Results of system analysis

Kaspersky Virus Removal Tool 11.0.0.1245 (database released 14/05/2012; 15:48)

List of processes

File namePIDDescriptionCopyrightMD5Information
Detected:42, recognized as trusted 42
Module nameHandleDescriptionCopyrightMD5Used by processes
Modules detected:461, recognized as trusted 461

Kernel Space Modules Viewer

ModuleBase addressSize in memoryDescriptionManufacturer
C:\WINDOWS\System32\Drivers\dump_atapi.sys
Script: Quarantine, Delete, BC delete		F4399000018000 (98304)
C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Script: Quarantine, Delete, BC delete		F7A72000002000 (8192)
C:\WINDOWS\system32\Drivers\uphcleanhlp.sys
Script: Quarantine, Delete, BC delete		F1377000003000 (12288)
Modules detected - 153, recognized as trusted - 150

Services

ServiceDescriptionStatusFileGroupDependencies
RoxLiveShare9
Service: Stop, Delete, Disable, BC delete		LiveShare P2P Server 9Not startedC:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
Script: Quarantine, Delete, BC delete		 RPCSS
Detected - 109, recognized as trusted - 108

Drivers

ServiceDescriptionStatusFileGroupDependencies
Abiosdsk
Driver: Unload, Delete, Disable, BC delete		AbiosdskNot startedAbiosdsk.sys
Script: Quarantine, Delete, BC delete		Primary disk 
Atdisk
Driver: Unload, Delete, Disable, BC delete		AtdiskNot startedAtdisk.sys
Script: Quarantine, Delete, BC delete		Primary disk 
catchme
Driver: Unload, Delete, Disable, BC delete		catchmeNot startedC:\DOCUME~1\hra\LOCALS~1\Temp\catchme.sys
Script: Quarantine, Delete, BC delete		Base 
Changer
Driver: Unload, Delete, Disable, BC delete		ChangerNot startedChanger.sys
Script: Quarantine, Delete, BC delete		Filter 
lbrtfdc
Driver: Unload, Delete, Disable, BC delete		lbrtfdcNot startedlbrtfdc.sys
Script: Quarantine, Delete, BC delete		System Bus Extender 
LMIRfsClientNP
Driver: Unload, Delete, Disable, BC delete		LMIRfsClientNPNot startedLMIRfsClientNP.sys
Script: Quarantine, Delete, BC delete		NetworkProvider 
PCIDump
Driver: Unload, Delete, Disable, BC delete		PCIDumpNot startedPCIDump.sys
Script: Quarantine, Delete, BC delete		PCI Configuration 
PDCOMP
Driver: Unload, Delete, Disable, BC delete		PDCOMPNot startedPDCOMP.sys
Script: Quarantine, Delete, BC delete		  
PDFRAME
Driver: Unload, Delete, Disable, BC delete		PDFRAMENot startedPDFRAME.sys
Script: Quarantine, Delete, BC delete		  
PDRELI
Driver: Unload, Delete, Disable, BC delete		PDRELINot startedPDRELI.sys
Script: Quarantine, Delete, BC delete		  
PDRFRAME
Driver: Unload, Delete, Disable, BC delete		PDRFRAMENot startedPDRFRAME.sys
Script: Quarantine, Delete, BC delete		  
Simbad
Driver: Unload, Delete, Disable, BC delete		SimbadNot startedSimbad.sys
Script: Quarantine, Delete, BC delete		Filter 
WDICA
Driver: Unload, Delete, Disable, BC delete		WDICANot startedWDICA.sys
Script: Quarantine, Delete, BC delete		  
Detected - 214, recognized as trusted - 201

Autoruns

File nameStatusStartup methodDescription
C:\Documents and Settings\hra\Local Settings\Temp\_uninst_27976583.bat
Script: Quarantine, Delete, BC delete		ActiveShortcut in Autoruns folderC:\Documents and Settings\hra\Start Menu\Programs\Startup\, C:\Documents and Settings\hra\Start Menu\Programs\Startup\_uninst_27976583.lnk,
C:\WINDOWS\System32\Drivers\lbrtfdc.sys
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\lbrtfdc, EventMessageFile
C:\WINDOWS\System32\hidserv.dll
Script: Quarantine, Delete, BC delete		ActiveRegistry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\HidServ\Parameters, ServiceDll
Delete
C:\WINDOWS\System32\igmpv2.dll
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile
C:\WINDOWS\System32\ipbootp.dll
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile
C:\WINDOWS\System32\iprip2.dll
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile
C:\WINDOWS\System32\ospf.dll
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPF, EventMessageFile
C:\WINDOWS\System32\ospfmib.dll
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPFMib, EventMessageFile
C:\WINDOWS\System32\polagent.dll
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PolicyAgent, EventMessageFile
C:\WINDOWS\System32\tssdis.exe
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\TermServSessDir, EventMessageFile
C:\WINDOWS\system32\KB905474\wgasetup.exe
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\WgaSetup, EventMessageFile
C:\WINDOWS\system32\MsSip1.dll
Script: Quarantine, Delete, BC delete		ActiveRegistry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 1, $DLL
Delete
C:\WINDOWS\system32\MsSip2.dll
Script: Quarantine, Delete, BC delete		ActiveRegistry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 2, $DLL
Delete
C:\WINDOWS\system32\MsSip3.dll
Script: Quarantine, Delete, BC delete		ActiveRegistry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 3, $DLL
Delete
C:\WINDOWS\system32\psxss.exe
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
C:\WINDOWS\system32\stisvc.exe
Script: Quarantine, Delete, BC delete		--Registry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System, EventMessageFile
kbd101.dll
Script: Quarantine, Delete, BC delete		ActiveRegistry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver JPN
Delete
kbd101a.dll
Script: Quarantine, Delete, BC delete		ActiveRegistry keyHKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver KOR
Delete
mvfs32.dll
Script: Quarantine, Delete, BC delete		ActiveRegistry keyHKEY_USERS, .DEFAULT\Control Panel\IOProcs, MVB
Delete
mvfs32.dll
Script: Quarantine, Delete, BC delete		ActiveRegistry keyHKEY_USERS, S-1-5-19\Control Panel\IOProcs, MVB
Delete
mvfs32.dll
Script: Quarantine, Delete, BC delete		ActiveRegistry keyHKEY_USERS, S-1-5-20\Control Panel\IOProcs, MVB
Delete
mvfs32.dll
Script: Quarantine, Delete, BC delete		ActiveRegistry keyHKEY_USERS, S-1-5-18\Control Panel\IOProcs, MVB
Delete
mvfs32.dll
Script: Quarantine, Delete, BC delete		ActiveRegistry keyHKEY_USERS, S-1-5-21-2617700467-1337732287-186788590-2635\Control Panel\IOProcs, MVB
Delete
vgafix.fon
Script: Quarantine, Delete, BC delete		ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon
Delete
vgaoem.fon
Script: Quarantine, Delete, BC delete		ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon
Delete
vgasys.fon
Script: Quarantine, Delete, BC delete		ActiveRegistry keyHKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon
Delete
Autoruns items detected - 811, recognized as trusted - 785

Microsoft Internet Explorer extension modules (BHOs, Toolbars ...)

File nameTypeDescriptionManufacturerCLSID
Elements detected - 13, recognized as trusted - 13

Windows Explorer extension modules

File nameDestinationDescriptionManufacturerCLSID
Display Panning CPL Extension{42071714-76d4-11d1-8b24-00a0c9068ff3}
Delete
Shell extensions for file compression{764BF0E1-F219-11ce-972D-00AA00A14F56}
Delete
Encryption Context Menu{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}
Delete
Taskbar and Start Menu{0DF44EAA-FF21-4412-828E-260A8728E7F1}
Delete
User Accounts{7A9D77BD-5403-11d2-8785-2E0420524153}
Delete
Elements detected - 207, recognized as trusted - 202

Printing system extensions (print monitors, providers)

File nameTypeNameDescriptionManufacturer
Elements detected - 12, recognized as trusted - 12

Task Scheduler jobs

File nameJob nameJob statusDescriptionManufacturer
Elements detected - 3, recognized as trusted - 3

SPI/LSP settings

Namespace providers (NSP)
ProviderStatusEXE fileDescriptionGUID
Detected - 4, recognized as trusted - 4
Transport protocol providers (TSP, LSP)
ProviderEXE fileDescription
Detected - 11, recognized as trusted - 11
Results of automatic SPI settings check 
LSP settings checked. No errors detected

TCP/UDP ports

PortStatusRemote HostRemote PortApplicationNotes
TCP ports
135LISTENING0.0.0.053305[1088] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
139LISTENING0.0.0.02240[4] System
Script: Quarantine, Delete, BC delete, Terminate		 
445LISTENING0.0.0.063648[4] System
Script: Quarantine, Delete, BC delete, Terminate		 
1032ESTABLISHED127.0.0.15354[2012] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1052ESTABLISHED64.74.103.159443[124] c:\program files\logmein\x86\logmein.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1056ESTABLISHED127.0.0.12002[2212] c:\program files\logmein\x86\logmeinsystray.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1063LISTENING0.0.0.063705[3416] c:\windows\system32\alg.exe
Script: Quarantine, Delete, BC delete, Terminate		 
2002LISTENING0.0.0.032877[124] c:\program files\logmein\x86\logmein.exe
Script: Quarantine, Delete, BC delete, Terminate		 
2002ESTABLISHED127.0.0.11056[124] c:\program files\logmein\x86\logmein.exe
Script: Quarantine, Delete, BC delete, Terminate		 
2990ESTABLISHED192.168.0.9132465[1072] c:\docume~1\hra\locals~1\temp\1062207\4412528.exe
Script: Quarantine, Delete, BC delete, Terminate		 
3124ESTABLISHED192.168.0.120445[4] System
Script: Quarantine, Delete, BC delete, Terminate		 
3129ESTABLISHED192.168.2.110139[4] System
Script: Quarantine, Delete, BC delete, Terminate		 
3389LISTENING0.0.0.055444[984] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
3428TIME_WAIT204.232.200.9080[0]   
5152LISTENING0.0.0.063608[476] c:\program files\java\jre6\bin\jqs.exe
Script: Quarantine, Delete, BC delete, Terminate		 
5152CLOSE_WAIT127.0.0.13137[476] c:\program files\java\jre6\bin\jqs.exe
Script: Quarantine, Delete, BC delete, Terminate		 
5354LISTENING0.0.0.024786[176] c:\program files\bonjour\mdnsresponder.exe
Script: Quarantine, Delete, BC delete, Terminate		 
5354ESTABLISHED127.0.0.11032[176] c:\program files\bonjour\mdnsresponder.exe
Script: Quarantine, Delete, BC delete, Terminate		 
6999LISTENING0.0.0.010361[2100] c:\program files\trend micro\client server security agent\tmproxy.exe
Script: Quarantine, Delete, BC delete, Terminate		 
27015LISTENING0.0.0.02064[2012] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe
Script: Quarantine, Delete, BC delete, Terminate		 
36256LISTENING0.0.0.020618[1952] c:\program files\trend micro\client server security agent\tmlisten.exe
Script: Quarantine, Delete, BC delete, Terminate		 
UDP ports
123LISTENING----[1184] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
123LISTENING----[1184] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
137LISTENING----[4] System
Script: Quarantine, Delete, BC delete, Terminate		 
138LISTENING----[4] System
Script: Quarantine, Delete, BC delete, Terminate		 
445LISTENING----[4] System
Script: Quarantine, Delete, BC delete, Terminate		 
500LISTENING----[716] c:\windows\system32\lsass.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1025LISTENING----[716] c:\windows\system32\lsass.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1028LISTENING----[2012] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1029LISTENING----[2012] c:\program files\common files\apple\mobile device support\applemobiledeviceservice.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1030LISTENING----[176] c:\program files\bonjour\mdnsresponder.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1069LISTENING----[660] \??\c:\windows\system32\winlogon.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1900LISTENING----[1384] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1900LISTENING----[1384] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
3594LISTENING----[2532] c:\program files\common files\installshield\updateservice\agent.exe
Script: Quarantine, Delete, BC delete, Terminate		 
4500LISTENING----[716] c:\windows\system32\lsass.exe
Script: Quarantine, Delete, BC delete, Terminate		 
5353LISTENING----[176] c:\program files\bonjour\mdnsresponder.exe
Script: Quarantine, Delete, BC delete, Terminate		 

Downloaded Program Files (DPF)

File nameDescriptionManufacturerCLSIDSource URL
Elements detected - 11, recognized as trusted - 11

Control Panel Applets (CPL)

File nameDescriptionManufacturer
Elements detected - 28, recognized as trusted - 28

Active Setup

File nameDescriptionManufacturerCLSID
Elements detected - 16, recognized as trusted - 16

HOSTS file

Hosts file record 
127.0.0.1       localhost
Clear Hosts file

Protocols and handlers

File nameTypeDescriptionManufacturerCLSID
Elements detected - 32, recognized as trusted - 32

Suspicious objects

FileDescriptionType 

Main script of analysis
Windows version: Microsoft Windows XP, Build=2600, SP="Service Pack 3"
System Restore: enabled
1.1 Searching for user-mode API hooks
 Analysis: kernel32.dll, export table found in section .text
IAT modification detected: CreateProcessA - 00B90010<>7C80236B
IAT modification detected: GetModuleFileNameA - 00B90080<>7C80B56F
IAT modification detected: FreeLibrary - 00B900F0<>7C80AC7E
IAT modification detected: GetModuleFileNameW - 00B90160<>7C80B475
IAT modification detected: CreateProcessW - 00B901D0<>7C802336
IAT modification detected: LoadLibraryW - 00B902B0<>7C80AEEB
IAT modification detected: LoadLibraryA - 00B90320<>7C801D7B
IAT modification detected: GetProcAddress - 00B90390<>7C80AE40
 Analysis: ntdll.dll, export table found in section .text
 Analysis: user32.dll, export table found in section .text
 Analysis: advapi32.dll, export table found in section .text
 Analysis: ws2_32.dll, export table found in section .text
 Analysis: wininet.dll, export table found in section .text
 Analysis: rasapi32.dll, export table found in section .text
 Analysis: urlmon.dll, export table found in section .text
 Analysis: netapi32.dll, export table found in section .text
1.2 Searching for kernel-mode API hooks
 Driver loaded successfully
 SDT found (RVA=085700)
 Kernel ntkrnlpa.exe found in memory at address 804D7000
   SDT = 8055C700
   KiST = 80504494 (284)
Functions checked: 284, intercepted: 0, restored: 0
1.3 Checking IDT and SYSENTER
 Analysis for CPU 1
 Analysis for CPU 2
CmpCallCallBacks = 00093D84
Disable callback - уже нейтирализованы
 Checking IDT and SYSENTER - complete
1.4 Searching for masking processes and drivers
 Checking not performed: extended monitoring driver (AVZPM) is not installed
1.5 Checking of IRP handlers
 Driver loaded successfully
 Checking - complete
>> Services: potentially dangerous service allowed: RemoteRegistry (Remote Registry)
>> Services: potentially dangerous service allowed: TermService (Terminal Services)
>> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery Service)
>> Services: potentially dangerous service allowed: TlntSvr (Telnet)
>> Services: potentially dangerous service allowed: Schedule (Task Scheduler)
>> Services: potentially dangerous service allowed: mnmsrvc (NetMeeting Remote Desktop Sharing)
>> Services: potentially dangerous service allowed: RDSessMgr (Remote Desktop Help Session Manager)
> Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)!
>> Security: disk drives' autorun is enabled
>> Security: administrative shares (C$, D$ ...) are enabled
>> Security: anonymous user access is enabled
>> Security: terminal connections to the PC are allowed
>> Security: sending Remote Assistant queries is enabled
 >>  Disable HDD autorun
 >>  Disable autorun from network drives
 >>  Disable CD/DVD autorun
 >>  Disable removable media autorun
 >>  Windows Explorer - show extensions of known file types
System Analysis in progress

 System Analysis - complete


Script commands
 

Add commands to script:
Additional operations:

File list