# Forum in English  > Internet security for beginners  > Viruses, Adware, Spyware, Hijackers  > Custom descriptions of malware  >  scan results

## biancamatsch

<AVZ_CollectSysInfo>
--------------------
Start time: 08.03.2008 22:31:53
Duration: 00:01:44
Finish time: 08.03.2008 22:33:37

<AVZ_CollectSysInfo>
--------------------
Time Event
---- -----
08.03.2008 22:31:54 1.1 Searching for user-mode API hooks
08.03.2008 22:31:54  Analysis: kernel32.dll, export table found in section .text
08.03.2008 22:31:54 Function kernel32.dll:CreateProcessA (99) intercepted, method ProcAddressHijack.GetProcAddress ->7C802367->61F03F42
08.03.2008 22:31:54 Hook kernel32.dll:CreateProcessA (99) blocked
08.03.2008 22:31:54 Function kernel32.dll:CreateProcessW (103) intercepted, method ProcAddressHijack.GetProcAddress ->7C802332->61F04040
08.03.2008 22:31:54 Hook kernel32.dll:CreateProcessW (103) blocked
08.03.2008 22:31:54 Function kernel32.dll:FreeLibrary (241) intercepted, method ProcAddressHijack.GetProcAddress ->7C80ABDE->61F041FC
08.03.2008 22:31:54 Hook kernel32.dll:FreeLibrary (241) blocked
08.03.2008 22:31:54 Function kernel32.dll:GetModuleFileNameA (372) intercepted, method ProcAddressHijack.GetProcAddress ->7C80B4CF->61F040FB
08.03.2008 22:31:54 Hook kernel32.dll:GetModuleFileNameA (372) blocked
08.03.2008 22:31:54 Function kernel32.dll:GetModuleFileNameW (373) intercepted, method ProcAddressHijack.GetProcAddress ->7C80B3D5->61F041A0
08.03.2008 22:31:54 Hook kernel32.dll:GetModuleFileNameW (373) blocked
08.03.2008 22:31:54 Function kernel32.dll:GetProcAddress (40 :Cool:  intercepted, method ProcAddressHijack.GetProcAddress ->7C80ADA0->61F04648
08.03.2008 22:31:54 Hook kernel32.dll:GetProcAddress (40 :Cool:  blocked
08.03.2008 22:31:54 Function kernel32.dll :lol: oadLibraryA (57 :Cool:  intercepted, method ProcAddressHijack.GetProcAddress ->7C801D77->61F03C6F
08.03.2008 22:31:54 Hook kernel32.dll :lol: oadLibraryA (57 :Cool:  blocked
08.03.2008 22:31:54  >>> Functions LoadLibraryA - preventing the AVZ process from being intercepted by address replacement  !!)
08.03.2008 22:31:54 Function kernel32.dll :lol: oadLibraryExA (579) intercepted, method ProcAddressHijack.GetProcAddress ->7C801D4F->61F03DAF
08.03.2008 22:31:54 Hook kernel32.dll :lol: oadLibraryExA (579) blocked
08.03.2008 22:31:54  >>> Functions LoadLibraryExA - preventing the AVZ process from being intercepted by address replacement !!)
08.03.2008 22:31:54 Function kernel32.dll :lol: oadLibraryExW (580) intercepted, method ProcAddressHijack.GetProcAddress ->7C801AF1->61F03E5A
08.03.2008 22:31:54 Hook kernel32.dll :lol: oadLibraryExW (580) blocked
08.03.2008 22:31:54 Function kernel32.dll :lol: oadLibraryW (581) intercepted, method ProcAddressHijack.GetProcAddress ->7C80AE4B->61F03D0C
08.03.2008 22:31:54 Hook kernel32.dll :lol: oadLibraryW (581) blocked
08.03.2008 22:31:54 IAT modification detected: GetModuleFileNameW - 009A0010<>7C80B3D5
08.03.2008 22:31:54  Analysis: ntdll.dll, export table found in section .text
08.03.2008 22:31:54  Analysis: user32.dll, export table found in section .text
08.03.2008 22:31:54  Analysis: advapi32.dll, export table found in section .text
08.03.2008 22:31:54  Analysis: ws2_32.dll, export table found in section .text
08.03.2008 22:31:54  Analysis: wininet.dll, export table found in section .text
08.03.2008 22:31:54  Analysis: rasapi32.dll, export table found in section .text
08.03.2008 22:31:55  Analysis: urlmon.dll, export table found in section .text
08.03.2008 22:31:55  Analysis: netapi32.dll, export table found in section .text
08.03.2008 22:31:55 1.2 Searching for kernel-mode API hooks
08.03.2008 22:31:55  Driver loaded successfully
08.03.2008 22:31:55  SDT found (RVA=07B380)
08.03.2008 22:31:55  Kernel ntkrnlpa.exe found in memory at address 804D7000
08.03.2008 22:31:55    SDT = 80552380
08.03.2008 22:31:55    KiST = 805011FC (284)
08.03.2008 22:31:55 Function NtOpenProcess (7A) intercepted (805BFE1E->F7C128AC), hook C:\Programme\Grisoft\AVG Anti-Spyware 7.5\guard.sys
08.03.2008 22:31:55 >>> Function recovered successfully !
08.03.2008 22:31:55 >>> Hook code blocked
08.03.2008 22:31:55 Function NtTerminateProcess (101) intercepted (805C776C->F531A660), hook C:\Programme\SUPERAntiSpyware\SASKUTIL.sys
08.03.2008 22:31:55 >>> Function recovered successfully !
08.03.2008 22:31:55 >>> Hook code blocked
08.03.2008 22:31:57 Functions checked: 284, intercepted: 2, restored: 2
08.03.2008 22:31:57 1.3 Checking IDT and SYSENTER
08.03.2008 22:31:57  Analysis for CPU 1
08.03.2008 22:31:57  Checking IDT and SYSENTER - complete
08.03.2008 22:31:57 1.4 Searching for masking processes and drivers
08.03.2008 22:31:57  Checking not performed: the extended monitoring driver (AVZPM) is not installed
08.03.2008 22:31:59 C:\Dokumente und Einstellungen\All Users\Desktop\Kaspersky Lab Tool\prremote.dll --> Suspicion for a Keylogger or Trojan DLL
08.03.2008 22:31:59 C:\Dokumente und Einstellungen\All Users\Desktop\Kaspersky Lab Tool\prremote.dll>>> Behavioral analysis: 
08.03.2008 22:31:59  Behaviour typical for keyloggers not detected
08.03.2008 22:31:59 C:\Dokumente und Einstellungen\All Users\Desktop\Kaspersky Lab Tool\FSSync.dll --> Suspicion for a Keylogger or Trojan DLL
08.03.2008 22:31:59 C:\Dokumente und Einstellungen\All Users\Desktop\Kaspersky Lab Tool\FSSync.dll>>> Behavioral analysis: 
08.03.2008 22:31:59  Behaviour typical for keyloggers not detected
08.03.2008 22:31:59 C:\Dokumente und Einstellungen\All Users\Desktop\Kaspersky Lab Tool\AVPGS.PPL --> Suspicion for a Keylogger or Trojan DLL
08.03.2008 22:31:59 C:\Dokumente und Einstellungen\All Users\Desktop\Kaspersky Lab Tool\AVPGS.PPL>>> Behavioral analysis: 
08.03.2008 22:31:59  Behaviour typical for keyloggers not detected
08.03.2008 22:31:59 C:\Dokumente und Einstellungen\All Users\Desktop\Kaspersky Lab Tool\prloader.dll --> Suspicion for a Keylogger or Trojan DLL
08.03.2008 22:31:59 C:\Dokumente und Einstellungen\All Users\Desktop\Kaspersky Lab Tool\prloader.dll>>> Behavioral analysis: 
08.03.2008 22:31:59  Behaviour typical for keyloggers not detected
08.03.2008 22:31:59 C:\Dokumente und Einstellungen\All Users\Desktop\Kaspersky Lab Tool\prkernel.ppl --> Suspicion for a Keylogger or Trojan DLL
08.03.2008 22:31:59 C:\Dokumente und Einstellungen\All Users\Desktop\Kaspersky Lab Tool\prkernel.ppl>>> Behavioral analysis: 
08.03.2008 22:31:59  Behaviour typical for keyloggers not detected
08.03.2008 22:31:59 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\pxstub.ppl --> Suspicion for a Keylogger or Trojan DLL
08.03.2008 22:31:59 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\pxstub.ppl>>> Behavioral analysis: 
08.03.2008 22:31:59  Behaviour typical for keyloggers not detected
08.03.2008 22:31:59 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\params.ppl --> Suspicion for a Keylogger or Trojan DLL
08.03.2008 22:31:59 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\params.ppl>>> Behavioral analysis: 
08.03.2008 22:31:59  Behaviour typical for keyloggers not detected
08.03.2008 22:31:59 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\dtreg.ppl --> Suspicion for a Keylogger or Trojan DLL
08.03.2008 22:31:59 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\dtreg.ppl>>> Behavioral analysis: 
08.03.2008 22:31:59  Behaviour typical for keyloggers not detected
08.03.2008 22:31:59 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\nfio.ppl --> Suspicion for a Keylogger or Trojan DLL
08.03.2008 22:31:59 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\nfio.ppl>>> Behavioral analysis: 
08.03.2008 22:31:59  Behaviour typical for keyloggers not detected
08.03.2008 22:31:59 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\fsdrvplg.ppl --> Suspicion for a Keylogger or Trojan DLL
08.03.2008 22:31:59 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\fsdrvplg.ppl>>> Behavioral analysis: 
08.03.2008 22:31:59  Behaviour typical for keyloggers not detected
08.03.2008 22:31:59 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\mkavio.ppl --> Suspicion for a Keylogger or Trojan DLL
08.03.2008 22:31:59 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\mkavio.ppl>>> Behavioral analysis: 
08.03.2008 22:31:59  Behaviour typical for keyloggers not detected
08.03.2008 22:31:59 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\tempfile.ppl --> Suspicion for a Keylogger or Trojan DLL
08.03.2008 22:31:59 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\tempfile.ppl>>> Behavioral analysis: 
08.03.2008 22:31:59  Behaviour typical for keyloggers not detected
08.03.2008 22:31:59 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\tm.ppl --> Suspicion for a Keylogger or Trojan DLL
08.03.2008 22:31:59 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\tm.ppl>>> Behavioral analysis: 
08.03.2008 22:31:59  Behaviour typical for keyloggers not detected
08.03.2008 22:31:59 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\bl.ppl --> Suspicion for a Keylogger or Trojan DLL
08.03.2008 22:31:59 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\bl.ppl>>> Behavioral analysis: 
08.03.2008 22:31:59  Behaviour typical for keyloggers not detected
08.03.2008 22:31:59 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\wmihlpr.ppl --> Suspicion for a Keylogger or Trojan DLL
08.03.2008 22:31:59 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\wmihlpr.ppl>>> Behavioral analysis: 
08.03.2008 22:31:59  Behaviour typical for keyloggers not detected
08.03.2008 22:32:01 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\regmap.ppl --> Suspicion for a Keylogger or Trojan DLL
08.03.2008 22:32:01 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\regmap.ppl>>> Behavioral analysis: 
08.03.2008 22:32:01  Behaviour typical for keyloggers not detected
08.03.2008 22:32:01 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\crpthlpr.ppl --> Suspicion for a Keylogger or Trojan DLL
08.03.2008 22:32:01 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\crpthlpr.ppl>>> Behavioral analysis: 
08.03.2008 22:32:01  Behaviour typical for keyloggers not detected
08.03.2008 22:32:01 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\winreg.ppl --> Suspicion for a Keylogger or Trojan DLL
08.03.2008 22:32:01 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\winreg.ppl>>> Behavioral analysis: 
08.03.2008 22:32:01  Behaviour typical for keyloggers not detected
08.03.2008 22:32:01 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\report.ppl --> Suspicion for a Keylogger or Trojan DLL
08.03.2008 22:32:01 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\report.ppl>>> Behavioral analysis: 
08.03.2008 22:32:01  Behaviour typical for keyloggers not detected
08.03.2008 22:32:01 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\thpimpl.ppl --> Suspicion for a Keylogger or Trojan DLL
08.03.2008 22:32:01 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\thpimpl.ppl>>> Behavioral analysis: 
08.03.2008 22:32:01  Behaviour typical for keyloggers not detected
08.03.2008 22:32:02 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\avs.ppl --> Suspicion for a Keylogger or Trojan DLL
08.03.2008 22:32:02 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\avs.ppl>>> Behavioral analysis: 
08.03.2008 22:32:02  Behaviour typical for keyloggers not detected
08.03.2008 22:32:02 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\avpmgr.ppl --> Suspicion for a Keylogger or Trojan DLL
08.03.2008 22:32:02 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\avpmgr.ppl>>> Behavioral analysis: 
08.03.2008 22:32:02  Behaviour typical for keyloggers not detected
08.03.2008 22:32:02 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\wdiskio.ppl --> Suspicion for a Keylogger or Trojan DLL
08.03.2008 22:32:02 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\wdiskio.ppl>>> Behavioral analysis: 
08.03.2008 22:32:02  Behaviour typical for keyloggers not detected
08.03.2008 22:32:02 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\avlib.ppl --> Suspicion for a Keylogger or Trojan DLL
08.03.2008 22:32:02 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\avlib.ppl>>> Behavioral analysis: 
08.03.2008 22:32:02  Behaviour typical for keyloggers not detected
08.03.2008 22:32:02 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\vmarea.ppl --> Suspicion for a Keylogger or Trojan DLL
08.03.2008 22:32:02 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\vmarea.ppl>>> Behavioral analysis: 
08.03.2008 22:32:02  Behaviour typical for keyloggers not detected
08.03.2008 22:32:02 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\avspm.ppl --> Suspicion for a Keylogger or Trojan DLL
08.03.2008 22:32:02 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\avspm.ppl>>> Behavioral analysis: 
08.03.2008 22:32:02  Behaviour typical for keyloggers not detected
08.03.2008 22:32:02 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\avp3info.ppl --> Suspicion for a Keylogger or Trojan DLL
08.03.2008 22:32:02 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\avp3info.ppl>>> Behavioral analysis: 
08.03.2008 22:32:02  Behaviour typical for keyloggers not detected
08.03.2008 22:32:02 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\avzscan.ppl --> Suspicion for a Keylogger or Trojan DLL
08.03.2008 22:32:02 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\avzscan.ppl>>> Behavioral analysis: 
08.03.2008 22:32:02  Behaviour typical for keyloggers not detected
08.03.2008 22:32:02 C:\Dokumente und Einstellungen\All Users\Desktop\Kaspersky Lab Tool\avzkrnl.dll --> Suspicion for a Keylogger or Trojan DLL
08.03.2008 22:32:02 C:\Dokumente und Einstellungen\All Users\Desktop\Kaspersky Lab Tool\avzkrnl.dll>>> Behavioral analysis: 
08.03.2008 22:32:02   1. Reacts to events: keyboard, all events
08.03.2008 22:32:02 Neural net: checking error
08.03.2008 22:32:02 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\basegui.ppl --> Suspicion for a Keylogger or Trojan DLL
08.03.2008 22:32:02 c:\dokumente und einstellungen\all users\desktop\kaspersky lab tool\basegui.ppl>>> Behavioral analysis: 
08.03.2008 22:32:02  Behaviour typical for keyloggers not detected
08.03.2008 22:32:02 Note: Do NOT delete suspicious files, send them for analysis  (see FAQ for more details),  because there are lots of useful hooking DLLs
08.03.2008 22:32:11 Latent loading of libraries through AppInit_DLLs suspected: "sockspy.dll"
08.03.2008 22:32:11 >> Services: potentially dangerous service allowed TermService (Terminaldienste)
08.03.2008 22:32:11 >> Services: potentially dangerous service allowed SSDPSRV (SSDP-Suchdienst)
08.03.2008 22:32:11 >> Services: potentially dangerous service allowed Alerter (Warndienst)
08.03.2008 22:32:11 >> Services: potentially dangerous service allowed Schedule (Taskplaner)
08.03.2008 22:32:11 >> Services: potentially dangerous service allowed mnmsrvc (NetMeeting-Remotedesktop-Freigabe)
08.03.2008 22:32:11 >> Services: potentially dangerous service allowed RDSessMgr (Sitzungs-Manager fьr Remotedesktophilfe)
08.03.2008 22:32:11 > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)!
08.03.2008 22:32:11 >> Security: disk drives' autorun is enabled
08.03.2008 22:32:11 >> Security: administrative shares (C$, D$ ...) are enabled
08.03.2008 22:32:11 >> Security: anonymous user access is enabled
08.03.2008 22:32:11 >> Security: sending Remote Assistant queries is enabled
08.03.2008 22:32:11 System Analysis in progress
08.03.2008 22:33:37 System Analysis - complete
08.03.2008 22:33:37 Delete file:C:\Dokumente und Einstellungen\All Users\Desktop\Kaspersky Lab Tool\LOG\avptool_syscheck.htm
08.03.2008 22:33:37 Delete file:C:\Dokumente und Einstellungen\All Users\Desktop\Kaspersky Lab Tool\LOG\avptool_syscheck.xml

----------


## NickGolovko

Hello,

please create a thread here:

http://virusinfo.info/forumdisplay.php?f=84

Follow the How To Post guide, please.

----------

