AVZ 4.32 http://z-oleg.com/secur/avz/
| File name | PID | Description | Copyright | MD5 | Information
| c:\program files\canon\myprinter\bjmyprt.exe | Script: Quarantine, Delete, Delete via BC, Terminate 1896 | Canon My Printer | Copyright 2004-2007 CANON INC. All Rights Reserved. | ?? | 1565.58 kb, rsAh, | created: 26. 10. 2009 17:26:14, modified: 3. 4. 2007 17:50:00 Command line: "C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" /logon c:\program files\d-tools\daemon.exe | Script: Quarantine, Delete, Delete via BC, Terminate 3336 | Virtual DAEMON Manager | Copyright (C) 2000-2004 | ?? | 80.00 kb, rsAh, | created: 22. 8. 2004 17:05:02, modified: 22. 8. 2004 17:05:02 Command line: "C:\Program Files\D-Tools\daemon.exe" -lang 1033 c:\program files\eset\eset nod32 antivirus\ekrn.exe | Script: Quarantine, Delete, Delete via BC, Terminate 464 | Eset Service | Copyright (c) Eset 1992 - 2007. All rights reserved. | ?? | 457.25 kb, rsAh, | created: 21. 12. 2007 8:21:16, modified: 21. 12. 2007 8:21:16 Command line: "C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe" c:\windows\explorer.exe | Script: Quarantine, Delete, Delete via BC, Terminate 1772 | Průzkumník Windows | © Microsoft Corporation. Všechna práva vyhrazena. | ?? | 1008.50 kb, rsAh, | created: 17. 8. 2004 14:49:24, modified: 17. 8. 2004 14:49:24 Command line: C:\WINDOWS\Explorer.EXE c:\program files\mozilla firefox\firefox.exe | Script: Quarantine, Delete, Delete via BC, Terminate 1556 | Firefox | ©Firefox and Mozilla Developers, according to the MPL 1.1/GPL 2.0/LGPL 2.1 licenses, as applicable. | ?? | 886.96 kb, rsAh, | created: 25. 10. 2009 13:36:56, modified: 7. 11. 2009 22:07:23 Command line: "C:\Program Files\Mozilla Firefox\firefox.exe" c:\windows\system32\fsusbexservice.exe | Script: Quarantine, Delete, Delete via BC, Terminate 532 | FsUsbDevice | Copyright (C) 2005 | ?? | 228.00 kb, rsAh, | created: 1. 11. 2009 11:28:00, modified: 31. 3. 2009 9:39:36 Command line: C:\WINDOWS\system32\FsUsbExService.Exe c:\program files\java\jre6\bin\jqs.exe | Script: Quarantine, Delete, Delete via BC, Terminate 584 | Java(TM) Quick Starter Service | Copyright © 2004 | ?? | 149.78 kb, rsAh, | created: 25. 10. 2009 16:08:32, modified: 25. 10. 2009 16:08:32 Command line: "C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf" c:\program files\common files\nero\lib\nmindexstoresvr.exe | Script: Quarantine, Delete, Delete via BC, Terminate 2376 | Nero Home | Copyright 2007 Nero AG and its licensors | ?? | 1377.29 kb, rsAh, | created: 20. 9. 2007 15:35:40, modified: 20. 9. 2007 15:35:40 Command line: "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" -Embedding c:\program files\samsung\samsung new pc studio\npsagent.exe | Script: Quarantine, Delete, Delete via BC, Terminate 224 | NPSAgent | (c) Samsung Electronics Co., Ltd. All rights reserved. | ?? | 100.00 kb, rsAh, | created: 2. 4. 2009 18:05:22, modified: 2. 4. 2009 18:05:22 Command line: "C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe" c:\windows\system32\rundll32.exe | Script: Quarantine, Delete, Delete via BC, Terminate 1864 | Run a DLL as an App | © Microsoft Corporation. Všechna práva vyhrazena. | ?? | 32.50 kb, rsAh, | created: 17. 8. 2004 14:49:28, modified: 17. 8. 2004 14:49:28 Command line: "C:\WINDOWS\system32\RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit c:\program files\skype\phone\skype.exe | Script: Quarantine, Delete, Delete via BC, Terminate 172 | Skype | (c) Skype Technologies S.A. | ?? | 25022.79 kb, RsAh, | created: 9. 10. 2009 13:11:12, modified: 9. 10. 2009 13:11:12 Command line: "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized c:\program files\skype\toolbars\shared\skypenames.exe | Script: Quarantine, Delete, Delete via BC, Terminate 3156 | SkypeNames | (c) Skype Technologies S.A. | ?? | 233.29 kb, rsAh, | created: 3. 8. 2009 20:05:02, modified: 3. 8. 2009 20:05:02 Command line: "C:\Program Files\Skype\Toolbars\Shared\SkypeNames.exe" -Embedding c:\program files\skype\plugin manager\skypepm.exe | Script: Quarantine, Delete, Delete via BC, Terminate 3180 | Skype Extras Manager | Skype Limited | ?? | 76.18 kb, RsAh, | created: 9. 10. 2009 13:11:12, modified: 9. 10. 2009 13:11:12 Command line: "C:\Program Files\Skype\Plugin Manager\skypePM.exe" /SILENT c:\program files\utorrent\utorrent.exe | Script: Quarantine, Delete, Delete via BC, Terminate 3708 | µTorrent | ©2009 BitTorrent, Inc. All Rights Reserved. | ?? | 282.30 kb, rsAh, | created: 6. 11. 2009 0:44:09, modified: 2. 10. 2009 18:56:42 Command line: "C:\Program Files\uTorrent\utorrent.exe" e:\instal\xmd_4.0.0.2\xmd_4.0.0.2\xmdownloader.exe | Script: Quarantine, Delete, Delete via BC, Terminate 680 | Xm's downloader | Copyright © Xm 2008 | ?? | 1300.00 kb, rsAh, | created: 11. 11. 2009 0:18:40, modified: 30. 9. 2009 20:29:45 Command line: "E:\instal\Xmd_4.0.0.2\Xmd_4.0.0.2\Xmdownloader.exe" Detected:45, recognized as trusted 37
| | |||||
| Module | Base address | Size in memory | Description | Manufacturer
| .sys | Script: Quarantine, Delete, Delete via BC F744C000 | 018000 (98304) |
| C:\WINDOWS\system32\drivers\acedrv11.sys | Script: Quarantine, Delete, Delete via BC B5BEF000 | 043000 (274432) | ProtectDisc x64/x86 Hybrid Driver | Copyright (C) 1995-2008 Protect Software GmbH
| C:\WINDOWS\System32\Drivers\dump_atapi.sys | Script: Quarantine, Delete, Delete via BC B6567000 | 018000 (98304) |
| C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS | Script: Quarantine, Delete, Delete via BC F79D3000 | 002000 (8192) |
| C:\WINDOWS\system32\FsUsbExDisk.SYS | Script: Quarantine, Delete, Delete via BC B56C4000 | 009000 (36864) |
| C:\DOCUME~1\JOKO~1\LOCALS~1\Temp\mbr.sys | Script: Quarantine, Delete, Delete via BC F7787000 | 006000 (24576) |
| C:\WINDOWS\system32\Drivers\pavboot.sys | Script: Quarantine, Delete, Delete via BC F7717000 | 006000 (24576) | Panda Boot Driver | © Panda Security 2008
| Modules found - 132, recognized as trusted - 125
| | |||||||||
| Service | Description | Status | File | Group | Dependencies
| FsUsbExService | Service: Stop, Delete, Disable FsUsbExService | Running | C:\WINDOWS\system32\FsUsbExService.Exe | Script: Quarantine, Delete, Delete via BC |
| EhttpSrv | Service: Stop, Delete, Disable Eset HTTP Server | Not started | C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe | Script: Quarantine, Delete, Delete via BC |
| Detected - 93, recognized as trusted - 91
| | ||||||
| Service | Description | Status | File | Group | Dependencies
| acedrv11 | Driver: Unload, Delete, Disable acedrv11 | Running | C:\WINDOWS\system32\drivers\acedrv11.sys | Script: Quarantine, Delete, Delete via BC |
| atapi | Driver: Unload, Delete, Disable Standardní řadič disku IDE/ESDI | Running | C:\WINDOWS\system32\DRIVERS\atapi.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| pavboot | Driver: Unload, Delete, Disable pavboot | Running | C:\WINDOWS\system32\drivers\pavboot.sys | Script: Quarantine, Delete, Delete via BC System Bus Extender |
| Abiosdsk | Driver: Unload, Delete, Disable Abiosdsk | Not started | Abiosdsk.sys | Script: Quarantine, Delete, Delete via BC Primary disk |
| abp480n5 | Driver: Unload, Delete, Disable abp480n5 | Not started | abp480n5.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| adfs | Driver: Unload, Delete, Disable adfs | Not started | adfs.sys | Script: Quarantine, Delete, Delete via BC |
| adpu160m | Driver: Unload, Delete, Disable adpu160m | Not started | adpu160m.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| Aha154x | Driver: Unload, Delete, Disable Aha154x | Not started | Aha154x.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| aic78u2 | Driver: Unload, Delete, Disable aic78u2 | Not started | aic78u2.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| aic78xx | Driver: Unload, Delete, Disable aic78xx | Not started | aic78xx.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| AliIde | Driver: Unload, Delete, Disable AliIde | Not started | AliIde.sys | Script: Quarantine, Delete, Delete via BC System Bus Extender |
| amsint | Driver: Unload, Delete, Disable amsint | Not started | amsint.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| asc | Driver: Unload, Delete, Disable asc | Not started | asc.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| asc3350p | Driver: Unload, Delete, Disable asc3350p | Not started | asc3350p.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| asc3550 | Driver: Unload, Delete, Disable asc3550 | Not started | asc3550.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| Atdisk | Driver: Unload, Delete, Disable Atdisk | Not started | Atdisk.sys | Script: Quarantine, Delete, Delete via BC Primary disk |
| cd20xrnt | Driver: Unload, Delete, Disable cd20xrnt | Not started | cd20xrnt.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| Changer | Driver: Unload, Delete, Disable Changer | Not started | Changer.sys | Script: Quarantine, Delete, Delete via BC Filter |
| CmdIde | Driver: Unload, Delete, Disable CmdIde | Not started | CmdIde.sys | Script: Quarantine, Delete, Delete via BC System Bus Extender |
| Cpqarray | Driver: Unload, Delete, Disable Cpqarray | Not started | Cpqarray.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| dac960nt | Driver: Unload, Delete, Disable dac960nt | Not started | dac960nt.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| dpti2o | Driver: Unload, Delete, Disable dpti2o | Not started | dpti2o.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| hpn | Driver: Unload, Delete, Disable hpn | Not started | hpn.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| i2omgmt | Driver: Unload, Delete, Disable i2omgmt | Not started | i2omgmt.sys | Script: Quarantine, Delete, Delete via BC SCSI Class |
| i2omp | Driver: Unload, Delete, Disable i2omp | Not started | i2omp.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| ini910u | Driver: Unload, Delete, Disable ini910u | Not started | ini910u.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| IntelIde | Driver: Unload, Delete, Disable IntelIde | Not started | IntelIde.sys | Script: Quarantine, Delete, Delete via BC System Bus Extender |
| lbrtfdc | Driver: Unload, Delete, Disable lbrtfdc | Not started | lbrtfdc.sys | Script: Quarantine, Delete, Delete via BC System Bus Extender |
| mraid35x | Driver: Unload, Delete, Disable mraid35x | Not started | mraid35x.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| PCIDump | Driver: Unload, Delete, Disable PCIDump | Not started | PCIDump.sys | Script: Quarantine, Delete, Delete via BC PCI Configuration |
| PDCOMP | Driver: Unload, Delete, Disable PDCOMP | Not started | PDCOMP.sys | Script: Quarantine, Delete, Delete via BC |
| PDFRAME | Driver: Unload, Delete, Disable PDFRAME | Not started | PDFRAME.sys | Script: Quarantine, Delete, Delete via BC |
| PDRELI | Driver: Unload, Delete, Disable PDRELI | Not started | PDRELI.sys | Script: Quarantine, Delete, Delete via BC |
| PDRFRAME | Driver: Unload, Delete, Disable PDRFRAME | Not started | PDRFRAME.sys | Script: Quarantine, Delete, Delete via BC |
| perc2 | Driver: Unload, Delete, Disable perc2 | Not started | perc2.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| perc2hib | Driver: Unload, Delete, Disable perc2hib | Not started | perc2hib.sys | Script: Quarantine, Delete, Delete via BC Filter |
| ql1080 | Driver: Unload, Delete, Disable ql1080 | Not started | ql1080.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| Ql10wnt | Driver: Unload, Delete, Disable Ql10wnt | Not started | Ql10wnt.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| ql12160 | Driver: Unload, Delete, Disable ql12160 | Not started | ql12160.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| ql1240 | Driver: Unload, Delete, Disable ql1240 | Not started | ql1240.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| ql1280 | Driver: Unload, Delete, Disable ql1280 | Not started | ql1280.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| Simbad | Driver: Unload, Delete, Disable Simbad | Not started | Simbad.sys | Script: Quarantine, Delete, Delete via BC Filter |
| Sparrow | Driver: Unload, Delete, Disable Sparrow | Not started | Sparrow.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| sym_hi | Driver: Unload, Delete, Disable sym_hi | Not started | sym_hi.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| sym_u3 | Driver: Unload, Delete, Disable sym_u3 | Not started | sym_u3.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| symc810 | Driver: Unload, Delete, Disable symc810 | Not started | symc810.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| symc8xx | Driver: Unload, Delete, Disable symc8xx | Not started | symc8xx.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| TosIde | Driver: Unload, Delete, Disable TosIde | Not started | TosIde.sys | Script: Quarantine, Delete, Delete via BC System Bus Extender |
| ultra | Driver: Unload, Delete, Disable ultra | Not started | ultra.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| ViaIde | Driver: Unload, Delete, Disable ViaIde | Not started | ViaIde.sys | Script: Quarantine, Delete, Delete via BC System Bus Extender |
| WDICA | Driver: Unload, Delete, Disable WDICA | Not started | WDICA.sys | Script: Quarantine, Delete, Delete via BC |
| Detected - 193, recognized as trusted - 142
| | ||||||
| File name | Status | Startup method | Description
| (None) | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_USERS, .DEFAULT\Control Panel\Desktop, scrnsave.exe | Delete (None) | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_USERS, S-1-5-18\Control Panel\Desktop, scrnsave.exe | Delete C:\PROGRA~1\MICROS~3\Office12\1051\MAPIR.DLL | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Outlook, EventMessageFile | Delete C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, Adobe Reader Speed Launcher | Delete C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, Adobe ARM | Delete C:\Program Files\DVDFab 6\DVDFab.exe | Script: Quarantine, Delete, Delete via BC Active | Shortcut in Startup folder | C:\Documents and Settings\Jožko\Data aplikací\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\Jožko\Data aplikací\Microsoft\Internet Explorer\Quick Launch\DVDFab 6.lnk,
| C:\Program Files\Isotope244 Graphics\Atomic Cannon Demo\atomic.exe | Script: Quarantine, Delete, Delete via BC Active | Shortcut in Startup folder | C:\Documents and Settings\Jožko\Data aplikací\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\Jožko\Data aplikací\Microsoft\Internet Explorer\Quick Launch\Atomic Cannon Demo.lnk,
| C:\Program Files\Isotope244 Graphics\Atomic Cannon\atomic.exe | Script: Quarantine, Delete, Delete via BC Active | Shortcut in Startup folder | C:\Documents and Settings\Jožko\Data aplikací\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\Jožko\Data aplikací\Microsoft\Internet Explorer\Quick Launch\Atomic Cannon.lnk,
| C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, Malwarebytes Anti-Malware (reboot) | Delete C:\Program Files\Mozilla Firefox\firefox.exe | Script: Quarantine, Delete, Delete via BC Active | Shortcut in Startup folder | C:\Documents and Settings\Jožko\Data aplikací\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\Jožko\Data aplikací\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk,
| C:\Program Files\Nero\Nero8\Nero Toolkit\NeroBurnRights.cpl | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cpls, Nero BurnRights | Delete C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_CURRENT_USER, Software\Microsoft\Windows\CurrentVersion\Run, AutoStartNPSAgent | Delete C:\Program Files\Samsung\Samsung New PC Studio\NPSGuide.exe | Script: Quarantine, Delete, Delete via BC Active | Shortcut in Startup folder | C:\Documents and Settings\Jožko\Data aplikací\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\Jožko\Data aplikací\Microsoft\Internet Explorer\Quick Launch\Samsung New PC Studio.lnk,
| C:\Program Files\Skype\Phone\Skype.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_CURRENT_USER, Software\Microsoft\Windows\CurrentVersion\Run, Skype | Delete C:\Program Files\VSO\ConvertX\4\ConvertXtoDvd.exe | Script: Quarantine, Delete, Delete via BC Active | Shortcut in Startup folder | C:\Documents and Settings\Jožko\Data aplikací\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\Jožko\Data aplikací\Microsoft\Internet Explorer\Quick Launch\ConvertXtoDVD 4.lnk,
| C:\WINDOWS\System32\igmpv2.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile | Delete C:\WINDOWS\System32\ipbootp.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile | Delete C:\WINDOWS\System32\iprip2.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile | Delete C:\WINDOWS\System32\ospf.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPF, EventMessageFile | Delete C:\WINDOWS\System32\ospfmib.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPFMib, EventMessageFile | Delete C:\WINDOWS\System32\polagent.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PolicyAgent, EventMessageFile | Delete C:\WINDOWS\System32\spmsg.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Windows Installer 3.1, EventMessageFile | Delete C:\WINDOWS\System32\tssdis.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\TermServSessDir, EventMessageFile | Delete C:\WINDOWS\system32\MsSip1.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 1, $DLL | Delete C:\WINDOWS\system32\MsSip2.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 2, $DLL | Delete C:\WINDOWS\system32\MsSip3.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 3, $DLL | Delete C:\WINDOWS\system32\mscoree.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\.NET Runtime, EventMessageFile | Delete C:\WINDOWS\system32\mscoree.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\.NET Runtime Optimization Service, EventMessageFile | Delete C:\WINDOWS\system32\nwiz.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, nwiz | Delete C:\WINDOWS\system32\psxss.exe | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
| C:\WINDOWS\system32\stisvc.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System, EventMessageFile | Delete C:\WINDOWS\system32\vp6vfw.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, vidc.VP60 | Delete C:\WINDOWS\system32\vp6vfw.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Drivers32, vidc.VP61 | Delete E:\Program Files\Fireburg Media\Pumpkinshop\PumpkinShop.exe | Script: Quarantine, Delete, Delete via BC Active | Shortcut in Startup folder | C:\Documents and Settings\Jožko\Data aplikací\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\Jožko\Data aplikací\Microsoft\Internet Explorer\Quick Launch\Pumpkinshop.lnk,
| SDEvents.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Spybot - Search & Destroy 2, EventMessageFile | Delete mscoree.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\.NETFramework\Performance, Library | Delete mvfs32.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_USERS, .DEFAULT\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_USERS, S-1-5-19\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_USERS, S-1-5-20\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_USERS, S-1-5-18\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_CURRENT_USER, Control Panel\IOProcs, MVB | Delete vgafix.fon | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon | Delete vgaoem.fon | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon | Delete vgasys.fon | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon | Delete Autoruns items found - 550, recognized as trusted - 506
| | ||||||
| File name | Type | Description | Manufacturer | CLSID
| C:\Program Files\ToggleEN\tbTog1.dll | Script: Quarantine, Delete, Delete via BC BHO | Conduit Toolbar | Copyright © Conduit Ltd. 2008 | {038cb5c7-48ea-4af9-94e0-a1646542e62b} | Delete C:\Program Files\ToggleEN\tbTog1.dll | Script: Quarantine, Delete, Delete via BC Toolbar | Conduit Toolbar | Copyright © Conduit Ltd. 2008 | {038cb5c7-48ea-4af9-94e0-a1646542e62b} | Delete C:\Program Files\ToggleEN\tbTog1.dll | Script: Quarantine, Delete, Delete via BC Extension module | Conduit Toolbar | Copyright © Conduit Ltd. 2008 | {92780B25-18CC-41C8-B9BE-3C9C571A8263} | Delete Extension module | {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} | Delete C:\Program Files\ToggleEN\tbTog1.dll | Script: Quarantine, Delete, Delete via BC URLSearchHook | Conduit Toolbar | Copyright © Conduit Ltd. 2008 | {038cb5c7-48ea-4af9-94e0-a1646542e62b} | Delete Items found - 13, recognized as trusted - 8
| | |||||||||
| File name | Destination | Description | Manufacturer | CLSID
| deskpan.dll | Script: Quarantine, Delete, Delete via BC Rozšíření panelu Zobrazení pro panoramatické zobrazení | {42071714-76d4-11d1-8b24-00a0c9068ff3} | Delete Rozšíření prostředí pro kompresi souborů | {764BF0E1-F219-11ce-972D-00AA00A14F56} | Delete Kontextová nabídka šifrování | {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} | Delete Hlavní panel a nabídka Start | {0DF44EAA-FF21-4412-828E-260A8728E7F1} | Delete rundll32.exe C:\WINDOWS\system32\shimgvw.dll,ImageView_COMServer {00E7B358-F65B-4dcf-83DF-CD026B94BFD4} | Script: Quarantine, Delete, Delete via BC Autoplay for SlideShow | {00E7B358-F65B-4dcf-83DF-CD026B94BFD4} | Delete Uživatelské účty | {7A9D77BD-5403-11d2-8785-2E0420524153} | Delete C:\WINDOWS\system32\nvshell.dll | Script: Quarantine, Delete, Delete via BC Desktop Explorer | {1CDB2949-8F65-4355-8456-263E7C208A5D} | Delete C:\WINDOWS\system32\nvshell.dll | Script: Quarantine, Delete, Delete via BC Desktop Explorer Menu | {1E9B04FB-F9E5-4718-997B-B8DA88302A47} | Delete C:\WINDOWS\system32\nvshell.dll | Script: Quarantine, Delete, Delete via BC nView Desktop Context Menu | {1E9B04FB-F9E5-4718-997B-B8DA88302A48} | Delete C:\Program Files\WinRAR\rarext.dll | Script: Quarantine, Delete, Delete via BC WinRAR shell extension | {B41DB860-8EE4-11D2-9906-E49FADC173CA} | Delete Items found - 195, recognized as trusted - 185
| | ||||||||||||||||||||||||||||||
| File name | Type | Name | Description | Manufacturer
| Items found - 8, recognized as trusted - 8
| | ||||||
| File name | Job name | Job state | Description | Manufacturer
| Items found - 0, recognized as trusted - 0
| | ||||||
| Manufacturer | Status | EXE file | Description | GUID
| Detected - 3, recognized as trusted - 3
| | ||||||
| Manufacturer | EXE file | Description
| Detected - 15, recognized as trusted - 15
| | ||||||
| File name | Description | Manufacturer | CLSID | Source URL
| Items found - 3, recognized as trusted - 3
| | ||||||
| File name | Description | Manufacturer
| C:\WINDOWS\system32\javacpl.cpl | Script: Quarantine, Delete, Delete via BC Java(TM) Control Panel | Copyright © 2004
| C:\WINDOWS\system32\nvcpl.cpl | Script: Quarantine, Delete, Delete via BC NVIDIA Control Panel Applet 2.2.350.00 | (C) NVIDIA Corporation. All rights reserved.
| C:\WINDOWS\system32\nvtuicpl.cpl | Script: Quarantine, Delete, Delete via BC
| Items found - 29, recognized as trusted - 26
| | |||||||
| File name | Description | Manufacturer | CLSID
| Items found - 13, recognized as trusted - 13
| | ||||||
Hosts file record
|
| File name | Type | Description | Manufacturer | CLSID
| mscoree.dll | Script: Quarantine, Delete, Delete via BC Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| mscoree.dll | Script: Quarantine, Delete, Delete via BC Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| mscoree.dll | Script: Quarantine, Delete, Delete via BC Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
| Items found - 31, recognized as trusted - 28
| | ||||||
| File | Description | Type |
Attention !!! Database was last updated 21. 8. 2009 it is necessary to update the database (via File - Database update) AVZ Antiviral Toolkit log; AVZ version is 4.32 Scanning started at 18. 11. 2009 11:31:40 Database loaded: signatures - 237871, NN profile(s) - 2, malware removal microprograms - 56, signature database released 21.08.2009 14:23 Heuristic microprograms loaded: 374 PVS microprograms loaded: 9 Digital signatures of system files loaded: 135524 Heuristic analyzer mode: Medium heuristics mode Malware removal mode: enabled Windows version is: 5.1.2600, Service Pack 2 ; AVZ is run with administrator rights System Restore: enabled 1. Searching for Rootkits and other software intercepting API functions 1.1 Searching for user-mode API hooks Analysis: kernel32.dll, export table found in section .text Analysis: ntdll.dll, export table found in section .text Analysis: user32.dll, export table found in section .text Analysis: advapi32.dll, export table found in section .text Analysis: ws2_32.dll, export table found in section .text Analysis: wininet.dll, export table found in section .text Analysis: rasapi32.dll, export table found in section .text Analysis: urlmon.dll, export table found in section .text Analysis: netapi32.dll, export table found in section .text 1.2 Searching for kernel-mode API hooks Driver loaded successfully SDT found (RVA=08C500) Kernel ntoskrnl.exe found in memory at address 804D7000 SDT = 80563500 KiST = 804E4F40 (284) Functions checked: 284, intercepted: 0, restored: 0 1.3 Checking IDT and SYSENTER Analyzing CPU 1 Analyzing CPU 2 Analyzing CPU 3 Analyzing CPU 4 CmpCallCallBacks = 00145A9F Disable callback - ??? ??????????????? Checking IDT and SYSENTER - complete 1.4 Searching for masking processes and drivers Checking not performed: extended monitoring driver (AVZPM) is not installed Driver loaded successfully 1.5 Checking IRP handlers Checking - complete 2. Scanning RAM Number of processes found: 44 Number of modules loaded: 445 Scanning RAM - complete 3. Scanning disks Direct reading: C:\WINDOWS\system32\drivers\atapi.sys 4. Checking Winsock Layered Service Provider (SPI/LSP) LSP settings checked. No errors detected 5. Searching for keyboard/mouse/windows events hooks (Keyloggers, Trojan DLLs) 6. Searching for opened TCP/UDP ports used by malicious software Checking - disabled by user 7. Heuristic system check Checking - complete 8. Searching for vulnerabilities >> Services: potentially dangerous service allowed: RemoteRegistry (Vzd?len? registr) >> Services: potentially dangerous service allowed: TermService (Termin?lov? slu?ba) >> Services: potentially dangerous service allowed: SSDPSRV (Slu?ba rozpozn?v?n? pomoc? protokolu SSDP) >> Services: potentially dangerous service allowed: Schedule (Pl?nova? ?loh) >> Services: potentially dangerous service allowed: mnmsrvc (NetMeeting - Vzd?len? sd?len? plochy) >> Services: potentially dangerous service allowed: RDSessMgr (Spr?vce relac? n?pov?dy ke vzd?len? plo?e) > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)! >> Security: disk drives' autorun is enabled >> Security: administrative shares (C$, D$ ...) are enabled >> Security: anonymous user access is enabled >> Security: sending Remote Assistant queries is enabled Checking - complete 9. Troubleshooting wizard >> HDD autorun is allowed >> Network drives autorun is allowed >> Removable media autorun is allowed Checking - complete Files scanned: 81043, extracted from archives: 60926, malicious software found 0, suspicions - 0 Scanning finished at 18. 11. 2009 11:41:40 Time of scanning: 00:10:01 If you have a suspicion on presence of viruses or questions on the suspected objects, you can address http://virusinfo.info conference Creating archive of files from Quarantine Creating archive of files from Quarantine - complete System Analysis in progressAdd commands to script:
Script commands