Avira Free Antivirus Report file date: 28 lutego 2012 22:32 Scanning for 3509678 virus strains and unwanted programs. The program is running as an unrestricted full version. Online services are available: Licensee : Avira AntiVir Personal - Free Antivirus Serial number : 0000149996-ADJIE-0000001 Platform : Windows 7 x64 Windows version : (Service Pack 1) [6.1.7601] Boot mode : Normally booted Username : SYSTEM Computer name : PARSLEY-PC Version information: BUILD.DAT : 12.0.0.898 41963 Bytes 2012-01-31 14:50:00 AVSCAN.EXE : 12.1.0.20 492496 Bytes 2012-01-31 07:56:54 AVSCAN.DLL : 12.1.0.18 54224 Bytes 2012-01-31 07:57:27 LUKE.DLL : 12.1.0.19 68304 Bytes 2012-01-31 07:57:02 AVSCPLR.DLL : 12.1.0.22 100048 Bytes 2012-01-31 07:56:54 AVREG.DLL : 12.1.0.29 228048 Bytes 2012-01-31 07:56:53 VBASE000.VDF : 7.10.0.0 19875328 Bytes 2009-11-06 08:05:36 VBASE001.VDF : 7.11.0.0 13342208 Bytes 2010-12-14 07:57:15 VBASE002.VDF : 7.11.19.170 14374912 Bytes 2011-12-20 07:57:20 VBASE003.VDF : 7.11.21.238 4472832 Bytes 2012-02-01 20:49:17 VBASE004.VDF : 7.11.21.239 2048 Bytes 2012-02-01 20:49:17 VBASE005.VDF : 7.11.21.240 2048 Bytes 2012-02-01 20:49:18 VBASE006.VDF : 7.11.21.241 2048 Bytes 2012-02-01 20:49:19 VBASE007.VDF : 7.11.21.242 2048 Bytes 2012-02-01 20:49:19 VBASE008.VDF : 7.11.21.243 2048 Bytes 2012-02-01 20:49:19 VBASE009.VDF : 7.11.21.244 2048 Bytes 2012-02-01 20:49:19 VBASE010.VDF : 7.11.21.245 2048 Bytes 2012-02-01 20:49:20 VBASE011.VDF : 7.11.21.246 2048 Bytes 2012-02-01 20:49:20 VBASE012.VDF : 7.11.21.247 2048 Bytes 2012-02-01 20:49:20 VBASE013.VDF : 7.11.22.33 1486848 Bytes 2012-02-03 20:49:23 VBASE014.VDF : 7.11.22.56 687616 Bytes 2012-02-03 20:49:24 VBASE015.VDF : 7.11.22.92 178176 Bytes 2012-02-06 20:49:24 VBASE016.VDF : 7.11.22.154 144896 Bytes 2012-02-08 20:49:25 VBASE017.VDF : 7.11.22.220 183296 Bytes 2012-02-13 20:49:25 VBASE018.VDF : 7.11.23.34 202752 Bytes 2012-02-15 20:49:26 VBASE019.VDF : 7.11.23.98 126464 Bytes 2012-02-17 20:49:26 VBASE020.VDF : 7.11.23.150 148480 Bytes 2012-02-20 20:49:27 VBASE021.VDF : 7.11.23.224 172544 Bytes 2012-02-23 20:49:27 VBASE022.VDF : 7.11.24.52 219648 Bytes 2012-02-28 20:49:28 VBASE023.VDF : 7.11.24.53 2048 Bytes 2012-02-28 20:49:28 VBASE024.VDF : 7.11.24.54 2048 Bytes 2012-02-28 20:49:28 VBASE025.VDF : 7.11.24.55 2048 Bytes 2012-02-28 20:49:28 VBASE026.VDF : 7.11.24.56 2048 Bytes 2012-02-28 20:49:28 VBASE027.VDF : 7.11.24.57 2048 Bytes 2012-02-28 20:49:29 VBASE028.VDF : 7.11.24.58 2048 Bytes 2012-02-28 20:49:29 VBASE029.VDF : 7.11.24.59 2048 Bytes 2012-02-28 20:49:29 VBASE030.VDF : 7.11.24.60 2048 Bytes 2012-02-28 20:49:30 VBASE031.VDF : 7.11.24.76 36352 Bytes 2012-02-28 20:49:33 Engineversion : 8.2.10.8 AEVDF.DLL : 8.1.2.2 106868 Bytes 2012-01-31 07:56:42 AESCRIPT.DLL : 8.1.4.7 442746 Bytes 2012-02-28 20:49:41 AESCN.DLL : 8.1.8.2 131444 Bytes 2012-02-28 20:49:40 AESBX.DLL : 8.2.4.5 434549 Bytes 2012-01-31 07:56:42 AERDL.DLL : 8.1.9.15 639348 Bytes 2012-01-31 07:56:42 AEPACK.DLL : 8.2.16.3 799094 Bytes 2012-02-28 20:49:40 AEOFFICE.DLL : 8.1.2.25 201084 Bytes 2012-01-31 07:56:41 AEHEUR.DLL : 8.1.4.0 4436342 Bytes 2012-02-28 20:49:39 AEHELP.DLL : 8.1.19.0 254327 Bytes 2012-02-28 20:49:36 AEGEN.DLL : 8.1.5.21 409971 Bytes 2012-02-28 20:49:35 AEEXP.DLL : 8.1.0.23 70005 Bytes 2012-02-28 20:49:41 AEEMU.DLL : 8.1.3.0 393589 Bytes 2012-01-31 07:56:38 AECORE.DLL : 8.1.25.4 201079 Bytes 2012-02-28 20:49:35 AEBB.DLL : 8.1.1.0 53618 Bytes 2012-01-31 07:56:38 AVWINLL.DLL : 12.1.0.17 27344 Bytes 2012-01-31 07:56:55 AVPREF.DLL : 12.1.0.17 51920 Bytes 2012-01-31 07:56:53 AVREP.DLL : 12.1.0.17 179408 Bytes 2012-01-31 07:56:53 AVARKT.DLL : 12.1.0.23 209360 Bytes 2012-01-31 07:56:49 AVEVTLOG.DLL : 12.1.0.17 169168 Bytes 2012-01-31 07:56:50 SQLITE3.DLL : 3.7.0.0 398288 Bytes 2012-01-31 07:57:08 AVSMTP.DLL : 12.1.0.17 62928 Bytes 2012-01-31 07:56:54 NETNT.DLL : 12.1.0.17 17104 Bytes 2012-01-31 07:57:04 RCIMAGE.DLL : 12.1.0.17 4450000 Bytes 2012-01-31 07:57:30 RCTEXT.DLL : 12.1.1.16 96208 Bytes 2012-01-31 07:57:30 Configuration settings for the scan: Jobname.............................: Complete system scan Configuration file..................: C:\program files (x86)\avira\antivir desktop\sysscan.avp Logging.............................: default Primary action......................: interactive Secondary action....................: ignore Scan master boot sector.............: on Scan boot sector....................: on Boot sectors........................: C:, D:, E:, Process scan........................: on Extended process scan...............: on Scan registry.......................: on Search for rootkits.................: on Integrity checking of system files..: off Scan all files......................: All files Scan archives.......................: on Recursion depth.....................: 20 Smart extensions....................: on Macro heuristic.....................: on File heuristic......................: extended Start of the scan: 28 lutego 2012 22:32 Starting master boot sector scan: Master boot sector HD0 [INFO] No virus was found! Start scanning boot sectors: Boot sector 'C:\' [INFO] No virus was found! Boot sector 'D:\' [INFO] No virus was found! Boot sector 'E:\' [INFO] No virus was found! Starting search for hidden objects. HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\CLSID\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\TreatAs [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\CLSID\{4299124F-F2C3-41b4-9C73-9236B2AD0E8F} [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\CLSID\{5852F5ED-8BF4-11D4-A245-0080C6F74284} [NOTE] The registry entry is invisible. The scan of running processes will be started Scan process 'WINWORD.EXE' - '88' Module(s) have been scanned Scan process 'avscan.exe' - '80' Module(s) have been scanned Scan process 'avcenter.exe' - '82' Module(s) have been scanned Scan process 'SUPBackground.exe' - '64' Module(s) have been scanned Scan process 'BingApp.exe' - '40' Module(s) have been scanned Scan process 'BingBar.exe' - '47' Module(s) have been scanned Scan process 'SSCKbdHk.exe' - '40' Module(s) have been scanned Scan process 'MovieColorEnhancer.exe' - '50' Module(s) have been scanned Scan process 'UNS.exe' - '42' Module(s) have been scanned Scan process 'daemonu.exe' - '42' Module(s) have been scanned Scan process 'LMS.exe' - '30' Module(s) have been scanned Scan process 'WCScheduler.exe' - '62' Module(s) have been scanned Scan process 'EasySpeedUpManager.exe' - '42' Module(s) have been scanned Scan process 'YCMMirage.exe' - '40' Module(s) have been scanned Scan process 'BluetoothHeadsetProxy.exe' - '28' Module(s) have been scanned Scan process 'avgnt.exe' - '76' Module(s) have been scanned Scan process 'BrYNSvc.exe' - '53' Module(s) have been scanned Scan process 'RunDll32.exe' - '34' Module(s) have been scanned Scan process 'BrStMonW.exe' - '54' Module(s) have been scanned Scan process 'MagicDisc.exe' - '35' Module(s) have been scanned Scan process 'Dropbox.exe' - '78' Module(s) have been scanned Scan process 'SeaPort.EXE' - '49' Module(s) have been scanned Scan process 'avguard.exe' - '74' Module(s) have been scanned Scan process 'rundll32.exe' - '66' Module(s) have been scanned Scan process 'sched.exe' - '41' Module(s) have been scanned Starting to scan executable files (registry). The registry was scanned ( '656' files ). Starting the file scan: Begin scan in 'C:\' C:\Users\Parsley\AppData\Local\Temp\fsyxhamopcezia.exe [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan C:\Users\Parsley\AppData\Local\Temp\iscsibin.exe [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan C:\Users\Parsley\AppData\Local\Temp\jar_cache1622216471253436412.tmp [0] Archive type: ZIP --> kxzspxpfzzffbdmdmwdxhgxb/jwlmbjwzipog.class [DETECTION] Contains recognition pattern of the EXP/CVE-2010-0840 exploit Begin scan in 'D:\' Begin scan in 'E:\' Beginning disinfection: C:\Users\Parsley\AppData\Local\Temp\jar_cache1622216471253436412.tmp [DETECTION] Contains recognition pattern of the EXP/CVE-2010-0840 exploit [NOTE] The file was moved to the quarantine directory under the name '4909fbed.qua'. C:\Users\Parsley\AppData\Local\Temp\iscsibin.exe [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan [NOTE] The file was moved to the quarantine directory under the name '5191d424.qua'. C:\Users\Parsley\AppData\Local\Temp\fsyxhamopcezia.exe [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan [NOTE] The file was moved to the quarantine directory under the name '03b88ecc.qua'. End of the scan: 28 lutego 2012 23:53 Used time: 1:20:31 Hour(s) The scan has been done completely. 28701 Scanned directories 598988 Files were scanned 3 Viruses and/or unwanted programs were found 0 Files were classified as suspicious 0 Files were deleted 0 Viruses and unwanted programs were repaired 3 Files were moved to quarantine 0 Files were renamed 0 Files cannot be scanned 598985 Files not concerned 7002 Archives were scanned 0 Warnings 6 Notes 719787 Objects were scanned with rootkit scan 3 Hidden objects were found