is it clean?

[parufka]

Hi,
at first thanks for all help, I'm sure about one computer:
(maybe it could be AV - I forgot tell user to disable AV)

Function kernel32.dll:CreateProcessA (198) intercepted, method ProcAddressHijack.GetProcAddress ->BFF77741->C008CEEE
Function kernel32.dll:LoadLibraryExA (554) intercepted, method ProcAddressHijack.GetProcAddress ->BFF91318->C008CF05
Function kernel32.dll:WinExec (812) intercepted, method ProcAddressHijack.GetProcAddress ->BFFA0DA8->C008CEE6

and AVZ found some suspicious files.

Could You take a look?

Parufka

[drongo]

Please download the last version of the AVZ(4.24 ) update it and create 2 logs of avz .
Please copy these files to zip archive with password : virus

c:\WINDOWS\SYSTEM\CMSFIXLD.EXE
c:\Program Files\Linksys\Wireless-G Notebook Adapter\InstallDrv.exe

and upload it using http://virusinfo.info/upload_virus.php?tid=8445
for future investigation .

[parufka]

>I'm sure about one computer:
Should be: I'm not sure about one computer

I uploaded files but logs should arrive on monday

Parufka

[NickGolovko]

c:\WINDOWS\SYSTEM\CMSFIXLD.EXE

was detected by Ikarus antivirus only. This looks like a false alarm.

The other file seems to be clean either.

[parufka]

>Please download the last version of the AVZ(4.24 ) update it and create >2 logs of avz .

logs are uploaded
parufka

[NickGolovko]

No active infection is visible.

Please send us the quarantine contents according to the rules.

[CyberHelper]

Статистика проведенного лечения:

• Получено карантинов: 2
• Обработано файлов: 12
• В ходе лечения вредоносные программы в карантинах не обнаружены