AVZ 4.30 http://z-oleg.com/secur/avz/
| File name | PID | Description | Copyright | MD5 | Information
| c:\progra~1\common~1\aol\acs\acsd.exe | Script: Quarantine, Delete, BC delete, Terminate 764 | AOL Connectivity Service | Copyright © 2003 America Online, Inc. | ?? | 1401.22 kb, rsAh, | created: 11/14/2003 2:11:21 PM, modified: 4/21/2004 12:16:02 PM Command line: C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe c:\windows\system32\alg.exe | Script: Quarantine, Delete, BC delete, Terminate 2924 | Application Layer Gateway Service | © Microsoft Corporation. All rights reserved. | ?? | 43.50 kb, rsah, | created: 8/29/2002 6:00:00 AM, modified: 8/4/2004 3:56:47 AM Command line: C:\WINDOWS\System32\alg.exe c:\documents and settings\stacy\desktop\avz4\avz.exe | Script: Quarantine, Delete, BC delete, Terminate 952 | ???????????? ??????? AVZ | ???????????? ??????? AVZ | ?? | 716.50 kb, rsAh, | created: 2/9/2009 3:37:52 PM, modified: 2/9/2009 3:37:52 PM Command line: "C:\Documents and Settings\Stacy\Desktop\avz4\avz.exe" c:\program files\sharp\button manager g\btnman.exe | Script: Quarantine, Delete, BC delete, Terminate 2500 | Button Manager | Copyright (c) 2000-2004 SHARP CORPORATION | ?? | 172.00 kb, rsAh, | created: 4/15/2009 9:42:07 AM, modified: 9/14/2004 6:13:12 AM Command line: "C:\Program Files\SHARP\Button Manager G\btnman.exe" c:\program files\ca\ca internet security suite\ca anti-spyware\cappactiveprotection.exe | Script: Quarantine, Delete, BC delete, Terminate 2152 | CAPPActiveProtection Application | Copyright (C) 2006 CA | ?? | 213.26 kb, rsAh, | created: 8/16/2007 9:10:14 PM, modified: 8/16/2007 9:10:14 PM Command line: "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe" c:\program files\ca\ca internet security suite\ca anti-virus\cavrid.exe | Script: Quarantine, Delete, BC delete, Terminate 3580 | CA Anti-Virus Realtime Infection Report | (c) Copyright 2006 CA, Inc. | ?? | 225.26 kb, rsAh, | created: 4/21/2009 3:36:04 PM, modified: 8/20/2007 1:36:38 PM Command line: "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" c:\program files\ca\ca internet security suite\ccprovsp.exe | Script: Quarantine, Delete, BC delete, Terminate 3428 | CCProvSP | (c) Copyright 2006 CA, Inc. | ?? | 209.23 kb, rsAh, | created: 4/21/2009 3:35:11 PM, modified: 4/21/2009 3:42:51 PM Command line: "C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe" c:\program files\ca\ca internet security suite\cctray\cctray.exe | Script: Quarantine, Delete, BC delete, Terminate 1948 | CA Common Tray | (c) Copyright 2007 CA, Inc. | ?? | 173.23 kb, rsAh, | created: 4/21/2009 3:35:11 PM, modified: 4/21/2009 3:42:50 PM Command line: "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe" c:\windows\explorer.exe | Script: Quarantine, Delete, BC delete, Terminate 736 | Windows Explorer | © Microsoft Corporation. All rights reserved. | ?? | 1009.00 kb, rsAh, | created: 8/29/2002 6:00:00 AM, modified: 6/13/2007 6:23:07 AM Command line: C:\WINDOWS\Explorer.EXE c:\program files\embarq online security\common\fameh32.exe | Script: Quarantine, Delete, BC delete, Terminate 1540 | F-Secure Alert and Management Extension Handler | Copyright © 1998-2007 F-Secure Corporation. All rights reserved. | ?? | 376.00 kb, rsAh, | created: 1/16/2008 2:13:52 PM, modified: 4/26/2007 7:43:26 AM Command line: 1.3.6.1.4.1.2213.11.1.18 c:\program files\embarq online security\common\fch32.exe | Script: Quarantine, Delete, BC delete, Terminate 820 | F-Secure Configuration Handler | Copyright © 1998-2007 F-Secure Corporation. All rights reserved. | ?? | 116.05 kb, rsAh, | created: 1/16/2008 2:13:32 PM, modified: 4/26/2007 7:43:26 AM Command line: 1.3.6.1.4.1.2213.11.1.15 c:\program files\embarq online security\common\fsma32.exe | Script: Quarantine, Delete, BC delete, Terminate 1340 | F-Secure Management Agent | Copyright © 1998-2007 F-Secure Corporation. All rights reserved. | ?? | 104.05 kb, rsAh, | created: 1/16/2008 2:13:46 PM, modified: 4/26/2007 7:43:26 AM Command line: "C:\Program Files\EMBARQ Online Security\Common\FSMA32.EXE" c:\program files\embarq online security\common\fsmb32.exe | Script: Quarantine, Delete, BC delete, Terminate 1836 | F-Secure Message Broker | Copyright © 1998-2007 F-Secure Corporation. All rights reserved. | ?? | 220.05 kb, rsAh, | created: 1/16/2008 2:13:47 PM, modified: 4/26/2007 7:43:26 AM Command line: 1.3.6.1.4.1.2213.11.1.23 c:\program files\sharp\sharpdesk\indexer.exe | Script: Quarantine, Delete, BC delete, Terminate 3464 | Indexer Module | Copyright (C) 2000-2005 | ?? | 180.00 kb, rsAh, | created: 11/16/2005 12:20:18 PM, modified: 11/16/2005 12:20:18 PM Command line: "C:\Program Files\Sharp\Sharpdesk\Indexer.exe" c:\program files\sharp\sharpdesk\indextray.exe | Script: Quarantine, Delete, BC delete, Terminate 3200 | IndexTray Module | Copyright (C) 2000-2005 | ?? | 104.00 kb, rsAh, | created: 11/16/2005 12:19:16 PM, modified: 11/16/2005 12:19:16 PM Command line: "C:\Program Files\Sharp\Sharpdesk\IndexTray.exe" c:\program files\ca\ca internet security suite\ca anti-virus\isafe.exe | Script: Quarantine, Delete, BC delete, Terminate 968 | CA ISafe Service | © 2004 Computer Associates International, Inc. | ?? | 141.56 kb, rsAh, | created: 4/21/2009 3:36:04 PM, modified: 8/20/2007 1:27:26 PM Command line: "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe" c:\program files\ca\sharedcomponents\pprt\bin\itmrtsvc.exe | Script: Quarantine, Delete, BC delete, Terminate 1396 | eTrust PestPatrol Real-time service | Copyright © 2006 CA, Inc. All rights reserved. | ?? | 273.52 kb, rsAh, | created: 1/4/2007 12:10:22 PM, modified: 1/4/2007 12:10:22 PM Command line: "C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe" c:\windows\system32\lsass.exe | Script: Quarantine, Delete, BC delete, Terminate 228 | LSA Shell (Export Version) | © Microsoft Corporation. All rights reserved. | ?? | 13.00 kb, rsah, | created: 8/29/2002 6:00:00 AM, modified: 8/4/2004 3:56:50 AM Command line: C:\WINDOWS\system32\lsass.exe c:\program files\jawssystems\jaws pdf creator\pdfclient.exe | Script: Quarantine, Delete, BC delete, Terminate 2892 | Jaws PDFClient Application | Copyright (C) 1997-2003 Global Graphics Software Ltd. | ?? | 308.00 kb, rsAh, | created: 1/20/2004 1:32:29 PM, modified: 12/9/2003 12:11:06 PM Command line: "C:\Program Files\JawsSystems\Jaws PDF Creator\PDFClient.exe" c:\windows\system32\pdfcreatormessages.exe | Script: Quarantine, Delete, BC delete, Terminate 216 | PDFCreatorMessages Module | Copyright 2002 | ?? | 136.00 kb, rsah, | created: 1/20/2004 1:32:31 PM, modified: 12/9/2003 12:48:40 PM Command line: C:\WINDOWS\SYSTEM32\PDFCreatorMessages.exe c:\program files\tracker software\pdf-xchange 3\pdfsaver\pdfsaver3.exe | Script: Quarantine, Delete, BC delete, Terminate 2972 | pdfSaver for PDF-XChange 3.0 | Copyright © 2001-2006 by Tracker Software Products Ltd. | ?? | 2036.00 kb, rsAh, | created: 4/22/2009 12:09:13 PM, modified: 1/10/2007 11:46:28 AM Command line: "C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe" c:\program files\ca\ca internet security suite\ca anti-spyware\ppctlpriv.exe | Script: Quarantine, Delete, BC delete, Terminate 1024 | CA Anti-Spyware Elevation service | Copyright (C) 2007 CA | ?? | 185.26 kb, rsAh, | created: 8/16/2007 9:10:16 PM, modified: 8/16/2007 9:10:16 PM Command line: "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe" c:\program files\ca\ca internet security suite\ca anti-spam\qsp-5.1.18.0\qoeloader.exe | Script: Quarantine, Delete, BC delete, Terminate 3284 | QOELoader Application | Copyright © 2006 CA. All rights reserved. | ?? | 13.76 kb, rsAh, | created: 4/21/2009 3:35:53 PM, modified: 4/21/2009 3:35:50 PM Command line: "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-5.1.18.0\QOELoader.exe" c:\program files\quicktime\qttask.exe | Script: Quarantine, Delete, BC delete, Terminate 2596 | | © Apple Computer, Inc. 2001-2003 | ?? | 76.00 kb, rsAh, | created: 11/14/2003 2:13:01 PM, modified: 11/14/2003 2:13:01 PM Command line: "C:\Program Files\QuickTime\qttask.exe" -atboottime c:\windows\system32\services.exe | Script: Quarantine, Delete, BC delete, Terminate 176 | Services and Controller app | © Microsoft Corporation. All rights reserved. | ?? | 108.00 kb, rsah, | created: 8/29/2002 6:00:00 AM, modified: 2/6/2009 1:14:03 PM Command line: C:\WINDOWS\system32\services.exe c:\program files\sharp\sharpdesk\sharptray.exe | Script: Quarantine, Delete, BC delete, Terminate 3796 | SharpTray Module | Copyright (C) 2000-2005 | ?? | 32.00 kb, rsAh, | created: 11/16/2005 12:33:42 PM, modified: 11/16/2005 12:33:42 PM Command line: "C:\Program Files\Sharp\Sharpdesk\SharpTray.exe" c:\windows\system32\spoolsv.exe | Script: Quarantine, Delete, BC delete, Terminate 1808 | Spooler SubSystem App | © Microsoft Corporation. All rights reserved. | ?? | 56.50 kb, rsah, | created: 8/29/2002 6:00:00 AM, modified: 6/10/2005 7:53:32 PM Command line: C:\WINDOWS\system32\spoolsv.exe c:\windows\system32\svchost.exe | Script: Quarantine, Delete, BC delete, Terminate 1856 | Generic Host Process for Win32 Services | © Microsoft Corporation. All rights reserved. | ?? | 14.00 kb, rsah, | created: 8/29/2002 6:00:00 AM, modified: 8/4/2004 3:56:57 AM Command line: C:\WINDOWS\system32\svchost -k rpcss c:\windows\system32\svchost.exe | Script: Quarantine, Delete, BC delete, Terminate 1068 | Generic Host Process for Win32 Services | © Microsoft Corporation. All rights reserved. | ?? | 14.00 kb, rsah, | created: 8/29/2002 6:00:00 AM, modified: 8/4/2004 3:56:57 AM Command line: C:\WINDOWS\System32\svchost.exe -k imgsvc c:\windows\system32\svchost.exe | Script: Quarantine, Delete, BC delete, Terminate 500 | Generic Host Process for Win32 Services | © Microsoft Corporation. All rights reserved. | ?? | 14.00 kb, rsah, | created: 8/29/2002 6:00:00 AM, modified: 8/4/2004 3:56:57 AM Command line: C:\WINDOWS\System32\svchost.exe -k netsvcs c:\windows\system32\svchost.exe | Script: Quarantine, Delete, BC delete, Terminate 888 | Generic Host Process for Win32 Services | © Microsoft Corporation. All rights reserved. | ?? | 14.00 kb, rsah, | created: 8/29/2002 6:00:00 AM, modified: 8/4/2004 3:56:57 AM Command line: C:\WINDOWS\System32\svchost.exe -k NetworkService c:\windows\system32\svchost.exe | Script: Quarantine, Delete, BC delete, Terminate 1236 | Generic Host Process for Win32 Services | © Microsoft Corporation. All rights reserved. | ?? | 14.00 kb, rsah, | created: 8/29/2002 6:00:00 AM, modified: 8/4/2004 3:56:57 AM Command line: C:\WINDOWS\System32\svchost.exe -k LocalService c:\windows\system32\svchost.exe | Script: Quarantine, Delete, BC delete, Terminate 1632 | Generic Host Process for Win32 Services | © Microsoft Corporation. All rights reserved. | ?? | 14.00 kb, rsah, | created: 8/29/2002 6:00:00 AM, modified: 8/4/2004 3:56:57 AM Command line: C:\WINDOWS\system32\svchost -k DcomLaunch c:\program files\ca\ca internet security suite\ca anti-virus\vetmsg.exe | Script: Quarantine, Delete, BC delete, Terminate 1320 | CA Anti-Virus Realtime Messaging Service | (c) Copyright 2006 CA, Inc. | ?? | 237.26 kb, rsAh, | created: 4/21/2009 3:36:04 PM, modified: 8/20/2007 1:36:42 PM Command line: "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe" c:\windows\system32\winlogon.exe | Script: Quarantine, Delete, BC delete, Terminate 1956 | Windows NT Logon Application | © Microsoft Corporation. All rights reserved. | ?? | 490.50 kb, rsah, | created: 8/29/2002 6:00:00 AM, modified: 8/4/2004 3:56:57 AM Command line: winlogon.exe c:\windows\system32\wuauclt.exe | Script: Quarantine, Delete, BC delete, Terminate 2588 | Windows Update Automatic Updates | © Microsoft Corporation. All rights reserved. | ?? | 50.02 kb, rsAh, | created: 8/29/2002 6:00:00 AM, modified: 10/16/2008 3:09:44 PM Command line: "C:\WINDOWS\system32\wuauclt.exe" Detected:48, recognized as trusted 27
| | |||||
| Module | Base address | Size in memory | Description | Manufacturer
| C:\WINDOWS\system32\drivers\Afc.sys | Script: Quarantine, Delete, BC delete F8A77000 | 008000 (32768) | Arcsoft(R) ASPI Shell | (C) Arcsoft, Inc. 1999-2005. All rights reserved.
| C:\WINDOWS\System32\Drivers\dump_atapi.sys | Script: Quarantine, Delete, BC delete EF583000 | 018000 (98304) |
| C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS | Script: Quarantine, Delete, BC delete F8C81000 | 002000 (8192) |
| C:\WINDOWS\system32\Drivers\eskddiwc.sys | Script: Quarantine, Delete, BC delete F89B7000 | 006000 (24576) | Andrea Audio Stub Driver | Copyright © 1999-2002 Andrea Electronics Corporation
| C:\WINDOWS\System32\Drivers\VET-FILT.SYS | Script: Quarantine, Delete, BC delete F8ABF000 | 006000 (24576) | CA Antivirus File Protection Driver | © 2004 Computer Associates International, Inc.
| C:\WINDOWS\System32\Drivers\VET-REC.SYS | Script: Quarantine, Delete, BC delete F8C1B000 | 004000 (16384) | CA Antivirus File Protection Driver | © 2004 Computer Associates International, Inc.
| C:\WINDOWS\System32\Drivers\VETEBOOT.SYS | Script: Quarantine, Delete, BC delete EF77B000 | 018000 (98304) | RealTime Anti-Virus Protection Driver | Copyright © 1996-2004 Computer Associates International, Inc.
| C:\WINDOWS\System32\Drivers\VETEFILE.SYS | Script: Quarantine, Delete, BC delete EF7BB000 | 0C4000 (802816) | RealTime Anti-Virus Protection Driver | Copyright © 1996-2004 Computer Associates International, Inc.
| C:\WINDOWS\System32\Drivers\VETFDDNT.SYS | Script: Quarantine, Delete, BC delete F8C13000 | 004000 (16384) | CA Antivirus File Protection Driver | © 2006 Computer Associates International, Inc.
| C:\WINDOWS\System32\Drivers\VETMONNT.SYS | Script: Quarantine, Delete, BC delete F8AC7000 | 007000 (28672) | CA Antivirus File Protection Driver | © 2006 Computer Associates International, Inc.
| Modules detected - 125, recognized as trusted - 115
| | ||||||
| File name | Status | Startup method | Description
| C:\Documents and Settings\Stacy\Desktop\OTListIt2.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\RunOnce, OTListIt
| C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-5.1.18.0\QOELoader.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, QOELOADER
| C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, CAVRID
| C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, cctray
| C:\Program Files\JawsSystems\Jaws PDF Creator\PDFClient.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, PDFCreatorClient
| C:\Program Files\SHARP\Button Manager G\btnman.exe | Script: Quarantine, Delete, BC delete Active | Shortcut in Autoruns folder | C:\Documents and Settings\All Users\Start Menu\Programs\Startup\, C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Button Manager G.lnk,
| C:\Program Files\Sharp\Sharpdesk\IndexTray.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, IndexTray
| C:\Program Files\Sharp\Sharpdesk\Indexer.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, Indexer
| C:\Program Files\Sharp\Sharpdesk\SharpTray.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, SharpTray
| C:\Program Files\Sharp\Sharpdesk\TypeRegChecker.exe | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, TypeRegChecker
| C:\WINDOWS\winstart.bat | Script: Quarantine, Delete, BC delete -- | File in Autoruns folder | C:\WINDOWS\, C:\WINDOWS\winstart.bat,
| WgaLogon.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon, DLLName
| appmgmts.dll | Script: Quarantine, Delete, BC delete Active | Registry key | HKEY_LOCAL_MACHINE, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}, DLLName
| autocheck autochk * lsdelete | Script: Quarantine, Delete, BC delete -- | Registry key | HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager, BootExecute
| Autoruns items detected - 64, recognized as trusted - 50
| | ||||||
| File name | Type | Description | Manufacturer | CLSID
| BHO | {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} | Delete C:\WINDOWS\system32\comdlg32n.dll | Script: Quarantine, Delete, BC delete BHO | {7846CD13-76D6-4C18-89AD-369ED4935B53} | Delete c:\windows\system32\cmdial32f.dll | Script: Quarantine, Delete, BC delete BHO | DS Authorization for Services | © Microsoft Corporation. All rights reserved. | {79997E2D-2255-4D36-9AFA-1564A8CEB07A} | Delete Extension module | {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} | Delete Elements detected - 10, recognized as trusted - 6
| | ||||||||||||||
| File name | Destination | Description | Manufacturer | CLSID
| deskpan.dll | Script: Quarantine, Delete, BC delete Display Panning CPL Extension | {42071714-76d4-11d1-8b24-00a0c9068ff3}
| Shell extensions for file compression | {764BF0E1-F219-11ce-972D-00AA00A14F56}
| Encryption Context Menu | {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}
| Taskbar and Start Menu | {0DF44EAA-FF21-4412-828E-260A8728E7F1}
| Media Band | {32683183-48a0-441b-a342-7c2a440a9478}
| User Accounts | {7A9D77BD-5403-11d2-8785-2E0420524153}
| C:\WINDOWS\system32\mscoree.dll | Script: Quarantine, Delete, BC delete Fusion Cache | Microsoft .NET Runtime Execution Engine | © Microsoft Corporation. All rights reserved. | {1D2680C9-0E2A-469d-B787-065558BC7D43}
| C:\PROGRA~1\WINZIP\WZSHLSTB.DLL | Script: Quarantine, Delete, BC delete WinZip | WinZip Shell Extension DLL | Copyright (c) WinZip Computing, Inc. 1991-2003 - All Rights Reserved | {E0D79304-84BE-11CE-9641-444553540000}
| C:\PROGRA~1\WINZIP\WZSHLSTB.DLL | Script: Quarantine, Delete, BC delete WinZip | WinZip Shell Extension DLL | Copyright (c) WinZip Computing, Inc. 1991-2003 - All Rights Reserved | {E0D79305-84BE-11CE-9641-444553540000}
| C:\PROGRA~1\WINZIP\WZSHLSTB.DLL | Script: Quarantine, Delete, BC delete WinZip | WinZip Shell Extension DLL | Copyright (c) WinZip Computing, Inc. 1991-2003 - All Rights Reserved | {E0D79306-84BE-11CE-9641-444553540000}
| C:\PROGRA~1\WINZIP\WZSHLSTB.DLL | Script: Quarantine, Delete, BC delete WinZip | WinZip Shell Extension DLL | Copyright (c) WinZip Computing, Inc. 1991-2003 - All Rights Reserved | {E0D79307-84BE-11CE-9641-444553540000}
| AVG Shell Extension | {1E2CDF40-419B-11D2-A5A1-002018648BA7}
| SPTHandler | {BD88A479-9623-4897-8546-BC62B9628F44}
| Shell Extension for Malware scanning | {45AC2688-0253-4ED8-97DE-B5370FA7D48A}
| C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\avshlext.dll | Script: Quarantine, Delete, BC delete CA_AntiVirus | CA Anti-Virus Shell Extension Handler | (c) Copyright 2007 CA, Inc. | {1CE2AA40-1317-11D3-9922-00104B0AD431}
| Elements detected - 186, recognized as trusted - 171
| | ||||||||||||||||||||||||||||||||
| File name | Type | Name | Description | Manufacturer
| C:\WINDOWS\System32\PDFCreator.DLL | Script: Quarantine, Delete, BC delete Monitor | Jaws PDF Creator Port | Jaws PDF Creator | Copyright (C) 1997-2003 Global Graphics Software Ltd.
| Elements detected - 11, recognized as trusted - 10
| | ||||||
| File name | Job name | Job status | Description | Manufacturer
| C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAAntiSpyware.exe | Script: Quarantine, Delete, BC delete CAAntiSpywareScan_Daily as Stacy at 3 35 PM.job | The task is ready to run at its next scheduled time. | CAAntiSpyware Application | Copyright (C) 2006 CA
| Elements detected - 2, recognized as trusted - 1
| | ||||||
| Manufacturer | Status | EXE file | Description | GUID
| Detected - 3, recognized as trusted - 3
| | ||||||
| Manufacturer | EXE file | Description
| Detected - 19, recognized as trusted - 19
| | ||||||
| File name | Description | Manufacturer | CLSID | Source URL
| DirectAnimation Java Classes | Delete file://C:\WINDOWS\Java\classes\dajava.cab
| Microsoft XML Parser for Java | Delete file://C:\WINDOWS\Java\classes\xmldso.cab
| {33564D57-9980-0010-8000-00AA00389B71} | Delete http://codecs.microsoft.com/codecs/i386/wmv9dmo.cab
| C:\WINDOWS\System32\mcinsctl.dll | Script: Quarantine, Delete, BC delete McAfee Security Installer Control | Copyright © 1998-2002 Networks Associates Technology, Inc. | {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} | Delete http://bin.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,72/mcinsctl.cab
| C:\WINDOWS\System32\McGDMgr.dll | Script: Quarantine, Delete, BC delete McAfee Security Download Control | Copyright © 1998-2002 Networks Associates Technology, Inc | {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} | Delete http://bin.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,15/mcgdmgr.cab
| Elements detected - 13, recognized as trusted - 8
| | |||||||||||||||
| File name | Description | Manufacturer
| C:\WINDOWS\system32\B57exp.cpl | Script: Quarantine, Delete, BC delete Broadcom Advanced Control Suite | Copyright(C) 2000-2003 Broadcom Corporation, All Rights Reserved
| C:\WINDOWS\system32\PDFCreator.cpl | Script: Quarantine, Delete, BC delete Jaws PDF Creator Control Panel Applet | Copyright (C) 1997-2003 Global Graphics Software Ltd.
| Elements detected - 30, recognized as trusted - 28
| | ||||||
| File name | Description | Manufacturer | CLSID
| Elements detected - 15, recognized as trusted - 15
| | ||||||
Hosts file record
|
| File name | Type | Description | Manufacturer | CLSID
| C:\WINDOWS\System32\mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| C:\WINDOWS\System32\mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| C:\WINDOWS\System32\mscoree.dll | Script: Quarantine, Delete, BC delete Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| C:\Program Files\Sharp\Sharpdesk\ExplorerExtensions.dll | Script: Quarantine, Delete, BC delete Handler | ExplorerExtensions Module (SharpDesk Thumbnail Extractor Protocol) | Copyright (C) 2000-2005 | {79E0F14C-9C52-4218-89A7-7C4B0563D121}
| Elements detected - 31, recognized as trusted - 27
| | ||||||
| File | Description | Type
| C:\WINDOWS\system32\Drivers\uti2mte1.sys | Script: Quarantine, Delete, BC delete Suspicion for Rootkit | Suspicion for Rootkit
| C:\WINDOWS\SYSTEM32\comdlg32n.dll | Script: Quarantine, Delete, BC delete Suspicion by File scanner | Suspicion for Rootkit.Win32.Podnuha.du ( 0A940841 04AE5E05 0021B044 00216CD7 88064)
| C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-5.1.18.0\QOEHook.dll | Script: Quarantine, Delete, BC delete Suspicion for Keylogger | Suspicion for Keylogger or Trojan DLL
| |
AVZ Antiviral Toolkit log; AVZ version is 4.30 Scanning started at 4/22/2009 12:25:53 PM Database loaded: signatures - 219778, NN profile(s) - 2, microprograms of healing - 56, signature database released 21.04.2009 23:23 Heuristic microprograms loaded: 372 SPV microprograms loaded: 9 Digital signatures of system files loaded: 108605 Heuristic analyzer mode: Medium heuristics level Healing mode: enabled Windows version: 5.1.2600, Service Pack 2 ; AVZ is launched with administrator rights System Restore: enabled 1. Searching for Rootkits and programs intercepting API functions 1.1 Searching for user-mode API hooks Analysis: kernel32.dll, export table found in section .text Analysis: ntdll.dll, export table found in section .text Analysis: user32.dll, export table found in section .text Analysis: advapi32.dll, export table found in section .text Analysis: ws2_32.dll, export table found in section .text Analysis: wininet.dll, export table found in section .text Analysis: rasapi32.dll, export table found in section .text Analysis: urlmon.dll, export table found in section .text Analysis: netapi32.dll, export table found in section .text 1.2 Searching for kernel-mode API hooks Error loading driver - checking interrupted [C0000022] >>>> Suspicion for Rootkit uti2mte1 C:\WINDOWS\system32\Drivers\uti2mte1.sys 1.4 Searching for masking processes and drivers Checking not performed: extended monitoring driver (AVZPM) is not installed Error loading driver - checking interrupted [C0000022] 2. Scanning memory Number of processes found: 47 Number of modules loaded: 357 Scanning memory - complete 3. Scanning disks Direct reading C:\Documents and Settings\Stacy\Local Settings\Temp\~DF4665.tmp Direct reading C:\Documents and Settings\Stacy\Local Settings\Temp\~DF4670.tmp Direct reading C:\Documents and Settings\Stacy\Local Settings\Temp\~DF9C70.tmp Direct reading C:\Documents and Settings\Stacy\Local Settings\Temp\~DFDCEE.tmp Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\70Hotfix_PSC7\17\bin\gui\fslapi.dll Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\70Hotfix_PSC7\17\bin\gui\gres.dll Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\70Hotfix_PSC7\17\bin\gui\SetupGUI.exe Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\70Hotfix_PSC7\17\bin\gui\SetupGUIMngr.exe Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\70Hotfix_PSC7\17\bin\ih8run.exe Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\70Hotfix_PSC7\17\hf\IS7_HF08-55574-unsigned.jar Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\70Hotfix_PSC7\17\hf\PSC7_HF01-Charter_SecondaryAction-unsigned.jar Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\70Hotfix_PSC7MF5\20\bin\gui\fslapi.dll Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\70Hotfix_PSC7MF5\20\bin\gui\gres.dll Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\70Hotfix_PSC7MF5\20\bin\gui\SetupGUI.exe Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\70Hotfix_PSC7MF5\20\bin\gui\SetupGUIMngr.exe Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\70Hotfix_PSC7MF5\20\bin\ih8run.exe Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\70Hotfix_PSC7MF5\20\hf\fsav741-01-signed.jar Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\70Hotfix_PSC7MF5\20\hf\fsav743-01-smash_signed.jar Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\70Hotfix_PSC7MF5\20\hf\PSC7_HF01-Charter_SecondaryAction-unsigned.jar Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\70Hotfix_PSC7MF5\20\hf\PSC7_HF10-unsigned.jar Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\70Hotfix_PSC7MF5\20\hf\PSC7_HF12_FW-unsigned.jar Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\70Hotfix_PSC7MF5\20\hf\PSC7_HF13-smash_signed.jar Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\70Hotfix_PSC7MF8\21\bin\gui\fslapi.dll Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\70Hotfix_PSC7MF8\21\bin\gui\gres.dll Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\70Hotfix_PSC7MF8\21\bin\gui\SetupGUI.exe Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\70Hotfix_PSC7MF8\21\bin\gui\SetupGUIMngr.exe Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\70Hotfix_PSC7MF8\21\bin\ih8run.exe Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\70Hotfix_PSC7MF8\21\hf\fsav744-04-smash_signed.jar Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\70Hotfix_PSC7MF8\21\hf\fsav749-02-smash_signed.jar Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\70Hotfix_PSC7MF8\21\hf\FSAVCS710_HF08-57339-smash_signed.jar Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\70Hotfix_PSC7MF8\21\hf\PSC7_HF10-unsigned.jar Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\70Hotfix_PSC7MF8\21\hf\PSC7_HF12_FW-unsigned.jar Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\70Hotfix_PSC7MF8\21\hf\PSC7_HF13-smash_signed.jar Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\SCDB31\2008022701\lib\auto\Compress\Zlib\Zlib.dll Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\SCDB31\2008022701\lib\auto\Digest\MD5\MD5.dll Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\SCDB31\2008022701\lib\auto\List\Util\Util.dll Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\SCDB31\2008093001\dlib\5.8.3\auto\File\Glob\Glob.dll Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\SCDB31\2008093001\dlib\5.8.3\auto\HTML\Parser\Parser.dll Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\SCDB31\2008093001\dlib\auto\HTML\Parser\Parser.dll Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\SCDB31\2008093001\dlib\auto\Net\DNS\DNS.dll Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\SCDB31\2008093001\lib\auto\Compress\Zlib\Zlib.dll Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\SCDB31\2008093001\lib\auto\Digest\MD5\MD5.dll Direct reading C:\Program Files\EMBARQ Online Security\FSAUA\content\SCDB31\2008093001\lib\auto\List\Util\Util.dll C:\WINDOWS\SYSTEM32\comdlg32n.dll >>> suspicion for Rootkit.Win32.Podnuha.du ( 0A940841 04AE5E05 0021B044 00216CD7 88064) File quarantined succesfully (C:\WINDOWS\SYSTEM32\comdlg32n.dll) 4. Checking Winsock Layered Service Provider (SPI/LSP) LSP settings checked. No errors detected 5. Searching for keyboard/mouse/windows events hooks (Keyloggers, Trojan DLLs) C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-5.1.18.0\QOEHook.dll --> Suspicion for Keylogger or Trojan DLL C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-5.1.18.0\QOEHook.dll>>> Behavioural analysis Behaviour typical for keyloggers not detected File quarantined succesfully (C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-5.1.18.0\QOEHook.dll) Note: Do NOT delete suspicious files, send them for analysis (see FAQ for more details), because there are lots of useful hooking DLLs 6. Searching for opened TCP/UDP ports used by malicious programs Checking disabled by user 7. Heuristic system check Checking - complete 8. Searching for vulnerabilities >> Services: potentially dangerous service allowed: TermService (Terminal Services) >> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery Service) >> Services: potentially dangerous service allowed: Schedule (Task Scheduler) >> Services: potentially dangerous service allowed: mnmsrvc (NetMeeting Remote Desktop Sharing) >> Services: potentially dangerous service allowed: RDSessMgr (Remote Desktop Help Session Manager) > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)! >> Security: disk drives' autorun is enabled >> Security: administrative shares (C$, D$ ...) are enabled >> Security: anonymous user access is enabled >> Security: sending Remote Assistant queries is enabled Checking - complete 9. Troubleshooting wizard >> HDD autorun are allowed >> Autorun from network drives are allowed >> Removable media autorun are allowed Checking - complete Files scanned: 92588, extracted from archives: 64790, malicious software found 0, suspicions - 1 Scanning finished at 4/22/2009 1:06:30 PM Time of scanning: 00:40:42 If you have a suspicion on presence of viruses or questions on the suspected objects, you can address http://virusinfo.info conference Creating archive of files from Quarantine Creating archive of files from Quarantine - complete System Analysis in progressAdd commands to script:
Script commands