Results of system analysis

AVZ 4.30 http://z-oleg.com/secur/avz/

List of processes

File namePIDDescriptionCopyrightMD5Information
e:\windows\system32\winlogon.exe
Script: Quarantine, Delete, BC delete, Terminate		832Windows NT Logon Application© Microsoft Corporation. All rights reserved.??496.00 kb, rsAh,
created: 2/28/2006 5:00:00 AM,
modified: 4/13/2008 5:12:39 PM
Command line:
winlogon.exe
Detected:11, recognized as trusted 11
Module nameHandleDescriptionCopyrightMD5Used by processes
E:\WINDOWS\system32\WgaLogon.dll
Script: Quarantine, Delete, BC delete		19726336Windows Genuine Advantage Notification© 1995-2006 Microsoft Corporation--832
Modules detected:141, recognized as trusted 140

Kernel Space Modules Viewer

ModuleBase addressSize in memoryDescriptionManufacturer
E:\WINDOWS\System32\Drivers\dump_atapi.sys
Script: Quarantine, Delete, BC delete		B7AAD000018000 (98304)
E:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Script: Quarantine, Delete, BC delete		F79B1000002000 (8192)
E:\WINDOWS\system32\SE4BLPT.SYS
Script: Quarantine, Delete, BC delete		B6E3D000009000 (36864)IEEE 1284 DriverCopyright (C) Sharp Corp.1997-1999
E:\WINDOWS\system32\DRIVERS\tm_mbd_c.sys
Script: Quarantine, Delete, BC delete		B653B00001E000 (122880)Trend Micro Malicious Behavior Detector (i386-fre)Copyright (C) 2001-2006 Trend Micro Inc. All rights reserved.
Modules detected - 135, recognized as trusted - 131

Services

ServiceDescriptionStatusFileGroupDependencies
PcCtlCom
Service: Stop, Delete, Disable		Trend Micro Central Control ComponentNot startedE:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
Script: Quarantine, Delete, BC delete		 RPCSS
PcScnSrv
Service: Stop, Delete, Disable		Trend Micro Protection Against Spyware Not startedE:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
Script: Quarantine, Delete, BC delete		 RPCSS
Tmntsrv
Service: Stop, Delete, Disable		Trend Micro Real-time ServiceNot startedE:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
Script: Quarantine, Delete, BC delete		  
TmPfw
Service: Stop, Delete, Disable		Trend Micro Personal FirewallNot startedE:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
Script: Quarantine, Delete, BC delete		 tmcfw
tmproxy
Service: Stop, Delete, Disable		Trend Micro Proxy ServiceNot startedE:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
Script: Quarantine, Delete, BC delete		 tmtdi
Detected - 96, recognized as trusted - 91

Drivers

ServiceDescriptionStatusFileGroupDependencies
SE4BLPT
Driver: Unload, Delete, Disable		SE4BLPTRunningE:\WINDOWS\system32\SE4BLPT.SYS
Script: Quarantine, Delete, BC delete		  
tmmbd
Driver: Unload, Delete, Disable		Trend Micro MBD DriverRunningE:\WINDOWS\system32\DRIVERS\tm_mbd_c.sys
Script: Quarantine, Delete, BC delete		  
Abiosdsk
Driver: Unload, Delete, Disable		AbiosdskNot startedAbiosdsk.sys
Script: Quarantine, Delete, BC delete		Primary disk 
abp480n5
Driver: Unload, Delete, Disable		abp480n5Not startedabp480n5.sys
Script: Quarantine, Delete, BC delete		SCSI miniport 
adpu160m
Driver: Unload, Delete, Disable		adpu160mNot startedadpu160m.sys
Script: Quarantine, Delete, BC delete		SCSI miniport 
Aha154x
Driver: Unload, Delete, Disable		Aha154xNot startedAha154x.sys
Script: Quarantine, Delete, BC delete		SCSI miniport 
aic78u2
Driver: Unload, Delete, Disable		aic78u2Not startedaic78u2.sys
Script: Quarantine, Delete, BC delete		SCSI miniport 
aic78xx
Driver: Unload, Delete, Disable		aic78xxNot startedaic78xx.sys
Script: Quarantine, Delete, BC delete		SCSI miniport 
AliIde
Driver: Unload, Delete, Disable		AliIdeNot startedAliIde.sys
Script: Quarantine, Delete, BC delete		System Bus Extender 
amsint
Driver: Unload, Delete, Disable		amsintNot startedamsint.sys
Script: Quarantine, Delete, BC delete		SCSI miniport 
asc
Driver: Unload, Delete, Disable		ascNot startedasc.sys
Script: Quarantine, Delete, BC delete		SCSI miniport 
asc3350p
Driver: Unload, Delete, Disable		asc3350pNot startedasc3350p.sys
Script: Quarantine, Delete, BC delete		SCSI miniport 
asc3550
Driver: Unload, Delete, Disable		asc3550Not startedasc3550.sys
Script: Quarantine, Delete, BC delete		SCSI miniport 
Atdisk
Driver: Unload, Delete, Disable		AtdiskNot startedAtdisk.sys
Script: Quarantine, Delete, BC delete		Primary disk 
cd20xrnt
Driver: Unload, Delete, Disable		cd20xrntNot startedcd20xrnt.sys
Script: Quarantine, Delete, BC delete		SCSI miniport 
Changer
Driver: Unload, Delete, Disable		ChangerNot startedChanger.sys
Script: Quarantine, Delete, BC delete		Filter 
CmdIde
Driver: Unload, Delete, Disable		CmdIdeNot startedCmdIde.sys
Script: Quarantine, Delete, BC delete		System Bus Extender 
Cpqarray
Driver: Unload, Delete, Disable		CpqarrayNot startedCpqarray.sys
Script: Quarantine, Delete, BC delete		SCSI miniport 
dac960nt
Driver: Unload, Delete, Disable		dac960ntNot starteddac960nt.sys
Script: Quarantine, Delete, BC delete		SCSI miniport 
dpti2o
Driver: Unload, Delete, Disable		dpti2oNot starteddpti2o.sys
Script: Quarantine, Delete, BC delete		SCSI miniport 
hpn
Driver: Unload, Delete, Disable		hpnNot startedhpn.sys
Script: Quarantine, Delete, BC delete		SCSI miniport 
hpt3xx
Driver: Unload, Delete, Disable		hpt3xxNot startedhpt3xx.sys
Script: Quarantine, Delete, BC delete		SCSI miniport 
i2omgmt
Driver: Unload, Delete, Disable		i2omgmtNot startedi2omgmt.sys
Script: Quarantine, Delete, BC delete		SCSI Class 
i2omp
Driver: Unload, Delete, Disable		i2ompNot startedi2omp.sys
Script: Quarantine, Delete, BC delete		SCSI miniport 
ini910u
Driver: Unload, Delete, Disable		ini910uNot startedini910u.sys
Script: Quarantine, Delete, BC delete		SCSI miniport 
IntelIde
Driver: Unload, Delete, Disable		IntelIdeNot startedIntelIde.sys
Script: Quarantine, Delete, BC delete		System Bus Extender 
lbrtfdc
Driver: Unload, Delete, Disable		lbrtfdcNot startedlbrtfdc.sys
Script: Quarantine, Delete, BC delete		System Bus Extender 
mraid35x
Driver: Unload, Delete, Disable		mraid35xNot startedmraid35x.sys
Script: Quarantine, Delete, BC delete		SCSI miniport 
PCIDump
Driver: Unload, Delete, Disable		PCIDumpNot startedPCIDump.sys
Script: Quarantine, Delete, BC delete		PCI Configuration 
PDCOMP
Driver: Unload, Delete, Disable		PDCOMPNot startedPDCOMP.sys
Script: Quarantine, Delete, BC delete		  
PDFRAME
Driver: Unload, Delete, Disable		PDFRAMENot startedPDFRAME.sys
Script: Quarantine, Delete, BC delete		  
PDRELI
Driver: Unload, Delete, Disable		PDRELINot startedPDRELI.sys
Script: Quarantine, Delete, BC delete		  
PDRFRAME
Driver: Unload, Delete, Disable		PDRFRAMENot startedPDRFRAME.sys
Script: Quarantine, Delete, BC delete		  
perc2
Driver: Unload, Delete, Disable		perc2Not startedperc2.sys
Script: Quarantine, Delete, BC delete		SCSI miniport 
perc2hib
Driver: Unload, Delete, Disable		perc2hibNot startedperc2hib.sys
Script: Quarantine, Delete, BC delete		Filter 
ql1080
Driver: Unload, Delete, Disable		ql1080Not startedql1080.sys
Script: Quarantine, Delete, BC delete		SCSI miniport 
Ql10wnt
Driver: Unload, Delete, Disable		Ql10wntNot startedQl10wnt.sys
Script: Quarantine, Delete, BC delete		SCSI miniport 
ql12160
Driver: Unload, Delete, Disable		ql12160Not startedql12160.sys
Script: Quarantine, Delete, BC delete		SCSI miniport 
ql1240
Driver: Unload, Delete, Disable		ql1240Not startedql1240.sys
Script: Quarantine, Delete, BC delete		SCSI miniport 
ql1280
Driver: Unload, Delete, Disable		ql1280Not startedql1280.sys
Script: Quarantine, Delete, BC delete		SCSI miniport 
Simbad
Driver: Unload, Delete, Disable		SimbadNot startedSimbad.sys
Script: Quarantine, Delete, BC delete		Filter 
Sparrow
Driver: Unload, Delete, Disable		SparrowNot startedSparrow.sys
Script: Quarantine, Delete, BC delete		SCSI miniport 
sym_hi
Driver: Unload, Delete, Disable		sym_hiNot startedsym_hi.sys
Script: Quarantine, Delete, BC delete		SCSI miniport 
sym_u3
Driver: Unload, Delete, Disable		sym_u3Not startedsym_u3.sys
Script: Quarantine, Delete, BC delete		SCSI miniport 
symc810
Driver: Unload, Delete, Disable		symc810Not startedsymc810.sys
Script: Quarantine, Delete, BC delete		SCSI miniport 
symc8xx
Driver: Unload, Delete, Disable		symc8xxNot startedsymc8xx.sys
Script: Quarantine, Delete, BC delete		SCSI miniport 
TosIde
Driver: Unload, Delete, Disable		TosIdeNot startedTosIde.sys
Script: Quarantine, Delete, BC delete		System Bus Extender 
ultra
Driver: Unload, Delete, Disable		ultraNot startedultra.sys
Script: Quarantine, Delete, BC delete		SCSI miniport 
ViaIde
Driver: Unload, Delete, Disable		ViaIdeNot startedViaIde.sys
Script: Quarantine, Delete, BC delete		System Bus Extender 
WDICA
Driver: Unload, Delete, Disable		WDICANot startedWDICA.sys
Script: Quarantine, Delete, BC delete		  
Detected - 197, recognized as trusted - 147

Autoruns

File nameStatusStartup methodDescription
WgaLogon.dll
Script: Quarantine, Delete, BC delete		ActiveRegistry keyHKEY_LOCAL_MACHINE, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon, DLLName
Autoruns items detected - 61, recognized as trusted - 60

Internet Explorer extension modules (BHOs, Toolbars ...)

File nameTypeDescriptionManufacturerCLSID
E:\Program Files\Yahoo!\Messenger\yhexbmes.dll
Script: Quarantine, Delete, BC delete		Extension moduleYhExBMesCopyright © Yahoo! Inc. 2002{4528BBE0-4E08-11D5-AD55-00010333D0AD}
Delete
E:\Program Files\Yahoo!\Messenger\yhexbmes.dll
Script: Quarantine, Delete, BC delete		Extension moduleYhExBMesCopyright © Yahoo! Inc. 2002{92780B25-18CC-41C8-B9BE-3C9C571A8263}
Delete
Elements detected - 6, recognized as trusted - 4

Windows Explorer extension modules

File nameDestinationDescriptionManufacturerCLSID
deskpan.dll
Script: Quarantine, Delete, BC delete		Display Panning CPL Extension{42071714-76d4-11d1-8b24-00a0c9068ff3}
Shell extensions for file compression{764BF0E1-F219-11ce-972D-00AA00A14F56}
Encryption Context Menu{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}
Taskbar and Start Menu{0DF44EAA-FF21-4412-828E-260A8728E7F1}
Media Band{32683183-48a0-441b-a342-7c2a440a9478}
User Accounts{7A9D77BD-5403-11d2-8785-2E0420524153}
E:\Program Files\Trend Micro\Internet Security 2007\VBProp.dll
Script: Quarantine, Delete, BC delete		VBPropSheetVBProp ModuleCopyright (C) 1995-2006 Trend Micro Incorporated. All rights reserved.{771A9DA0-731A-11CE-993C-00AA004ADB6C}
E:\Program Files\Trend Micro\Internet Security 2007\Tmdshell.dll
Script: Quarantine, Delete, BC delete		TMD Shell ExtensionTmdshell ModuleCopyright (C) 1995-2006 Trend Micro Incorporated. All rights reserved.{48F45200-91E6-11CE-8A4F-0080C81A28D4}
rundll32.exe E:\WINDOWS\system32\shimgvw.dll,ImageView_COMServer {00E7B358-F65B-4dcf-83DF-CD026B94BFD4}
Script: Quarantine, Delete, BC delete		Autoplay for SlideShow{00E7B358-F65B-4dcf-83DF-CD026B94BFD4}
Elements detected - 193, recognized as trusted - 184

Printing system extensions (print monitors, providers)

File nameTypeNameDescriptionManufacturer
E:\WINDOWS\system32\SE4BLMON.DLL
Script: Quarantine, Delete, BC delete		MonitorSHARP AR-M162/M207 Language MonitorSharp Printer DriverCopyright Sharp Corporation 2001-2004
Elements detected - 12, recognized as trusted - 11

Task Scheduler jobs

File nameJob nameJob statusDescriptionManufacturer
Elements detected - 0, recognized as trusted - 0

SPI/LSP settings

Namespace providers (NSP)
ManufacturerStatusEXE fileDescriptionGUID
Detected - 3, recognized as trusted - 3
Transport protocol providers (TSP, LSP)
ManufacturerEXE fileDescription
Detected - 17, recognized as trusted - 17
Results of automatic SPI settings check 
LSP settings checked. No errors detected

TCP/UDP ports

PortStatusRemote HostRemote PortApplicationNotes
TCP ports
135LISTENING0.0.0.06243[1188] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
139LISTENING0.0.0.051394[4] System
Script: Quarantine, Delete, BC delete, Terminate		 
445LISTENING0.0.0.016535[4] System
Script: Quarantine, Delete, BC delete, Terminate		 
1032CLOSE_WAIT89.108.66.15680[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1036CLOSE_WAIT209.131.36.15880[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1039CLOSE_WAIT98.137.88.3580[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1042CLOSE_WAIT98.137.88.3580[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1047CLOSE_WAIT128.241.218.980[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1048CLOSE_WAIT128.241.218.980[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1051CLOSE_WAIT128.241.218.980[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1056CLOSE_WAIT98.137.88.3580[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1057CLOSE_WAIT216.252.124.3080[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1060CLOSE_WAIT209.131.36.15880[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1063CLOSE_WAIT209.131.36.15880[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1066CLOSE_WAIT209.131.36.15880[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1070CLOSE_WAIT209.131.36.15880[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1073CLOSE_WAIT128.241.218.5980[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1076CLOSE_WAIT128.241.218.5980[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1079CLOSE_WAIT70.86.6.24480[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1516LISTENING0.0.0.02064[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1516CLOSE_WAIT127.0.0.11031[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1516CLOSE_WAIT127.0.0.11035[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1516CLOSE_WAIT127.0.0.11038[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1516CLOSE_WAIT127.0.0.11041[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1516CLOSE_WAIT127.0.0.11044[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1516CLOSE_WAIT127.0.0.11046[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1516CLOSE_WAIT127.0.0.11050[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1516CLOSE_WAIT127.0.0.11053[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1516CLOSE_WAIT127.0.0.11055[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1516CLOSE_WAIT127.0.0.11059[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1516CLOSE_WAIT127.0.0.11062[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1516CLOSE_WAIT127.0.0.11065[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1516CLOSE_WAIT127.0.0.11069[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1516CLOSE_WAIT127.0.0.11072[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1516CLOSE_WAIT127.0.0.11075[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
1516CLOSE_WAIT127.0.0.11078[1084] e:\windows\system32\svchost.exe
Script: Quarantine, Delete, BC delete, Terminate		 
UDP ports
137LISTENING----[4] System
Script: Quarantine, Delete, BC delete, Terminate		 
138LISTENING----[4] System
Script: Quarantine, Delete, BC delete, Terminate		 
445LISTENING----[4] System
Script: Quarantine, Delete, BC delete, Terminate		 

Downloaded Program Files (DPF)

File nameDescriptionManufacturerCLSIDSource URL
E:\PROGRA~1\MICROS~2\OFFICE11\IEAWSDC.DLL
Script: Quarantine, Delete, BC delete		{02BCC737-B171-4746-94C9-0D8A0B2C0089}
Delete		http://office.microsoft.com/templates/ieawsdc.cab
E:\WINDOWS\DOWNLO~1\xscan60.ocx
Script: Quarantine, Delete, BC delete		xscan OLE Control ModuleCopyright (C) 1989-2005 Trend Micro Incorporated. All rights reserved.{04E214E5-63AF-4236-83C6-A7ADCBF9BD02}
Delete		http://housecall60.trendmicro.com/housecall/xscan60.cab
E:\Program Files\HP\Common\HPDeviceDetection.dll
Script: Quarantine, Delete, BC delete		HPDeviceDetection Library(c)Hewlett-Packard. All rights reserved.{6B75345B-AA36-438A-BBE6-4078B4C6984D}
Delete		http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
{9F1C11AA-197B-4942-BA54-47A8489BB47F}
Delete		http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38001.5912037037
{A17E30C4-A9BA-11D4-8673-60DB54C10000}
Delete		http://download.yahoo.com/dl/installs/ymail/ymmapi.dll
E:\WINDOWS\Downloaded Program Files\cpcScan.dll
Script: Quarantine, Delete, BC delete		BIOS ScannerCrucial Technology, Inc. All rights reserved.{A90A5822-F108-45AD-8482-9BC8B12DD539}
Delete		http://www.crucial.com/controls/cpcScanner.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000}
Delete		http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
{E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD}
Delete		http://download.abacast.com/download/files/abasetup132.cab
Elements detected - 19, recognized as trusted - 11

Control Panel Applets (CPL)

File nameDescriptionManufacturer
E:\WINDOWS\system32\PccWSC32.cpl
Script: Quarantine, Delete, BC delete		PCCWSCCopyright (C) 1995-2006 Trend Micro Incorporated. All rights reserved.
Elements detected - 26, recognized as trusted - 25

Active Setup

File nameDescriptionManufacturerCLSID
Elements detected - 14, recognized as trusted - 14

HOSTS file

Hosts file record 


127.0.0.1       localhost

Protocols and handlers

File nameTypeDescriptionManufacturerCLSID
mscoree.dll
Script: Quarantine, Delete, BC delete		ProtocolMicrosoft .NET Runtime Execution Engine ()© Microsoft Corporation. All rights reserved.{1E66F26B-79EE-11D2-8710-00C04F79ED0D}
mscoree.dll
Script: Quarantine, Delete, BC delete		ProtocolMicrosoft .NET Runtime Execution Engine ()© Microsoft Corporation. All rights reserved.{1E66F26B-79EE-11D2-8710-00C04F79ED0D}
mscoree.dll
Script: Quarantine, Delete, BC delete		ProtocolMicrosoft .NET Runtime Execution Engine ()© Microsoft Corporation. All rights reserved.{1E66F26B-79EE-11D2-8710-00C04F79ED0D}
E:\Program Files\Sharp\Sharpdesk\ExplorerExtensions.dll
Script: Quarantine, Delete, BC delete		HandlerExplorerExtensions Module (SharpDesk Thumbnail Extractor Protocol)Copyright (C) 2000-2004{79E0F14C-9C52-4218-89A7-7C4B0563D121}
Elements detected - 35, recognized as trusted - 31

Suspicious objects

FileDescriptionType
E:\WINDOWS\system32\Drivers\IPVNMon.sys
Script: Quarantine, Delete, BC delete		Suspicion for RootkitKernel-mode hook 

AVZ Antiviral Toolkit log; AVZ version is 4.30
Scanning started at 4/24/2009 1:29:37 PM
Database loaded: signatures - 219995, NN profile(s) - 2, microprograms of healing - 56, signature database released 22.04.2009 21:39
Heuristic microprograms loaded: 372
SPV microprograms loaded: 9
Digital signatures of system files loaded: 108883
Heuristic analyzer mode: Medium heuristics level
Healing mode: enabled
Windows version: 5.1.2600, Service Pack 3 ; AVZ is launched with administrator rights
System Restore: enabled
1. Searching for Rootkits and programs intercepting API functions
1.1 Searching for user-mode API hooks
 Analysis: kernel32.dll, export table found in section .text
 Analysis: ntdll.dll, export table found in section .text
 Analysis: user32.dll, export table found in section .text
 Analysis: advapi32.dll, export table found in section .text
 Analysis: ws2_32.dll, export table found in section .text
 Analysis: wininet.dll, export table found in section .text
 Analysis: rasapi32.dll, export table found in section .text
 Analysis: urlmon.dll, export table found in section .text
 Analysis: netapi32.dll, export table found in section .text
1.2 Searching for kernel-mode API hooks
 Driver loaded successfully
 SDT found (RVA=083220)
 Kernel ntoskrnl.exe found in memory at address 804D7000
   SDT = 8055A220
   KiST = 804E26A8 (284)
Function NtDeviceIoControlFile (42) intercepted (8058EFB9->BAFD7803), hook E:\WINDOWS\system32\Drivers\IPVNMon.sys, driver recognized as trusted
>>> Function restored successfully !
>>> Hook code blocked
Function NtEnumerateKey (47) - machine code modification Method of JmpTo. jmp E19A3E1C
>>> Function restored successfully !
Function NtFlushInstructionCache (4E) - machine code modification Method of JmpTo. jmp E19A3EFC
>>> Function restored successfully !
Functions checked: 284, intercepted: 1, restored: 3
1.3 Checking IDT and SYSENTER
 Analysis for CPU 1
 Checking IDT and SYSENTER - complete
1.4 Searching for masking processes and drivers
 Checking not performed: extended monitoring driver (AVZPM) is not installed
 Driver loaded successfully
1.5 Checking of IRP handlers
 Checking - complete
2. Scanning memory
 Number of processes found: 11
 Number of modules loaded: 139
Scanning memory - complete
3. Scanning disks
4. Checking  Winsock Layered Service Provider (SPI/LSP)
 LSP settings checked. No errors detected
5. Searching for keyboard/mouse/windows events hooks (Keyloggers, Trojan DLLs)
6. Searching for opened TCP/UDP ports used by malicious programs
 Checking disabled by user
7. Heuristic system check
Checking - complete
8. Searching for vulnerabilities
>> Security: disk drives' autorun is enabled
>> Security: administrative shares (C$, D$ ...) are enabled
>> Security: anonymous user access is enabled
Checking - complete
9. Troubleshooting wizard
 >>  HDD autorun are allowed
 >>  Autorun from network drives are allowed
 >>  Removable media autorun are allowed
Checking - complete
Files scanned: 119560, extracted from archives: 92067, malicious software found 0, suspicions - 0
Scanning finished at 4/24/2009 1:50:40 PM
!!! Attention !!! Recovered 3 KiST functions during Anti-Rootkit operation
This may affect execution of several programs, so it is strongly recommended to reboot
Time of scanning: 00:21:06
If you have a suspicion on presence of viruses or questions on the suspected objects,
you can address http://virusinfo.info conference
Creating archive of files from Quarantine
Creating archive of files from Quarantine - complete
System Analysis in progress


Script commands
 

Add commands to script:
Additional operations:

File list