AVZ 4.32 http://z-oleg.com/secur/avz/
| File name | PID | Description | Copyright | MD5 | Information
| c:\users\jerry\desktop\new folder\move1\desktop\avz4\avz.exe | Script: Quarantine, Delete, Delete via BC, Terminate 1416 | ???????????? ??????? AVZ | ???????????? ??????? AVZ | ?? | 733.00 kb, rsAh, | created: 12/1/2009 1:40:56 PM, modified: 8/21/2009 2:40:32 PM Command line: "C:\Users\Jerry\Desktop\New Folder\move1\Desktop\avz4\avz.exe" c:\windows\explorer.exe | Script: Quarantine, Delete, Delete via BC, Terminate 1632 | Windows Explorer | © Microsoft Corporation. All rights reserved. | ?? | 2858.50 kb, rsAh, | created: 9/5/2009 10:38:15 PM, modified: 9/5/2009 10:38:15 PM Command line: C:\Windows\Explorer.EXE c:\windows\system32\lsass.exe | Script: Quarantine, Delete, Delete via BC, Terminate 604 | Local Security Authority Process | © Microsoft Corporation. All rights reserved. | ?? | 9.50 kb, rsAh, | created: 9/5/2009 10:33:21 PM, modified: 9/5/2009 10:33:21 PM Command line: C:\Windows\system32\lsass.exe Detected:21, recognized as trusted 21
| | |||||
| Module name | Handle | Description | Copyright | MD5 | Used by processes
| C:\Program Files\Protector Suite QL\farchns.dll | Script: Quarantine, Delete, Delete via BC 835584000 | PSQL file safe | Copyright (C) 2001-2007 UPEK Inc. | -- | 1416, 1632
| C:\Program Files\Protector Suite QL\homefus2.dll | Script: Quarantine, Delete, Delete via BC 824639488 | PS QL Logon Kernel | Copyright (C) 2001-2007 UPEK Inc. | -- | 604
| C:\Program Files\Protector Suite QL\infql2.dll | Script: Quarantine, Delete, Delete via BC 67502080 | Infrastructure utility library | Copyright (C) 2001-2007 UPEK Inc. | -- | 1416, 1632, 604
| C:\Windows\system32\AM.DLL | Script: Quarantine, Delete, Delete via BC 268435456 | HelperC Dynamic Link Library | Copyright (C) 2006 | -- | 1416, 1632
| C:\Windows\system32\psqlpwd.dll | Script: Quarantine, Delete, Delete via BC 828571648 | Logon stub | Copyright (C) 2001-2007 UPEK Inc. | -- | 604
| C:\Windows\system32\RlShellExt.dll | Script: Quarantine, Delete, Delete via BC 69337088 | | | -- | 1416, 1632
| Modules found:250, recognized as trusted 244
| | |||||
| Module | Base address | Size in memory | Description | Manufacturer
| C:\Windows\System32\Drivers\dump_atapi.sys | Script: Quarantine, Delete, Delete via BC 8C502000 | 008000 (32768) |
| C:\Windows\System32\Drivers\dump_dumpata.sys | Script: Quarantine, Delete, Delete via BC 8C4F7000 | 00B000 (45056) |
| C:\Windows\System32\drivers\REDLIGHT.SYS | Script: Quarantine, Delete, Delete via BC 87C0D000 | 378000 (3637248) | BufferZone Kernel Module | © BufferZone. All rights reserved.
| Modules found - 117, recognized as trusted - 114
| | ||||||
| File name | Status | Startup method | Description
| C:\PROGRA~1\RETROS~1\RETROS~1.0\RetroExpress.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, RetroExpress | Delete C:\Program Files\BufferZone\CLIENTGUI.EXE | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, BufferZone | Delete C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, Camera Assistant Software | Delete C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, RoxWatchTray | Delete C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, Google Desktop Search | Delete C:\Program Files\Protector Suite QL\eventlog.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\psql, EventMessageFile | Delete C:\Program Files\Protector Suite QL\infopnl.cpl | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cpls, ProtectorSuiteInfoPanel | Delete C:\Program Files\Protector Suite QL\launcher.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, PSQLLauncher | Delete C:\Program Files\Retrospect\Retrospect Express HD 2.0\retrores.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Retrospect, EventMessageFile | Delete C:\Program Files\Shareaza\Shareaza.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_CURRENT_USER, Software\Microsoft\Windows\CurrentVersion\Run, Shareaza | Delete C:\Program Files\Shareaza\Shareaza.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_USERS, .DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run, Shareaza | Delete C:\Program Files\Shareaza\Shareaza.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_USERS, S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run, Shareaza | Delete C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, SVPWUTIL | Delete C:\Program Files\WordPerfect Office X3\Programs\QFSCHD130.EXE | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, QuickFinder Scheduler | Delete C:\Program Files\\Toshiba\SmoothView\SmoothView.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, SmoothView | Delete C:\WindowsSystem32\IoLogMsg.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\vsmraid, EventMessageFile | Delete C:\Windows\System32\appmgmts.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters, ServiceDll | Delete C:\Windows\System32\igmpv2.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile | Delete C:\Windows\System32\ipbootp.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile | Delete C:\Windows\System32\iprip2.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile | Delete C:\Windows\system32\DivX.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, vidc.DIVX | Delete C:\Windows\system32\DivX.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, vidc.yv12 | Delete C:\Windows\system32\psqlpwd.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\psfus, DLLName | Delete C:\Windows\system32\psqlpwd.dll | Script: Quarantine, Delete, Delete via BC -- | ? | HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Lsa, Notification Packages
| C:\Windows\system32\psxss.exe | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
| C:\Windows\system32\xvidvfw.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, vidc.XVID | Delete NDSTray.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, NDSTray.exe | Delete progman.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, shell | Delete rdpclip | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd, StartupPrograms | Delete vgafix.fon | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon | Delete vgaoem.fon | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon | Delete vgasys.fon | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon | Delete vrlogon.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon, GinaDLL
| Autoruns items found - 501, recognized as trusted - 468
| | ||||||
| File name | Type | Description | Manufacturer | CLSID
| C:\Program Files\Adobe\Adobe Contribute CS4/contributeieplugin.dll | Script: Quarantine, Delete, Delete via BC BHO | Contribute IE Plugin | Copyright © 2002-2008. Adobe Systems Incorporated and its licensors. All rights reserved. | {074C1DC5-9320-4A9A-947D-C042949C6216} | Delete C:\Program Files\BufferZone\BZbho.dll | Script: Quarantine, Delete, Delete via BC BHO | BufferZone Trusted Sites Protection | (c) Trustware. All rights reserved. | {311BA51F-64F2-439D-9A4A-772373D77312} | Delete C:\Program Files\AVG\AVG9\avgssie.dll | Script: Quarantine, Delete, Delete via BC BHO | {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} | Delete C:\Program Files\Adobe\Adobe Contribute CS4/contributeieplugin.dll | Script: Quarantine, Delete, Delete via BC Toolbar | Contribute IE Plugin | Copyright © 2002-2008. Adobe Systems Incorporated and its licensors. All rights reserved. | {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} | Delete Extension module | {2670000A-7350-4f3c-8081-5663EE0C6C49} | Delete Extension module | {92780B25-18CC-41C8-B9BE-3C9C571A8263} | Delete Extension module | {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} | Delete Items found - 20, recognized as trusted - 13
| | |||||||||||||||||
| File name | Destination | Description | Manufacturer | CLSID
| Color Control Panel Applet | {b2c761c6-29bc-4f19-9251-e6195265baf1} | Delete Add New Hardware | {7A979262-40CE-46ff-AEEE-7884AC3B6136} | Delete Get Programs Online | {3e7efb4c-faf1-453d-89eb-56026875ef90} | Delete Taskbar and Start Menu | {0DF44EAA-FF21-4412-828E-260A8728E7F1} | Delete ActiveDirectory Folder | {1b24a030-9b20-49bc-97ac-1be4426f9e59} | Delete ActiveDirectory Folder | {34449847-FD14-4fc8-A75A-7432F5181EFB} | Delete Sam Account Folder | {C8494E42-ACDD-4739-B0FB-217361E4894F} | Delete Sam Account Folder | {E29F9716-5C08-4FCD-955A-119FDB5A522D} | Delete Control Panel command object for Start menu | {5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0} | Delete Default Programs command object for Start menu | {E44E5D18-0652-4508-A4E2-8A090067BCB0} | Delete Folder Options | {6dfd7c5c-2451-11d3-a299-00c04f8ef6af} | Delete Explorer Query Band | {2C2577C2-63A7-40e3-9B7F-586602617ECB} | Delete View Available Networks | {38a98528-6cbf-4ca9-8dc0-b1e1d10f7b1b} | Delete Contacts folder | {0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} | Delete Windows Firewall | {4026492f-2f69-46b8-b9bf-5654fc07e423} | Delete Problem Reports and Solutions | {fcfeecae-ee1b-4849-ae50-685dcf7717ec} | Delete iSCSI Initiator | {a304259d-52b8-4526-8b1a-a1d6cecc8243} | Delete .cab or .zip files | {911051fa-c21c-4246-b470-070cd8df6dc4} | Delete Windows Search Shell Service | {da67b8ad-e81b-4c70-9b91b417b5e33527} | Delete Microsoft.ScannersAndCameras | {00f2886f-cd64-4fc9-8ec5-30ef6cdbe8c3} | Delete "C:\Windows\System32\rundll32.exe" "C:\Program Files\\Windows Photo Gallery\PhotoViewer.dll",ImageView_COMServer {9D687A4C-1404-41ef-A089-883B6FBECDE6} | Script: Quarantine, Delete, Delete via BC Windows Photo Gallery Viewer Autoplay Handler | {9D687A4C-1404-41ef-A089-883B6FBECDE6} | Delete Windows Sidebar Properties | {37efd44d-ef8d-41b1-940d-96973a50e9e0} | Delete Windows Features | {67718415-c450-4f3c-bf8a-b487642dc39b} | Delete Windows Defender | {d8559eb9-20c0-410e-beda-7ed416aecc2a} | Delete Mobility Center Control Panel | {5ea4f148-308c-46d7-98a9-49041b1dd468} | Delete "C:\Program Files\\Windows Media Player\wmprph.exe" | Script: Quarantine, Delete, Delete via BC Windows Media Player Rich Preview Handler | {031EE060-67BC-460d-8847-E4A7C5E45A27} | Delete User Accounts | {7A9D77BD-5403-11d2-8785-2E0420524153} | Delete C:\Windows\system32\RlShellExt.dll | Script: Quarantine, Delete, Delete via BC SxBzUnknownOverlay | {E4FC4B31-8A4F-45E6-BDAC-28F612371FE3} | Delete C:\Windows\system32\RlShellExt.dll | Script: Quarantine, Delete, Delete via BC SxBzForbiddenOverlay | {F1A1DA12-E651-4AD0-A1A0-6214546B2F9D} | Delete C:\Windows\system32\RlShellExt.dll | Script: Quarantine, Delete, Delete via BC SxBzConfidentialOverlay | {F594B094-8768-4632-8143-12852EBBD688} | Delete C:\Windows\system32\RlShellExt.dll | Script: Quarantine, Delete, Delete via BC SxBzBufferZoneOverlay | {37ADBD0B-11EC-4A2C-9F93-5C3ACC7994DF} | Delete C:\Windows\system32\RlShellExt.dll | Script: Quarantine, Delete, Delete via BC BufferZone context menu | {E2958773-ACDB-4553-A069-A1EEB4AFBA0F} | Delete C:\Program Files\Roxio\Virtual Drive 9\DC_ShellExt.dll | Script: Quarantine, Delete, Delete via BC RXDCExtShlExt extension | Roxio Disc Copier Shell Extension | Copyright (c) 1994-2005 Sonic Solutions | {0FB82570-BB2D-23D3-8D3B-AC2F34F1FA3C} | Delete C:\Program Files\Protector Suite QL\farchns.dll | Script: Quarantine, Delete, Delete via BC Safearchive ContextMenu Class | PSQL file safe | Copyright (C) 2001-2007 UPEK Inc. | {9AFDE8D6-200C-4b41-A5FC-B7251DFD1A8E} | Delete C:\Program Files\Protector Suite QL\farchns.dll | Script: Quarantine, Delete, Delete via BC Safearchive ShellFolder Class | PSQL file safe | Copyright (C) 2001-2007 UPEK Inc. | {055EF591-5C38-49a0-9BDA-51B1D69D0BF4} | Delete C:\Program Files\Protector Suite QL\farchns.dll | Script: Quarantine, Delete, Delete via BC Safearchive PropertySheetHandler Class | PSQL file safe | Copyright (C) 2001-2007 UPEK Inc. | {66C99756-1C92-4d3e-BA69-9400A6F731F5} | Delete C:\Program Files\Protector Suite QL\farchns.dll | Script: Quarantine, Delete, Delete via BC Safearchive ExtractIcon Class | PSQL file safe | Copyright (C) 2001-2007 UPEK Inc. | {E6D7D89A-2232-446d-8A0F-D0F9B06DB1CA} | Delete Items found - 316, recognized as trusted - 279
| | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| File name | Type | Name | Description | Manufacturer
| C:\Windows\system32\hpz3l4v2.dll | Script: Quarantine, Delete, Delete via BC Monitor | PCL Language Monitor | LanguageMonitor | Copyright (C) 1999
| Items found - 10, recognized as trusted - 9
| | ||||||
| File name | Job name | Job state | Description | Manufacturer
| Items found - 0, recognized as trusted - 0
| | ||||||
| Manufacturer | Status | EXE file | Description | GUID
| Detected - 7, recognized as trusted - 7
| | ||||||
| Manufacturer | EXE file | Description
| Detected - 24, recognized as trusted - 24
| | ||||||
| File name | Description | Manufacturer | CLSID | Source URL
| Items found - 0, recognized as trusted - 0
| | ||||||
| File name | Description | Manufacturer
| Items found - 29, recognized as trusted - 29
| | ||||||
| File name | Description | Manufacturer | CLSID
| Items found - 9, recognized as trusted - 9
| | ||||||
Hosts file record
|
| File name | Type | Description | Manufacturer | CLSID
| mscoree.dll | Script: Quarantine, Delete, Delete via BC Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| mscoree.dll | Script: Quarantine, Delete, Delete via BC Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| mscoree.dll | Script: Quarantine, Delete, Delete via BC Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| Items found - 20, recognized as trusted - 17
| | ||||||
| File | Description | Type
| C:\Windows\system32\RlShellExt.dll | Script: Quarantine, Delete, Delete via BC Suspicion for Keylogger | Suspicion for Keylogger or Trojan DLL
| C:\Windows\system32\AM.DLL | Script: Quarantine, Delete, Delete via BC Suspicion for Keylogger | Suspicion for Keylogger or Trojan DLL
| C:\Program Files\Protector Suite QL\farchns.dll | Script: Quarantine, Delete, Delete via BC Suspicion for Keylogger | Suspicion for Keylogger or Trojan DLL
| C:\Program Files\Protector Suite QL\infql2.dll | Script: Quarantine, Delete, Delete via BC Suspicion for Keylogger | Suspicion for Keylogger or Trojan DLL
| |
AVZ Antiviral Toolkit log; AVZ version is 4.32 Scanning started at 12/1/2009 1:43:49 PM Database loaded: signatures - 251910, NN profile(s) - 2, malware removal microprograms - 56, signature database released 01.12.2009 22:57 Heuristic microprograms loaded: 374 PVS microprograms loaded: 9 Digital signatures of system files loaded: 157427 Heuristic analyzer mode: Medium heuristics mode Malware removal mode: enabled Windows version is: 6.0.6001, Service Pack 1 ; AVZ is run with administrator rights System Restore: enabled System booted in Safe Mode with Networking 1. Searching for Rootkits and other software intercepting API functions 1.1 Searching for user-mode API hooks Analysis: kernel32.dll, export table found in section .text Analysis: ntdll.dll, export table found in section .text Analysis: user32.dll, export table found in section .text Analysis: advapi32.dll, export table found in section .text Analysis: ws2_32.dll, export table found in section .text Analysis: wininet.dll, export table found in section .text Analysis: rasapi32.dll, export table found in section .text Analysis: urlmon.dll, export table found in section .text Analysis: netapi32.dll, export table found in section .text 1.2 Searching for kernel-mode API hooks Error loading driver - operation interrupted [C000035F] 1.4 Searching for masking processes and drivers Checking not performed: extended monitoring driver (AVZPM) is not installed Error loading driver - operation interrupted [C000035F] 2. Scanning RAM Number of processes found: 20 Number of modules loaded: 241 Scanning RAM - complete 3. Scanning disks 4. Checking Winsock Layered Service Provider (SPI/LSP) LSP settings checked. No errors detected 5. Searching for keyboard/mouse/windows events hooks (Keyloggers, Trojan DLLs) C:\Windows\system32\RlShellExt.dll --> Suspicion for Keylogger or Trojan DLL C:\Windows\system32\RlShellExt.dll>>> Behaviour analysis Behaviour typical for keyloggers was not detected File quarantined succesfully (C:\Windows\system32\RlShellExt.dll) C:\Windows\system32\AM.DLL --> Suspicion for Keylogger or Trojan DLL C:\Windows\system32\AM.DLL>>> Behaviour analysis Behaviour typical for keyloggers was not detected File quarantined succesfully (C:\Windows\system32\AM.DLL) C:\Program Files\Protector Suite QL\farchns.dll --> Suspicion for Keylogger or Trojan DLL C:\Program Files\Protector Suite QL\farchns.dll>>> Behaviour analysis Behaviour typical for keyloggers was not detected File quarantined succesfully (C:\Program Files\Protector Suite QL\farchns.dll) C:\Program Files\Protector Suite QL\infql2.dll --> Suspicion for Keylogger or Trojan DLL C:\Program Files\Protector Suite QL\infql2.dll>>> Behaviour analysis Behaviour typical for keyloggers was not detected File quarantined succesfully (C:\Program Files\Protector Suite QL\infql2.dll) Note: Do NOT delete suspicious files, send them for analysis (see FAQ for more details), because there are lots of useful hooking DLLs 6. Searching for opened TCP/UDP ports used by malicious software Checking - disabled by user 7. Heuristic system check Latent DLL loading through AppInit_DLLs suspected: "C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL" Checking - complete 8. Searching for vulnerabilities >> Services: potentially dangerous service allowed: TermService (@%SystemRoot%\System32\termsrv.dll,-268) >> Services: potentially dangerous service allowed: SSDPSRV (@%systemroot%\system32\ssdpsrv.dll,-100) >> Services: potentially dangerous service allowed: Schedule (@%SystemRoot%\system32\schedsvc.dll,-100) > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)! >> Security: disk drives' autorun is enabled >> Security: administrative shares (C$, D$ ...) are enabled >> Security: anonymous user access is enabled >> Security: sending Remote Assistant queries is enabled Checking - complete 9. Troubleshooting wizard >> HDD autorun is allowed >> Network drives autorun is allowed >> Removable media autorun is allowed Checking - complete Files scanned: 404144, extracted from archives: 278795, malicious software found 0, suspicions - 0 Scanning finished at 12/1/2009 2:26:32 PM Time of scanning: 00:42:44 If you have a suspicion on presence of viruses or questions on the suspected objects, you can address http://virusinfo.info conference Creating archive of files from Quarantine Creating archive of files from Quarantine - complete System Analysis in progressAdd commands to script:
Script commands