AVZ 4.32 http://z-oleg.com/secur/avz/
| File name | PID | Description | Copyright | MD5 | Information
| ? | Script: Quarantine, Delete, Delete via BC, Terminate 20236 | | | ?? | ?,0.00 kb, rsah, | created: 24.5.2010 20:24:25, modified: 24.5.2010 20:27:47 Command line: ? | Script: Quarantine, Delete, Delete via BC, Terminate 25376 | | | ?? | ?,0.00 kb, rsah, | created: 24.5.2010 20:24:25, modified: 24.5.2010 20:27:47 Command line: ? | Script: Quarantine, Delete, Delete via BC, Terminate 25440 | | | ?? | ?,0.00 kb, rsah, | created: 24.5.2010 20:24:25, modified: 24.5.2010 20:27:47 Command line: ? | Script: Quarantine, Delete, Delete via BC, Terminate 25588 | | | ?? | ?,0.00 kb, rsah, | created: 24.5.2010 20:24:25, modified: 24.5.2010 20:27:47 Command line: ? | Script: Quarantine, Delete, Delete via BC, Terminate 26180 | | | ?? | ?,0.00 kb, rsah, | created: 24.5.2010 20:24:25, modified: 24.5.2010 20:27:47 Command line: ? | Script: Quarantine, Delete, Delete via BC, Terminate 26176 | | | ?? | ?,0.00 kb, rsah, | created: 24.5.2010 20:24:25, modified: 24.5.2010 20:27:47 Command line: ? | Script: Quarantine, Delete, Delete via BC, Terminate 26628 | | | ?? | ?,0.00 kb, rsah, | created: 24.5.2010 20:24:25, modified: 24.5.2010 20:27:47 Command line: ? | Script: Quarantine, Delete, Delete via BC, Terminate 28424 | | | ?? | ?,0.00 kb, rsah, | created: 24.5.2010 20:24:25, modified: 24.5.2010 20:27:47 Command line: ? | Script: Quarantine, Delete, Delete via BC, Terminate 27348 | | | ?? | ?,0.00 kb, rsah, | created: 24.5.2010 20:24:25, modified: 24.5.2010 20:27:47 Command line: ? | Script: Quarantine, Delete, Delete via BC, Terminate 26312 | | | ?? | ?,0.00 kb, rsah, | created: 24.5.2010 20:24:25, modified: 24.5.2010 20:27:47 Command line: ? | Script: Quarantine, Delete, Delete via BC, Terminate 29620 | | | ?? | ?,0.00 kb, rsah, | created: 24.5.2010 20:24:25, modified: 24.5.2010 20:27:47 Command line: ? | Script: Quarantine, Delete, Delete via BC, Terminate 10612 | | | ?? | ?,0.00 kb, rsah, | created: 24.5.2010 20:24:25, modified: 24.5.2010 20:27:47 Command line: ? | Script: Quarantine, Delete, Delete via BC, Terminate 27024 | | | ?? | ?,0.00 kb, rsah, | created: 24.5.2010 20:24:25, modified: 24.5.2010 20:27:47 Command line: ? | Script: Quarantine, Delete, Delete via BC, Terminate 26576 | | | ?? | ?,0.00 kb, rsah, | created: 24.5.2010 20:24:25, modified: 24.5.2010 20:27:47 Command line: ? | Script: Quarantine, Delete, Delete via BC, Terminate 33316 | | | ?? | ?,0.00 kb, rsah, | created: 24.5.2010 20:24:25, modified: 24.5.2010 20:27:47 Command line: ? | Script: Quarantine, Delete, Delete via BC, Terminate 33448 | | | ?? | ?,0.00 kb, rsah, | created: 24.5.2010 20:24:25, modified: 24.5.2010 20:27:47 Command line: c:\program files\apoint2k\apntex.exe | Script: Quarantine, Delete, Delete via BC, Terminate 1280 | Alps Pointing-device Driver for Windows NT/2000/XP/Vista | Copyright (C) 1998-2006 Alps Electric Co., Ltd. | ?? | 44.00 kb, RsAh, | created: 20.3.2008 17:34:50, modified: 28.3.2006 18:10:10 Command line: "Apntex.exe" c:\program files\apoint2k\apoint.exe | Script: Quarantine, Delete, Delete via BC, Terminate 664 | Alps Pointing-device Driver | Copyright (C) 1999-2006 Alps Electric Co., Ltd. | ?? | 168.00 kb, RsAh, | created: 20.3.2008 17:34:50, modified: 4.7.2006 16:14:30 Command line: "C:\Program Files\Apoint2K\Apoint.exe" c:\progra~1\alwils~1\avast4\ashdisp.exe | Script: Quarantine, Delete, Delete via BC, Terminate 720 | avast! service GUI component | Copyright (c) 2009 ALWIL Software | ?? | 79.10 kb, rsAh, | created: 20.3.2008 19:07:32, modified: 5.2.2009 23:08:45 Command line: "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" c:\program files\alwil software\avast4\ashmaisv.exe | Script: Quarantine, Delete, Delete via BC, Terminate 2592 | avast! e-Mail Scanner Service | Copyright (c) 2009 ALWIL Software | ?? | 248.09 kb, rsAh, | created: 20.3.2008 19:07:32, modified: 5.2.2009 23:08:26 Command line: "C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service c:\program files\alwil software\avast4\ashserv.exe | Script: Quarantine, Delete, Delete via BC, Terminate 1612 | avast! antivirus service | Copyright (c) 2009 ALWIL Software | ?? | 135.43 kb, rsAh, | created: 20.3.2008 19:07:32, modified: 5.2.2009 23:08:40 Command line: "C:\Program Files\Alwil Software\Avast4\ashServ.exe" c:\program files\alwil software\avast4\ashwebsv.exe | Script: Quarantine, Delete, Delete via BC, Terminate 2672 | avast! Web Scanner | Copyright (c) 2009 ALWIL Software | ?? | 344.65 kb, rsAh, | created: 20.3.2008 19:07:32, modified: 5.2.2009 23:06:04 Command line: "C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service c:\program files\alwil software\avast4\aswupdsv.exe | Script: Quarantine, Delete, Delete via BC, Terminate 1544 | avast! Antivirus updating service | Copyright (c) 2009 ALWIL Software | ?? | 18.31 kb, rsAh, | created: 20.3.2008 19:07:32, modified: 5.2.2009 23:01:25 Command line: "C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe" c:\documents and settings\monika zlámalová\plocha\avz4\avz4\avz.exe | Script: Quarantine, Delete, Delete via BC, Terminate 164388 | ???????????? ??????? AVZ | ???????????? ??????? AVZ | ?? | 733.00 kb, rsAh, | created: 24.5.2010 20:24:25, modified: 21.8.2009 14:40:32, name contains national symbols Command line: "C:\Documents and Settings\Monika Zlámalová\Plocha\avz4\avz4\avz.exe" c:\windows\system32\ctfmon.exe | Script: Quarantine, Delete, Delete via BC, Terminate 3260 | CTF Loader | © Microsoft Corporation. All rights reserved. | ?? | 15.00 kb, rsAh, | created: 2.3.2006 14:00:00, modified: 2.3.2006 14:00:00 Command line: "C:\WINDOWS\system32\ctfmon.exe" c:\windows\explorer.exe | Script: Quarantine, Delete, Delete via BC, Terminate 280 | Průzkumník Windows | © Microsoft Corporation. Všechna práva vyhrazena. | ?? | 1008.50 kb, rsAh, | created: 2.3.2006 14:00:00, modified: 2.3.2006 14:00:00 Command line: C:\WINDOWS\Explorer.EXE c:\program files\mozilla firefox\firefox.exe | Script: Quarantine, Delete, Delete via BC, Terminate 158420 | Firefox | ©Firefox and Mozilla Developers, according to the MPL 1.1/GPL 2.0/LGPL 2.1 licenses, as applicable. | ?? | 888.96 kb, rsAh, | created: 20.3.2008 20:00:39, modified: 13.5.2010 8:42:45 Command line: "C:\Program Files\Mozilla Firefox\firefox.exe" c:\documents and settings\monika zlámalová\dokumenty\stažené soubory\hijackthis.exe | Script: Quarantine, Delete, Delete via BC, Terminate 160692 | HijackThis | (c) 2007 Trend Micro Inc | ?? | 392.30 kb, rsAh, | created: 24.5.2010 19:30:04, modified: 24.5.2010 19:30:09, name contains national symbols Command line: "C:\Documents and Settings\Monika Zlámalová\Dokumenty\Stažené soubory\HijackThis.exe" c:\windows\system32\hkcmd.exe | Script: Quarantine, Delete, Delete via BC, Terminate 700 | hkcmd Module | Copyright 1999-2006, Intel Corporation | ?? | 156.00 kb, rsAh, | created: 21.5.2010 21:27:25, modified: 8.2.2008 9:48:36 Command line: "C:\WINDOWS\system32\hkcmd.exe" c:\program files\icq6toolbar\icq service.exe | Script: Quarantine, Delete, Delete via BC, Terminate 2196 | ICQIEUpdater Module | Copyright 2007 | ?? | 217.74 kb, rsAh, | created: 13.9.2008 13:59:40, modified: 1.6.2009 22:20:12 Command line: "C:\Program Files\ICQ6Toolbar\ICQ Service.exe" c:\windows\system32\igfxext.exe | Script: Quarantine, Delete, Delete via BC, Terminate 1708 | igfxext Module | Copyright 1999-2006, Intel Corporation | ?? | 160.00 kb, rsAh, | created: 20.3.2008 17:40:37, modified: 8.2.2008 9:48:06 Command line: C:\WINDOWS\system32\igfxext.exe -Embedding c:\windows\system32\igfxpers.exe | Script: Quarantine, Delete, Delete via BC, Terminate 712 | persistence Module | Copyright 1999-2006, Intel Corporation | ?? | 128.00 kb, rsAh, | created: 20.3.2008 17:40:37, modified: 8.2.2008 9:48:10 Command line: "C:\WINDOWS\system32\igfxpers.exe" c:\windows\system32\igfxsrvc.exe | Script: Quarantine, Delete, Delete via BC, Terminate 896 | igfxsrvc Module | Copyright 1999-2006, Intel Corporation | ?? | 244.00 kb, rsAh, | created: 20.3.2008 17:40:36, modified: 8.2.2008 9:47:56 Command line: C:\WINDOWS\system32\igfxsrvc.exe -Embedding c:\windows\system32\igfxtray.exe | Script: Quarantine, Delete, Delete via BC, Terminate 680 | igfxTray Module | Copyright 1999-2006, Intel Corporation | ?? | 132.00 kb, rsAh, | created: 20.3.2008 17:40:37, modified: 8.2.2008 9:48:36 Command line: "C:\WINDOWS\system32\igfxtray.exe" c:\progra~1\launch~1\lmanager.exe | Script: Quarantine, Delete, Delete via BC, Terminate 648 | Launch Manager | Copyright (c) Dritek System Inc. | ?? | 662.77 kb, rsAh, | created: 4.4.2007 9:02:00, modified: 4.4.2007 9:02:00 Command line: "C:\PROGRA~1\LAUNCH~1\LManager.exe" c:\windows\system32\lsass.exe | Script: Quarantine, Delete, Delete via BC, Terminate 940 | LSA Shell (Export Version) | © Microsoft Corporation. All rights reserved. | ?? | 13.00 kb, rsAh, | created: 2.3.2006 14:00:00, modified: 2.3.2006 14:00:00 Command line: C:\WINDOWS\system32\lsass.exe c:\program files\t-mobile\web'n'walk manager\manager.exe | Script: Quarantine, Delete, Delete via BC, Terminate 3292 | Web'n'walk Manager | | ?? | 933.88 kb, rsAh, | created: 25.10.2007 19:16:58, modified: 25.10.2007 19:16:58 Command line: "C:\Program Files\T-Mobile\Web'n'walk Manager\Manager.exe" c:\program files\messenger\msmsgs.exe | Script: Quarantine, Delete, Delete via BC, Terminate 3268 | Windows Messenger | Copyright (c) Microsoft Corporation 2004 | ?? | 1628.50 kb, rsah, | created: 20.3.2008 16:42:05, modified: 17.8.2004 16:58:18 Command line: "C:\Program Files\Messenger\msmsgs.exe" /background c:\windows\system32\notepad.exe | Script: Quarantine, Delete, Delete via BC, Terminate 141684 | Poznámkový blok | © Microsoft Corporation. Všechna práva vyhrazena. | ?? | 68.00 kb, rsAh, | created: 2.3.2006 14:00:00, modified: 2.3.2006 14:00:00 Command line: "C:\WINDOWS\system32\NOTEPAD.EXE" C:\Documents and Settings\Monika Zlámalová\Dokumenty\Stažené soubory\hijackthis.log c:\windows\rthdcpl.exe | Script: Quarantine, Delete, Delete via BC, Terminate 620 | Realtek HD Audio Control Panel | Copyright (c) 2004 Realtek Semiconductor Corp. | ?? | 15959.50 kb, Rsah, | created: 20.3.2008 17:21:53, modified: 10.5.2007 12:08:00 Command line: "C:\WINDOWS\RTHDCPL.EXE" c:\docume~1\monika~1\locals~1\temp\rtkbtmnt.exe | Script: Quarantine, Delete, Delete via BC, Terminate 2068 | Realtek HD Audio Data Rerouter | 2006 (c) Realtek Semiconductor. All rights reserved. | ?? | 204.00 kb, rsAh, | created: 20.3.2008 17:30:10, modified: 20.3.2008 17:30:10 Command line: C:\DOCUME~1\MONIKA~1\LOCALS~1\Temp\RtkBtMnt.exe c:\windows\system32\rundll32.exe | Script: Quarantine, Delete, Delete via BC, Terminate 672 | Run a DLL as an App | © Microsoft Corporation. Všechna práva vyhrazena. | ?? | 32.50 kb, rsAh, | created: 2.3.2006 14:00:00, modified: 2.3.2006 14:00:00 Command line: "C:\WINDOWS\system32\rundll32.exe" bthprops.cpl,,BluetoothAuthenticationAgent c:\windows\system32\services.exe | Script: Quarantine, Delete, Delete via BC, Terminate 924 | Services and Controller app | © Microsoft Corporation. Všechna práva vyhrazena. | ?? | 108.50 kb, rsAh, | created: 2.3.2006 14:00:00, modified: 9.2.2009 12:11:38 Command line: C:\WINDOWS\system32\services.exe c:\program files\skype\phone\skype.exe | Script: Quarantine, Delete, Delete via BC, Terminate 5940 | Skype | (c) Skype Technologies S.A. | ?? | 25488.79 kb, RsAh, | created: 9.3.2010 10:02:14, modified: 9.3.2010 10:02:14 Command line: "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized c:\program files\skype\toolbars\shared\skypenames2.exe | Script: Quarantine, Delete, Delete via BC, Terminate 63716 | SkypeNames | (c) Skype Technologies S.A. | ?? | 229.29 kb, rsAh, | created: 24.11.2009 11:32:22, modified: 24.11.2009 11:32:22 Command line: "C:\Program Files\Skype\Toolbars\Shared\SkypeNames2.exe" -Embedding c:\program files\skype\plugin manager\skypepm.exe | Script: Quarantine, Delete, Delete via BC, Terminate 156660 | Skype Extras Manager | Skype Limited | ?? | 76.18 kb, RsAh, | created: 9.3.2010 10:02:14, modified: 9.3.2010 10:02:14 Command line: "C:\Program Files\Skype\Plugin Manager\skypePM.exe" /SILENT c:\windows\system32\spoolsv.exe | Script: Quarantine, Delete, Delete via BC, Terminate 1984 | Spooler SubSystem App | © Microsoft Corporation. All rights reserved. | ?? | 56.50 kb, rsAh, | created: 2.3.2006 14:00:00, modified: 2.3.2006 14:00:00 Command line: C:\WINDOWS\system32\spoolsv.exe c:\windows\system32\svchost.exe | Script: Quarantine, Delete, Delete via BC, Terminate 1320 | Generic Host Process for Win32 Services | © Microsoft Corporation. All rights reserved. | ?? | 14.00 kb, rsAh, | created: 2.3.2006 14:00:00, modified: 2.3.2006 14:00:00 Command line: C:\WINDOWS\system32\svchost.exe -k LocalService c:\windows\system32\svchost.exe | Script: Quarantine, Delete, Delete via BC, Terminate 1100 | Generic Host Process for Win32 Services | © Microsoft Corporation. All rights reserved. | ?? | 14.00 kb, rsAh, | created: 2.3.2006 14:00:00, modified: 2.3.2006 14:00:00 Command line: C:\WINDOWS\system32\svchost -k DcomLaunch c:\windows\system32\svchost.exe | Script: Quarantine, Delete, Delete via BC, Terminate 2136 | Generic Host Process for Win32 Services | © Microsoft Corporation. All rights reserved. | ?? | 14.00 kb, rsAh, | created: 2.3.2006 14:00:00, modified: 2.3.2006 14:00:00 Command line: C:\WINDOWS\system32\svchost.exe -k LocalService c:\windows\system32\svchost.exe | Script: Quarantine, Delete, Delete via BC, Terminate 3320 | Generic Host Process for Win32 Services | © Microsoft Corporation. All rights reserved. | ?? | 14.00 kb, rsAh, | created: 2.3.2006 14:00:00, modified: 2.3.2006 14:00:00 Command line: C:\WINDOWS\system32\svchost.exe c:\windows\system32\svchost.exe | Script: Quarantine, Delete, Delete via BC, Terminate 2164 | Generic Host Process for Win32 Services | © Microsoft Corporation. All rights reserved. | ?? | 14.00 kb, rsAh, | created: 2.3.2006 14:00:00, modified: 2.3.2006 14:00:00 Command line: C:\WINDOWS\system32\svchost.exe -k bthsvcs c:\windows\system32\svchost.exe | Script: Quarantine, Delete, Delete via BC, Terminate 1148 | Generic Host Process for Win32 Services | © Microsoft Corporation. All rights reserved. | ?? | 14.00 kb, rsAh, | created: 2.3.2006 14:00:00, modified: 2.3.2006 14:00:00 Command line: C:\WINDOWS\system32\svchost -k rpcss c:\windows\system32\svchost.exe | Script: Quarantine, Delete, Delete via BC, Terminate 157252 | Generic Host Process for Win32 Services | © Microsoft Corporation. All rights reserved. | ?? | 14.00 kb, rsAh, | created: 2.3.2006 14:00:00, modified: 2.3.2006 14:00:00 Command line: C:\WINDOWS\System32\svchost.exe c:\windows\system32\svchost.exe | Script: Quarantine, Delete, Delete via BC, Terminate 157248 | Generic Host Process for Win32 Services | © Microsoft Corporation. All rights reserved. | ?? | 14.00 kb, rsAh, | created: 2.3.2006 14:00:00, modified: 2.3.2006 14:00:00 Command line: C:\WINDOWS\System32\svchost.exe c:\windows\system32\svchost.exe | Script: Quarantine, Delete, Delete via BC, Terminate 157700 | Generic Host Process for Win32 Services | © Microsoft Corporation. All rights reserved. | ?? | 14.00 kb, rsAh, | created: 2.3.2006 14:00:00, modified: 2.3.2006 14:00:00 Command line: C:\WINDOWS\System32\svchost.exe c:\windows\system32\svchost.exe | Script: Quarantine, Delete, Delete via BC, Terminate 2292 | Generic Host Process for Win32 Services | © Microsoft Corporation. All rights reserved. | ?? | 14.00 kb, rsAh, | created: 2.3.2006 14:00:00, modified: 2.3.2006 14:00:00 Command line: svchost.exe "C:\WINDOWS\system32\1028s.exe" c:\windows\system32\svchost.exe | Script: Quarantine, Delete, Delete via BC, Terminate 2316 | Generic Host Process for Win32 Services | © Microsoft Corporation. All rights reserved. | ?? | 14.00 kb, rsAh, | created: 2.3.2006 14:00:00, modified: 2.3.2006 14:00:00 Command line: C:\WINDOWS\system32\svchost.exe -k imgsvc c:\windows\system32\svchost.exe | Script: Quarantine, Delete, Delete via BC, Terminate 157384 | Generic Host Process for Win32 Services | © Microsoft Corporation. All rights reserved. | ?? | 14.00 kb, rsAh, | created: 2.3.2006 14:00:00, modified: 2.3.2006 14:00:00 Command line: C:\WINDOWS\System32\svchost.exe c:\windows\system32\svchost.exe | Script: Quarantine, Delete, Delete via BC, Terminate 42472 | Generic Host Process for Win32 Services | © Microsoft Corporation. All rights reserved. | ?? | 14.00 kb, rsAh, | created: 2.3.2006 14:00:00, modified: 2.3.2006 14:00:00 Command line: C:\WINDOWS\System32\svchost.exe c:\windows\system32\svchost.exe | Script: Quarantine, Delete, Delete via BC, Terminate 1188 | Generic Host Process for Win32 Services | © Microsoft Corporation. All rights reserved. | ?? | 14.00 kb, rsAh, | created: 2.3.2006 14:00:00, modified: 2.3.2006 14:00:00 Command line: C:\WINDOWS\System32\svchost.exe -k netsvcs c:\windows\system32\svchost.exe | Script: Quarantine, Delete, Delete via BC, Terminate 1256 | Generic Host Process for Win32 Services | © Microsoft Corporation. All rights reserved. | ?? | 14.00 kb, rsAh, | created: 2.3.2006 14:00:00, modified: 2.3.2006 14:00:00 Command line: C:\WINDOWS\system32\svchost.exe -k NetworkService c:\windows\system32\svchost.exe | Script: Quarantine, Delete, Delete via BC, Terminate 158096 | Generic Host Process for Win32 Services | © Microsoft Corporation. All rights reserved. | ?? | 14.00 kb, rsAh, | created: 2.3.2006 14:00:00, modified: 2.3.2006 14:00:00 Command line: C:\WINDOWS\System32\svchost.exe c:\windows\system32\svchost.exe | Script: Quarantine, Delete, Delete via BC, Terminate 157648 | Generic Host Process for Win32 Services | © Microsoft Corporation. All rights reserved. | ?? | 14.00 kb, rsAh, | created: 2.3.2006 14:00:00, modified: 2.3.2006 14:00:00 Command line: C:\WINDOWS\System32\svchost.exe c:\program files\spybot - search & destroy\teatimer.exe | Script: Quarantine, Delete, Delete via BC, Terminate 3348 | System settings protector | © 2000-2009 Safer-Networking Ltd. Alle Rechte vorbehalten. | ?? | 2207.50 kb, RSAH, | created: 4.8.2009 15:33:41, modified: 5.3.2009 16:07:20 Command line: "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" c:\windows\system32\winlogon.exe | Script: Quarantine, Delete, Delete via BC, Terminate 876 | Windows NT Logon Application | © Microsoft Corporation. Všechna práva vyhrazena. | ?? | 490.50 kb, rsAh, | created: 2.3.2006 14:00:00, modified: 2.3.2006 14:00:00 Command line: winlogon.exe c:\windows\system32\wbem\wmiapsrv.exe | Script: Quarantine, Delete, Delete via BC, Terminate 151308 | WMI Performance Adapter Service | © Microsoft Corporation. Všechna práva vyhrazena. | ?? | 123.50 kb, rsAh, | created: 20.3.2008 16:41:13, modified: 2.3.2006 14:00:00 Command line: C:\WINDOWS\system32\wbem\wmiapsrv.exe c:\program files\internet explorer\wmpscfgs.exe | Script: Quarantine, Delete, Delete via BC, Terminate 156512 | | | ?? | error getting file info | Command line: "C:\Program Files\Internet Explorer\wmpscfgs.exe" c:\windows\system32\wuaucldt.exe | Script: Quarantine, Delete, Delete via BC, Terminate 159496 | | | ?? | 29.07 kb, rsAh, | created: 24.5.2010 16:02:18, modified: 24.5.2010 16:02:18 Command line: c:\windows\system32\wuaucldt.exe c:\windows\system32\wuauclt.exe | Script: Quarantine, Delete, Delete via BC, Terminate 164520 | Windows Update | © Microsoft Corporation. All rights reserved. | ?? | 52.22 kb, rsAh, | created: 20.3.2008 16:43:41, modified: 6.8.2009 19:24:06 Command line: "C:\WINDOWS\system32\wuauclt.exe" /RunStoreAsComServer Local\[4a4]SUSDS3af9f0028d059c4da58c872bc5cf6e54 c:\windows\system32\wuauclt.exe | Script: Quarantine, Delete, Delete via BC, Terminate 156448 | Windows Update | © Microsoft Corporation. All rights reserved. | ?? | 52.22 kb, rsAh, | created: 20.3.2008 16:43:41, modified: 6.8.2009 19:24:06 Command line: "C:\WINDOWS\system32\wuauclt.exe" Detected:74, recognized as trusted 48
| | |||||
| Module | Base address | Size in memory | Description | Manufacturer
| C:\WINDOWS\system32\DRIVERS\Apfiltr.sys | Script: Quarantine, Delete, Delete via BC F6B19000 | 01F000 (126976) | Alps Touch Pad Driver | Copyright (C) Alps Electric Co., Ltd. 1999-2006
| C:\WINDOWS\System32\Drivers\dump_atapi.sys | Script: Quarantine, Delete, Delete via BC A96B1000 | 018000 (98304) |
| C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS | Script: Quarantine, Delete, Delete via BC F7B96000 | 002000 (8192) |
| C:\WINDOWS\system32\DRIVERS\ethpdrv.sys | Script: Quarantine, Delete, Delete via BC F79E6000 | 008000 (32768) | Ethernet Packet Driver |
| C:\WINDOWS\system32\DRIVERS\HSX_CNXT.sys | Script: Quarantine, Delete, Delete via BC A98E6000 | 0B4000 (737280) | HSF_CNXT driver | Copyright© Conexant Systems, Inc. 2006
| C:\WINDOWS\system32\DRIVERS\HSX_DPV.sys | Script: Quarantine, Delete, Delete via BC A999A000 | 103000 (1060864) | HSF_DP driver | Copyright© Conexant Systems, Inc. 2006
| C:\WINDOWS\system32\DRIVERS\HSXHWAZL.sys | Script: Quarantine, Delete, Delete via BC A9A9D000 | 03D000 (249856) | HSF_HWAZL WDM driver | Copyright© Conexant Systems, Inc. 2006
| C:\WINDOWS\system32\Drivers\NDIS.sys | Script: Quarantine, Delete, Delete via BC 86205000 | 02CA80 (182912) |
| C:\WINDOWS\system32\DRIVERS\xaudio.sys | Script: Quarantine, Delete, Delete via BC F79C6000 | 008000 (32768) | Modem Audio Device Driver | Copyright© Conexant Systems, Inc. 2006
| C:\WINDOWS\system32\Drivers\zzmaa.sys | Script: Quarantine, Delete, Delete via BC F7483000 | 134000 (1261568) |
| Modules found - 144, recognized as trusted - 134
| | ||||||||
| Service | Description | Status | File | Group | Dependencies
| Messengerose | Service: Stop, Delete, Disable Kurýrní služba Messengerose | Not started | C:\WINDOWS\system32\1028s.exe | Script: Quarantine, Delete, Delete via BC |
| XAudioService | Service: Stop, Delete, Disable XAudioService | Not started | C:\WINDOWS\system32\DRIVERS\xaudio.exe | Script: Quarantine, Delete, Delete via BC |
| Detected - 87, recognized as trusted - 85
| | ||||||
| Service | Description | Status | File | Group | Dependencies
| ApfiltrService | Driver: Unload, Delete, Disable Alps Pointing-device Filter Driver | Running | C:\WINDOWS\system32\DRIVERS\Apfiltr.sys | Script: Quarantine, Delete, Delete via BC Pointer Port |
| Ethpdrv | Driver: Unload, Delete, Disable Ethernet Packet Driver | Running | C:\WINDOWS\system32\DRIVERS\ethpdrv.sys | Script: Quarantine, Delete, Delete via BC PNP_TDI |
| HSF_DPV | Driver: Unload, Delete, Disable HSF_DPV | Running | C:\WINDOWS\system32\DRIVERS\HSX_DPV.sys | Script: Quarantine, Delete, Delete via BC |
| HSXHWAZL | Driver: Unload, Delete, Disable HSXHWAZL | Running | C:\WINDOWS\system32\DRIVERS\HSXHWAZL.sys | Script: Quarantine, Delete, Delete via BC |
| NDIS | Driver: Unload, Delete, Disable Systémový ovladač NDIS | Running | NDIS.sys | Script: Quarantine, Delete, Delete via BC |
| winachsf | Driver: Unload, Delete, Disable winachsf | Running | C:\WINDOWS\system32\DRIVERS\HSX_CNXT.sys | Script: Quarantine, Delete, Delete via BC |
| Abiosdsk | Driver: Unload, Delete, Disable Abiosdsk | Not started | Abiosdsk.sys | Script: Quarantine, Delete, Delete via BC Primary disk |
| abp480n5 | Driver: Unload, Delete, Disable abp480n5 | Not started | abp480n5.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| adpu160m | Driver: Unload, Delete, Disable adpu160m | Not started | adpu160m.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| Aha154x | Driver: Unload, Delete, Disable Aha154x | Not started | Aha154x.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| aic78u2 | Driver: Unload, Delete, Disable aic78u2 | Not started | aic78u2.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| aic78xx | Driver: Unload, Delete, Disable aic78xx | Not started | aic78xx.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| AliIde | Driver: Unload, Delete, Disable AliIde | Not started | AliIde.sys | Script: Quarantine, Delete, Delete via BC System Bus Extender |
| amsint | Driver: Unload, Delete, Disable amsint | Not started | amsint.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| asc | Driver: Unload, Delete, Disable asc | Not started | asc.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| asc3350p | Driver: Unload, Delete, Disable asc3350p | Not started | asc3350p.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| asc3550 | Driver: Unload, Delete, Disable asc3550 | Not started | asc3550.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| Atdisk | Driver: Unload, Delete, Disable Atdisk | Not started | Atdisk.sys | Script: Quarantine, Delete, Delete via BC Primary disk |
| cd20xrnt | Driver: Unload, Delete, Disable cd20xrnt | Not started | cd20xrnt.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| Changer | Driver: Unload, Delete, Disable Changer | Not started | Changer.sys | Script: Quarantine, Delete, Delete via BC Filter |
| CmdIde | Driver: Unload, Delete, Disable CmdIde | Not started | CmdIde.sys | Script: Quarantine, Delete, Delete via BC System Bus Extender |
| Cpqarray | Driver: Unload, Delete, Disable Cpqarray | Not started | Cpqarray.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| dac960nt | Driver: Unload, Delete, Disable dac960nt | Not started | dac960nt.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| dpti2o | Driver: Unload, Delete, Disable dpti2o | Not started | dpti2o.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| hpn | Driver: Unload, Delete, Disable hpn | Not started | hpn.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| i2omgmt | Driver: Unload, Delete, Disable i2omgmt | Not started | i2omgmt.sys | Script: Quarantine, Delete, Delete via BC SCSI Class |
| i2omp | Driver: Unload, Delete, Disable i2omp | Not started | i2omp.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| igfx | Driver: Unload, Delete, Disable igfx | Not started | C:\WINDOWS\system32\DRIVERS\igdkmd32.sys | Script: Quarantine, Delete, Delete via BC Video |
| ini910u | Driver: Unload, Delete, Disable ini910u | Not started | ini910u.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| IntelIde | Driver: Unload, Delete, Disable IntelIde | Not started | IntelIde.sys | Script: Quarantine, Delete, Delete via BC System Bus Extender |
| lbrtfdc | Driver: Unload, Delete, Disable lbrtfdc | Not started | lbrtfdc.sys | Script: Quarantine, Delete, Delete via BC System Bus Extender |
| mraid35x | Driver: Unload, Delete, Disable mraid35x | Not started | mraid35x.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| PCIDump | Driver: Unload, Delete, Disable PCIDump | Not started | PCIDump.sys | Script: Quarantine, Delete, Delete via BC PCI Configuration |
| PDCOMP | Driver: Unload, Delete, Disable PDCOMP | Not started | PDCOMP.sys | Script: Quarantine, Delete, Delete via BC |
| PDFRAME | Driver: Unload, Delete, Disable PDFRAME | Not started | PDFRAME.sys | Script: Quarantine, Delete, Delete via BC |
| PDRELI | Driver: Unload, Delete, Disable PDRELI | Not started | PDRELI.sys | Script: Quarantine, Delete, Delete via BC |
| PDRFRAME | Driver: Unload, Delete, Disable PDRFRAME | Not started | PDRFRAME.sys | Script: Quarantine, Delete, Delete via BC |
| perc2 | Driver: Unload, Delete, Disable perc2 | Not started | perc2.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| perc2hib | Driver: Unload, Delete, Disable perc2hib | Not started | perc2hib.sys | Script: Quarantine, Delete, Delete via BC Filter |
| ql1080 | Driver: Unload, Delete, Disable ql1080 | Not started | ql1080.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| Ql10wnt | Driver: Unload, Delete, Disable Ql10wnt | Not started | Ql10wnt.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| ql12160 | Driver: Unload, Delete, Disable ql12160 | Not started | ql12160.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| ql1240 | Driver: Unload, Delete, Disable ql1240 | Not started | ql1240.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| ql1280 | Driver: Unload, Delete, Disable ql1280 | Not started | ql1280.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| Simbad | Driver: Unload, Delete, Disable Simbad | Not started | Simbad.sys | Script: Quarantine, Delete, Delete via BC Filter |
| Sparrow | Driver: Unload, Delete, Disable Sparrow | Not started | Sparrow.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| sym_hi | Driver: Unload, Delete, Disable sym_hi | Not started | sym_hi.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| sym_u3 | Driver: Unload, Delete, Disable sym_u3 | Not started | sym_u3.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| symc810 | Driver: Unload, Delete, Disable symc810 | Not started | symc810.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| symc8xx | Driver: Unload, Delete, Disable symc8xx | Not started | symc8xx.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| TosIde | Driver: Unload, Delete, Disable TosIde | Not started | TosIde.sys | Script: Quarantine, Delete, Delete via BC System Bus Extender |
| ultra | Driver: Unload, Delete, Disable ultra | Not started | ultra.sys | Script: Quarantine, Delete, Delete via BC SCSI miniport |
| ViaIde | Driver: Unload, Delete, Disable ViaIde | Not started | ViaIde.sys | Script: Quarantine, Delete, Delete via BC System Bus Extender |
| WDICA | Driver: Unload, Delete, Disable WDICA | Not started | WDICA.sys | Script: Quarantine, Delete, Delete via BC |
| Detected - 206, recognized as trusted - 152
| | ||||||
| File name | Status | Startup method | Description
| C:\Documents and Settings\Monika Zlámalová\Data aplikací\onbbw.exe | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon, Taskman
| C:\Documents and Settings\Monika Zlámalová\csrss.exe,explorer.exe,C:\Documents and Settings\Monika Zlámalová\Data aplikací\onbbw.exe | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_CURRENT_USER, Software\Microsoft\Windows NT\CurrentVersion\Winlogon, Shell
| C:\PROGRA~1\LAUNCH~1\LManager.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, LManager | Delete C:\Program Files\Ahead\Nero StartSmart\NeroStartSmart.exe | Script: Quarantine, Delete, Delete via BC Active | Shortcut in Startup folder | C:\Documents and Settings\Monika Zlámalová\Data aplikací\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\Monika Zlámalová\Data aplikací\Microsoft\Internet Explorer\Quick Launch\Nero StartSmart.lnk,
| C:\Program Files\Apoint2K\Apoint.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, Apoint | Delete C:\Program Files\DoubleD\GamingHarbor Toolbar\4.1.2.19770\stbapp.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_CURRENT_USER, Software\Microsoft\Windows\CurrentVersion\Run, SmileyApp | Delete C:\Program Files\ICQ6.5\ICQ.exe | Script: Quarantine, Delete, Delete via BC Active | Shortcut in Startup folder | C:\Documents and Settings\Monika Zlámalová\Data aplikací\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\Monika Zlámalová\Data aplikací\Microsoft\Internet Explorer\Quick Launch\ICQ6.5.lnk,
| C:\Program Files\Mozilla Firefox\firefox.exe | Script: Quarantine, Delete, Delete via BC Active | Shortcut in Startup folder | C:\Documents and Settings\Monika Zlámalová\Data aplikací\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\Monika Zlámalová\Data aplikací\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk,
| C:\Program Files\Skype\Phone\Skype.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_CURRENT_USER, Software\Microsoft\Windows\CurrentVersion\Run, Skype | Delete C:\Program Files\T-Mobile\Web'n'walk Manager\Manager.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_CURRENT_USER, Software\Microsoft\Windows\CurrentVersion\Run, T-Mobile Communication Centre | Delete C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1811\vsbntlo.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_CURRENT_USER, Software\Microsoft\Windows\CurrentVersion\Run, 12CFG214-K641-12SF-N85P | Delete C:\WINDOWS\System32\hidserv.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\HidServ\Parameters, ServiceDll | Delete C:\WINDOWS\System32\igmpv2.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile | Delete C:\WINDOWS\System32\ipbootp.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile | Delete C:\WINDOWS\System32\iprip2.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile | Delete C:\WINDOWS\System32\ospf.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPF, EventMessageFile | Delete C:\WINDOWS\System32\ospfmib.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPFMib, EventMessageFile | Delete C:\WINDOWS\System32\polagent.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PolicyAgent, EventMessageFile | Delete C:\WINDOWS\System32\spmsg.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\NtServicePack, EventMessageFile | Delete C:\WINDOWS\System32\spmsg.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\WgaNotify, EventMessageFile | Delete C:\WINDOWS\System32\spmsg.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\Windows Installer 3.1, EventMessageFile | Delete C:\WINDOWS\System32\spmsg.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\WindowsMedia, EventMessageFile | Delete C:\WINDOWS\System32\tssdis.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\TermServSessDir, EventMessageFile | Delete C:\WINDOWS\system32\KB905474\wgasetup.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\WgaSetup, EventMessageFile | Delete C:\WINDOWS\system32\MsSip1.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 1, $DLL | Delete C:\WINDOWS\system32\MsSip2.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 2, $DLL | Delete C:\WINDOWS\system32\MsSip3.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 3, $DLL | Delete C:\WINDOWS\system32\psxss.exe | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
| C:\WINDOWS\system32\regedit.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, Regedit32 | Delete C:\WINDOWS\system32\stisvc.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System, EventMessageFile | Delete SDEvents.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Spybot - Search & Destroy 2, EventMessageFile | Delete WgaLogon.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon, DLLName | Delete c:\documents and settings\monika zlámalová\wuaucldt.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_CURRENT_USER, Software\Microsoft\Windows\CurrentVersion\Run, syncman | Delete c:\windows\system32\wuaucldt.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, syncman | Delete kbd101.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver JPN | Delete kbd101a.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver KOR | Delete mvfs32.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_USERS, .DEFAULT\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_USERS, S-1-5-19\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_USERS, S-1-5-20\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_USERS, S-1-5-18\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_CURRENT_USER, Control Panel\IOProcs, MVB | Delete vgafix.fon | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon | Delete vgaoem.fon | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon | Delete vgasys.fon | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon | Delete Autoruns items found - 537, recognized as trusted - 493
| | ||||||
| File name | Type | Description | Manufacturer | CLSID
| Extension module | {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} | Delete C:\Program Files\ICQ6.5\ICQ.exe | Script: Quarantine, Delete, Delete via BC Extension module | ICQ | Copyright (c) 1998-2008 ICQ, LLC. | {E59EB121-F339-4851-A3BA-FE49C35617C2} | Delete Items found - 17, recognized as trusted - 15
| | |||||||||
| File name | Destination | Description | Manufacturer | CLSID
| deskpan.dll | Script: Quarantine, Delete, Delete via BC Rozšíření panelu Zobrazení pro panoramatické zobrazení | {42071714-76d4-11d1-8b24-00a0c9068ff3} | Delete Rozšíření prostředí pro kompresi souborů | {764BF0E1-F219-11ce-972D-00AA00A14F56} | Delete Kontextová nabídka šifrování | {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} | Delete Hlavní panel a nabídka Start | {0DF44EAA-FF21-4412-828E-260A8728E7F1} | Delete rundll32.exe C:\WINDOWS\system32\shimgvw.dll,ImageView_COMServer {00E7B358-F65B-4dcf-83DF-CD026B94BFD4} | Script: Quarantine, Delete, Delete via BC Autoplay for SlideShow | {00E7B358-F65B-4dcf-83DF-CD026B94BFD4} | Delete Uživatelské účty | {7A9D77BD-5403-11d2-8785-2E0420524153} | Delete Items found - 182, recognized as trusted - 176
| | ||||||||||||||||||||||
| File name | Type | Name | Description | Manufacturer
| Items found - 9, recognized as trusted - 9
| | ||||||
| File name | Job name | Job state | Description | Manufacturer
| C:\WINDOWS\system32\KB905474\wgasetup.exe | Script: Quarantine, Delete, Delete via BC WGASetup.job | The task is ready to run at its next scheduled time. | Nastavení programu Windows Genuine Advantage Notification | © 1995-2008 Microsoft Corporation
| Items found - 1, recognized as trusted - 0
| | ||||||
| Manufacturer | Status | EXE file | Description | GUID
| Detected - 4, recognized as trusted - 4
| | ||||||
| Manufacturer | EXE file | Description
| Detected - 24, recognized as trusted - 24
| | ||||||
| File name | Description | Manufacturer | CLSID | Source URL
| Items found - 0, recognized as trusted - 0
| | ||||||
| File name | Description | Manufacturer
| Items found - 26, recognized as trusted - 26
| | ||||||
| File name | Description | Manufacturer | CLSID
| Items found - 12, recognized as trusted - 12
| | ||||||
Hosts file record
|
| File name | Type | Description | Manufacturer | CLSID
| C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL | Script: Quarantine, Delete, Delete via BC Handler | Skype for COM API (Skype4COM Pluggable Protocol) | (c) Skype Technologies. All rights reserved. | {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D}
| Items found - 29, recognized as trusted - 28
| | ||||||
| File | Description | Type
| c:\program files\internet explorer\wmpscfgs.exe | Script: Quarantine, Delete, Delete via BC Suspicion for Rootkit | Suspicion for Rootkit
| ? | Script: Quarantine, Delete, Delete via BC Suspicion for Rootkit | Suspicion for Rootkit
| C:\WINDOWS\system32\app_dll.dll | Script: Quarantine, Delete, Delete via BC Suspicion for Keylogger | Suspicion for Keylogger or Trojan DLL
| |
Attention !!! Database was last updated 21.8.2009 it is necessary to update the database (via File - Database update) AVZ Antiviral Toolkit log; AVZ version is 4.32 Scanning started at 24.5.2010 20:27:50 Database loaded: signatures - 237871, NN profile(s) - 2, malware removal microprograms - 56, signature database released 21.08.2009 14:23 Heuristic microprograms loaded: 374 PVS microprograms loaded: 9 Digital signatures of system files loaded: 135524 Heuristic analyzer mode: Maximum heuristics mode Malware removal mode: disabled Windows version is: 5.1.2600, Service Pack 2 ; AVZ is run with administrator rights System Restore: enabled 1. Searching for Rootkits and other software intercepting API functions >>>> Suspicion for process file masking: c:\program files\internet explorer\wmpscfgs.exe 1.1 Searching for user-mode API hooks Analysis: kernel32.dll, export table found in section .text Analysis: ntdll.dll, export table found in section .text Analysis: user32.dll, export table found in section .text Analysis: advapi32.dll, export table found in section .text Analysis: ws2_32.dll, export table found in section .text Analysis: wininet.dll, export table found in section .text Analysis: rasapi32.dll, export table found in section .text Analysis: urlmon.dll, export table found in section .text Analysis: netapi32.dll, export table found in section .text 1.2 Searching for kernel-mode API hooks Driver loaded successfully SDT found (RVA=08A500) Kernel ntoskrnl.exe found in memory at address 804D7000 SDT = 80561500 KiST = 804E48D0 (284) Functions checked: 284, intercepted: 0, restored: 0 1.3 Checking IDT and SYSENTER Analyzing CPU 1 Analyzing CPU 2 Checking IDT and SYSENTER - complete >>>> Process masking detected 20236 ? >>>> Process masking detected 25376 ? >>>> Process masking detected 25440 ? >>>> Process masking detected 25588 ? >>>> Process masking detected 26180 ? >>>> Process masking detected 26176 ? >>>> Process masking detected 26628 ? >>>> Process masking detected 28424 ? >>>> Process masking detected 27348 ? >>>> Process masking detected 26312 ? >>>> Process masking detected 29620 ? >>>> Process masking detected 10612 ? >>>> Process masking detected 27024 ? >>>> Process masking detected 26576 ? >>>> Process masking detected 33316 ? 1.4 Searching for masking processes and drivers Checking not performed: extended monitoring driver (AVZPM) is not installed Driver loaded successfully 1.5 Checking IRP handlers \FileSystem\ntfs[IRP_MJ_CREATE] = 863470D0 -> hook not defined Checking - complete 2. Scanning RAM Number of processes found: 56 Extended process analysis: 648 C:\PROGRA~1\LAUNCH~1\LManager.exe [ES]:Application has no visible windows [ES]:Registered for automatic startup !! Extended process analysis: 664 C:\Program Files\Apoint2K\Apoint.exe [ES]:Program code includes networking-related functionality [ES]:Application has no visible windows [ES]:Registered for automatic startup !! Extended process analysis: 1280 C:\Program Files\Apoint2K\Apntex.exe [ES]:Application has no visible windows Extended process analysis: 3292 C:\Program Files\T-Mobile\Web'n'walk Manager\Manager.exe [ES]:Program code includes networking-related functionality [ES]:Application has no visible windows [ES]:EXE runtime packer ? [ES]:Registered for automatic startup !! [ES]:Loads RASAPI DLL - may use dialing ? Extended process analysis: 156512 C:\Program Files\Internet Explorer\wmpscfgs.exe [ES]:Program code includes networking-related functionality [ES]:Application has no visible windows [ES]:Loads RASAPI DLL - may use dialing ? Extended process analysis: 156660 C:\Program Files\Skype\Plugin Manager\skypePM.exe [ES]:Program code includes networking-related functionality [ES]:Application has no visible windows [ES]:Loads RASAPI DLL - may use dialing ? Extended process analysis: 159496 c:\windows\system32\wuaucldt.exe [ES]:Application has no visible windows [ES]:Located in system folder [ES]:Registered for automatic startup !! Extended process analysis: 158420 C:\Program Files\Mozilla Firefox\firefox.exe [ES]:Program code includes networking-related functionality [ES]:Registered for automatic startup !! [ES]:Loads RASAPI DLL - may use dialing ? Extended process analysis: 63716 C:\Program Files\Skype\Toolbars\Shared\SkypeNames2.exe [ES]:Application has no visible windows Number of modules loaded: 429 Scanning RAM - complete 3. Scanning disks 4. Checking Winsock Layered Service Provider (SPI/LSP) LSP settings checked. No errors detected 5. Searching for keyboard/mouse/windows events hooks (Keyloggers, Trojan DLLs) C:\WINDOWS\system32\app_dll.dll --> Suspicion for Keylogger or Trojan DLL C:\WINDOWS\system32\app_dll.dll>>> Behaviour analysis Behaviour typical for keyloggers was not detected Note: Do NOT delete suspicious files, send them for analysis (see FAQ for more details), because there are lots of useful hooking DLLs 6. Searching for opened TCP/UDP ports used by malicious software Checking - disabled by user 7. Heuristic system check Latent DLL loading through AppInit_DLLs suspected: "app_dll.dll" >>> Attention - non-standard Task Manager "C:\Documents and Settings\Monika Zl?malov?\csrss.exe" non-standard Winlogon\Shell key, hidden startup suspected "explorer.exe rundll32.exe bfvf.bxo dompgam" >>> Attention - Registry Editor is blocked >>> Suspicion for service/driver reg key masking "zzmaa" Checking - complete 8. Searching for vulnerabilities >> Services: potentially dangerous service allowed: RemoteRegistry (Vzd?len? registr) >> Services: potentially dangerous service allowed: TermService (Termin?lov? slu?ba) >> Services: potentially dangerous service allowed: SSDPSRV (Slu?ba rozpozn?v?n? pomoc? protokolu SSDP) >> Services: potentially dangerous service allowed: Schedule (Pl?nova? ?loh) >> Services: potentially dangerous service allowed: mnmsrvc (NetMeeting - Vzd?len? sd?len? plochy) >> Services: potentially dangerous service allowed: RDSessMgr (Spr?vce relac? n?pov?dy ke vzd?len? plo?e) > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)! >> Security: administrative shares (C$, D$ ...) are enabled >> Security: anonymous user access is enabled >> Security: sending Remote Assistant queries is enabled Checking - complete 9. Troubleshooting wizard >> Blocked: Registry Editor >> Task Manager substitution >> Windows Explorer startup key is modified >> HDD autorun is allowed >> Network drives autorun is allowed >> Removable media autorun is allowed Checking - complete Files scanned: 486, extracted from archives: 0, malicious software found 0, suspicions - 0 Scanning finished at 24.5.2010 20:29:32 Time of scanning: 00:01:44 If you have a suspicion on presence of viruses or questions on the suspected objects, you can address http://virusinfo.info conference System Analysis in progressAdd commands to script:
Script commands