Kaspersky Virus Removal Tool 2010 9.0.0.722 (database released 17/01/2011; 01:20)
| File name | PID | Description | Copyright | MD5 | Information
| c:\program files\ati technologies\ati control panel\atiptaxx.exe | Script: Quarantine, Delete, BC delete, Terminate 2660 | ATI Desktop Control Panel | Copyright (C) 1998-2006 ATI Technologies Inc. | ?? | 336.00 kb, rsAh, | created: 03/05/2006 3:42:22 PM, modified: 17/03/2006 5:37:00 PM Command line: "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" c:\program files\toshiba\e-key\ceekey.exe | Script: Quarantine, Delete, BC delete, Terminate 2936 | TOSHIBA HotKey Utility | Copyright 2003-2004 Compal Electronic Inc. | ?? | 620.00 kb, rsAh, | created: 16/03/2006 3:27:26 PM, modified: 16/03/2006 3:27:26 PM Command line: "C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe" c:\program files\toshiba\configfree\cfsserv.exe | Script: Quarantine, Delete, BC delete, Terminate 3496 | ConfigFree(TM) Search for Wireless Devices Version 5.70 | Copyright (C) 2002-2005 TOSHIBA CORPORATION. All rights reserved. | ?? | 780.00 kb, rsAh, | created: 03/05/2006 4:03:36 PM, modified: 17/11/2005 2:44:38 AM Command line: "C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe" -NoClient c:\program files\toshiba\toshiba direct disc writer\ddwmon.exe | Script: Quarantine, Delete, BC delete, Terminate 3040 | TOSHIBA Direct Disc Writer - Event Monitor | Copyright(C)2006 TOSHIBA Corporation. All rights reserved. | ?? | 292.00 kb, rsAh, | created: 25/04/2006 7:57:00 PM, modified: 25/04/2006 7:57:00 PM Command line: "C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe" c:\program files\toshiba\touch and launch\padexe.exe | Script: Quarantine, Delete, BC delete, Terminate 3088 | PadTouch Main | Copyright (C) 2003-2005 TOSHIBA Corporation | ?? | 1052.07 kb, rsAh, | created: 03/05/2006 4:05:47 PM, modified: 06/12/2005 12:06:10 AM Command line: "C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe" c:\program files\toshiba\touchpad\tptray.exe | Script: Quarantine, Delete, BC delete, Terminate 2904 | TPTray Application | Copyright 2002-2004 Compal Electronic Inc. | ?? | 52.00 kb, rsAh, | created: 04/04/2006 4:57:18 PM, modified: 04/04/2006 4:57:18 PM Command line: "C:\Program Files\TOSHIBA\TouchPad\TPTray.exe" c:\program files\toshiba\tvs\tvstray.exe | Script: Quarantine, Delete, BC delete, Terminate 3220 | TOSHIBA Virtual Sound Taskbar Module | Copyright (C) 2004-2006 TOSHIBA Corporation. | ?? | 72.00 kb, rsAh, | created: 03/05/2006 4:07:00 PM, modified: 02/02/2006 2:11:38 PM Command line: "C:\Program Files\Toshiba\Tvs\TvsTray.exe" Detected:64, recognized as trusted 59
| | |||||
| Module name | Handle | Description | Copyright | MD5 | Used by processes
| C:\Program Files\ATI Technologies\ATI Control Panel\atipdsxx.dll | Script: Quarantine, Delete, BC delete 268435456 | ATI Desktop Control Panel | Copyright (C) 1998-2006 ATI Technologies Inc. | -- | 2660
| C:\Program Files\ATI Technologies\ATI Control Panel\atipdxxx.dll | Script: Quarantine, Delete, BC delete 12386304 | ATI Desktop Control Panel | Copyright (C) 1998-2006 ATI Technologies Inc. | -- | 2660
| C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe | Script: Quarantine, Delete, BC delete 4194304 | ATI Desktop Control Panel | Copyright (C) 1998-2006 ATI Technologies Inc. | ?? | 2660
| C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATRPUIXX.ENU | Script: Quarantine, Delete, BC delete 11075584 | ATI Desktop Control Panel | Copyright (C) 1998-2006 ATI Technologies Inc. | -- | 2660
| C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe | Script: Quarantine, Delete, BC delete 4194304 | TOSHIBA HotKey Utility | Copyright 2003-2004 Compal Electronic Inc. | ?? | 2936
| C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe | Script: Quarantine, Delete, BC delete 4194304 | TOSHIBA Direct Disc Writer - Event Monitor | Copyright(C)2006 TOSHIBA Corporation. All rights reserved. | ?? | 3040
| C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe | Script: Quarantine, Delete, BC delete 4194304 | PadTouch Main | Copyright (C) 2003-2005 TOSHIBA Corporation | ?? | 3088
| C:\Program Files\TOSHIBA\TouchPad\TPECioCtl.dll | Script: Quarantine, Delete, BC delete 268435456 | TPECioCtl DLL | Copyright (C) 2005 | -- | 2904
| C:\Program Files\TOSHIBA\TouchPad\TPTray.exe | Script: Quarantine, Delete, BC delete 4194304 | TPTray Application | Copyright 2002-2004 Compal Electronic Inc. | ?? | 2904
| C:\Program Files\Toshiba\Tvs\TvsRes.dll | Script: Quarantine, Delete, BC delete 9437184 | TOSHIBA Virtual Sound | Copyright (C) 2004-2006 TOSHIBA Corporation. | -- | 3220
| C:\WINDOWS\system32\EBLib.dll | Script: Quarantine, Delete, BC delete 3342336 | EBLib DLL | Copyright (C) 2005 | -- | 2936, 3496, 2904
| C:\WINDOWS\system32\EKECioCtl.dll | Script: Quarantine, Delete, BC delete 268435456 | EKECioCtl DLL | Copyright (C) 2005 | -- | 2936, 3496
| Modules detected:545, recognized as trusted 533
| | |||||
| Module | Base address | Size in memory | Description | Manufacturer
| C:\WINDOWS\System32\Drivers\dump_atapi.sys | Script: Quarantine, Delete, BC delete F37DD000 | 018000 (98304) |
| C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS | Script: Quarantine, Delete, BC delete F7DA0000 | 002000 (8192) |
| C:\WINDOWS\system32\drivers\TPwSav.sys | Script: Quarantine, Delete, BC delete F5FFD000 | 003000 (12288) | IO Driver | Copyright 2005 ,All Rights Reserved.
| C:\WINDOWS\system32\DRIVERS\Tvs.sys | Script: Quarantine, Delete, BC delete F7A30000 | 00B000 (45056) | TOSHIBA Audio Filter Driver | Copyright (c) 2004-2006 TOSHIBA Corporation. All rights reserved.
| Modules detected - 140, recognized as trusted - 136
| | ||||||
| Service | Description | Status | File | Group | Dependencies
| Detected - 105, recognized as trusted - 105
| | ||||||
| Service | Description | Status | File | Group | Dependencies
| TPwSav | Driver: Unload, Delete, Disable TPwSav | Running | C:\WINDOWS\system32\drivers\TPwSav.sys | Script: Quarantine, Delete, BC delete |
| Tvs | Driver: Unload, Delete, Disable TOSHIBA Virtual Sound with SRS technologies | Running | C:\WINDOWS\system32\DRIVERS\Tvs.sys | Script: Quarantine, Delete, BC delete PNP Filter |
| Abiosdsk | Driver: Unload, Delete, Disable Abiosdsk | Not started | Abiosdsk.sys | Script: Quarantine, Delete, BC delete Primary disk |
| abp480n5 | Driver: Unload, Delete, Disable abp480n5 | Not started | abp480n5.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| adpu160m | Driver: Unload, Delete, Disable adpu160m | Not started | adpu160m.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Aha154x | Driver: Unload, Delete, Disable Aha154x | Not started | Aha154x.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| aic78u2 | Driver: Unload, Delete, Disable aic78u2 | Not started | aic78u2.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| aic78xx | Driver: Unload, Delete, Disable aic78xx | Not started | aic78xx.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| AliIde | Driver: Unload, Delete, Disable AliIde | Not started | AliIde.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| amsint | Driver: Unload, Delete, Disable amsint | Not started | amsint.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| asc | Driver: Unload, Delete, Disable asc | Not started | asc.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| asc3350p | Driver: Unload, Delete, Disable asc3350p | Not started | asc3350p.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| asc3550 | Driver: Unload, Delete, Disable asc3550 | Not started | asc3550.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Atdisk | Driver: Unload, Delete, Disable Atdisk | Not started | Atdisk.sys | Script: Quarantine, Delete, BC delete Primary disk |
| catchme | Driver: Unload, Delete, Disable catchme | Not started | C:\DOCUME~1\default\LOCALS~1\Temp\catchme.sys | Script: Quarantine, Delete, BC delete Base |
| cd20xrnt | Driver: Unload, Delete, Disable cd20xrnt | Not started | cd20xrnt.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Changer | Driver: Unload, Delete, Disable Changer | Not started | Changer.sys | Script: Quarantine, Delete, BC delete Filter |
| CmdIde | Driver: Unload, Delete, Disable CmdIde | Not started | CmdIde.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| Cpqarray | Driver: Unload, Delete, Disable Cpqarray | Not started | Cpqarray.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| dac960nt | Driver: Unload, Delete, Disable dac960nt | Not started | dac960nt.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| dpti2o | Driver: Unload, Delete, Disable dpti2o | Not started | dpti2o.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| hpn | Driver: Unload, Delete, Disable hpn | Not started | hpn.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| i2omgmt | Driver: Unload, Delete, Disable i2omgmt | Not started | i2omgmt.sys | Script: Quarantine, Delete, BC delete SCSI Class |
| i2omp | Driver: Unload, Delete, Disable i2omp | Not started | i2omp.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ini910u | Driver: Unload, Delete, Disable ini910u | Not started | ini910u.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| IntelIde | Driver: Unload, Delete, Disable IntelIde | Not started | IntelIde.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| lbrtfdc | Driver: Unload, Delete, Disable lbrtfdc | Not started | lbrtfdc.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| mraid35x | Driver: Unload, Delete, Disable mraid35x | Not started | mraid35x.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| PCIDump | Driver: Unload, Delete, Disable PCIDump | Not started | PCIDump.sys | Script: Quarantine, Delete, BC delete PCI Configuration |
| PDCOMP | Driver: Unload, Delete, Disable PDCOMP | Not started | PDCOMP.sys | Script: Quarantine, Delete, BC delete |
| PDFRAME | Driver: Unload, Delete, Disable PDFRAME | Not started | PDFRAME.sys | Script: Quarantine, Delete, BC delete |
| PDRELI | Driver: Unload, Delete, Disable PDRELI | Not started | PDRELI.sys | Script: Quarantine, Delete, BC delete |
| PDRFRAME | Driver: Unload, Delete, Disable PDRFRAME | Not started | PDRFRAME.sys | Script: Quarantine, Delete, BC delete |
| perc2 | Driver: Unload, Delete, Disable perc2 | Not started | perc2.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| perc2hib | Driver: Unload, Delete, Disable perc2hib | Not started | perc2hib.sys | Script: Quarantine, Delete, BC delete Filter |
| ql1080 | Driver: Unload, Delete, Disable ql1080 | Not started | ql1080.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Ql10wnt | Driver: Unload, Delete, Disable Ql10wnt | Not started | Ql10wnt.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ql12160 | Driver: Unload, Delete, Disable ql12160 | Not started | ql12160.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ql1240 | Driver: Unload, Delete, Disable ql1240 | Not started | ql1240.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ql1280 | Driver: Unload, Delete, Disable ql1280 | Not started | ql1280.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Simbad | Driver: Unload, Delete, Disable Simbad | Not started | Simbad.sys | Script: Quarantine, Delete, BC delete Filter |
| Sparrow | Driver: Unload, Delete, Disable Sparrow | Not started | Sparrow.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| sym_hi | Driver: Unload, Delete, Disable sym_hi | Not started | sym_hi.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| sym_u3 | Driver: Unload, Delete, Disable sym_u3 | Not started | sym_u3.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| symc810 | Driver: Unload, Delete, Disable symc810 | Not started | symc810.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| symc8xx | Driver: Unload, Delete, Disable symc8xx | Not started | symc8xx.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| TosIde | Driver: Unload, Delete, Disable TosIde | Not started | TosIde.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| ultra | Driver: Unload, Delete, Disable ultra | Not started | ultra.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ViaIde | Driver: Unload, Delete, Disable ViaIde | Not started | ViaIde.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| WDICA | Driver: Unload, Delete, Disable WDICA | Not started | WDICA.sys | Script: Quarantine, Delete, BC delete |
| Detected - 213, recognized as trusted - 163
| | ||||||
| File name | Status | Startup method | Description
| C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, ATIPTA | Delete C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, CeEKEY | Delete C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, DDWMon | Delete C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, PadTouch | Delete C:\Program Files\TOSHIBA\TouchPad\TPTray.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, TPNF | Delete C:\WINDOWS\System32\PrintFilterPipelineSvc.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PrintFilterPipelineSvc, EventMessageFile | Delete C:\WINDOWS\System32\appmgmts.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters, ServiceDll | Delete C:\WINDOWS\System32\appmgmts.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Application Management, EventMessageFile | Delete C:\WINDOWS\System32\appmgr.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Software Installation, EventMessageFile | Delete C:\WINDOWS\System32\fdeploy.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\File Deployment, EventMessageFile | Delete C:\WINDOWS\System32\fdeploy.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Folder Redirection, EventMessageFile | Delete C:\WINDOWS\System32\igmpv2.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile | Delete C:\WINDOWS\System32\ipbootp.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile | Delete C:\WINDOWS\System32\iprip2.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile | Delete C:\WINDOWS\System32\ntbackup.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\ntbackup, EventMessageFile | Delete C:\WINDOWS\System32\ospf.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPF, EventMessageFile | Delete C:\WINDOWS\System32\ospfmib.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPFMib, EventMessageFile | Delete C:\WINDOWS\System32\polagent.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PolicyAgent, EventMessageFile | Delete C:\WINDOWS\System32\tssdis.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\TermServSessDir, EventMessageFile | Delete C:\WINDOWS\System\LVMaLogD.DLL | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\LOGITECH, EventMessageFile | Delete C:\WINDOWS\system32\MsSip1.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 1, $DLL | Delete C:\WINDOWS\system32\MsSip2.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 2, $DLL | Delete C:\WINDOWS\system32\MsSip3.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 3, $DLL | Delete C:\WINDOWS\system32\asr_fmt.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR format utility for volumes | Delete C:\WINDOWS\system32\asr_ldm.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR utility for Logical Disk Manager | Delete C:\WINDOWS\system32\asr_pfu.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands, ASR protected file utility | Delete C:\WINDOWS\system32\psxss.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
| C:\WINDOWS\system32\stisvc.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System, EventMessageFile | Delete CFSServ.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, CFSServ.exe | Delete NDSTray.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, NDSTray.exe | Delete WRLogonNTF.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier, DLLName | Delete appmgmts.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}, DLLName | Delete kbd101.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver JPN | Delete kbd101a.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver KOR | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, .DEFAULT\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-19\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-20\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-18\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_USERS, S-1-5-21-1537700535-1587211706-558873121-1006\Control Panel\IOProcs, MVB | Delete vgafix.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon | Delete vgaoem.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon | Delete vgasys.fon | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon | Delete Autoruns items detected - 605, recognized as trusted - 563
| | ||||||
| File name | Type | Description | Manufacturer | CLSID
| BHO | {5C255C8A-E604-49b4-9D64-90988571CECB} | Delete Elements detected - 9, recognized as trusted - 8
| | |||||||||
| File name | Destination | Description | Manufacturer | CLSID
| deskpan.dll | Script: Quarantine, Delete, BC delete Display Panning CPL Extension | {42071714-76d4-11d1-8b24-00a0c9068ff3} | Delete Shell extensions for file compression | {764BF0E1-F219-11ce-972D-00AA00A14F56} | Delete Encryption Context Menu | {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} | Delete Taskbar and Start Menu | {0DF44EAA-FF21-4412-828E-260A8728E7F1} | Delete rundll32.exe C:\WINDOWS\system32\shimgvw.dll,ImageView_COMServer {00E7B358-F65B-4dcf-83DF-CD026B94BFD4} | Script: Quarantine, Delete, BC delete Autoplay for SlideShow | {00E7B358-F65B-4dcf-83DF-CD026B94BFD4} | Delete User Accounts | {7A9D77BD-5403-11d2-8785-2E0420524153} | Delete C:\WINDOWS\system32\TPprop.dll | Script: Quarantine, Delete, BC delete TouchPad Property Sheet | TPprop Module | Copyright 2003 Compal Electronic Inc. | {9ED66769-A198-41FE-8615-601691C68846} | Delete Elements detected - 208, recognized as trusted - 201
| | ||||||||||||||||||||||
| File name | Type | Name | Description | Manufacturer
| Elements detected - 9, recognized as trusted - 9
| | ||||||
| File name | Job name | Job status | Description | Manufacturer
| Elements detected - 0, recognized as trusted - 0
| | ||||||
| Provider | Status | EXE file | Description | GUID
| Detected - 4, recognized as trusted - 4
| | ||||||
| Provider | EXE file | Description
| Detected - 17, recognized as trusted - 17
| | ||||||
| File name | Description | Manufacturer | CLSID | Source URL
| {E2883E8F-472F-4FB0-9522-AC9BF37916A7} | Delete http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
| Elements detected - 9, recognized as trusted - 8
| | |||||||||
| File name | Description | Manufacturer
| C:\WINDOWS\system32\HWSetup.cpl | Script: Quarantine, Delete, BC delete Hardware Setup Utility | Copyright (C) TOSHIBA Corp. 1995 - 2004
| Elements detected - 30, recognized as trusted - 29
| | ||||||
| File name | Description | Manufacturer | CLSID
| Elements detected - 14, recognized as trusted - 14
| | ||||||
Hosts file record
|
| File name | Type | Description | Manufacturer | CLSID
| mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| Elements detected - 33, recognized as trusted - 30
| | ||||||
| File | Description | Type
| \SystemRoot\system32\drivers\mfehidk.sys | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| |
Main script of analysis Windows version: Microsoft Windows XP, Build=2600, SP="Service Pack 3" System Restore: enabled 1.1 Searching for user-mode API hooks Analysis: kernel32.dll, export table found in section .text IAT modification detected: CreateProcessA - 00BA0010<>7C80236B IAT modification detected: GetModuleFileNameA - 00BA0080<>7C80B56F IAT modification detected: GetModuleFileNameW - 00BA00F0<>7C80B475 IAT modification detected: CreateProcessW - 00BA0160<>7C802336 IAT modification detected: LoadLibraryW - 00BA0240<>7C80AEEB IAT modification detected: LoadLibraryA - 00BA0320<>7C801D7B IAT modification detected: GetProcAddress - 00BA0390<>7C80AE40 IAT modification detected: FreeLibrary - 00BA0400<>7C80AC7E Analysis: ntdll.dll, export table found in section .text Analysis: user32.dll, export table found in section .text Analysis: advapi32.dll, export table found in section .text Analysis: ws2_32.dll, export table found in section .text Analysis: wininet.dll, export table found in section .text Analysis: rasapi32.dll, export table found in section .text Analysis: urlmon.dll, export table found in section .text Analysis: netapi32.dll, export table found in section .text 1.2 Searching for kernel-mode API hooks Driver loaded successfully SDT found (RVA=083220) Kernel ntoskrnl.exe found in memory at address 804D7000 SDT = 8055A220 KiST = 804E26B8 (284) Function NtCreateKey (29) - machine code modification Method of JmpTo. jmp F04AF1AF\SystemRoot\system32\drivers\mfehidk.sys, driver recognized as trusted Function NtDeleteKey (3F) - machine code modification Method of JmpTo. jmp F04AF1C3\SystemRoot\system32\drivers\mfehidk.sys, driver recognized as trusted Function NtDeleteValueKey (41) - machine code modification Method of JmpTo. jmp F04AF1EF\SystemRoot\system32\drivers\mfehidk.sys, driver recognized as trusted Function NtOpenKey (77) - machine code modification Method of JmpTo. jmp F04AF19B\SystemRoot\system32\drivers\mfehidk.sys, driver recognized as trusted Function NtRenameKey (C0) - machine code modification Method of JmpTo. jmp F04AF1D9\SystemRoot\system32\drivers\mfehidk.sys, driver recognized as trusted Function NtSetValueKey (F7) - machine code modification Method of JmpTo. jmp F04AF205\SystemRoot\system32\drivers\mfehidk.sys, driver recognized as trusted Function NtTerminateProcess (101) - machine code modification Method of JmpTo. jmp F04AF21B\SystemRoot\system32\drivers\mfehidk.sys, driver recognized as trusted Functions checked: 284, intercepted: 0, restored: 0 1.3 Checking IDT and SYSENTER Analysis for CPU 1 Checking IDT and SYSENTER - complete 1.4 Searching for masking processes and drivers Checking not performed: extended monitoring driver (AVZPM) is not installed Driver loaded successfully 1.5 Checking of IRP handlers Checking - complete >> Services: potentially dangerous service allowed: TermService (Terminal Services) Error [2, SC_EXT_ADDITEMST] >> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery Service) Error [2, SC_EXT_ADDITEMST] >> Services: potentially dangerous service allowed: TlntSvr () Error [2, SC_EXT_ADDITEMST] >> Services: potentially dangerous service allowed: Schedule () Error [2, SC_EXT_ADDITEMST] >> Services: potentially dangerous service allowed: mnmsrvc (NetMeeting Remote Desktop Sharing) Error [2, SC_EXT_ADDITEMST] >> Services: potentially dangerous service allowed: RDSessMgr (Remote Desktop Help Session Manager) Error [2, SC_EXT_ADDITEMST] > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)! >> Security: disk drives' autorun is enabled Error [2, SC_EXT_ADDITEMST] >> Security: administrative shares (C$, D$ ...) are enabled Error [2, SC_EXT_ADDITEMST] >> Security: anonymous user access is enabled Error [2, SC_EXT_ADDITEMST] Error [2, SC_EXT_ADDITEMST] >> Security: sending Remote Assistant queries is enabled >> Disable HDD autorun >> Disable autorun from network drives >> Disable CD/DVD autorun >> Disable removable media autorun >> Windows Explorer - show extensions of known file types System Analysis in progressAdd commands to script:
System Analysis - complete
Script commands