD6F2), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtDuplicateObject (44) intercepted (80572D8E->EDDC0D26), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtEnumerateKey (47) intercepted (8056F10F->EDDBC00A), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtEnumerateValueKey (49) intercepted (8057FDEC->EDDBC0A2), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtFsControlFile (54) intercepted (8057AF81->EDDBD500), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtLoadDriver (61) intercepted (805A5972->EDDBFC0C), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtLoadKey (62) intercepted (805AFE1E->EDDBB4DC), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtLoadKey2 (63) intercepted (805AFC6C->EDDBB4EE), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtMapViewOfSection (6C) intercepted (805725D4->EDDC0374), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtNotifyChangeKey (6F) intercepted (805908B8->EDDBC1CE), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenEvent (72) intercepted (80580706->EDDBE3A8), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenFile (74) intercepted (8056FDF3->EDDBD016), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenKey (77) intercepted (80567D6A->EDDBB6C0), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenMutant (78) intercepted (8057B517->EDDBE288), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenProcess (7A) intercepted (80572F6E->EDDBC8CC), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenSection (7D) intercepted (80576973->EDDC010E), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenSemaphore (7E) intercepted (805DC98A->EDDBE4C8), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenThread (80) intercepted (8058FCDD->EDDBC7BE), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtProtectVirtualMemory (89) intercepted (8057331D->82BFAFD0), hook not defined
>>> Function restored successfully !
>>> Hook code blocked
Function NtQueryKey (A0) intercepted (8056EE18->EDDBC13A), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQueryMultipleValueKey (A1) intercepted (8064D043->EDDBBD72), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQuerySection (A7) intercepted (8057A001->EDDC06AE), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQueryValueKey (B1) intercepted (8056B343->EDDBB99C), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtQueueApcThread (B4) intercepted (8058CDA6->EDDBFFA0), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtRenameKey (C0) intercepted (8064D48B->EDDBBC2C), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtReplaceKey (C1) intercepted (8064D97E->EDDBAF16), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtReplyPort (C2) intercepted (8057E57B->EDDBE82C), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtReplyWaitReceivePort (C3) intercepted (8056A0D7->EDDBE6F2), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtRequestWaitReplyPort (C8) intercepted (80576192->EDDBF8B4), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtRestoreKey (CC) intercepted (8064C488->EDDBB28E), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtResumeThread (CE) intercepted (8057CD86->EDDC0BC8), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSaveKey (CF) intercepted (8064C52F->EDDBAEAE), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSecureConnectPort (D2) intercepted (8057EC62->EDDBDB0E), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetContextThread (D5) intercepted (8062C7FB->EDDBCE38), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetInformationThread (E5) intercepted (80574A0E->82BFAD90), hook not defined
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetInformationToken (E6) intercepted (805A96ED->EDDBF154), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetSecurityObject (ED) intercepted (8059CE17->EDDBFDAA), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetSystemInformation (F0) intercepted (805A3F5D->EDDC07FE), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetValueKey (F7) intercepted (80573EF5->EDDBB816), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSuspendProcess (FD) intercepted (8062E3DD->EDDC08F0), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSuspendThread (FE) intercepted (805DFB80->EDDC0A2A), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtSystemDebugControl (FF) intercepted (806487DF->EDDBFA3E), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtTerminateProcess (101) intercepted (805849B4->EDDBCA68), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtTerminateThread (102) intercepted (8057BE2C->EDDBC9C8), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtUnmapViewOfSection (10B) intercepted (80572159->EDDC0552), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtWriteVirtualMemory (115) intercepted (8057A8FF->EDDBCB52), hook C:\WINDOWS\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function FsRtlCheckLockForReadAccess (80503C39) - machine code modification Method of JmpTo. jmp EDDAEFD0 \SystemRoot\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
Function IoIsOperationSynchronous (804E8762) - machine code modification Method of JmpTo. jmp EDDAF3AC \SystemRoot\system32\DRIVERS\9333247drv.sys, driver recognized as trusted
>>> Function restored successfully !
Functions checked: 284, intercepted: 63, restored: 65
1.3 Checking IDT and SYSENTER
 Analysis for CPU 1
CmpCallCallBacks = 0013979F
Disable callback OK
 Checking IDT and SYSENTER - complete
1.4 Searching for masking processes and drivers
 Checking not performed: extended monitoring driver (AVZPM) is not installed
1.5 Checking of IRP handlers
 Driver loaded successfully
 Checking - complete
>> Services: potentially dangerous service allowed: TermService (Terminal Services)
>> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery Service)
>> Services: potentially dangerous service allowed: TlntSvr ()
>> Services: potentially dangerous service allowed: Schedule (Task Scheduler)
>> Services: potentially dangerous service allowed: mnmsrvc (NetMeeting Remote Desktop Sharing)
>> Services: potentially dangerous service allowed: RDSessMgr (Remote Desktop Help Session Manager)
> Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)!
>> Security: disk drives' autorun is enabled
>> Security: administrative shares (C$, D$ ...) are enabled
>> Security: anonymous user access is enabled
>> Security: sending Remote Assistant queries is enabled
 >>  Disable HDD autorun
 >>  Disable autorun from network drives
 >>  Disable CD/DVD autorun
 >>  Disable removable media autorun
System Analysis in progress

 System Analysis - complete


Script commands 
Add commands to script:
Blocking hooks using Anti-Rootkit
Enable AVZGuard
Operations with AVZPM (true=enable,false=disable)
BootCleaner - import list of deleted files
BootCleaner - import all
Registry cleanup after deleting files
ExecuteWizard ('TSW',2,3,true) - Running Troubleshooting wizard
BootCleaner - activate
Reboot
Insert template for QuarantineFile() - quarantining file
Insert template for BC_QrFile() - quarantining file via BootCleaner
Insert template for DeleteFile() - deleting file
Insert template for DelCLSID() - deleting CLSID item from registry
Additional operations:Performance tweaking: disable service TermService (Terminal Services)
Performance tweaking: disable service SSDPSRV (SSDP Discovery Service)
Performance tweaking: disable service TlntSvr ()
Performance tweaking: disable service Schedule (Task Scheduler)
Performance tweaking: disable service mnmsrvc (NetMeeting Remote Desktop Sharing)
Performance tweaking: disable service RDSessMgr (Remote Desktop Help Session Manager)
Security tweaking: disable CD autorun
Security tweaking: disable administrative shares
Security tweaking: disable anonymous user access
Security: disable sending Remote Assistant queries

File list

Port	Status	Remote Host	Remote Port	Application	Notes
TCP ports
135	LISTENING	0.0.0.0	41190	[960] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
445	LISTENING	0.0.0.0	39022	[4] System Script: Quarantine, Delete, BC delete, Terminate
701	LISTENING	0.0.0.0	36934	[124] c:\program files\blubster\blubster.exe Script: Quarantine, Delete, BC delete, Terminate
1026	LISTENING	0.0.0.0	55381	[188] c:\windows\system32\alg.exe Script: Quarantine, Delete, BC delete, Terminate
UDP ports
123	LISTENING	--	--	[1016] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
445	LISTENING	--	--	[4] System Script: Quarantine, Delete, BC delete, Terminate
500	LISTENING	--	--	[708] c:\windows\system32\lsass.exe Script: Quarantine, Delete, BC delete, Terminate
1030	LISTENING	--	--	[124] c:\program files\blubster\blubster.exe Script: Quarantine, Delete, BC delete, Terminate
1434	LISTENING	--	--	[1508] c:\program files\microsoft sql server\90\shared\sqlbrowser.exe Script: Quarantine, Delete, BC delete, Terminate
1900	LISTENING	--	--	[1148] c:\windows\system32\svchost.exe Script: Quarantine, Delete, BC delete, Terminate
4500	LISTENING	--	--	[708] c:\windows\system32\lsass.exe Script: Quarantine, Delete, BC delete, Terminate
41169	LISTENING	--	--	[124] c:\program files\blubster\blubster.exe Script: Quarantine, Delete, BC delete, Terminate
41170	LISTENING	--	--	[124] c:\program files\blubster\blubster.exe Script: Quarantine, Delete, BC delete, Terminate