Results of system analysis

LSP settings checked. No errors detected

яю1

Main script of analysis
Windows version: Windows Vista (TM) Business, Build=6002, SP="Service Pack 2"
System Restore: enabled
1.1 Searching for user-mode API hooks
 Analysis: kernel32.dll, export table found in section .text
IAT modification detected: CreateProcessA - 00B60010<>77191C28
IAT modification detected: GetModuleFileNameA - 00B60080<>771DB6BD
IAT modification detected: GetModuleFileNameW - 00B600F0<>771DB27E
IAT modification detected: CreateProcessW - 00B60160<>77191BF3
IAT modification detected: LoadLibraryW - 00B60240<>771B9362
IAT modification detected: LoadLibraryA - 00B60320<>771B94DC
IAT modification detected: GetProcAddress - 00B60390<>771D903B
IAT modification detected: FreeLibrary - 00B60400<>771D3DB4
 Analysis: ntdll.dll, export table found in section .text
 Analysis: user32.dll, export table found in section .text
 Analysis: advapi32.dll, export table found in section .text
 Analysis: ws2_32.dll, export table found in section .text
 Analysis: wininet.dll, export table found in section .text
 Analysis: rasapi32.dll, export table found in section .text
 Analysis: urlmon.dll, export table found in section .text
 Analysis: netapi32.dll, export table found in section .text
 >> Danger ! Process masking detected
1.2 Searching for kernel-mode API hooks
 Driver loaded successfully
 SDT found (RVA=137B00)
 Kernel ntkrnlpa.exe found in memory at address 81E3C000
   SDT = 81F73B00
   KiST = 81EE886C (391)
Function NtConnectPort (36) intercepted (82009ACB->8CD23430), hook not defined
>>> Function restored successfully !
>>> Hook code blocked
Functions checked: 391, intercepted: 1, restored: 1
1.3 Checking IDT and SYSENTER
 Analysis for CPU 1
 Analysis for CPU 2
CmpCallCallBacks = 00000000
 Checking IDT and SYSENTER - complete
1.4 Searching for masking processes and drivers
 Checking not performed: extended monitoring driver (AVZPM) is not installed
 Driver loaded successfully
1.5 Checking of IRP handlers
 Checking - complete
>> Services: potentially dangerous service allowed: TermService (@%SystemRoot%\System32\termsrv.dll,-268)
Error [2, SC_EXT_ADDITEMST]
>> Services: potentially dangerous service allowed: SSDPSRV (@%systemroot%\system32\ssdpsrv.dll,-100)
Error [2, SC_EXT_ADDITEMST]
>> Services: potentially dangerous service allowed: Schedule (@%SystemRoot%\system32\schedsvc.dll,-100)
Error [2, SC_EXT_ADDITEMST]
> Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)!
>> Security: disk drives' autorun is enabled
Error [2, SC_EXT_ADDITEMST]
>> Security: administrative shares (C$, D$ ...) are enabled
Error [2, SC_EXT_ADDITEMST]
>> Security: anonymous user access is enabled
Error [2, SC_EXT_ADDITEMST]
Error [2, SC_EXT_ADDITEMST]
>> Security: sending Remote Assistant queries is enabled
 >>  Disable HDD autorun
 >>  Disable autorun from network drives
 >>  Disable CD/DVD autorun
 >>  Disable removable media autorun
System Analysis in progress

 System Analysis - complete


Script commands
 
Add commands to script:
Blocking hooks using Anti-Rootkit
Enable AVZGuard
Operations with AVZPM (true=enable,false=disable)
BootCleaner - import list of deleted files
Registry cleanup after deleting files
BootCleaner - activate
Reboot
Insert template for QuarantineFile() - quarantining file
Insert template for BC_QrFile() - quarantining file via BootCleaner
Insert template for DeleteFile() - deleting file
Insert template for DelCLSID() - deleting CLSID item from registry
Additional operations:
Performance tweaking: disable service TermService (@%SystemRoot%\System32\termsrv.dll,-268)
Performance tweaking: disable service SSDPSRV (@%systemroot%\system32\ssdpsrv.dll,-100)
Performance tweaking: disable service Schedule (@%SystemRoot%\system32\schedsvc.dll,-100)
Security tweaking: disable CD autorun
Security tweaking: disable administrative shares
Security tweaking: disable anonymous user access
Security: disable sending Remote Assistant queries

File list