AVZ 4.37 http://z-oleg.com/secur/avz/
| File name | PID | Description | Copyright | MD5 | Information
| c:\windows\explorer.exe | Script: Quarantine, Delete, Delete via BC, Terminate 2108 | Průzkumník Windows | © Microsoft Corporation. Všechna práva vyhrazena. | ?? | 2555.00 kb, rsAh, | created: 27.04.2011 22:19:11, modified: 25.02.2011 07:30:54 Command line: C:\Windows\Explorer.EXE c:\program files\samsung\kies\external\firmwareupdate\kiespdlr.exe | Script: Quarantine, Delete, Delete via BC, Terminate 4000 | KiesPDLR | Copyright © 2011 | ?? | 20.39 kb, rsAh, | created: 29.09.2011 16:19:26, modified: 29.09.2011 16:19:26 Command line: "C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" c:\program files\samsung\kies\kiestrayagent.exe | Script: Quarantine, Delete, Delete via BC, Terminate 3412 | Kies TrayAgent Application | (c) Samsung Electronics Co., Ltd. All rights reserved. | ?? | 3425.89 kb, rsAh, | created: 29.09.2011 16:19:16, modified: 29.09.2011 16:19:16 Command line: "C:\Program Files\Samsung\Kies\KiesTrayAgent.exe" c:\program files\windows sidebar\sidebar.exe | Script: Quarantine, Delete, Delete via BC, Terminate 3576 | Windows Desktop Gadgets | © Microsoft Corporation. Všechna práva vyhrazena. | ?? | 1146.50 kb, rsAh, | created: 23.02.2011 23:24:47, modified: 20.11.2010 05:17:42 Command line: "C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun c:\program files\superantispyware\superantispyware.exe | Script: Quarantine, Delete, Delete via BC, Terminate 3932 | SUPERAntiSpyware Application | Copyright (C) 2005-2010 by SUPERAntiSpyware.com and SUPERAdBlocker.com | ?? | 2367.73 kb, rsAh, | created: 22.11.2010 18:29:41, modified: 22.11.2010 18:29:41 Command line: "C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" c:\program files\windows media player\wmpnetwk.exe | Script: Quarantine, Delete, Delete via BC, Terminate 3592 | Windows Media Player Network Sharing Service | © Microsoft Corporation. Všechna práva vyhrazena. | ?? | 1095.50 kb, rsAh, | created: 23.02.2011 23:25:27, modified: 20.11.2010 05:17:58 Command line: "C:\Program Files\Windows Media Player\wmpnetwk.exe" Detected:65, recognized as trusted 62
| | |||||
| Module | Base address | Size in memory | Description | Manufacturer
| C:\Windows\System32\Drivers\dump_atapi.sys | Script: Quarantine, Delete, Delete via BC 963DE000 | 009000 (36864) |
| C:\Windows\System32\Drivers\dump_dumpata.sys | Script: Quarantine, Delete, Delete via BC 963D3000 | 00B000 (45056) |
| C:\Windows\System32\Drivers\dump_dumpfve.sys | Script: Quarantine, Delete, Delete via BC 963E7000 | 011000 (69632) |
| C:\Windows\System32\Drivers\spgs.sys | Script: Quarantine, Delete, Delete via BC 88EA6000 | 0F3000 (995328) |
| Modules found - 195, recognized as trusted - 191
| | ||||||||
| Service | Description | Status | File | Group | Dependencies
| Detected - 157, recognized as trusted - 157
| | ||||||
| File name | Status | Startup method | Description
| C:\PROGRA~1\MIF5BA~1\Office12\1029\MAPIR.DLL | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Outlook, EventMessageFile
| C:\Program Files\MyPlayCity.com\Turtix - Rescue Adventures\Turtix - Rescue Adventures.exe | Script: Quarantine, Delete, Delete via BC Active | Shortcut in Startup folder | C:\Users\Petr\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\, C:\Users\Petr\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Turtix - Rescue Adventures.lnk,
| C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_CURRENT_USER, Software\Microsoft\Windows\CurrentVersion\Run, SUPERAntiSpyware | Delete C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_CURRENT_USER, Software\Microsoft\Windows\CurrentVersion\Run, KiesPDLR | Delete C:\Program Files\Samsung\Kies\Kies.exe | Script: Quarantine, Delete, Delete via BC Active | Shortcut in Startup folder | C:\Users\Petr\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\, C:\Users\Petr\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Samsung Kies.lnk,
| C:\Program Files\Samsung\Kies\KiesHelper.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, KiesHelper | Delete C:\Program Files\Samsung\Kies\KiesTrayAgent.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, KiesTrayAgent | Delete C:\Users\Petr\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk | Script: Quarantine, Delete, Delete via BC Active | File in Startup folder | C:\Users\Petr\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\, C:\Users\Petr\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk,
| C:\Users\Petr\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk | Script: Quarantine, Delete, Delete via BC Active | File in Startup folder | C:\Users\Petr\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\, C:\Users\Petr\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk,
| C:\Users\Petr\Desktop\JR2010\JRcm.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {C20B9A7B-ED5B-4CEB-B2A6-F1F62E99C539} | Delete C:\Windows\System32\appmgmts.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters, ServiceDll | Delete C:\Windows\System32\drivers\avipbb.sys | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\avipbb, EventMessageFile
| C:\Windows\System32\drivers\ss_bbus.sys | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\ss_bbus, EventMessageFile
| C:\Windows\system32\psxss.exe | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
| progman.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, shell | Delete rdpclip | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd, StartupPrograms | Delete vgafix.fon | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon | Delete vgaoem.fon | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon | Delete vgasys.fon | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon | Delete Autoruns items found - 653, recognized as trusted - 634
| | ||||||
| File name | Type | Description | Manufacturer | CLSID
| Extension module | {2670000A-7350-4f3c-8081-5663EE0C6C49} | Delete Extension module | {92780B25-18CC-41C8-B9BE-3C9C571A8263} | Delete URLSearchHook | {855F3B16-6D32-4fe6-8A56-BBB695989046} | Delete Items found - 10, recognized as trusted - 7
| | |||||||||||||||
| File name | Destination | Description | Manufacturer | CLSID
| WLMD Message Handler | {0563DB41-F538-4B37-A92D-4659049B7766} | Delete {1984DD45-52CF-49cd-AB77-18F378FEA264} {000214e8-0000-0000-c000-000000000046} 0x401 | Delete Context Menu Shell Extension | {84058084-7609-44D1-B3CC-7A9436CB6D92} | Delete {B9B9F083-2B04-452A-8691-83694AC1037B} | Logitech Setpoint Extension | Delete Shell Extension for Malware scanning | {45AC2688-0253-4ED8-97DE-B5370FA7D48A} | Delete C:\Users\Petr\Desktop\JR2010\JRcm.dll | Script: Quarantine, Delete, Delete via BC JRcm | {C20B9A7B-ED5B-4CEB-B2A6-F1F62E99C539} | Delete Items found - 47, recognized as trusted - 41
| | ||||||||||||||||||||||||
| File name | Type | Name | Description | Manufacturer
| Items found - 8, recognized as trusted - 8
| | ||||||
| File name | Job name | Job state | Description | Manufacturer
| Items found - 4, recognized as trusted - 4
| | ||||||
| Manufacturer | Status | EXE file | Description | GUID
| Detected - 9, recognized as trusted - 9
| | ||||||
| Manufacturer | EXE file | Description
| Detected - 35, recognized as trusted - 35
| | ||||||
| File name | Description | Manufacturer | CLSID | Source URL
| Items found - 4, recognized as trusted - 4
| | ||||||
| File name | Description | Manufacturer
| Items found - 24, recognized as trusted - 24
| | ||||||
| File name | Description | Manufacturer | CLSID
| Items found - 10, recognized as trusted - 10
| | ||||||
Hosts file record
|
| File name | Type | Description | Manufacturer | CLSID
| mscoree.dll | Script: Quarantine, Delete, Delete via BC Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D} | Delete mscoree.dll | Script: Quarantine, Delete, Delete via BC Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D} | Delete mscoree.dll | Script: Quarantine, Delete, Delete via BC Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D} | Delete Items found - 19, recognized as trusted - 16
| | ||||||
| File | Description | Type |
AVZ Antiviral Toolkit log; AVZ version is 4.37 Scanning started at 27.10.2011 19:54:50 Database loaded: signatures - 294598, NN profile(s) - 2, malware removal microprograms - 56, signature database released 27.10.2011 16:00 Heuristic microprograms loaded: 388 PVS microprograms loaded: 9 Digital signatures of system files loaded: 302280 Heuristic analyzer mode: Maximum heuristics mode Malware removal mode: disabled Windows version is: 6.1.7601, Service Pack 1 ; AVZ is run with administrator rights System Restore: enabled 1. Searching for Rootkits and other software intercepting API functions 1.1 Searching for user-mode API hooks Analysis: kernel32.dll, export table found in section .text Analysis: ntdll.dll, export table found in section .text Analysis: user32.dll, export table found in section .text Analysis: advapi32.dll, export table found in section .text Analysis: ws2_32.dll, export table found in section .text Analysis: wininet.dll, export table found in section .text Analysis: rasapi32.dll, export table found in section .text Analysis: urlmon.dll, export table found in section .text Analysis: netapi32.dll, export table found in section .text 1.2 Searching for kernel-mode API hooks Driver loaded successfully SDT found (RVA=169B00) Kernel ntkrnlpa.exe found in memory at address 82E4B000 SDT = 82FB4B00 KiST = 82EC9D5C (401) Functions checked: 401, intercepted: 0, restored: 0 1.3 Checking IDT and SYSENTER Analyzing CPU 1 Analyzing CPU 2 Checking IDT and SYSENTER - complete 1.4 Searching for masking processes and drivers Checking not performed: extended monitoring driver (AVZPM) is not installed 1.5 Checking IRP handlers Driver loaded successfully \FileSystem\ntfs[IRP_MJ_CREATE] = 84E7C1F8 -> hook not defined \FileSystem\ntfs[IRP_MJ_CLOSE] = 84E7C1F8 -> hook not defined \FileSystem\ntfs[IRP_MJ_WRITE] = 84E7C1F8 -> hook not defined \FileSystem\ntfs[IRP_MJ_QUERY_INFORMATION] = 84E7C1F8 -> hook not defined \FileSystem\ntfs[IRP_MJ_SET_INFORMATION] = 84E7C1F8 -> hook not defined \FileSystem\ntfs[IRP_MJ_QUERY_EA] = 84E7C1F8 -> hook not defined \FileSystem\ntfs[IRP_MJ_SET_EA] = 84E7C1F8 -> hook not defined \FileSystem\ntfs[IRP_MJ_QUERY_VOLUME_INFORMATION] = 84E7C1F8 -> hook not defined \FileSystem\ntfs[IRP_MJ_SET_VOLUME_INFORMATION] = 84E7C1F8 -> hook not defined \FileSystem\ntfs[IRP_MJ_DIRECTORY_CONTROL] = 84E7C1F8 -> hook not defined \FileSystem\ntfs[IRP_MJ_FILE_SYSTEM_CONTROL] = 84E7C1F8 -> hook not defined \FileSystem\ntfs[IRP_MJ_DEVICE_CONTROL] = 84E7C1F8 -> hook not defined \FileSystem\ntfs[IRP_MJ_LOCK_CONTROL] = 84E7C1F8 -> hook not defined \FileSystem\ntfs[IRP_MJ_QUERY_SECURITY] = 84E7C1F8 -> hook not defined \FileSystem\ntfs[IRP_MJ_SET_SECURITY] = 84E7C1F8 -> hook not defined \FileSystem\ntfs[IRP_MJ_PNP] = 84E7C1F8 -> hook not defined Checking - complete 2. Scanning RAM Number of processes found: 69 Extended process analysis: 4000 C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [ES]:Application has no visible windows [ES]:Registered for automatic startup !! Number of modules loaded: 641 Scanning RAM - complete 3. Scanning disks 4. Checking Winsock Layered Service Provider (SPI/LSP) LSP settings checked. No errors detected 5. Searching for keyboard/mouse/windows events hooks (Keyloggers, Trojan DLLs) Checking - disabled by user 6. Searching for opened TCP/UDP ports used by malicious software Checking - disabled by user 7. Heuristic system check Checking - complete 8. Searching for vulnerabilities >> Services: potentially dangerous service allowed: TermService (Vzd?len? plocha) >> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery) >> Services: potentially dangerous service allowed: Schedule (Pl?nova? ?loh) > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)! >> Security: disk drives' autorun is enabled >> Security: administrative shares (C$, D$ ...) are enabled >> Security: anonymous user access is enabled >> Security: sending Remote Assistant queries is enabled Checking - complete 9. Troubleshooting wizard >> HDD autorun is allowed >> Network drives autorun is allowed >> Removable media autorun is allowed Checking - complete Files scanned: 710, extracted from archives: 0, malicious software found 0, suspicions - 0 Scanning finished at 27.10.2011 19:55:51 Time of scanning: 00:01:02 If you have a suspicion on presence of viruses or questions on the suspected objects, you can address http://forum.kaspersky.com/index.php?showforum=19 System Analysis in progressAdd commands to script:
System Analysis - complete
Script commands