AVZ 4.30 http://z-oleg.com/secur/avz/
| File name | PID | Description | Copyright | MD5 | Information
| c:\windows\system32\zunebusenum.exe | Script: Quarantine, Delete, BC delete, Terminate 296 | Zune Bus Enumerator Service | © Microsoft Corporation. All rights reserved. | ?? | 58.63 kb, rsah, | created: 12/12/2008 1:41:02 PM, modified: 12/12/2008 1:41:02 PM Command line: c:\WINDOWS\system32\ZuneBusEnum.exe c:\program files\zune\zunenss.exe | Script: Quarantine, Delete, BC delete, Terminate 764 | Zune Network Sharing Service | © Microsoft Corporation. All rights reserved. | ?? | 4997.63 kb, rsah, | created: 12/12/2008 1:41:18 PM, modified: 12/12/2008 1:41:18 PM Command line: "c:\Program Files\Zune\ZuneNss.exe" Detected:24, recognized as trusted 22
| | |||||
| Module name | Handle | Description | Copyright | MD5 | Used by processes
| C:\Documents and Settings\All Users\DRM\Cache\Indiv01.key | Script: Quarantine, Delete, BC delete 180355072 | Individualized Black Box DLL | © Microsoft Corporation. All rights reserved. | -- | 764
| c:\Program Files\Zune\ZuneCfg.DLL | Script: Quarantine, Delete, BC delete 1694892032 | Zune Configuration | © Microsoft Corporation. All rights reserved. | -- | 764
| c:\Program Files\Zune\ZuneDB.dll | Script: Quarantine, Delete, BC delete 1729560576 | OLEDB Provider (32-bit) | © Microsoft Corporation. All rights reserved. | -- | 764
| c:\Program Files\Zune\zunemde.dll | Script: Quarantine, Delete, BC delete 1746141184 | ZuneMDE DLL | © Microsoft Corporation. All rights reserved. | -- | 764
| c:\Program Files\Zune\ZuneNativeLib.dll | Script: Quarantine, Delete, BC delete 1701445632 | Zune Native Library DLL | © Microsoft Corporation. All rights reserved. | -- | 764
| c:\Program Files\Zune\ZuneNss.exe | Script: Quarantine, Delete, BC delete 1748238336 | Zune Network Sharing Service | © Microsoft Corporation. All rights reserved. | ?? | 764
| c:\Program Files\Zune\ZuneQP.dll | Script: Quarantine, Delete, BC delete 1730543616 | Query Processor (32-bit) | © Microsoft Corporation. All rights reserved. | -- | 764
| c:\Program Files\Zune\ZuneSE.dll | Script: Quarantine, Delete, BC delete 1733820416 | Storage Engine (32-bit) | © Microsoft Corporation. All rights reserved. | -- | 764
| c:\Program Files\Zune\ZuneService.dll | Script: Quarantine, Delete, BC delete 1711669248 | Zune Service DLL | © Microsoft Corporation. All rights reserved. | -- | 764
| c:\Program Files\Zune\ZuneSH.DLL | Script: Quarantine, Delete, BC delete 1713569792 | Zune Device Communication Support | © Microsoft Corporation. All rights reserved. | -- | 764
| c:\WINDOWS\system32\ZuneBusEnum.exe | Script: Quarantine, Delete, BC delete 4194304 | Zune Bus Enumerator Service | © Microsoft Corporation. All rights reserved. | ?? | 296
| Modules detected:309, recognized as trusted 298
| | |||||
| Module | Base address | Size in memory | Description | Manufacturer
| C:\WINDOWS\System32\Drivers\dump_atapi.sys | Script: Quarantine, Delete, BC delete EF1F9000 | 018000 (98304) |
| C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS | Script: Quarantine, Delete, BC delete F7A32000 | 002000 (8192) |
| C:\WINDOWS\SYSTEM32\EGATHDRV.SYS | Script: Quarantine, Delete, BC delete F7A36000 | 002000 (8192) | IBM eGatherer Kernel Module | (c) Copyright 1999, 2000 IBM Corporation
| C:\WINDOWS\System32\drivers\pmemnt.sys | Script: Quarantine, Delete, BC delete F7A42000 | 002000 (8192) | Physical Memory Driver | Copyright (C) Microsoft Corp. 1981-1996
| C:\Program Files\SMI2\smi2.sys | Script: Quarantine, Delete, BC delete F0E2A000 | 001000 (4096) | SMI BIOS driver | Copyright (C) 1999-2005 IBM Corp.
| C:\WINDOWS\system32\drivers\tvtfilter.sys | Script: Quarantine, Delete, BC delete B9AA2000 | 004000 (16384) | Rescue and Recovery filter driver | Copyright (C) Lenovo2003
| Modules detected - 117, recognized as trusted - 111
| | ||||||
| Service | Description | Status | File | Group | Dependencies
| ZuneBusEnum | Service: Stop, Delete, Disable Zune Bus Enumerator | Running | c:\WINDOWS\system32\ZuneBusEnum.exe | Script: Quarantine, Delete, BC delete |
| ZuneNetworkSvc | Service: Stop, Delete, Disable Zune Network Sharing Service | Running | c:\Program Files\Zune\ZuneNss.exe | Script: Quarantine, Delete, BC delete | upnphost
| getPlus(R) Helper | Service: Stop, Delete, Disable getPlus(R) Helper | Not started | C:\Program Files\NOS\bin\getPlus_HelperSvc.exe | Script: Quarantine, Delete, BC delete | RPCSS
| PsaSrv | Service: Stop, Delete, Disable IBM PSA Access Driver Control | Not started | PsaSrv.sys | Script: Quarantine, Delete, BC delete |
| ThinkVantage Registry Monitor Service | Service: Stop, Delete, Disable ThinkVantage Registry Monitor Service | Not started | C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe | Script: Quarantine, Delete, BC delete |
| TVT Backup Service | Service: Stop, Delete, Disable TVT Backup Service | Not started | C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe | Script: Quarantine, Delete, BC delete |
| TVT Scheduler | Service: Stop, Delete, Disable TVT Scheduler | Not started | C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe | Script: Quarantine, Delete, BC delete |
| WmcCds | Service: Stop, Delete, Disable Windows Media Connect (WMC) | Not started | c:\program files\windows media connect\mswmccds.exe | Script: Quarantine, Delete, BC delete | RPCSS
| WmcCdsLs | Service: Stop, Delete, Disable Windows Media Connect (WMC) Helper | Not started | C:\Program Files\Windows Media Connect\mswmcls.exe | Script: Quarantine, Delete, BC delete | RPCSS
| Detected - 100, recognized as trusted - 91
| | ||||||
| File name | Status | Startup method | Description
| C:\Program Files\AIM6\aim6.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_CURRENT_USER, Software\Microsoft\Windows\CurrentVersion\Run, Aim6
| appmgmts.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}, DLLName
| Autoruns items detected - 52, recognized as trusted - 50
| | ||||||
| File name | Type | Description | Manufacturer | CLSID
| Extension module | {2670000A-7350-4f3c-8081-5663EE0C6C49} | Delete C:\Program Files\PokerStars\PokerStarsUpdate.exe | Script: Quarantine, Delete, BC delete Extension module | PokerStars Update | Copyright (C) 2001 - 2008 PokerStars.com | {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} | Delete C:\Program Files\PokerStars\PokerStarsUpdate.exe | Script: Quarantine, Delete, BC delete Extension module | PokerStars Update | Copyright (C) 2001 - 2008 PokerStars.com | {92780B25-18CC-41C8-B9BE-3C9C571A8263} | Delete Elements detected - 9, recognized as trusted - 6
| | |||||||||
| File name | Destination | Description | Manufacturer | CLSID
| deskpan.dll | Script: Quarantine, Delete, BC delete Display Panning CPL Extension | {42071714-76d4-11d1-8b24-00a0c9068ff3}
| Shell extensions for file compression | {764BF0E1-F219-11ce-972D-00AA00A14F56}
| Encryption Context Menu | {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}
| Taskbar and Start Menu | {0DF44EAA-FF21-4412-828E-260A8728E7F1}
| rundll32.exe C:\WINDOWS\system32\shimgvw.dll,ImageView_COMServer {00E7B358-F65B-4dcf-83DF-CD026B94BFD4} | Script: Quarantine, Delete, BC delete Autoplay for SlideShow | {00E7B358-F65B-4dcf-83DF-CD026B94BFD4}
| User Accounts | {7A9D77BD-5403-11d2-8785-2E0420524153}
| C:\WINDOWS\system32\mscoree.dll | Script: Quarantine, Delete, BC delete Fusion Cache | Microsoft .NET Runtime Execution Engine | © Microsoft Corporation. All rights reserved. | {1D2680C9-0E2A-469d-B787-065558BC7D43}
| C:\WINDOWS\system32\nvshell.dll | Script: Quarantine, Delete, BC delete Desktop Explorer | {1CDB2949-8F65-4355-8456-263E7C208A5D}
| C:\WINDOWS\system32\nvshell.dll | Script: Quarantine, Delete, BC delete Desktop Explorer Menu | {1E9B04FB-F9E5-4718-997B-B8DA88302A47}
| C:\WINDOWS\system32\nvshell.dll | Script: Quarantine, Delete, BC delete nView Desktop Context Menu | {1E9B04FB-F9E5-4718-997B-B8DA88302A48}
| Shell Extension for Malware scanning | {45AC2688-0253-4ED8-97DE-B5370FA7D48A}
| Elements detected - 205, recognized as trusted - 194
| | |||||||||||||||||||||||||||||||
| File name | Type | Name | Description | Manufacturer
| Elements detected - 8, recognized as trusted - 8
| | ||||||
| File name | Job name | Job status | Description | Manufacturer
| Elements detected - 0, recognized as trusted - 0
| | ||||||
| Manufacturer | Status | EXE file | Description | GUID
| Detected - 3, recognized as trusted - 3
| | ||||||
| Manufacturer | EXE file | Description
| Detected - 13, recognized as trusted - 13
| | ||||||
| File name | Description | Manufacturer | CLSID | Source URL
| {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} | Delete http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
| Elements detected - 4, recognized as trusted - 3
| | |||||||||
| File name | Description | Manufacturer
| C:\WINDOWS\system32\nvtuicpl.cpl | Script: Quarantine, Delete, BC delete
| Elements detected - 25, recognized as trusted - 24
| | |||||||
| File name | Description | Manufacturer | CLSID
| C:\WINDOWS\alg | Script: Quarantine, Delete, BC delete {E17D8D3C-762E-E86C-BC90-D2638B15129B}
| Elements detected - 15, recognized as trusted - 14
| | ||||||||
Hosts file record
|
| File name | Type | Description | Manufacturer | CLSID
| mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| Elements detected - 33, recognized as trusted - 30
| | ||||||
| File | Description | Type |
AVZ Antiviral Toolkit log; AVZ version is 4.30 Scanning started at 4/13/2009 1:42:03 AM Database loaded: signatures - 218522, NN profile(s) - 2, microprograms of healing - 56, signature database released 12.04.2009 21:36 Heuristic microprograms loaded: 372 SPV microprograms loaded: 9 Digital signatures of system files loaded: 106813 Heuristic analyzer mode: Medium heuristics level Healing mode: enabled Windows version: 5.1.2600, Service Pack 3 ; AVZ is launched with administrator rights System Restore: enabled 1. Searching for Rootkits and programs intercepting API functions 1.1 Searching for user-mode API hooks Analysis: kernel32.dll, export table found in section .text Analysis: ntdll.dll, export table found in section .text Analysis: user32.dll, export table found in section .text Analysis: advapi32.dll, export table found in section .text Analysis: ws2_32.dll, export table found in section .text Analysis: wininet.dll, export table found in section .text Analysis: rasapi32.dll, export table found in section .text Analysis: urlmon.dll, export table found in section .text Analysis: netapi32.dll, export table found in section .text 1.2 Searching for kernel-mode API hooks Driver loaded successfully SDT found (RVA=085700) Kernel ntkrnlpa.exe found in memory at address 804D7000 SDT = 8055C700 KiST = 80504460 (284) Functions checked: 284, intercepted: 0, restored: 0 1.3 Checking IDT and SYSENTER Analysis for CPU 1 Analysis for CPU 2 Checking IDT and SYSENTER - complete 1.4 Searching for masking processes and drivers Checking not performed: extended monitoring driver (AVZPM) is not installed Driver loaded successfully 1.5 Checking of IRP handlers Checking - complete 2. Scanning memory Number of processes found: 25 Number of modules loaded: 346 Scanning memory - complete 3. Scanning disks 4. Checking Winsock Layered Service Provider (SPI/LSP) LSP settings checked. No errors detected 5. Searching for keyboard/mouse/windows events hooks (Keyloggers, Trojan DLLs) 6. Searching for opened TCP/UDP ports used by malicious programs Checking disabled by user 7. Heuristic system check Checking - complete 8. Searching for vulnerabilities >> Services: potentially dangerous service allowed: TermService (Terminal Services) >> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery Service) >> Services: potentially dangerous service allowed: Schedule (Task Scheduler) >> Services: potentially dangerous service allowed: mnmsrvc (NetMeeting Remote Desktop Sharing) >> Services: potentially dangerous service allowed: RDSessMgr (Remote Desktop Help Session Manager) > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)! >> Security: disk drives' autorun is enabled >> Security: administrative shares (C$, D$ ...) are enabled >> Security: anonymous user access is enabled >> Security: sending Remote Assistant queries is enabled >> Security: automatic logon is enabled Checking - complete 9. Troubleshooting wizard >> HDD autorun are allowed >> Autorun from network drives are allowed >> Removable media autorun are allowed Checking - complete Files scanned: 74768, extracted from archives: 51038, malicious software found 0, suspicions - 0 Scanning finished at 4/13/2009 2:26:15 AM Time of scanning: 00:44:12 If you have a suspicion on presence of viruses or questions on the suspected objects, you can address http://virusinfo.info conference Creating archive of files from Quarantine Creating archive of files from Quarantine - complete System Analysis in progressAdd commands to script:
Script commands