Показано с 1 по 2 из 2.

virus in my compu

  1. #1
    Junior Member Репутация
    Регистрация
    22.02.2009
    Сообщений
    1
    Вес репутации
    29

    virus in my compu

    21/02/2009 04:56:57 p.m. Windows version: Microsoft Windows XP, Build=2600, SP="Service Pack 3"
    21/02/2009 04:56:57 p.m. System Restore: enabled
    21/02/2009 04:56:57 p.m. 1.1 Searching for user-mode API hooks
    21/02/2009 04:56:57 p.m. Analysis: kernel32.dll, export table found in section .text
    21/02/2009 04:56:57 p.m. Function kernel32.dll:CreateProcessA (99) intercepted, method ProcAddressHijack.GetProcAddress ->7C80236B->61F03F42
    21/02/2009 04:56:57 p.m. Hook kernel32.dll:CreateProcessA (99) blocked
    21/02/2009 04:56:57 p.m. Function kernel32.dll:CreateProcessW (103) intercepted, method ProcAddressHijack.GetProcAddress ->7C802336->61F04040
    21/02/2009 04:56:57 p.m. Hook kernel32.dll:CreateProcessW (103) blocked
    21/02/2009 04:56:57 p.m. Function kernel32.dll:FreeLibrary (241) intercepted, method ProcAddressHijack.GetProcAddress ->7C80AC6E->61F041FC
    21/02/2009 04:56:57 p.m. Hook kernel32.dll:FreeLibrary (241) blocked
    21/02/2009 04:56:57 p.m. Function kernel32.dll:GetModuleFileNameA (373) intercepted, method ProcAddressHijack.GetProcAddress ->7C80B55F->61F040FB
    21/02/2009 04:56:57 p.m. Hook kernel32.dll:GetModuleFileNameA (373) blocked
    21/02/2009 04:56:57 p.m. Function kernel32.dll:GetModuleFileNameW (374) intercepted, method ProcAddressHijack.GetProcAddress ->7C80B465->61F041A0
    21/02/2009 04:56:57 p.m. Hook kernel32.dll:GetModuleFileNameW (374) blocked
    21/02/2009 04:56:57 p.m. Function kernel32.dll:GetProcAddress (409) intercepted, method ProcAddressHijack.GetProcAddress ->7C80AE30->61F04648
    21/02/2009 04:56:57 p.m. Hook kernel32.dll:GetProcAddress (409) blocked
    21/02/2009 04:56:57 p.m. Function kernel32.dlloadLibraryA (581) intercepted, method ProcAddressHijack.GetProcAddress ->7C801D7B->61F03C6F
    21/02/2009 04:56:57 p.m. Hook kernel32.dlloadLibraryA (581) blocked
    21/02/2009 04:56:57 p.m. >>> Functions LoadLibraryA - preventing AVZ process from being intercepted by address replacement !!)
    21/02/2009 04:56:57 p.m. Function kernel32.dlloadLibraryExA (582) intercepted, method ProcAddressHijack.GetProcAddress ->7C801D53->61F03DAF
    21/02/2009 04:56:57 p.m. Hook kernel32.dlloadLibraryExA (582) blocked
    21/02/2009 04:56:57 p.m. >>> Functions LoadLibraryExA - preventing AVZ process from being intercepted by address replacement !!)
    21/02/2009 04:56:57 p.m. Function kernel32.dlloadLibraryExW (583) intercepted, method ProcAddressHijack.GetProcAddress ->7C801AF5->61F03E5A
    21/02/2009 04:56:57 p.m. Hook kernel32.dlloadLibraryExW (583) blocked
    21/02/2009 04:56:57 p.m. Function kernel32.dlloadLibraryW (584) intercepted, method ProcAddressHijack.GetProcAddress ->7C80AEDB->61F03D0C
    21/02/2009 04:56:57 p.m. Hook kernel32.dlloadLibraryW (584) blocked
    21/02/2009 04:56:57 p.m. IAT modification detected: LoadLibraryW - 00C80010<>7C80AEDB
    21/02/2009 04:56:57 p.m. Analysis: ntdll.dll, export table found in section .text
    21/02/2009 04:56:57 p.m. Analysis: user32.dll, export table found in section .text
    21/02/2009 04:56:57 p.m. Analysis: advapi32.dll, export table found in section .text
    21/02/2009 04:56:57 p.m. Analysis: ws2_32.dll, export table found in section .text
    21/02/2009 04:56:57 p.m. Analysis: wininet.dll, export table found in section .text
    21/02/2009 04:56:57 p.m. Analysis: rasapi32.dll, export table found in section .text
    21/02/2009 04:56:57 p.m. Analysis: urlmon.dll, export table found in section .text
    21/02/2009 04:56:57 p.m. Analysis: netapi32.dll, export table found in section .text
    21/02/2009 04:56:58 p.m. 1.2 Searching for kernel-mode API hooks
    21/02/2009 04:56:58 p.m. Driver loaded successfully
    21/02/2009 04:56:58 p.m. SDT found (RVA=085700)
    21/02/2009 04:56:58 p.m. Kernel ntkrnlpa.exe found in memory at address 804D7000
    21/02/2009 04:56:58 p.m. SDT = 8055C700
    21/02/2009 04:56:58 p.m. KiST = 80504460 (284)
    21/02/2009 04:56:59 p.m. Functions checked: 284, intercepted: 0, restored: 0
    21/02/2009 04:56:59 p.m. 1.3 Checking IDT and SYSENTER
    21/02/2009 04:56:59 p.m. Analysis for CPU 1
    21/02/2009 04:56:59 p.m. Analysis for CPU 2
    21/02/2009 04:56:59 p.m. Checking IDT and SYSENTER - complete
    21/02/2009 04:57:00 p.m. 1.4 Searching for masking processes and drivers
    21/02/2009 04:57:00 p.m. Checking not performed: extended monitoring driver (AVZPM) is not installed
    21/02/2009 04:57:00 p.m. Driver loaded successfully
    21/02/2009 04:57:00 p.m. 1.5 Checking of IRP handlers
    21/02/2009 04:57:00 p.m. Checking - complete
    21/02/2009 04:57:00 p.m. C:\WINDOWS\system32\wdmaud.drv --> Suspicion for Keylogger or Trojan DLL
    21/02/2009 04:57:00 p.m. C:\WINDOWS\system32\wdmaud.drv>>> Behavioral analysis
    21/02/2009 04:57:00 p.m. Behaviour typical for keyloggers not detected
    21/02/2009 04:57:00 p.m. Note: Do NOT delete suspicious files, send them for analysis (see FAQ for more details), because there are lots of useful hooking DLLs
    21/02/2009 04:57:07 p.m. Latent loading of libraries through AppInit_DLLs suspected: "C:\ARCHIV~1\KASPER~1\KASPER~1\mzvkbd.dll"
    21/02/2009 04:57:08 p.m. >> Services: potentially dangerous service allowed: RemoteRegistry (Registro remoto)
    21/02/2009 04:57:08 p.m. >> Services: potentially dangerous service allowed: TermService (Servicios de Terminal Server)
    21/02/2009 04:57:08 p.m. >> Services: potentially dangerous service allowed: SSDPSRV (Servicio de descubrimientos SSDP)
    21/02/2009 04:57:08 p.m. >> Services: potentially dangerous service allowed: Schedule (Programador de tareas)
    21/02/2009 04:57:08 p.m. >> Services: potentially dangerous service allowed: mnmsrvc (Escritorio remoto compartido de NetMeeting)
    21/02/2009 04:57:08 p.m. >> Services: potentially dangerous service allowed: RDSessMgr (Administrador de sesiуn de Ayuda de escritorio remoto)
    21/02/2009 04:57:08 p.m. > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)!
    21/02/2009 04:57:08 p.m. >> Security: disk drives' autorun is enabled
    21/02/2009 04:57:08 p.m. >> Security: administrative shares (C$, D$ ...) are enabled
    21/02/2009 04:57:08 p.m. >> Security: anonymous user access is enabled
    21/02/2009 04:57:08 p.m. >> Security: sending Remote Assistant queries is enabled
    21/02/2009 04:57:11 p.m. >> Disable HDD autorun
    21/02/2009 04:57:11 p.m. >> Disable autorun from network drives
    21/02/2009 04:57:11 p.m. >> Disable CD/DVD autorun
    21/02/2009 04:57:11 p.m. >> Disable removable media autorun
    21/02/2009 04:57:11 p.m. System Analysis in progress
    21/02/2009 04:57:41 p.m. System Analysis - complete
    21/02/2009 04:57:41 p.m. Delete file:C:\Documents and Settings\User\Escritorio\Virus Removal Tool\is-RM78S\LOG\avptool_syscheck.htm
    21/02/2009 04:57:41 p.m. Delete file:C:\Documents and Settings\User\Escritorio\Virus Removal Tool\is-RM78S\LOG\avptool_syscheck.xml
    21/02/2009 04:57:41 p.m. Deleting service/driver: uti3mtk2
    21/02/2009 04:57:41 p.m. Delete file:C:\WINDOWS\system32\Drivers\uti3mtk2.sys
    21/02/2009 04:57:41 p.m. Deleting service/driver: uji3mtk2
    21/02/2009 04:57:41 p.m. Script executed without errors

  2. #2
    Senior Member Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Аватар для pig
    Регистрация
    17.09.2004
    Адрес
    Апатиты, Мурманская область, Россия
    Сообщений
    10,629
    Вес репутации
    1288

Похожие темы

  1. Kaspersky Anti-Virus: forbidden incoming virus Trojan-Downloader.BAT.Small.aq
    От makstarikov в разделе Помогите!
    Ответов: 28
    Последнее сообщение: 29.06.2012, 14:01
  2. Virus Acting Like an Anti-Virus Program (заявка №47308)
    От CyberHelper в разделе Отчеты сервиса лечения VirusInfo
    Ответов: 2
    Последнее сообщение: 18.01.2011, 21:01
  3. Virus removal tool does not eliminate identified virus (заявка №41545)
    От CyberHelper в разделе Отчеты сервиса лечения VirusInfo
    Ответов: 2
    Последнее сообщение: 13.12.2010, 12:00
  4. Virus Removal Tool Failed to remove Virus (заявка №38037)
    От CyberHelper в разделе Отчеты сервиса лечения VirusInfo
    Ответов: 1
    Последнее сообщение: 18.11.2010, 18:00
  5. Ответов: 5
    Последнее сообщение: 22.01.2009, 01:13

Свернуть/Развернуть Ваши права в разделе

  • Вы не можете создавать новые темы
  • Вы не можете отвечать в темах
  • Вы не можете прикреплять вложения
  • Вы не можете редактировать свои сообщения
  •  
Page generated in 0.00081 seconds with 19 queries