AVZ 4.30 http://z-oleg.com/secur/avz/
| File name | PID | Description | Copyright | MD5 | Information
| c:\progra~1\alwils~1\avast4\ashdisp.exe | Script: Quarantine, Delete, BC delete, Terminate 2124 | avast! service GUI component | Copyright (c) 2009 ALWIL Software | ?? | 79.10 kb, rsAh, | created: 2/15/2009 8:46:53 PM, modified: 2/5/2009 4:08:45 PM Command line: "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" c:\program files\alwil software\avast4\ashmaisv.exe | Script: Quarantine, Delete, BC delete, Terminate 436 | avast! e-Mail Scanner Service | Copyright (c) 2009 ALWIL Software | ?? | 248.09 kb, rsAh, | created: 2/15/2009 8:46:53 PM, modified: 2/5/2009 4:08:26 PM Command line: "C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service c:\program files\alwil software\avast4\ashserv.exe | Script: Quarantine, Delete, BC delete, Terminate 1308 | avast! antivirus service | Copyright (c) 2009 ALWIL Software | ?? | 135.43 kb, rsAh, | created: 2/15/2009 8:46:53 PM, modified: 2/5/2009 4:08:40 PM Command line: "C:\Program Files\Alwil Software\Avast4\ashServ.exe" c:\program files\alwil software\avast4\ashwebsv.exe | Script: Quarantine, Delete, BC delete, Terminate 452 | avast! Web Scanner | Copyright (c) 2009 ALWIL Software | ?? | 344.65 kb, rsAh, | created: 2/15/2009 8:46:53 PM, modified: 2/5/2009 4:06:04 PM Command line: "C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service c:\windows\explorer.exe | Script: Quarantine, Delete, BC delete, Terminate 1568 | Windows Explorer | © Microsoft Corporation. All rights reserved. | ?? | 1009.50 kb, rsAh, | created: 12/6/2005 11:20:24 PM, modified: 4/13/2008 7:12:19 PM Command line: C:\WINDOWS\Explorer.EXE c:\program files\spybot - search & destroy\teatimer.exe | Script: Quarantine, Delete, BC delete, Terminate 2352 | System settings protector | © 2000-2008 Safer Networking Limited. Alle Rechte vorbehalten. | ?? | 2093.84 kb, RSAH, | created: 2/15/2009 11:09:24 AM, modified: 1/26/2009 3:31:16 PM Command line: "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" Detected:26, recognized as trusted 25
| | |||||
| Module name | Handle | Description | Copyright | MD5 | Used by processes
| C:\Program Files\Alwil Software\Avast4\English\Base.dll | Script: Quarantine, Delete, BC delete 1711800320 | avast! English Basic Module | Copyright (c) 2009 ALWIL Software | -- | 2124, 436, 1308, 452
| C:\Program Files\Alwil Software\Avast4\English\Lang.dll | Script: Quarantine, Delete, BC delete 1712324608 | avast! Main English Module | Copyright (c) 2009 ALWIL Software | -- | 2124, 436
| C:\Program Files\Alwil Software\Avast4\English\langmai.dll | Script: Quarantine, Delete, BC delete 1716518912 | English language DLL for avast! e-Mail Scanner | Copyright (c) 2009 ALWIL Software | -- | 436
| c:\Program Files\Microsoft Money\System\urlmapps.dll | Script: Quarantine, Delete, BC delete 52428800 | Money URL Map Proxy/Stub dll | Copyright (C) Microsoft Corp. 1990-2001. All rights reserved. | -- | 1568
| C:\Program Files\Spybot - Search & Destroy\advcheck.dll | Script: Quarantine, Delete, BC delete 57737216 | Dateiüberprüfungs-Bibliothek | © 2003-2008 Safer Networking Limited. Alle Rechte vorbehalten. | -- | 2352
| C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe | Script: Quarantine, Delete, BC delete 4194304 | System settings protector | © 2000-2008 Safer Networking Limited. Alle Rechte vorbehalten. | ?? | 2352
| C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll | Script: Quarantine, Delete, BC delete 42401792 | SBSD IE Protection | © 2000-2008 Safer Networking Limited. Alle Rechte vorbehalten. | -- | 1568
| Modules detected:336, recognized as trusted 329
| | |||||
| Module | Base address | Size in memory | Description | Manufacturer
| C:\WINDOWS\system32\Drivers\nvport.sys | Script: Quarantine, Delete, BC delete F7BD6000 | 007000 (28672) | Port Driver | Copyright (c) 2004 NVIDIA Corporation. All rights reserved.
| C:\WINDOWS\system32\Drivers\sptd.sys | Script: Quarantine, Delete, BC delete F76FD000 | 0D0000 (851968) |
| C:\WINDOWS\System32\Drivers\SPTD5869.SYS | Script: Quarantine, Delete, BC delete F76E5000 | 018000 (98304) |
| C:\WINDOWS\system32\drivers\tmcomm.sys | Script: Quarantine, Delete, BC delete ABE7F000 | 018000 (98304) | TrendMicro Common Module | Copyright (C) 2005-2007 Trend Micro Incorporated. All rights reserved.
| Modules detected - 138, recognized as trusted - 134
| | ||||||
| Service | Description | Status | File | Group | Dependencies
| nvport | Driver: Unload, Delete, Disable NVIDIA PORT IO Control Driver | Running | C:\WINDOWS\system32\Drivers\nvport.sys | Script: Quarantine, Delete, BC delete |
| sptd | Driver: Unload, Delete, Disable sptd | Running | C:\WINDOWS\System32\Drivers\sptd.sys | Script: Quarantine, Delete, BC delete Boot Bus Extender |
| tmcomm | Driver: Unload, Delete, Disable tmcomm | Running | C:\WINDOWS\system32\drivers\tmcomm.sys | Script: Quarantine, Delete, BC delete ExtendedBase |
| Abiosdsk | Driver: Unload, Delete, Disable Abiosdsk | Not started | Abiosdsk.sys | Script: Quarantine, Delete, BC delete Primary disk |
| abp480n5 | Driver: Unload, Delete, Disable abp480n5 | Not started | abp480n5.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| adpu160m | Driver: Unload, Delete, Disable adpu160m | Not started | adpu160m.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Aha154x | Driver: Unload, Delete, Disable Aha154x | Not started | Aha154x.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| aic78u2 | Driver: Unload, Delete, Disable aic78u2 | Not started | aic78u2.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| aic78xx | Driver: Unload, Delete, Disable aic78xx | Not started | aic78xx.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| AliIde | Driver: Unload, Delete, Disable AliIde | Not started | AliIde.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| amsint | Driver: Unload, Delete, Disable amsint | Not started | amsint.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| asc | Driver: Unload, Delete, Disable asc | Not started | asc.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| asc3350p | Driver: Unload, Delete, Disable asc3350p | Not started | asc3350p.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| asc3550 | Driver: Unload, Delete, Disable asc3550 | Not started | asc3550.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Atdisk | Driver: Unload, Delete, Disable Atdisk | Not started | Atdisk.sys | Script: Quarantine, Delete, BC delete Primary disk |
| ATI Remote Wonder II | Driver: Unload, Delete, Disable ATI Remote Wonder II | Not started | C:\WINDOWS\system32\drivers\ATIRWVD.SYS | Script: Quarantine, Delete, BC delete |
| cd20xrnt | Driver: Unload, Delete, Disable cd20xrnt | Not started | cd20xrnt.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Changer | Driver: Unload, Delete, Disable Changer | Not started | Changer.sys | Script: Quarantine, Delete, BC delete Filter |
| CmdIde | Driver: Unload, Delete, Disable CmdIde | Not started | CmdIde.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| Cpqarray | Driver: Unload, Delete, Disable Cpqarray | Not started | Cpqarray.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| dac960nt | Driver: Unload, Delete, Disable dac960nt | Not started | dac960nt.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| dpti2o | Driver: Unload, Delete, Disable dpti2o | Not started | dpti2o.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ecppolmr | Driver: Unload, Delete, Disable ecppolmr | Not started | C:\WINDOWS\system32\drivers\kfznmkkv.sys | Script: Quarantine, Delete, BC delete |
| ecxlkbix | Driver: Unload, Delete, Disable ecxlkbix | Not started | C:\WINDOWS\system32\drivers\ydlgbhfd.sys | Script: Quarantine, Delete, BC delete |
| hpn | Driver: Unload, Delete, Disable hpn | Not started | hpn.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| hpt3xx | Driver: Unload, Delete, Disable hpt3xx | Not started | hpt3xx.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| i2omgmt | Driver: Unload, Delete, Disable i2omgmt | Not started | i2omgmt.sys | Script: Quarantine, Delete, BC delete SCSI Class |
| i2omp | Driver: Unload, Delete, Disable i2omp | Not started | i2omp.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| iAimTV2 | Driver: Unload, Delete, Disable iAimTV2 | Not started | C:\WINDOWS\system32\DRIVERS\wATV03nt.sys | Script: Quarantine, Delete, BC delete |
| ini910u | Driver: Unload, Delete, Disable ini910u | Not started | ini910u.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| lbrtfdc | Driver: Unload, Delete, Disable lbrtfdc | Not started | lbrtfdc.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| MCSTRM | Driver: Unload, Delete, Disable MCSTRM | Not started | MCSTRM.sys | Script: Quarantine, Delete, BC delete MCSTRM |
| mlwchsjd | Driver: Unload, Delete, Disable mlwchsjd | Not started | C:\WINDOWS\system32\drivers\ouwvgpkl.sys | Script: Quarantine, Delete, BC delete |
| mraid35x | Driver: Unload, Delete, Disable mraid35x | Not started | mraid35x.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| oqcsxypd | Driver: Unload, Delete, Disable oqcsxypd | Not started | C:\WINDOWS\system32\drivers\pvbsltru.sys | Script: Quarantine, Delete, BC delete |
| P2k | Driver: Unload, Delete, Disable Motorola USB Device | Not started | C:\WINDOWS\system32\DRIVERS\P2k.sys | Script: Quarantine, Delete, BC delete |
| PBDOWNFORCE_SERVICE | Driver: Unload, Delete, Disable PBDOWNFORCE_SERVICE | Not started | C:\Documents and Settings\jeremy\Desktop\gamefiles\PBDownforce.sys | Script: Quarantine, Delete, BC delete |
| PBDOWNFORCE_TEST_SERVICE | Driver: Unload, Delete, Disable PBDOWNFORCE_TEST_SERVICE | Not started | C:\Documents and Settings\jeremy\Desktop\gamefiles\Test.sys | Script: Quarantine, Delete, BC delete |
| PCIDump | Driver: Unload, Delete, Disable PCIDump | Not started | PCIDump.sys | Script: Quarantine, Delete, BC delete PCI Configuration |
| PDCOMP | Driver: Unload, Delete, Disable PDCOMP | Not started | PDCOMP.sys | Script: Quarantine, Delete, BC delete |
| PDFRAME | Driver: Unload, Delete, Disable PDFRAME | Not started | PDFRAME.sys | Script: Quarantine, Delete, BC delete |
| PDRELI | Driver: Unload, Delete, Disable PDRELI | Not started | PDRELI.sys | Script: Quarantine, Delete, BC delete |
| PDRFRAME | Driver: Unload, Delete, Disable PDRFRAME | Not started | PDRFRAME.sys | Script: Quarantine, Delete, BC delete |
| perc2 | Driver: Unload, Delete, Disable perc2 | Not started | perc2.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| perc2hib | Driver: Unload, Delete, Disable perc2hib | Not started | perc2hib.sys | Script: Quarantine, Delete, BC delete Filter |
| PnkBstrK | Driver: Unload, Delete, Disable PnkBstrK | Not started | C:\WINDOWS\system32\drivers\PnkBstrK.sys | Script: Quarantine, Delete, BC delete |
| ql1080 | Driver: Unload, Delete, Disable ql1080 | Not started | ql1080.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Ql10wnt | Driver: Unload, Delete, Disable Ql10wnt | Not started | Ql10wnt.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ql12160 | Driver: Unload, Delete, Disable ql12160 | Not started | ql12160.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ql1240 | Driver: Unload, Delete, Disable ql1240 | Not started | ql1240.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| ql1280 | Driver: Unload, Delete, Disable ql1280 | Not started | ql1280.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| Simbad | Driver: Unload, Delete, Disable Simbad | Not started | Simbad.sys | Script: Quarantine, Delete, BC delete Filter |
| Sparrow | Driver: Unload, Delete, Disable Sparrow | Not started | Sparrow.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| sym_hi | Driver: Unload, Delete, Disable sym_hi | Not started | sym_hi.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| sym_u3 | Driver: Unload, Delete, Disable sym_u3 | Not started | sym_u3.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| symc810 | Driver: Unload, Delete, Disable symc810 | Not started | symc810.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| symc8xx | Driver: Unload, Delete, Disable symc8xx | Not started | symc8xx.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| TosIde | Driver: Unload, Delete, Disable TosIde | Not started | TosIde.sys | Script: Quarantine, Delete, BC delete System Bus Extender |
| ultra | Driver: Unload, Delete, Disable ultra | Not started | ultra.sys | Script: Quarantine, Delete, BC delete SCSI miniport |
| WDICA | Driver: Unload, Delete, Disable WDICA | Not started | WDICA.sys | Script: Quarantine, Delete, BC delete |
| zqqcysuu | Driver: Unload, Delete, Disable zqqcysuu | Not started | C:\WINDOWS\system32\drivers\fphgvlkj.sys | Script: Quarantine, Delete, BC delete |
| Detected - 232, recognized as trusted - 171
| | ||||||
| File name | Status | Startup method | Description
| C:\Program Files\ATI Multimedia\main\ATIDtct.EXE | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, ATI DeviceDetect
| C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\RunOnce, Spybot - Search & Destroy
| C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_CURRENT_USER, Software\Microsoft\Windows\CurrentVersion\Run, SpybotSD TeaTimer
| C:\WINDOWS\system32\logonuiX.exe | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon, UIHost
| C:\WINDOWS\system32\prunnet.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, prunnet
| appmgmts.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}, DLLName
| Autoruns items detected - 86, recognized as trusted - 80
| | ||||||
| File name | Type | Description | Manufacturer | CLSID
| BHO | AutorunsDisabled | Delete BHO | {02478D38-C3F9-4efb-9B51-7695ECA05670} | Delete C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll | Script: Quarantine, Delete, BC delete BHO | SBSD IE Protection | © 2000-2008 Safer Networking Limited. Alle Rechte vorbehalten. | {53707962-6F74-2D53-2644-206D7942484F} | Delete BHO | {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} | Delete c:\Program Files\Microsoft Money\System\mnyviewer.dll | Script: Quarantine, Delete, BC delete BHO | MoneySide Controls | Copyright (C) Microsoft Corp. 1990-2001. All rights reserved. | {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} | Delete c:\Program Files\Microsoft Money\System\mnyviewer.dll | Script: Quarantine, Delete, BC delete Extension module | MoneySide Controls | Copyright (C) Microsoft Corp. 1990-2001. All rights reserved. | AutorunsDisabled | Delete Extension module | {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} | Delete Extension module | {E023F504-0C5A-4750-A1E7-A9046DEA8A21} | Delete Elements detected - 12, recognized as trusted - 4
| | |||||||||||||||||||||
| File name | Destination | Description | Manufacturer | CLSID
| Shell extensions for file compression | {764BF0E1-F219-11ce-972D-00AA00A14F56}
| Encryption Context Menu | {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}
| Taskbar and Start Menu | {0DF44EAA-FF21-4412-828E-260A8728E7F1}
| Media Band | {32683183-48a0-441b-a342-7c2a440a9478}
| User Accounts | {7A9D77BD-5403-11d2-8785-2E0420524153}
| AlcoholShellEx | {32020A01-506E-484D-A2A8-BE3CF17601C3}
| rundll32.exe C:\WINDOWS\system32\shimgvw.dll,ImageView_COMServer {00E7B358-F65B-4dcf-83DF-CD026B94BFD4} | Script: Quarantine, Delete, BC delete Autoplay for SlideShow | {00E7B358-F65B-4dcf-83DF-CD026B94BFD4}
| Elements detected - 184, recognized as trusted - 177
| | ||||||||||||||||||||||||||
| File name | Type | Name | Description | Manufacturer
| Elements detected - 8, recognized as trusted - 8
| | ||||||
| File name | Job name | Job status | Description | Manufacturer
| C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe | Script: Quarantine, Delete, BC delete Uniblue SpeedUpMyPC.job | One or more of the properties that are needed to run this task on a schedule have not been set. |
| Elements detected - 3, recognized as trusted - 2
| | |||||||
| Manufacturer | Status | EXE file | Description | GUID
| Detected - 3, recognized as trusted - 3
| | ||||||
| Manufacturer | EXE file | Description
| Detected - 17, recognized as trusted - 17
| | ||||||
| File name | Description | Manufacturer | CLSID | Source URL
| Microsoft XML Parser for Java | Delete file://C:\WINDOWS\Java\classes\xmldso.cab
| {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} | Delete http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
| Elements detected - 2, recognized as trusted - 0
| | ||||||||||||
| File name | Description | Manufacturer
| C:\WINDOWS\system32\plugincpl131.cpl | Script: Quarantine, Delete, BC delete JavaPlugin | Copyright ¨ 2000
| C:\WINDOWS\system32\UICONFIG.cpl | Script: Quarantine, Delete, BC delete Easy Access User Interface Configuration Helper (Control Panel Applet) | Copyright (C) Compaq Computer Corporation 2002
| Elements detected - 28, recognized as trusted - 26
| | ||||||
| File name | Description | Manufacturer | CLSID
| Elements detected - 15, recognized as trusted - 15
| | ||||||
Hosts file record
|
| File name | Type | Description | Manufacturer | CLSID
| mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| Elements detected - 29, recognized as trusted - 26
| | ||||||
| File | Description | Type
| C:\WINDOWS\System32\Drivers\aswSP.SYS | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| C:\WINDOWS\system32\Drivers\sptd.sys | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Kernel-mode hook
| |
AVZ Antiviral Toolkit log; AVZ version is 4.30 Scanning started at 2/16/2009 6:26:45 PM Database loaded: signatures - 210419, NN profile(s) - 2, microprograms of healing - 56, signature database released 16.02.2009 21:21 Heuristic microprograms loaded: 372 SPV microprograms loaded: 9 Digital signatures of system files loaded: 96054 Heuristic analyzer mode: Maximum heuristics level Healing mode: disabled Windows version: 5.1.2600, Service Pack 3 ; AVZ is launched with administrator rights System Restore: enabled 1. Searching for Rootkits and programs intercepting API functions 1.1 Searching for user-mode API hooks Analysis: kernel32.dll, export table found in section .text Analysis: ntdll.dll, export table found in section .text Analysis: user32.dll, export table found in section .text Analysis: advapi32.dll, export table found in section .text Analysis: ws2_32.dll, export table found in section .text Analysis: wininet.dll, export table found in section .text Analysis: rasapi32.dll, export table found in section .text Analysis: urlmon.dll, export table found in section .text Analysis: netapi32.dll, export table found in section .text 1.2 Searching for kernel-mode API hooks Driver loaded successfully SDT found (RVA=083220) Kernel ntoskrnl.exe found in memory at address 804D7000 SDT = 8055A220 KiST = 804E26A8 (284) Function NtClose (19) intercepted (805678DD->AE5C66B8), hook C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted Function NtCreateKey (29) intercepted (8057065D->AE5C6574), hook C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted Function NtDeleteValueKey (41) intercepted (80592D5C->AE5C6A52), hook C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted Function NtDuplicateObject (44) intercepted (805715E0->AE5C614C), hook C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted Function NtEnumerateKey (47) intercepted (80570D64->F7702C7E), hook C:\WINDOWS\system32\Drivers\sptd.sys Function NtEnumerateValueKey (49) intercepted (80590677->F7702FF6), hook C:\WINDOWS\system32\Drivers\sptd.sys Function NtOpenKey (77) intercepted (80568D59->AE5C664E), hook C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted Function NtOpenProcess (7A) intercepted (805717C7->AE5C608C), hook C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted Function NtOpenThread (80) intercepted (8058A1C9->AE5C60F0), hook C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted Function NtQueryKey (A0) intercepted (80570A6D->F77030C0), hook C:\WINDOWS\system32\Drivers\sptd.sys Function NtQueryValueKey (B1) intercepted (8056A1F2->AE5C676E), hook C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted Function NtRestoreKey (CC) intercepted (8064ECA9->AE5C672E), hook C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted Function NtSetValueKey (F7) intercepted (80572889->AE5C68AE), hook C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted Functions checked: 284, intercepted: 13, restored: 0 1.3 Checking IDT and SYSENTER Analysis for CPU 1 Checking IDT and SYSENTER - complete 1.4 Searching for masking processes and drivers Checking not performed: extended monitoring driver (AVZPM) is not installed Driver loaded successfully 1.5 Checking of IRP handlers \FileSystem\ntfs[IRP_MJ_CREATE] = 877989C0 -> hook not defined \FileSystem\ntfs[IRP_MJ_CLOSE] = 877989C0 -> hook not defined \FileSystem\ntfs[IRP_MJ_WRITE] = 877989C0 -> hook not defined \FileSystem\ntfs[IRP_MJ_QUERY_INFORMATION] = 877989C0 -> hook not defined \FileSystem\ntfs[IRP_MJ_SET_INFORMATION] = 877989C0 -> hook not defined \FileSystem\ntfs[IRP_MJ_QUERY_EA] = 877989C0 -> hook not defined \FileSystem\ntfs[IRP_MJ_SET_EA] = 877989C0 -> hook not defined \FileSystem\ntfs[IRP_MJ_QUERY_VOLUME_INFORMATION] = 877989C0 -> hook not defined \FileSystem\ntfs[IRP_MJ_SET_VOLUME_INFORMATION] = 877989C0 -> hook not defined \FileSystem\ntfs[IRP_MJ_DIRECTORY_CONTROL] = 877989C0 -> hook not defined \FileSystem\ntfs[IRP_MJ_FILE_SYSTEM_CONTROL] = 877989C0 -> hook not defined \FileSystem\ntfs[IRP_MJ_DEVICE_CONTROL] = 877989C0 -> hook not defined \FileSystem\ntfs[IRP_MJ_LOCK_CONTROL] = 877989C0 -> hook not defined \FileSystem\ntfs[IRP_MJ_QUERY_SECURITY] = 877989C0 -> hook not defined \FileSystem\ntfs[IRP_MJ_SET_SECURITY] = 877989C0 -> hook not defined \FileSystem\ntfs[IRP_MJ_PNP] = 877989C0 -> hook not defined \driver\disk[IRP_MJ_CREATE] = 87798C78 -> hook not defined \driver\disk[IRP_MJ_CLOSE] = 87798C78 -> hook not defined \driver\disk[IRP_MJ_READ] = 87798C78 -> hook not defined \driver\disk[IRP_MJ_WRITE] = 87798C78 -> hook not defined \driver\disk[IRP_MJ_PNP] = 87798C78 -> hook not defined Checking - complete 2. Scanning memory Number of processes found: 25 Number of modules loaded: 322 Scanning memory - complete 3. Scanning disks 4. Checking Winsock Layered Service Provider (SPI/LSP) LSP settings checked. No errors detected 5. Searching for keyboard/mouse/windows events hooks (Keyloggers, Trojan DLLs) 6. Searching for opened TCP/UDP ports used by malicious programs Checking disabled by user 7. Heuristic system check Checking - complete 8. Searching for vulnerabilities >> Services: potentially dangerous service allowed: TermService (Terminal Services) >> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery Service) >> Services: potentially dangerous service allowed: Schedule (Task Scheduler) >> Services: potentially dangerous service allowed: RDSessMgr (Remote Desktop Help Session Manager) > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)! >> Security: disk drives' autorun is enabled >> Security: administrative shares (C$, D$ ...) are enabled >> Security: anonymous user access is enabled Checking - complete 9. Troubleshooting wizard >> Service termination timeout is out of admissible values >> HDD autorun are allowed >> Autorun from network drives are allowed >> Removable media autorun are allowed Checking - complete Files scanned: 347, extracted from archives: 0, malicious software found 0, suspicions - 0 Scanning finished at 2/16/2009 6:27:22 PM Time of scanning: 00:00:39 If you have a suspicion on presence of viruses or questions on the suspected objects, you can address http://virusinfo.info conference System Analysis in progressAdd commands to script:
Script commands