Results of system analysis

LSP settings checked. No errors detected

127.0.0.1       localhost

::1             localhost

AVZ Antiviral Toolkit log; AVZ version is 4.30
Scanning started at 7/23/2008 7:40:13 PM
Database loaded: signatures - 177692, NN profile(s) - 2, microprograms of healing - 56, signature database released 23.07.2008 22:19
Heuristic microprograms loaded: 370
SPV microprograms loaded: 9
Digital signatures of system files loaded: 71511
Heuristic analyzer mode: Maximum heuristics level
Healing mode: enabled
Windows version: 6.0.6000,  ; AVZ is launched with administrator rights
System Restore: enabled
1. Searching for Rootkits and programs intercepting API functions
1.1 Searching for user-mode API hooks
 Analysis: kernel32.dll, export table found in section .text
 Analysis: ntdll.dll, export table found in section .text
 Analysis: user32.dll, export table found in section .text
 Analysis: advapi32.dll, export table found in section .text
 Analysis: ws2_32.dll, export table found in section .text
 Analysis: wininet.dll, export table found in section .text
 Analysis: rasapi32.dll, export table found in section .text
 Analysis: urlmon.dll, export table found in section .text
 Analysis: netapi32.dll, export table found in section .text
1.2 Searching for kernel-mode API hooks
 Error loading driver - checking interrupted [C0000061]
1.4 Searching for masking processes and drivers
 Checking not performed: extended monitoring driver (AVZPM) is not installed
 Error loading driver - checking interrupted [C0000061]
2. Scanning memory
 Number of processes found: 31
Analyzer: process under analysis is 3200 F:\Programs\PowerISO\PWRISOVM.EXE
[ES]:Application has no visible windows
[ES]:Registered in autoruns !!
Analyzer: process under analysis is 3220 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
[ES]:Contains network functionality
[ES]:Application has no visible windows
[ES]:Registered in autoruns !!
Analyzer: process under analysis is 3504 C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
[ES]:Contains network functionality
[ES]:Application has no visible windows
Analyzer: process under analysis is 3528 C:\Program Files\iTunes\iTunesHelper.exe
[ES]:Contains network functionality
[ES]:Application has no visible windows
[ES]:Registered in autoruns !!
Analyzer: process under analysis is 3616 C:\Program Files\AIM6\aim6.exe
[ES]:Contains network functionality
[ES]:Application has no visible windows
[ES]:Registered in autoruns !!
[ES]:Loads RASAPI DLL - may use dialing ?
Analyzer: process under analysis is 3640 C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
[ES]:Contains network functionality
[ES]:Application has no visible windows
[ES]:Registered in autoruns !!
Analyzer: process under analysis is 3704 C:\Program Files\WinZip\WZQKPICK.EXE
[ES]:Application has no visible windows
[ES]:Registered in autoruns !!
Analyzer: process under analysis is 2344 C:\Program Files\Common Files\AOL\1158549145\ee\aolsoftware.exe
[ES]:Contains network functionality
[ES]:Application has no visible windows
[ES]:Loads RASAPI DLL - may use dialing ?
Analyzer: process under analysis is 3936 C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
[ES]:Application has no visible windows
Analyzer: process under analysis is 3048 C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
[ES]:Contains network functionality
[ES]:Application has no visible windows
Analyzer: process under analysis is 4184 C:\Program Files\AIM6\aolsoftware.exe
[ES]:Contains network functionality
[ES]:Application has no visible windows
[ES]:Loads RASAPI DLL - may use dialing ?
Analyzer: process under analysis is 1360 C:\Program Files\AIM6\anotify.exe
[ES]:Contains network functionality
[ES]:Loads RASAPI DLL - may use dialing ?
 Number of modules loaded: 385
Scanning memory - complete
3. Scanning disks
C:\327882R2FWJFW\nircmd.com - PE file with modified extension, allowing its launch (often typical for viruses)(dangerousness level is 35%)
File quarantined succesfully (C:\327882R2FWJFW\nircmd.com)
C:\Program Files\DivX\DivX Converter\dpil100.dll >>> suspicion for AdvWare.Win32.NewWeb.i ( 00707F72 00000000 001AEEF2 001AFFE8 61440)
File quarantined succesfully (C:\Program Files\DivX\DivX Converter\dpil100.dll)
C:\Program Files\GlobalSCAPE\CuteFTP 8 Professional\CUTEFTPPRO.BAK - PE file with non-standard extension(dangerousness level is 5%)
File quarantined succesfully (C:\Program Files\GlobalSCAPE\CuteFTP 8 Professional\CUTEFTPPRO.BAK)
C:\Program Files\GlobalSCAPE\CuteFTP 8 Professional\cuteftppro.exe.BAK - PE file with non-standard extension(dangerousness level is 5%)
File quarantined succesfully (C:\Program Files\GlobalSCAPE\CuteFTP 8 Professional\cuteftppro.exe.BAK)
C:\Program Files\GlobalSCAPE\CuteFTP 8 Professional\ftpte.exe.bak - PE file with non-standard extension(dangerousness level is 5%)
File quarantined succesfully (C:\Program Files\GlobalSCAPE\CuteFTP 8 Professional\ftpte.exe.bak)
File quarantined succesfully (C:\Program Files\Morpheus\morpheustoolbar.exe)
>>>To delete the file C:\Program Files\Morpheus\morpheustoolbar.exe reboot is required
C:\Program Files\Morpheus\morpheustoolbar.exe >>>>> AdvWare.Win32.MyWebSearch  error deleting 
C:\Program Files\MSI\Live Update 2\msi.files\FreeDOS\COMMAND.COM - PE file with modified extension, allowing its launch (often typical for viruses)(dangerousness level is 35%)
File quarantined succesfully (C:\Program Files\MSI\Live Update 2\msi.files\FreeDOS\COMMAND.COM)
C:\Users\Jordan\AppData\Local\VirtualStore\Program Files\GlobalSCAPE\CuteFTP 8 Professional\CUTEFTPPRO.BAK - PE file with non-standard extension(dangerousness level is 5%)
File quarantined succesfully (C:\Users\Jordan\AppData\Local\VirtualStore\Program Files\GlobalSCAPE\CuteFTP 8 Professional\CUTEFTPPRO.BAK)
C:\Users\Jordan\AppData\Local\VirtualStore\Program Files\GlobalSCAPE\CuteFTP 8 Professional\cuteftppro.exe.BAK - PE file with non-standard extension(dangerousness level is 5%)
File quarantined succesfully (C:\Users\Jordan\AppData\Local\VirtualStore\Program Files\GlobalSCAPE\CuteFTP 8 Professional\cuteftppro.exe.BAK)
C:\Users\Jordan\AppData\Local\VirtualStore\Program Files\GlobalSCAPE\CuteFTP 8 Professional\ftpte.exe.bak - PE file with non-standard extension(dangerousness level is 5%)
File quarantined succesfully (C:\Users\Jordan\AppData\Local\VirtualStore\Program Files\GlobalSCAPE\CuteFTP 8 Professional\ftpte.exe.bak)
C:\Users\Jordan\AppData\Roaming\Azureus\plugins\azemp\azmplay.exe.bak - PE file with non-standard extension(dangerousness level is 5%)
File quarantined succesfully (C:\Users\Jordan\AppData\Roaming\Azureus\plugins\azemp\azmplay.exe.bak)
C:\Users\Jordan\Desktop\Download_mbam-setup.exe >>> suspicion for Downloader.Win32.WinFixer.fs ( 00642D0A 0A48F021 001A73AC 002536FE 128368)
File quarantined succesfully (C:\Users\Jordan\Desktop\Download_mbam-setup.exe)
C:\Windows\Installer\{CCBAA1F7-E5E1-48B2-9ED9-A79C6A37CE78}\Icon3E5562ED8.html - PE file with non-standard extension(dangerousness level is 5%)
File quarantined succesfully (C:\Windows\Installer\{CCBAA1F7-E5E1-48B2-9ED9-A79C6A37CE78}\Icon3E5562ED8.html)
Removing traces of deleted files...
4. Checking  Winsock Layered Service Provider (SPI/LSP)
 LSP settings checked. No errors detected
5. Searching for keyboard/mouse/windows events hooks (Keyloggers, Trojan DLLs)
C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll --> Suspicion for Keylogger or Trojan DLL
C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll>>> Behavioural analysis 
 Behaviour typical for keyloggers not detected
File quarantined succesfully (C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll)
C:\Program Files\Microsoft Office\Office12\GrooveUtil.DLL --> Suspicion for Keylogger or Trojan DLL
C:\Program Files\Microsoft Office\Office12\GrooveUtil.DLL>>> Behavioural analysis 
 Behaviour typical for keyloggers not detected
File quarantined succesfully (C:\Program Files\Microsoft Office\Office12\GrooveUtil.DLL)
C:\Program Files\Microsoft Office\Office12\GrooveNew.DLL --> Suspicion for Keylogger or Trojan DLL
C:\Program Files\Microsoft Office\Office12\GrooveNew.DLL>>> Behavioural analysis 
 Behaviour typical for keyloggers not detected
File quarantined succesfully (C:\Program Files\Microsoft Office\Office12\GrooveNew.DLL)
C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll --> Suspicion for Keylogger or Trojan DLL
C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll>>> Behavioural analysis 
 Behaviour typical for keyloggers not detected
File quarantined succesfully (C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll)
C:\Program Files\Common Files\Symantec Shared\ccL70U.dll --> Suspicion for Keylogger or Trojan DLL
C:\Program Files\Common Files\Symantec Shared\ccL70U.dll>>> Behavioural analysis 
 Behaviour typical for keyloggers not detected
File quarantined succesfully (C:\Program Files\Common Files\Symantec Shared\ccL70U.dll)
C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll --> Suspicion for Keylogger or Trojan DLL
C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll>>> Behavioural analysis 
 Behaviour typical for keyloggers not detected
File quarantined succesfully (C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll)
C:\Program Files\Common Files\Symantec Shared\ccSet.dll --> Suspicion for Keylogger or Trojan DLL
C:\Program Files\Common Files\Symantec Shared\ccSet.dll>>> Behavioural analysis 
 Behaviour typical for keyloggers not detected
File quarantined succesfully (C:\Program Files\Common Files\Symantec Shared\ccSet.dll)
C:\Program Files\Common Files\Symantec Shared\ccIPC.dll --> Suspicion for Keylogger or Trojan DLL
C:\Program Files\Common Files\Symantec Shared\ccIPC.dll>>> Behavioural analysis 
 Behaviour typical for keyloggers not detected
File quarantined succesfully (C:\Program Files\Common Files\Symantec Shared\ccIPC.dll)
C:\Program Files\Common Files\Symantec Shared\AppCore\AppMgr32.dll --> Suspicion for Keylogger or Trojan DLL
C:\Program Files\Common Files\Symantec Shared\AppCore\AppMgr32.dll>>> Behavioural analysis 
 Behaviour typical for keyloggers not detected
File quarantined succesfully (C:\Program Files\Common Files\Symantec Shared\AppCore\AppMgr32.dll)
Note: Do NOT delete suspicious files, send them for analysis  (see FAQ for more details),  because there are lots of useful hooking DLLs
6. Searching for opened TCP/UDP ports used by malicious programs
 Checking disabled by user
7. Heuristic system check
Checking - complete
8. Searching for vulnerabilities
>> Security: disk drives' autorun is enabled
>> Security: administrative shares (C$, D$ ...) are enabled
>> Security: anonymous user access is enabled
>> Security: sending Remote Assistant queries is enabled
Checking - complete
9. Troubleshooting wizard
 >>  Abnormal SCR files association
 >>  Abnormal REG files association
 >>  HDD autorun are allowed
 >>  Autorun from network drives are allowed
 >>  Removable media autorun are allowed
Checking - complete
Files scanned: 100513, extracted from archives: 63557, malicious software found 1, suspicions - 2
Scanning finished at 7/23/2008 7:53:49 PM
Attention !!! Reboot is required to complete healing 
Time of scanning: 00:13:37
If you have a suspicion on presence of viruses or questions on the suspected objects,
you can address http://virusinfo.info conference
Creating archive of files from Quarantine
Creating archive of files from Quarantine - complete
System Analysis in progress


Script commands
 
Add commands to script:
Blocking hooks using Anti-Rootkit
Enable AVZGuard
BootCleaner - import list of deleted files
Registry cleanup after deleting files
BootCleaner - activate
Reboot
Insert template for QuarantineFile() - quarantining file
Insert template for BC_QrFile() - quarantining file via BootCleaner
Insert template for DeleteFile() - deleting file
Insert template for DelCLSID() - deleting CLSID item from registry
Additional operations:
Security tweaking: disable CD autorun
Security tweaking: disable administrative shares
Security tweaking: disable anonymous user access
Security: disable sending Remote Assistant queries

File list