AVZ 4.37 http://z-oleg.com/secur/avz/
| File name | PID | Description | Copyright | MD5 | Information
| c:\documents and settings\erika\local settings\application data\google\chrome\application\chrome.exe | Script: Quarantine, Delete, Delete via BC, Terminate 3064 | Google Chrome | Copyright (C) 2006-2010 Google Inc. All Rights Reserved. | ?? | 1012.05 kb, rsAh, | created: 28.10.2011 18:53:38, modified: 26.10.2011 10:10:47 Command line: "C:\Documents and Settings\Erika\Local Settings\Application Data\Google\Chrome\Application\chrome.exe" --type=plugin --plugin-path="C:\Documents and Settings\Erika\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.7.0.8524_0\npSkypeChromePlugin.dll" --lang=sk --channel=2484.08CF1A80.15141194 /prefetch:4 c:\windows\explorer.exe | Script: Quarantine, Delete, Delete via BC, Terminate 1904 | Windows Explorer | © Microsoft Corporation. All rights reserved. | ?? | 1009.50 kb, rsAh, | created: 16.01.2007 22:05:41, modified: 14.04.2008 02:12:19 Command line: C:\WINDOWS\Explorer.EXE c:\program files\activision\call of duty 2\gamepark2\gpcl.exe | Script: Quarantine, Delete, Delete via BC, Terminate 1868 | GamePark klient | Allstar Group, s.r.o. | ?? | 399.50 kb, rsAh, | created: 09.08.2011 12:18:27, modified: 29.07.2011 15:38:18 Command line: "C:\Program Files\Activision\Call of Duty 2\GamePark2\gpcl.exe" c:\program files\icq7.4\icq.exe | Script: Quarantine, Delete, Delete via BC, Terminate 3164 | ICQ | Copyright (c) 1998-2010 ICQ, LLC. | ?? | 116.80 kb, rsAh, | created: 06.04.2011 16:24:39, modified: 06.04.2011 16:24:39 Command line: "C:\Program Files\ICQ7.4\ICQ.exe" c:\program files\common files\microsoft shared\vs7debug\mdm.exe | Script: Quarantine, Delete, Delete via BC, Terminate 1480 | Machine Debug Manager | © Microsoft Corporation. All rights reserved. | ?? | 314.57 kb, rsAh, | created: 20.06.2003 00:25:00, modified: 20.06.2003 00:25:00 Command line: "C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" c:\windows\system32\pnkbstrb.exe | Script: Quarantine, Delete, Delete via BC, Terminate 2408 | | | ?? | 209.49 kb, rsAh, | created: 24.12.2009 20:56:57, modified: 28.10.2011 17:54:35 Command line: C:\WINDOWS\system32\PnkBstrB.exe c:\windows\system32\rundll32.exe | Script: Quarantine, Delete, Delete via BC, Terminate 472 | Run a DLL as an App | © Microsoft Corporation. All rights reserved. | ?? | 32.50 kb, rsAh, | created: 04.08.2004 01:56:56, modified: 14.04.2008 02:12:33 Command line: "C:\WINDOWS\system32\RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit c:\program files\skype\phone\skype.exe | Script: Quarantine, Delete, Delete via BC, Terminate 1184 | Skype | (c) Skype Technologies S.A. | ?? | 19092.13 kb, RsAh, | created: 13.10.2011 11:45:22, modified: 13.10.2011 11:45:22 Command line: "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized c:\windows\system32\svchost.exe | Script: Quarantine, Delete, Delete via BC, Terminate 1020 | Generic Host Process for Win32 Services | © Microsoft Corporation. All rights reserved. | ?? | 14.00 kb, rsAh, | created: 04.08.2004 01:56:58, modified: 14.04.2008 02:12:36 Command line: C:\WINDOWS\System32\svchost.exe -k Akamai Detected:44, recognized as trusted 41
| | |||||
| Module | Base address | Size in memory | Description | Manufacturer
| .sys | Script: Quarantine, Delete, Delete via BC F7474000 | 018000 (98304) |
| C:\WINDOWS\System32\Drivers\dump_atapi.sys | Script: Quarantine, Delete, Delete via BC B5BAE000 | 018000 (98304) |
| C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS | Script: Quarantine, Delete, Delete via BC F79D9000 | 002000 (8192) |
| Modules found - 119, recognized as trusted - 116
| | |||||||
| Service | Description | Status | File | Group | Dependencies
| PnkBstrB | Service: Stop, Delete, Disable, Delete via BC PnkBstrB | Running | C:\WINDOWS\system32\PnkBstrB.exe | Script: Quarantine, Delete, Delete via BC |
| EhttpSrv | Service: Stop, Delete, Disable, Delete via BC ESET HTTP Server | Not started | C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe | Script: Quarantine, Delete, Delete via BC |
| ekrn | Service: Stop, Delete, Disable, Delete via BC ESET Service | Not started | C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe | Script: Quarantine, Delete, Delete via BC |
| npggsvc | Service: Stop, Delete, Disable, Delete via BC nProtect GameGuard Service | Not started | C:\WINDOWS\system32\GameMon.des | Script: Quarantine, Delete, Delete via BC |
| Detected - 105, recognized as trusted - 101
| | ||||||
| File name | Status | Startup method | Description
| C:\DOCUME~1\Erika\LOCALS~1\Temp\wininitd.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, Audio HD Driver | Delete C:\Documents and Settings\Erika\Application Data\audiohd.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_CURRENT_USER, Software\Microsoft\Windows\CurrentVersion\Run, Windows Audio Driver | Delete C:\Program Files\Activision\Call of Duty 2\GamePark2\gpcl.exe | Script: Quarantine, Delete, Delete via BC Active | Shortcut in Startup folder | C:\Documents and Settings\All Users\Start Menu\Programs\Startup\, C:\Documents and Settings\All Users\Start Menu\Programs\Startup\GamePark klient 2.lnk,
| C:\Program Files\Common Files\Logitech\LCD Manager\lcdmon.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, Launch LCDMon | Delete C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, egui | Delete C:\Program Files\ESET\ESET NOD32 Antivirus\shellExt.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved, {B089FE88-FB52-11D3-BDF1-0050DA34150D} | Delete C:\Program Files\Electronic Arts\EADM\Core.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_CURRENT_USER, Software\Microsoft\Windows\CurrentVersion\Run, EA Core | Delete C:\Program Files\Gameforge4D\4Story\PrePatch.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, 4StoryPrePatch | Delete C:\Program Files\ICQ7.2\ICQ.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_CURRENT_USER, Software\Microsoft\Windows\CurrentVersion\Run, ICQ | Delete C:\Program Files\NuGardt Software\Seismovision 3\Seismovision3.exe | Script: Quarantine, Delete, Delete via BC Active | Shortcut in Startup folder | C:\Documents and Settings\Erika\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\Erika\Application Data\Microsoft\Internet Explorer\Quick Launch\Seismovision 3.lnk,
| C:\Program Files\PokerStars\PokerStarsUpdate.exe | Script: Quarantine, Delete, Delete via BC Active | Shortcut in Startup folder | C:\Documents and Settings\Erika\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\Erika\Application Data\Microsoft\Internet Explorer\Quick Launch\PokerStars.lnk,
| C:\Program Files\Skype\Phone\Skype.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_CURRENT_USER, Software\Microsoft\Windows\CurrentVersion\Run, Skype | Delete C:\Program Files\Winamp\winampa.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, WinampAgent | Delete C:\Program Files\Zoner\Photo Studio 13\Program32\Zps.exe | Script: Quarantine, Delete, Delete via BC Active | Shortcut in Startup folder | C:\Documents and Settings\Erika\Application Data\Microsoft\Internet Explorer\Quick Launch\, C:\Documents and Settings\Erika\Application Data\Microsoft\Internet Explorer\Quick Launch\Zoner Photo Studio 13.lnk,
| C:\WINDOWS\System32\Drivers\AliIde.sys | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\aliide, EventMessageFile
| C:\WINDOWS\System32\Drivers\CmdIde.sys | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\cmdide, EventMessageFile
| C:\WINDOWS\System32\Drivers\IntelIde.sys | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\intelide, EventMessageFile
| C:\WINDOWS\System32\Drivers\TosIde.sys | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\toside, EventMessageFile
| C:\WINDOWS\System32\Drivers\ViaIde.sys | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\viaide, EventMessageFile
| C:\WINDOWS\System32\Drivers\lbrtfdc.sys | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\lbrtfdc, EventMessageFile
| C:\WINDOWS\System32\PrintFilterPipelineSvc.exe | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PrintFilterPipelineSvc, EventMessageFile
| C:\WINDOWS\System32\drivers\ss_bbus.sys | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\ss_bbus, EventMessageFile
| C:\WINDOWS\System32\igmpv2.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2, EventMessageFile
| C:\WINDOWS\System32\ipbootp.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP, EventMessageFile
| C:\WINDOWS\System32\iprip2.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2, EventMessageFile
| C:\WINDOWS\System32\ospf.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPF, EventMessageFile
| C:\WINDOWS\System32\ospfmib.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPFMib, EventMessageFile
| C:\WINDOWS\System32\polagent.dll | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\PolicyAgent, EventMessageFile
| C:\WINDOWS\System32\tssdis.exe | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\TermServSessDir, EventMessageFile
| C:\WINDOWS\system32\KB905474\wgasetup.exe | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\WgaSetup, EventMessageFile
| C:\WINDOWS\system32\MsSip1.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 1, $DLL | Delete C:\WINDOWS\system32\MsSip2.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 2, $DLL | Delete C:\WINDOWS\system32\MsSip3.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 3, $DLL | Delete C:\WINDOWS\system32\SEISMO~1.SCR | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_CURRENT_USER, Control Panel\Desktop, scrnsave.exe | Delete C:\WINDOWS\system32\SEISMO~1.SCR | Script: Quarantine, Delete, Delete via BC Active | File system.ini | C:\WINDOWS\system.ini, boot, SCRNSAVE.EXE
| C:\WINDOWS\system32\WUDHost.exe | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows\CurrentVersion\Run, Windows-Network Component | Delete C:\WINDOWS\system32\psxss.exe | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
| C:\WINDOWS\system32\stisvc.exe | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System, EventMessageFile
| c:\program files\common files\akamai\netsession_win_807ba95.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Akamai\Parameters, ServiceDll | Delete kbd101.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver JPN | Delete kbd101a.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\i8042prt\Parameters, LayerDriver KOR | Delete mvfs32.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_USERS, .DEFAULT\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_USERS, S-1-5-19\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_USERS, S-1-5-20\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_USERS, S-1-5-18\Control Panel\IOProcs, MVB | Delete mvfs32.dll | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_CURRENT_USER, Control Panel\IOProcs, MVB | Delete services32.exe | Script: Quarantine, Delete, Delete via BC -- | Registry key | HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\SafeBoot, AlternateShell
| vgafix.fon | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fixedfon.fon | Delete vgaoem.fon | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, oemfonts.fon | Delete vgasys.fon | Script: Quarantine, Delete, Delete via BC Active | Registry key | HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\WOW\boot, fonts.fon | Delete Autoruns items found - 870, recognized as trusted - 820
| | ||||||
| File name | Type | Description | Manufacturer | CLSID
| C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll | Script: Quarantine, Delete, Delete via BC BHO | Skype Click to Call for Internet Explorer | (c) Skype Technologies S.A. | {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} | Delete C:\Program Files\PokerStars\PokerStarsUpdate.exe | Script: Quarantine, Delete, Delete via BC Extension module | {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} | Delete C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll | Script: Quarantine, Delete, Delete via BC Extension module | Skype Click to Call for Internet Explorer | (c) Skype Technologies S.A. | {898EA8C8-E7FF-479B-8935-AEC46303B9E5} | Delete C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll | Script: Quarantine, Delete, Delete via BC Extension module | Skype Click to Call for Internet Explorer | (c) Skype Technologies S.A. | {92780B25-18CC-41C8-B9BE-3C9C571A8263} | Delete Items found - 25, recognized as trusted - 21
| | ||||||||
| File name | Destination | Description | Manufacturer | CLSID
| Display Panning CPL Extension | {42071714-76d4-11d1-8b24-00a0c9068ff3} | Delete Shell extensions for file compression | {764BF0E1-F219-11ce-972D-00AA00A14F56} | Delete Encryption Context Menu | {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} | Delete Taskbar and Start Menu | {0DF44EAA-FF21-4412-828E-260A8728E7F1} | Delete User Accounts | {7A9D77BD-5403-11d2-8785-2E0420524153} | Delete C:\Program Files\ESET\ESET NOD32 Antivirus\shellExt.dll | Script: Quarantine, Delete, Delete via BC ESET Smart Security - Context Menu Shell Extension | {B089FE88-FB52-11D3-BDF1-0050DA34150D} | Delete Items found - 197, recognized as trusted - 191
| | |||||||||||||||||||||||
| File name | Type | Name | Description | Manufacturer
| Items found - 8, recognized as trusted - 8
| | ||||||
| File name | Job name | Job state | Description | Manufacturer
| Items found - 4, recognized as trusted - 4
| | ||||||
| Manufacturer | Status | EXE file | Description | GUID
| Detected - 3, recognized as trusted - 3
| | ||||||
| Manufacturer | EXE file | Description
| Detected - 19, recognized as trusted - 19
| | ||||||
| File name | Description | Manufacturer | CLSID | Source URL
| Items found - 6, recognized as trusted - 6
| | ||||||
| File name | Description | Manufacturer
| Items found - 33, recognized as trusted - 33
| | ||||||
| File name | Description | Manufacturer | CLSID
| Items found - 14, recognized as trusted - 14
| | ||||||
Hosts file record
|
| File name | Type | Description | Manufacturer | CLSID
| mscoree.dll | Script: Quarantine, Delete, Delete via BC Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D} | Delete mscoree.dll | Script: Quarantine, Delete, Delete via BC Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D} | Delete mscoree.dll | Script: Quarantine, Delete, Delete via BC Protocol | Microsoft .NET Runtime Execution Engine () | © Microsoft Corporation. All rights reserved. | {1E66F26B-79EE-11D2-8710-00C04F79ED0D} | Delete C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll | Script: Quarantine, Delete, Delete via BC Handler | Skype Click to Call for Internet Explorer (skype-ie-addon-data: pluggable protocol) | (c) Skype Technologies S.A. | {91774881-D725-4E58-B298-07617B9B86A8} | Delete Items found - 33, recognized as trusted - 29
| | ||||||
| File | Description | Type |
AVZ Antiviral Toolkit log; AVZ version is 4.37 Scanning started at 29.10.2011 17:19:44 Database loaded: signatures - 294598, NN profile(s) - 2, malware removal microprograms - 56, signature database released 29.10.2011 19:09 Heuristic microprograms loaded: 388 PVS microprograms loaded: 9 Digital signatures of system files loaded: 302911 Heuristic analyzer mode: Maximum heuristics mode Malware removal mode: disabled Windows version is: 5.1.2600, Service Pack 3 ; AVZ is run with administrator rights System Restore: enabled 1. Searching for Rootkits and other software intercepting API functions 1.1 Searching for user-mode API hooks Analysis: kernel32.dll, export table found in section .text Analysis: ntdll.dll, export table found in section .text Analysis: user32.dll, export table found in section .text Analysis: advapi32.dll, export table found in section .text Analysis: ws2_32.dll, export table found in section .text Analysis: wininet.dll, export table found in section .text Analysis: rasapi32.dll, export table found in section .text Analysis: urlmon.dll, export table found in section .text Analysis: netapi32.dll, export table found in section .text 1.2 Searching for kernel-mode API hooks Driver loaded successfully SDT found (RVA=08B520) Kernel ntoskrnl.exe found in memory at address 804D7000 SDT = 80562520 KiST = 804E48D0 (284) Functions checked: 284, intercepted: 0, restored: 0 1.3 Checking IDT and SYSENTER Analyzing CPU 1 Analyzing CPU 2 Analyzing CPU 3 Analyzing CPU 4 Checking IDT and SYSENTER - complete 1.4 Searching for masking processes and drivers Checking not performed: extended monitoring driver (AVZPM) is not installed 1.5 Checking IRP handlers Driver loaded successfully Checking - complete 2. Scanning RAM Number of processes found: 43 Extended process analysis: 1868 C:\Program Files\Activision\Call of Duty 2\GamePark2\gpcl.exe [ES]:Program code includes networking-related functionality [ES]:Listens on TCP ports ! [ES]:Application has no visible windows [ES]:Registered for automatic startup !! [ES]:Loads RASAPI DLL - may use dialing ? Extended process analysis: 2408 C:\WINDOWS\system32\PnkBstrB.exe [ES]:Program code includes networking-related functionality [ES]:Capable of sending mail ?! [ES]:Application has no visible windows [ES]:Located in system folder Number of modules loaded: 344 Scanning RAM - complete 3. Scanning disks 4. Checking Winsock Layered Service Provider (SPI/LSP) LSP settings checked. No errors detected 5. Searching for keyboard/mouse/windows events hooks (Keyloggers, Trojan DLLs) 6. Searching for opened TCP/UDP ports used by malicious software Checking - disabled by user 7. Heuristic system check Non-standard registry key for system service: BITS ImagePath="" Non-standard registry key for system service: wuauserv ImagePath="" Checking - complete 8. Searching for vulnerabilities >> Services: potentially dangerous service allowed: RemoteRegistry (Remote Registry) >> Services: potentially dangerous service allowed: TermService (Terminal Services) >> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery Service) >> Services: potentially dangerous service allowed: Schedule (Task Scheduler) >> Services: potentially dangerous service allowed: mnmsrvc (NetMeeting Remote Desktop Sharing) >> Services: potentially dangerous service allowed: RDSessMgr (Remote Desktop Help Session Manager) > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)! >> Security: disk drives' autorun is enabled >> Security: administrative shares (C$, D$ ...) are enabled >> Security: anonymous user access is enabled >> Security: sending Remote Assistant queries is enabled Checking - complete 9. Troubleshooting wizard >> HDD autorun is allowed >> Network drives autorun is allowed >> Removable media autorun is allowed Checking - complete Files scanned: 387, extracted from archives: 0, malicious software found 0, suspicions - 0 Scanning finished at 29.10.2011 17:20:18 Time of scanning: 00:00:35 If you have a suspicion on presence of viruses or questions on the suspected objects, you can address http://forum.kaspersky.com/index.php?showforum=19 System Analysis in progressAdd commands to script:
System Analysis - complete
Script commands