Results of system analysis

LSP settings checked. No errors detected

127.0.0.1       localhost

::1             localhost

AVZ Antiviral Toolkit log; AVZ version is 4.30
Scanning started at 2/10/2009 10:33:52 AM
Database loaded: signatures - 209302, NN profile(s) - 2, microprograms of healing - 56, signature database released 08.02.2009 18:56
Heuristic microprograms loaded: 372
SPV microprograms loaded: 9
Digital signatures of system files loaded: 91560
Heuristic analyzer mode: Maximum heuristics level
Healing mode: disabled
Windows version: 6.0.6001, Service Pack 1 ; AVZ is launched with administrator rights
System Restore: enabled
1. Searching for Rootkits and programs intercepting API functions
1.1 Searching for user-mode API hooks
 Analysis: kernel32.dll, export table found in section .text
 Analysis: ntdll.dll, export table found in section .text
Function ntdll.dll:LdrUnloadDll (144) intercepted, method APICodeHijack.JmpTo[10005736]
Function ntdll.dll:NtClose (212) intercepted, method APICodeHijack.JmpTo[10005806]
Function ntdll.dll:ZwClose (1345) intercepted, method APICodeHijack.JmpTo[10005806]
 Analysis: user32.dll, export table found in section .text
Function user32.dll:EndTask (215) intercepted, method APICodeHijack.JmpTo[100053C6]
Function user32.dll:keybd_event (774) intercepted, method APICodeHijack.JmpTo[10001546]
Function user32.dll:mouse_event (775) intercepted, method APICodeHijack.JmpTo[100016C6]
 Analysis: advapi32.dll, export table found in section .text
 Analysis: ws2_32.dll, export table found in section .text
 Analysis: wininet.dll, export table found in section .text
 Analysis: rasapi32.dll, export table found in section .text
 Analysis: urlmon.dll, export table found in section .text
 Analysis: netapi32.dll, export table found in section .text
1.2 Searching for kernel-mode API hooks
 Error loading driver - checking interrupted [C0000061]
1.4 Searching for masking processes and drivers
 Checking not performed: extended monitoring driver (AVZPM) is not installed
 Error loading driver - checking interrupted [C0000061]
2. Scanning memory
 Number of processes found: 19
Analyzer: process under analysis is 3908 C:\Program Files\Google\Google Toolbar\GoogleToolbarUser.exe
[ES]:Contains network functionality
[ES]:Application has no visible windows
[ES]:Loads RASAPI DLL - may use dialing ?
Analyzer: process under analysis is 3840 C:\Windows\system32\Macromed\Flash\FlashUtil10a.exe
[ES]:Contains network functionality
[ES]:Application has no visible windows
[ES]:Located in system folder
 Number of modules loaded: 290
Scanning memory - complete
3. Scanning disks
4. Checking  Winsock Layered Service Provider (SPI/LSP)
 LSP settings checked. No errors detected
5. Searching for keyboard/mouse/windows events hooks (Keyloggers, Trojan DLLs)
C:\Windows\system32\guard32.dll --> Suspicion for Keylogger or Trojan DLL
C:\Windows\system32\guard32.dll>>> Behavioural analysis 
  1. Reacts to events: keyboard, mouse
  2. Determines PID of current process
C:\Windows\system32\guard32.dll>>> Neural net: file with probability 0.60% like a typical keyboard/mouse events interceptor
C:\Windows\system32\cssdll32.dll --> Suspicion for Keylogger or Trojan DLL
C:\Windows\system32\cssdll32.dll>>> Behavioural analysis 
 Behaviour typical for keyloggers not detected
Note: Do NOT delete suspicious files, send them for analysis  (see FAQ for more details),  because there are lots of useful hooking DLLs
6. Searching for opened TCP/UDP ports used by malicious programs
 Checking disabled by user
7. Heuristic system check
Latent loading of libraries through AppInit_DLLs suspected: "C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL C:\Windows\system32\guard32.dll C:\Windows\system32\cssdll32.dll"
Checking - complete
8. Searching for vulnerabilities
>> Security: disk drives' autorun is enabled
>> Security: administrative shares (C$, D$ ...) are enabled
>> Security: anonymous user access is enabled
>> Security: terminal connections to the PC are allowed
>> Security: sending Remote Assistant queries is enabled
Checking - complete
9. Troubleshooting wizard
 >>  HDD autorun are allowed
 >>  Autorun from network drives are allowed
 >>  Removable media autorun are allowed
Checking - complete
Files scanned: 310, extracted from archives: 0, malicious software found 0, suspicions - 0
Scanning finished at 2/10/2009 10:34:25 AM
Time of scanning: 00:00:35
If you have a suspicion on presence of viruses or questions on the suspected objects,
you can address http://virusinfo.info conference
System Analysis in progress


Script commands
 
Add commands to script:
Blocking hooks using Anti-Rootkit
Enable AVZGuard
BootCleaner - import list of deleted files
Registry cleanup after deleting files
BootCleaner - activate
Reboot
Insert template for QuarantineFile() - quarantining file
Insert template for BC_QrFile() - quarantining file via BootCleaner
Insert template for DeleteFile() - deleting file
Insert template for DelCLSID() - deleting CLSID item from registry
Additional operations:
Security tweaking: disable CD autorun
Security tweaking: disable administrative shares
Security tweaking: disable anonymous user access
Security: prevent terminal connections to the PC
Security: disable sending Remote Assistant queries

File list