Results of system analysis
Kaspersky Virus Removal Tool 2010 9.0.0.722 (database released 01/06/2010; 06:26)
List of processes
File name PID Description Copyright MD5 Information
c:\program files\atk hotkey\hcontrol.exe
Script: Quarantine, Delete, BC delete, Terminate 1628 HControl Copyright (c) 2003 ?? 220.00 kb, rsAh,
created: 12/03/2007 18.24.21,
modified: 05/01/2007 22.17.28
Command line:
"C:\Program Files\ATK Hotkey\Hcontrol.exe"
Detected:60, recognized as trusted 59
Module name Handle Description Copyright MD5 Used by processes
C:\Program Files\ATK Hotkey\Hcontrol.exe
Script: Quarantine, Delete, BC delete 4194304 HControl Copyright (c) 2003 ?? 1628
Modules detected:595, recognized as trusted 594
Kernel Space Modules Viewer
Module Base address Size in memory Description Manufacturer
C:\Windows\System32\Drivers\dump_diskdump.sys
Script: Quarantine, Delete, BC delete 8EDDA000 00A000 (40960)
C:\Windows\System32\Drivers\dump_nvstor32.sys
Script: Quarantine, Delete, BC delete 8E1C7000 01D000 (118784)
Modules detected - 154, recognized as trusted - 152
Services
Service Description Status File Group Dependencies
BWSOT
Service: Stop, Delete, Disable BWSOT Not started C:\Users\Klod\AppData\Local\Temp\BWSOT.exe
Script: Quarantine, Delete, BC delete
JEZVMSB
Service: Stop, Delete, Disable JEZVMSB Not started C:\Users\Klod\AppData\Local\Temp\JEZVMSB.exe
Script: Quarantine, Delete, BC delete
Nero BackItUp Scheduler 4.0
Service: Stop, Delete, Disable Nero BackItUp Scheduler 4.0 Not started C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
Script: Quarantine, Delete, BC delete RPCSS
NHEONHGN
Service: Stop, Delete, Disable NHEONHGN Not started C:\Users\Klod\AppData\Local\Temp\NHEONHGN.exe
Script: Quarantine, Delete, BC delete
NZBQMZCKDLWFQ
Service: Stop, Delete, Disable NZBQMZCKDLWFQ Not started C:\Users\Klod\AppData\Local\Temp\NZBQMZCKDLWFQ.exe
Script: Quarantine, Delete, BC delete
OZJQLQ
Service: Stop, Delete, Disable OZJQLQ Not started C:\Users\Klod\AppData\Local\Temp\OZJQLQ.exe
Script: Quarantine, Delete, BC delete
PAPCFJNJM
Service: Stop, Delete, Disable PAPCFJNJM Not started C:\Users\Klod\AppData\Local\Temp\PAPCFJNJM.exe
Script: Quarantine, Delete, BC delete
POGASZGLKDFWL
Service: Stop, Delete, Disable POGASZGLKDFWL Not started C:\Users\Klod\AppData\Local\Temp\POGASZGLKDFWL.exe
Script: Quarantine, Delete, BC delete
Detected - 142, recognized as trusted - 134
Drivers
Service Description Status File Group Dependencies
blbdrive
Driver: Unload, Delete, Disable blbdrive Not started C:\Windows\system32\drivers\blbdrive.sys
Script: Quarantine, Delete, BC delete
catchme
Driver: Unload, Delete, Disable catchme Not started C:\Users\Klod\AppData\Local\Temp\catchme.sys
Script: Quarantine, Delete, BC delete Base
IpInIp
Driver: Unload, Delete, Disable IP in IP Tunnel Driver Not started C:\Windows\system32\DRIVERS\ipinip.sys
Script: Quarantine, Delete, BC delete Tcpip
Lbd
Driver: Unload, Delete, Disable Lbd Not started C:\Windows\system32\DRIVERS\Lbd.sys
Script: Quarantine, Delete, BC delete FSFilter Activity Monitor FltMgr
NDISKIO
Driver: Unload, Delete, Disable NDISKIO Not started C:\Users\Klod\AppData\Local\Temp\00001681.nmc\nse\bin\ndiskio.sys
Script: Quarantine, Delete, BC delete
NwlnkFlt
Driver: Unload, Delete, Disable IPX Traffic Filter Driver Not started C:\Windows\system32\DRIVERS\nwlnkflt.sys
Script: Quarantine, Delete, BC delete NwlnkFwd
NwlnkFwd
Driver: Unload, Delete, Disable IPX Traffic Forwarder Driver Not started C:\Windows\system32\DRIVERS\nwlnkfwd.sys
Script: Quarantine, Delete, BC delete
Detected - 240, recognized as trusted - 233
Autoruns
File name Status Startup method Description
C:\Program Files\Avira\AntiVir Desktop\avfwres.dll
Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Avira Firewall, EventMessageFile
Delete
C:\Program Files\F-Secure\Anti-Virus\minifilter\fsgk.sys
Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\F-Secure Gatekeeper, EventMessageFile
Delete
C:\Program Files\F-Secure\Common\AMEHEVN.DLL
Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\FSecure-FSecure-F-Secure Anti-Virus, EventMessageFile
Delete
C:\Program Files\F-Secure\Common\AMEHEVN.DLL
Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\FSecure-FSecure-F-Secure Management Agent, EventMessageFile
Delete
C:\Program Files\F-Secure\Common\AMEHEVN.DLL
Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\FSecure-FSecure-F-Secure System Control, EventMessageFile
Delete
C:\WindowsSystem32\IoLogMsg.dll
Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\vsmraid, EventMessageFile
Delete
C:\Windows\SoftwareDistribution\Download\Install\WGAER_M.exe
Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\WGA Scanner, EventMessageFile
Delete
C:\Windows\System32\MAGENT~1.SCR
Script: Quarantine, Delete, BC delete Active Registry key HKEY_USERS, S-1-5-21-4153703025-3799483044-3938653554-1000\Control Panel\Desktop, scrnsave.exe
Delete
C:\Windows\System32\MAGENT~1.SCR
Script: Quarantine, Delete, BC delete Active File system.ini C:\Windows\system.ini, boot, SCRNSAVE.EXE
C:\Windows\System32\appmgmts.dll
Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters, ServiceDll
Delete
C:\Windows\System32\igmpv2.dll
Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile
Delete
C:\Windows\System32\ipbootp.dll
Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile
Delete
C:\Windows\System32\iprip2.dll
Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile
Delete
C:\Windows\system32\psxss.exe
Script: Quarantine, Delete, BC delete -- Registry key HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
DivX.dll
Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, VIDC.DIVX
Delete
MSh263.drv
Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, VIDC.I420
Delete
progman.exe
Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, shell
Delete
rdpclip
Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd, StartupPrograms
Delete
vgafix.fon
Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon
Delete
vgaoem.fon
Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon
Delete
vgasys.fon
Script: Quarantine, Delete, BC delete Active Registry key HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon
Delete
Autoruns items detected - 443, recognized as trusted - 422
Microsoft Internet Explorer extension modules (BHOs, Toolbars ...)
File name Type Description Manufacturer CLSID
Elements detected - 10, recognized as trusted - 10
Windows Explorer extension modules
File name Destination Description Manufacturer CLSID
IE User Assist {FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75}
Delete
Color Control Panel Applet {b2c761c6-29bc-4f19-9251-e6195265baf1}
Delete
Add New Hardware {7A979262-40CE-46ff-AEEE-7884AC3B6136}
Delete
Get Programs Online {3e7efb4c-faf1-453d-89eb-56026875ef90}
Delete
Taskbar and Start Menu {0DF44EAA-FF21-4412-828E-260A8728E7F1}
Delete
ActiveDirectory Folder {1b24a030-9b20-49bc-97ac-1be4426f9e59}
Delete
ActiveDirectory Folder {34449847-FD14-4fc8-A75A-7432F5181EFB}
Delete
Sam Account Folder {C8494E42-ACDD-4739-B0FB-217361E4894F}
Delete
Sam Account Folder {E29F9716-5C08-4FCD-955A-119FDB5A522D}
Delete
Control Panel command object for Start menu {5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}
Delete
Default Programs command object for Start menu {E44E5D18-0652-4508-A4E2-8A090067BCB0}
Delete
Folder Options {6dfd7c5c-2451-11d3-a299-00c04f8ef6af}
Delete
Explorer Query Band {2C2577C2-63A7-40e3-9B7F-586602617ECB}
Delete
View Available Networks {38a98528-6cbf-4ca9-8dc0-b1e1d10f7b1b}
Delete
Contacts folder {0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48}
Delete
Windows Firewall {4026492f-2f69-46b8-b9bf-5654fc07e423}
Delete
Problem Reports and Solutions {fcfeecae-ee1b-4849-ae50-685dcf7717ec}
Delete
iSCSI Initiator {a304259d-52b8-4526-8b1a-a1d6cecc8243}
Delete
.cab or .zip files {911051fa-c21c-4246-b470-070cd8df6dc4}
Delete
Windows Search Shell Service {da67b8ad-e81b-4c70-9b91b417b5e33527}
Delete
Microsoft.ScannersAndCameras {00f2886f-cd64-4fc9-8ec5-30ef6cdbe8c3}
Delete
"C:\Windows\System32\rundll32.exe" "C:\Program Files\\Windows Photo Gallery\PhotoViewer.dll",ImageView_COMServer {9D687A4C-1404-41ef-A089-883B6FBECDE6}
Script: Quarantine, Delete, BC delete Windows Photo Gallery Viewer Autoplay Handler {9D687A4C-1404-41ef-A089-883B6FBECDE6}
Delete
Windows Sidebar Properties {37efd44d-ef8d-41b1-940d-96973a50e9e0}
Delete
Windows Features {67718415-c450-4f3c-bf8a-b487642dc39b}
Delete
Windows Defender {d8559eb9-20c0-410e-beda-7ed416aecc2a}
Delete
Mobility Center Control Panel {5ea4f148-308c-46d7-98a9-49041b1dd468}
Delete
"C:\Program Files\\Windows Media Player\wmprph.exe"
Script: Quarantine, Delete, BC delete Windows Media Player Rich Preview Handler {031EE060-67BC-460d-8847-E4A7C5E45A27}
Delete
User Accounts {7A9D77BD-5403-11d2-8785-2E0420524153}
Delete
Shell Extension for Malware scanning {45AC2688-0253-4ED8-97DE-B5370FA7D48A}
Delete
Elements detected - 286, recognized as trusted - 257
Printing system extensions (print monitors, providers)
File name Type Name Description Manufacturer
Elements detected - 8, recognized as trusted - 8
Task Scheduler jobs
File name Job name Job status Description Manufacturer
Elements detected - 1, recognized as trusted - 1
SPI/LSP settings
Namespace providers (NSP) Provider Status EXE file Description GUID
Detected - 6, recognized as trusted - 6
Transport protocol providers (TSP, LSP) Provider EXE file Description
Detected - 24, recognized as trusted - 24
Results of automatic SPI settings check LSP settings checked. No errors detected
TCP/UDP ports
Port Status Remote Host Remote Port Application Notes
TCP ports
135 LISTENING 0.0.0.0 0 [868] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
139 LISTENING 0.0.0.0 0 [4] System
Script: Quarantine, Delete, BC delete, Terminate
445 LISTENING 0.0.0.0 0 [4] System
Script: Quarantine, Delete, BC delete, Terminate
3389 LISTENING 0.0.0.0 0 [1460] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
5357 LISTENING 0.0.0.0 0 [4] System
Script: Quarantine, Delete, BC delete, Terminate
49152 LISTENING 0.0.0.0 0 [536] c:\windows\system32\wininit.exe
Script: Quarantine, Delete, BC delete, Terminate
49153 LISTENING 0.0.0.0 0 [1012] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
49154 LISTENING 0.0.0.0 0 [600] c:\windows\system32\lsass.exe
Script: Quarantine, Delete, BC delete, Terminate
49155 LISTENING 0.0.0.0 0 [1088] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
49159 LISTENING 0.0.0.0 0 [580] c:\windows\system32\services.exe
Script: Quarantine, Delete, BC delete, Terminate
49656 CLOSE_WAIT 62.41.85.18 80 [2104] c:\program files\common files\java\java update\jusched.exe
Script: Quarantine, Delete, BC delete, Terminate
49670 CLOSE_WAIT 62.41.85.18 80 [5392] c:\program files\common files\java\java update\jucheck.exe
Script: Quarantine, Delete, BC delete, Terminate
50461 CLOSE_WAIT 213.155.157.42 80 [5768] c:\program files\common files\adobe\updater5\adobeupdater.exe
Script: Quarantine, Delete, BC delete, Terminate
50466 CLOSE_WAIT 62.41.85.32 80 [5768] c:\program files\common files\adobe\updater5\adobeupdater.exe
Script: Quarantine, Delete, BC delete, Terminate
51165 ESTABLISHED 127.0.0.1 51166 [3804] c:\program files\internet explorer\iexplore.exe
Script: Quarantine, Delete, BC delete, Terminate
51166 ESTABLISHED 127.0.0.1 51165 [3804] c:\program files\internet explorer\iexplore.exe
Script: Quarantine, Delete, BC delete, Terminate
UDP ports
123 LISTENING -- -- [1268] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
137 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
138 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
500 LISTENING -- -- [1088] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
1900 LISTENING -- -- [1268] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
1900 LISTENING -- -- [1268] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
4500 LISTENING -- -- [1088] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
5355 LISTENING -- -- [1460] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
62296 LISTENING -- -- [2172] c:\program files\internet explorer\iexplore.exe
Script: Quarantine, Delete, BC delete, Terminate
62975 LISTENING -- -- [1268] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
62976 LISTENING -- -- [1268] c:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
64722 LISTENING -- -- [3804] c:\program files\internet explorer\iexplore.exe
Script: Quarantine, Delete, BC delete, Terminate
Downloaded Program Files (DPF)
File name Description Manufacturer CLSID Source URL
Microsoft XML Parser for Java
Delete file:///C:/Windows/Java/classes/xmldso.cab
{7530BFB8-7293-4D34-9923-61A11451AFC5}
Delete
http://download.eset.com/special/eos/OnlineScanner.cab {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
Delete
http://fpdownload.macromedia.com/get/fl ... rashim.cab Elements detected - 3, recognized as trusted - 0
Control Panel Applets (CPL)
File name Description Manufacturer
Elements detected - 22, recognized as trusted - 22
Active Setup
File name Description Manufacturer CLSID
Elements detected - 9, recognized as trusted - 9
HOSTS file
Hosts file record
127.0.0.1 localhost
::1 localhost
Protocols and handlers
File name Type Description Manufacturer CLSID
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Elements detected - 19, recognized as trusted - 16
Suspicious objects
File Description Type
C:\Windows\System32\drivers\pxrts.sys
Script: Quarantine, Delete, BC delete Suspicion for Rootkit Kernel-mode hook
--------------------------------------------------------------------------------
Main script of analysis
Windows version: Windows Vista (TM) Home Premium, Build=6002, SP="Service Pack 2"
System Restore: enabled
1.1 Searching for user-mode API hooks
Analysis: kernel32.dll, export table found in section .text
IAT modification detected: CreateProcessA - 00B80010<>76031C28
IAT modification detected: GetModuleFileNameA - 00B80080<>7607B6BD
IAT modification detected: GetModuleFileNameW - 00B800F0<>7607B27E
IAT modification detected: CreateProcessW - 00B80160<>76031BF3
IAT modification detected: LoadLibraryW - 00B80240<>76059362
IAT modification detected: LoadLibraryA - 00B80320<>760594DC
IAT modification detected: GetProcAddress - 00B80390<>7607903B
IAT modification detected: FreeLibrary - 00B80400<>76073DB4
Analysis: ntdll.dll, export table found in section .text
Analysis: user32.dll, export table found in section .text
Analysis: advapi32.dll, export table found in section .text
Analysis: ws2_32.dll, export table found in section .text
Analysis: wininet.dll, export table found in section .text
Analysis: rasapi32.dll, export table found in section .text
Analysis: urlmon.dll, export table found in section .text
Analysis: netapi32.dll, export table found in section .text
1.2 Searching for kernel-mode API hooks
Driver loaded successfully
SDT found (RVA=137B00)
Kernel ntkrnlpa.exe found in memory at address 81E1B000
SDT = 81F52B00
KiST = 81EC784C (391)
Function NtAssignProcessToJobObject (2A) intercepted (81FD8AEF->8DB23A00), hook C:\Windows\System32\drivers\pxrts.sys, driver recognized as trusted
Function NtCreateThread (4E) intercepted (820AC67C->8DB23A50), hook C:\Windows\System32\drivers\pxrts.sys, driver recognized as trusted
Function NtOpenProcess (C2) intercepted (8203BC08->8DB23E10), hook C:\Windows\System32\drivers\pxrts.sys, driver recognized as trusted
Function NtOpenThread (C9) intercepted (8203715A->8DB23CA0), hook C:\Windows\System32\drivers\pxrts.sys, driver recognized as trusted
Function NtProtectVirtualMemory (D2) intercepted (82034F3D->8DB23AF0), hook C:\Windows\System32\drivers\pxrts.sys, driver recognized as trusted
Function NtSetContextThread (121) intercepted (820AD34F->8DB239B0), hook C:\Windows\System32\drivers\pxrts.sys, driver recognized as trusted
Function NtTerminateProcess (14E) intercepted (8200BDA3->8DB23FB0), hook C:\Windows\System32\drivers\pxrts.sys, driver recognized as trusted
Function NtTerminateThread (14F) intercepted (8203718F->8DB23B90), hook C:\Windows\System32\drivers\pxrts.sys, driver recognized as trusted
Function NtWriteVirtualMemory (166) intercepted (8202858D->8DB23BE0), hook C:\Windows\System32\drivers\pxrts.sys, driver recognized as trusted
Functions checked: 391, intercepted: 9, restored: 0
1.3 Checking IDT and SYSENTER
Analysis for CPU 1
Analysis for CPU 2
Checking IDT and SYSENTER - complete
1.4 Searching for masking processes and drivers
Checking not performed: extended monitoring driver (AVZPM) is not installed
Driver loaded successfully
1.5 Checking of IRP handlers
Checking - complete
>> Services: potentially dangerous service allowed: TermService (@%SystemRoot%\System32\termsrv.dll,-268)
>> Services: potentially dangerous service allowed: SSDPSRV (@%systemroot%\system32\ssdpsrv.dll,-100)
>> Services: potentially dangerous service allowed: Schedule (@%SystemRoot%\system32\schedsvc.dll,-100)
> Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)!
>> Security: disk drives' autorun is enabled
>> Security: administrative shares (C$, D$ ...) are enabled
>> Security: anonymous user access is enabled
>> Security: terminal connections to the PC are allowed
>> Security: sending Remote Assistant queries is enabled
>> Disable HDD autorun
>> Disable autorun from network drives
>> Disable CD/DVD autorun
>> Disable removable media autorun
>> Windows Explorer - show extensions of known file types
System Analysis in progress
System Analysis - complete
Script commands
Add commands to script:Blocking hooks using Anti-RootkitEnable AVZGuardOperations with AVZPM (true=enable,false=disable)BootCleaner - import list of deleted filesRegistry cleanup after deleting filesBootCleaner - activateRebootInsert template for QuarantineFile() - quarantining fileInsert template for BC_QrFile() - quarantining file via BootCleanerInsert template for DeleteFile() - deleting fileInsert template for DelCLSID() - deleting CLSID item from registryAdditional operations:Performance tweaking: disable service TermService (@%SystemRoot%\System32\termsrv.dll,-268)Performance tweaking: disable service SSDPSRV (@%systemroot%\system32\ssdpsrv.dll,-100)Performance tweaking: disable service Schedule (@%SystemRoot%\system32\schedsvc.dll,-100)Security tweaking: disable CD autorunSecurity tweaking: disable administrative sharesSecurity tweaking: disable anonymous user accessSecurity: prevent terminal connections to the PCSecurity: disable sending Remote Assistant queries--------------------------------------------------------------------------------
File list
da Pct » sab mag 29, 2010 4:49 pm ![[:)]](http://www.megalab.it/forum/images/smilies/smile.gif "Smile")
.
![[boh]](http://www.megalab.it/forum/images/smilies/dntknw.gif "Boh")
non capisco... perché è così difficile mettere il pc apposto!!! ![[cry]](http://www.megalab.it/forum/images/smilies/crying.gif "Mi metto a piangere...")
Esegui ![[:-H]](http://www.megalab.it/forum/images/smilies/arrossire.gif "Arrossisco")