AVZ 4.32 http://z-oleg.com/secur/avz/
| File name | PID | Description | Copyright | MD5 | Information
| c:\program files\common files\lightscribe\lightscribecontrolpanel.exe | Script: Quarantine, Delete, Delete via BC, Terminate 2272 | | © Copyright 2003-2006 Hewlett-Packard Development Company, LP | ?? | 2308.00 kb, rsAh, | created: 10/22/2008 7:57:34 PM, modified: 10/22/2008 7:57:34 PM Command line: "C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" -hidden c:\windows\system32\lxrsii1s.exe | Script: Quarantine, Delete, Delete via BC, Terminate 336 | | | ?? | 52.00 kb, rsAh, | created: 4/5/2008 11:35:33 PM, modified: 5/19/2005 1:48:34 PM Command line: LxrSII1s.exe c:\windows\system32\spoolsv.exe | Script: Quarantine, Delete, Delete via BC, Terminate 1664 | Spooler SubSystem App | © Microsoft Corporation. All rights reserved. | ?? | 56.50 kb, rsah, | created: 8/3/2004 10:56:58 PM, modified: 6/10/2005 4:53:32 PM Command line: C:\WINDOWS\system32\spoolsv.exe Detected:41, recognized as trusted 39
| | |||||
| Module name | Handle | Description | Copyright | MD5 | Used by processes
| C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe | Script: Quarantine, Delete, Delete via BC 4194304 | | © Copyright 2003-2006 Hewlett-Packard Development Company, LP | ?? | 2272
| C:\Program Files\Lexmark Fax Solutions\ipcmt.dll | Script: Quarantine, Delete, Delete via BC 14090240 | IPC Core Dll | Copyright (C) 2003 | -- | 1664
| C:\WINDOWS\system32\LXF3OEM.DLL | Script: Quarantine, Delete, Delete via BC 268435456 | Lexmark Fax Solutions Software | Copyright (C) 2004 | -- | 1664
| C:\WINDOWS\system32\LXF3PMON.DLL | Script: Quarantine, Delete, Delete via BC 1346371584 | Print Monitor (Win2k/WinXP) | | -- | 1664
| C:\WINDOWS\system32\LXF3PMRC.DLL | Script: Quarantine, Delete, Delete via BC 14155776 | | Copyright © 2003 | -- | 1664
| C:\WINDOWS\system32\LxrSII1s.exe | Script: Quarantine, Delete, Delete via BC 4194304 | | | ?? | 336
| Modules found:349, recognized as trusted 343
| | |||||
| Module | Base address | Size in memory | Description | Manufacturer
| C:\WINDOWS\System32\Drivers\dump_atapi.sys | Script: Quarantine, Delete, Delete via BC EF160000 | 018000 (98304) |
| C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS | Script: Quarantine, Delete, Delete via BC F7BEA000 | 002000 (8192) |
| C:\WINDOWS\system32\Drivers\LxrSII1d.sys | Script: Quarantine, Delete, Delete via BC BA388000 | 012000 (73728) |
| splk.sys | Script: Quarantine, Delete, Delete via BC F7485000 | 100000 (1048576) |
| Modules found - 132, recognized as trusted - 128
| | ||||||||
| Service | Description | Status | File | Group | Dependencies
| LxrSII1s | Service: Stop, Delete, Disable Lexar Secure II | Running | C:\WINDOWS\system32\LxrSII1s.exe | Script: Quarantine, Delete, Delete via BC |
| ALG | Service: Stop, Delete, Disable Application Layer Gateway Service | Not started | C:\WINDOWS\System32\alg.exe | Script: Quarantine, Delete, Delete via BC |
| LVSrvLauncher | Service: Stop, Delete, Disable LVSrvLauncher | Not started | C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe | Script: Quarantine, Delete, Delete via BC |
| rpcapd | Service: Stop, Delete, Disable Remote Packet Capture Protocol v.0 (experimental) | Not started | C:\Program Files\WinPcap\rpcapd.exe | Script: Quarantine, Delete, Delete via BC |
| StkASSrv | Service: Stop, Delete, Disable Syntek STK1160 Service | Not started | C:\WINDOWS\System32\StkASv2K.exe | Script: Quarantine, Delete, Delete via BC |
| Detected - 107, recognized as trusted - 102
| | ||||||
| Service | Description | Status | File | Group | Dependencies
| LxrSII1d | Driver: Unload, Delete, Disable Secure II Driver | Running | C:\WINDOWS\system32\Drivers\LxrSII1d.sys | Script: Quarantine, Delete, Delete via BC |
| sptd | Driver: Unload, Delete, Disable sptd | Running | C:\WINDOWS\System32\Drivers\sptd.sys | Script: Quarantine, Delete, Delete via BC Boot Bus Extender |
| Abiosdsk | Driver: Unload, Delete, Disable Abiosdsk | Not started | Abiosdsk.sys | Script: Quarantine, Delete, Delete via BC Primary disk |
| abp480n5 | Driver: Unload, Delete, Disable abp480n5 | Not started | abp480n5.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| adpu160m | Driver: Unload, Delete, Disable adpu160m | Not started | adpu160m.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| Aha154x | Driver: Unload, Delete, Disable Aha154x | Not started | Aha154x.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| aic78u2 | Driver: Unload, Delete, Disable aic78u2 | Not started | aic78u2.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| aic78xx | Driver: Unload, Delete, Disable aic78xx | Not started | aic78xx.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| AliIde | Driver: Unload, Delete, Disable AliIde | Not started | AliIde.sys | Script: Quarantine, Delete, Delete via BC System Bus Extender |
| amsint | Driver: Unload, Delete, Disable amsint | Not started | amsint.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| asc | Driver: Unload, Delete, Disable asc | Not started | asc.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| asc3350p | Driver: Unload, Delete, Disable asc3350p | Not started | asc3350p.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| asc3550 | Driver: Unload, Delete, Disable asc3550 | Not started | asc3550.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| Atdisk | Driver: Unload, Delete, Disable Atdisk | Not started | Atdisk.sys | Script: Quarantine, Delete, Delete via BC Primary disk |
| ATI Remote Wonder II | Driver: Unload, Delete, Disable ATI Remote Wonder II | Not started | C:\WINDOWS\system32\drivers\ATIRWVD.SYS | Script: Quarantine, Delete, Delete via BC |
| catchme | Driver: Unload, Delete, Disable catchme | Not started | C:\ComboFix\catchme.sys | Script: Quarantine, Delete, Delete via BC Base |
| cd20xrnt | Driver: Unload, Delete, Disable cd20xrnt | Not started | cd20xrnt.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| Changer | Driver: Unload, Delete, Disable Changer | Not started | Changer.sys | Script: Quarantine, Delete, Delete via BC Filter |
| CmdIde | Driver: Unload, Delete, Disable CmdIde | Not started | CmdIde.sys | Script: Quarantine, Delete, Delete via BC System Bus Extender |
| Cpqarray | Driver: Unload, Delete, Disable Cpqarray | Not started | Cpqarray.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| dac960nt | Driver: Unload, Delete, Disable dac960nt | Not started | dac960nt.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| dpti2o | Driver: Unload, Delete, Disable dpti2o | Not started | dpti2o.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| hpn | Driver: Unload, Delete, Disable hpn | Not started | hpn.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| i2omgmt | Driver: Unload, Delete, Disable i2omgmt | Not started | i2omgmt.sys | Script: Quarantine, Delete, Delete via BC SCSI Class |
| i2omp | Driver: Unload, Delete, Disable i2omp | Not started | i2omp.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| ini910u | Driver: Unload, Delete, Disable ini910u | Not started | ini910u.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| IntelIde | Driver: Unload, Delete, Disable IntelIde | Not started | IntelIde.sys | Script: Quarantine, Delete, Delete via BC System Bus Extender |
| lbrtfdc | Driver: Unload, Delete, Disable lbrtfdc | Not started | lbrtfdc.sys | Script: Quarantine, Delete, Delete via BC System Bus Extender |
| MCSTRM | Driver: Unload, Delete, Disable MCSTRM | Not started | MCSTRM.sys | Script: Quarantine, Delete, Delete via BC MCSTRM |
| mraid35x | Driver: Unload, Delete, Disable mraid35x | Not started | mraid35x.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| PCIDump | Driver: Unload, Delete, Disable PCIDump | Not started | PCIDump.sys | Script: Quarantine, Delete, Delete via BC PCI Configuration |
| PDCOMP | Driver: Unload, Delete, Disable PDCOMP | Not started | PDCOMP.sys | Script: Quarantine, Delete, Delete via BC |
| PDFRAME | Driver: Unload, Delete, Disable PDFRAME | Not started | PDFRAME.sys | Script: Quarantine, Delete, Delete via BC |
| PDRELI | Driver: Unload, Delete, Disable PDRELI | Not started | PDRELI.sys | Script: Quarantine, Delete, Delete via BC |
| PDRFRAME | Driver: Unload, Delete, Disable PDRFRAME | Not started | PDRFRAME.sys | Script: Quarantine, Delete, Delete via BC |
| perc2 | Driver: Unload, Delete, Disable perc2 | Not started | perc2.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| perc2hib | Driver: Unload, Delete, Disable perc2hib | Not started | perc2hib.sys | Script: Quarantine, Delete, Delete via BC Filter |
| PsSdk30 | Driver: Unload, Delete, Disable PsSdk30 | Not started | C:\WINDOWS\system32\Drivers\PsSdk30.drv | Script: Quarantine, Delete, Delete via BC |
| ql1080 | Driver: Unload, Delete, Disable ql1080 | Not started | ql1080.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| Ql10wnt | Driver: Unload, Delete, Disable Ql10wnt | Not started | Ql10wnt.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| ql12160 | Driver: Unload, Delete, Disable ql12160 | Not started | ql12160.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| ql1240 | Driver: Unload, Delete, Disable ql1240 | Not started | ql1240.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| ql1280 | Driver: Unload, Delete, Disable ql1280 | Not started | ql1280.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| Simbad | Driver: Unload, Delete, Disable Simbad | Not started | Simbad.sys | Script: Quarantine, Delete, Delete via BC Filter |
| Sparrow | Driver: Unload, Delete, Disable Sparrow | Not started | Sparrow.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| StkAMini | Driver: Unload, Delete, Disable Syntek STK1160 | Not started | C:\WINDOWS\system32\Drivers\StkAMini.sys | Script: Quarantine, Delete, Delete via BC |
| StkScan | Driver: Unload, Delete, Disable Syntek STK1160 Still Image | Not started | C:\WINDOWS\system32\Drivers\StkScan.sys | Script: Quarantine, Delete, Delete via BC |
| sym_hi | Driver: Unload, Delete, Disable sym_hi | Not started | sym_hi.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| sym_u3 | Driver: Unload, Delete, Disable sym_u3 | Not started | sym_u3.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| symc810 | Driver: Unload, Delete, Disable symc810 | Not started | symc810.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| symc8xx | Driver: Unload, Delete, Disable symc8xx | Not started | symc8xx.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| TosIde | Driver: Unload, Delete, Disable TosIde | Not started | TosIde.sys | Script: Quarantine, Delete, Delete via BC System Bus Extender |
| ultra | Driver: Unload, Delete, Disable ultra | Not started | ultra.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| USBAAPL | Driver: Unload, Delete, Disable Apple Mobile USB Driver | Not started | C:\WINDOWS\system32\Drivers\usbaapl.sys | Script: Quarantine, Delete, Delete via BC Base |
| ViaIde | Driver: Unload, Delete, Disable ViaIde | Not started | ViaIde.sys | Script: Quarantine, Delete, Delete via BC System Bus Extender |
| WDICA | Driver: Unload, Delete, Disable WDICA | Not started | WDICA.sys | Script: Quarantine, Delete, Delete via BC |
| Detected - 210, recognized as trusted - 154
| | ||||||
| File name | Status | Startup method | Description
| %NEXT_ROOT%\NextLibrary\Executables\Foundation.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\AliDiskViewer, EventMessageFile | Delete C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_CURRENT_USER, Software\Microsoft\Windows\CurrentVersion\Run, LightScribe Control Panel | Delete C:\Program Files\Google\Picasa3\Picasa3.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Picasa3, EventMessageFile | Delete C:\Program Files\Symantec\LiveUpdate\ResLuComServer_3_2.DLL | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\LiveUpdate, EventMessageFile | Delete C:\Program Files\The Print Shop 23\Remind.exe | Script: Quarantine, Delete, Delete via BC Active | Shortcut in Startup folder | C:\Documents and Settings\All Users\Start Menu\Programs\Startup\, C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Event Reminder.lnk,
| C:\WINDOWS\System32\PrintFilterPipelineSvc.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PrintFilterPipelineSvc, EventMessageFile | Delete C:\WINDOWS\System32\igmpv2.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile | Delete C:\WINDOWS\System32\ipbootp.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile | Delete C:\WINDOWS\System32\iprip2.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile | Delete C:\WINDOWS\System32\ospf.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPF, EventMessageFile | Delete C:\WINDOWS\System32\ospfmib.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPFMib, EventMessageFile | Delete C:\WINDOWS\System32\polagent.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PolicyAgent, EventMessageFile | Delete C:\WINDOWS\System32\tssdis.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\TermServSessDir, EventMessageFile | Delete C:\WINDOWS\System\LVMaLogD.DLL | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\LOGITECH, EventMessageFile | Delete C:\WINDOWS\system32\Ati2evxx.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Ati HotKey Poller, EventMessageFile | Delete C:\WINDOWS\system32\MsSip1.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 1, $DLL | Delete C:\WINDOWS\system32\MsSip2.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 2, $DLL | Delete C:\WINDOWS\system32\MsSip3.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 3, $DLL | Delete C:\WINDOWS\system32\psxss.exe | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
| C:\WINDOWS\system32\stisvc.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System, EventMessageFile | Delete C:\WINDOWS\system32\x264vfw.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, vidc.x264 | Delete kbd101.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver JPN | Delete kbd101a.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver KOR | Delete m3jpeg32.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, vidc.MJPG | Delete m3jpeg32.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, vidc.dmb1 | Delete mvfs32.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_USERS, .DEFAULT\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_USERS, S-1-5-19\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_USERS, S-1-5-20\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_USERS, S-1-5-18\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_CURRENT_USER, Control Panel\IOProcs, MVB | Delete vgafix.fon | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon | Delete vgaoem.fon | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon | Delete vgasys.fon | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon | Delete Autoruns items found - 621, recognized as trusted - 588
| | ||||||
| File name | Type | Description | Manufacturer | CLSID
| Extension module | {2670000A-7350-4f3c-8081-5663EE0C6C49} | Delete Extension module | {92780B25-18CC-41C8-B9BE-3C9C571A8263} | Delete Items found - 11, recognized as trusted - 9
| | ||||||||||||
| File name | Destination | Description | Manufacturer | CLSID
| deskpan.dll | Script: Quarantine, Delete, Delete via BC Display Panning CPL Extension | {42071714-76d4-11d1-8b24-00a0c9068ff3} | Delete Shell extensions for file compression | {764BF0E1-F219-11ce-972D-00AA00A14F56} | Delete Encryption Context Menu | {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} | Delete Taskbar and Start Menu | {0DF44EAA-FF21-4412-828E-260A8728E7F1} | Delete rundll32.exe C:\WINDOWS\system32\shimgvw.dll,ImageView_COMServer {00E7B358-F65B-4dcf-83DF-CD026B94BFD4} | Script: Quarantine, Delete, Delete via BC Autoplay for SlideShow | {00E7B358-F65B-4dcf-83DF-CD026B94BFD4} | Delete User Accounts | {7A9D77BD-5403-11d2-8785-2E0420524153} | Delete Record ISO Image to CD | {34F4B935-17DC-4885-8BC9-CCD1ADF42F93} | Delete Cleanup Utility | {955CC7C3-EE83-4A0D-8135-83728B8B9EAD} | Delete Items found - 229, recognized as trusted - 221
| | ||||||||||||||||||||||||||||
| File name | Type | Name | Description | Manufacturer
| C:\WINDOWS\system32\LXF3PMON.DLL | Script: Quarantine, Delete, Delete via BC Monitor | Lexmark Print-2-Fax Port | Print Monitor (Win2k/WinXP) |
| Items found - 12, recognized as trusted - 11
| | ||||||
| File name | Job name | Job state | Description | Manufacturer
| Items found - 2, recognized as trusted - 2
| | ||||||
| Manufacturer | Status | EXE file | Description | GUID
| Detected - 4, recognized as trusted - 4
| | ||||||
| Manufacturer | EXE file | Description
| Detected - 21, recognized as trusted - 21
| | ||||||
| File name | Description | Manufacturer | CLSID | Source URL
| C:\WINDOWS\Downloaded Program Files\PhotoUploader55.ocx | Script: Quarantine, Delete, Delete via BC Facebook Photo Uploader 5 Control | Copyright © 2008 The Facebook | {8100D56A-5661-482C-BEE8-AFECE305D968} | Delete http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
| {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} | Delete http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
| {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} | Delete http://www.adobe.com/products/acrobat/nos/gp.cab
| {E2883E8F-472F-4FB0-9522-AC9BF37916A7} | Delete http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
| Items found - 6, recognized as trusted - 2
| | |||||||||||||||
| File name | Description | Manufacturer
| Items found - 29, recognized as trusted - 29
| | ||||||
| File name | Description | Manufacturer | CLSID
| C:\Program Files\Common Files\LightScribe\LSRunOnce.exe | Script: Quarantine, Delete, Delete via BC © Copyright 2003-2006 Hewlett-Packard Development Company, LP | {10880D85-AAD9-4558-ABDC-2AB1552D831F}
| Items found - 17, recognized as trusted - 16
| | |||||||
Hosts file record
|
| File name | Type | Description | Manufacturer | CLSID
| mscoree.dll | Script: Quarantine, Delete, Delete via BC Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| mscoree.dll | Script: Quarantine, Delete, Delete via BC Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| mscoree.dll | Script: Quarantine, Delete, Delete via BC Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| Items found - 32, recognized as trusted - 29
| | ||||||
| File | Description | Type
| splk.sys | Script: Quarantine, Delete, Delete via BC Suspicion for Rootkit | Kernel-mode hook
| |
AVZ Antiviral Toolkit log; AVZ version is 4.32 Scanning started at 1/25/2010 12:23:52 AM Database loaded: signatures - 260759, NN profile(s) - 2, malware removal microprograms - 56, signature database released 24.01.2010 11:20 Heuristic microprograms loaded: 374 PVS microprograms loaded: 9 Digital signatures of system files loaded: 166374 Heuristic analyzer mode: Maximum heuristics mode Malware removal mode: disabled Windows version is: 5.1.2600, Service Pack 2 ; AVZ is run with administrator rights System Restore: enabled 1. Searching for Rootkits and other software intercepting API functions 1.1 Searching for user-mode API hooks Analysis: kernel32.dll, export table found in section .text Analysis: ntdll.dll, export table found in section .text Analysis: user32.dll, export table found in section .text Analysis: advapi32.dll, export table found in section .text Analysis: ws2_32.dll, export table found in section .text Analysis: wininet.dll, export table found in section .text Analysis: rasapi32.dll, export table found in section .text Analysis: urlmon.dll, export table found in section .text Analysis: netapi32.dll, export table found in section .text 1.2 Searching for kernel-mode API hooks Driver loaded successfully SDT found (RVA=0846E0) Kernel ntkrnlpa.exe found in memory at address 804D7000 SDT = 8055B6E0 KiST = 80503960 (284) Function NtCreateKey (29) intercepted (80622130->F74860E0), hook splk.sys Function NtEnumerateKey (47) intercepted (80622970->F74A4CA2), hook splk.sys Function NtEnumerateValueKey (49) intercepted (80622BDA->F74A5030), hook splk.sys Function NtOpenKey (77) intercepted (806234C6->F74860C0), hook splk.sys Function NtQueryKey (A0) intercepted (806237EA->F74A5108), hook splk.sys Function NtQueryValueKey (B1) intercepted (806201EA->F74A4F88), hook splk.sys Function NtSetValueKey (F7) intercepted (806207F0->F74A519A), hook splk.sys Functions checked: 284, intercepted: 7, restored: 0 1.3 Checking IDT and SYSENTER Analyzing CPU 1 Analyzing CPU 2 Checking IDT and SYSENTER - complete 1.4 Searching for masking processes and drivers Checking not performed: extended monitoring driver (AVZPM) is not installed Driver loaded successfully 1.5 Checking IRP handlers \FileSystem\ntfs[IRP_MJ_CREATE] = 86FD61F8 -> hook not defined \FileSystem\ntfs[IRP_MJ_CLOSE] = 86FD61F8 -> hook not defined \FileSystem\ntfs[IRP_MJ_WRITE] = 86FD61F8 -> hook not defined \FileSystem\ntfs[IRP_MJ_QUERY_INFORMATION] = 86FD61F8 -> hook not defined \FileSystem\ntfs[IRP_MJ_SET_INFORMATION] = 86FD61F8 -> hook not defined \FileSystem\ntfs[IRP_MJ_QUERY_EA] = 86FD61F8 -> hook not defined \FileSystem\ntfs[IRP_MJ_SET_EA] = 86FD61F8 -> hook not defined \FileSystem\ntfs[IRP_MJ_QUERY_VOLUME_INFORMATION] = 86FD61F8 -> hook not defined \FileSystem\ntfs[IRP_MJ_SET_VOLUME_INFORMATION] = 86FD61F8 -> hook not defined \FileSystem\ntfs[IRP_MJ_DIRECTORY_CONTROL] = 86FD61F8 -> hook not defined \FileSystem\ntfs[IRP_MJ_FILE_SYSTEM_CONTROL] = 86FD61F8 -> hook not defined \FileSystem\ntfs[IRP_MJ_DEVICE_CONTROL] = 86FD61F8 -> hook not defined \FileSystem\ntfs[IRP_MJ_LOCK_CONTROL] = 86FD61F8 -> hook not defined \FileSystem\ntfs[IRP_MJ_QUERY_SECURITY] = 86FD61F8 -> hook not defined \FileSystem\ntfs[IRP_MJ_SET_SECURITY] = 86FD61F8 -> hook not defined \FileSystem\ntfs[IRP_MJ_PNP] = 86FD61F8 -> hook not defined Checking - complete 2. Scanning RAM Number of processes found: 40 Extended process analysis: 336 C:\WINDOWS\system32\LxrSII1s.exe [ES]:Application has no visible windows [ES]:Located in system folder Number of modules loaded: 315 Scanning RAM - complete 3. Scanning disks 4. Checking Winsock Layered Service Provider (SPI/LSP) LSP settings checked. No errors detected 5. Searching for keyboard/mouse/windows events hooks (Keyloggers, Trojan DLLs) 6. Searching for opened TCP/UDP ports used by malicious software Checking - disabled by user 7. Heuristic system check Checking - complete 8. Searching for vulnerabilities >> Services: potentially dangerous service allowed: TermService (Terminal Services) >> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery Service) >> Services: potentially dangerous service allowed: TlntSvr (Telnet) >> Services: potentially dangerous service allowed: Messenger (Messenger) >> Services: potentially dangerous service allowed: Alerter (Alerter) >> Services: potentially dangerous service allowed: Schedule () >> Services: potentially dangerous service allowed: mnmsrvc (NetMeeting Remote Desktop Sharing) >> Services: potentially dangerous service allowed: RDSessMgr (Remote Desktop Help Session Manager) > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)! >> Security: disk drives' autorun is enabled >> Security: administrative shares (C$, D$ ...) are enabled >> Security: anonymous user access is enabled >> Security: sending Remote Assistant queries is enabled Checking - complete 9. Troubleshooting wizard >> HDD autorun is allowed >> Network drives autorun is allowed >> Removable media autorun is allowed Checking - complete Files scanned: 355, extracted from archives: 0, malicious software found 0, suspicions - 0 Scanning finished at 1/25/2010 12:24:19 AM Time of scanning: 00:00:28 If you have a suspicion on presence of viruses or questions on the suspected objects, you can address http://virusinfo.info conference System Analysis in progressAdd commands to script:
Script commands