Avira Scan Report

missile

Can anyone please advise re the 4 WARNINGS in the following Avira scan?


Avira AntiVir Personal
Report file date: 12 June 2010 11:21
Scanning for 2206493 virus strains and unwanted programs.
Licensee : Avira AntiVir Personal - FREE Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows Vista
Windows version : (Service Pack 2) [6.0.6002]
Boot mode : Normally booted
Username : SYSTEM
Computer name : BOB-PC
Version information:
BUILD.DAT : 9.0.0.422 21701 Bytes 09/03/2010 10:29:00
AVSCAN.EXE : 9.0.3.10 466689 Bytes 20/11/2009 09:33:36
AVSCAN.DLL : 9.0.3.0 40705 Bytes 27/02/2009 10:58:24
LUKE.DLL : 9.0.3.2 209665 Bytes 20/02/2009 11:35:49
LUKERES.DLL : 9.0.2.0 12033 Bytes 27/02/2009 10:58:52
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06/11/2009 09:33:35
VBASE001.VDF : 7.10.1.0 1372672 Bytes 19/11/2009 09:33:36
VBASE002.VDF : 7.10.3.1 3143680 Bytes 20/01/2010 16:18:38
VBASE003.VDF : 7.10.3.75 996864 Bytes 26/01/2010 09:12:14
VBASE004.VDF : 7.10.4.203 1579008 Bytes 05/03/2010 11:56:22
VBASE005.VDF : 7.10.6.82 2494464 Bytes 15/04/2010 03:40:05
VBASE006.VDF : 7.10.7.218 2294784 Bytes 02/06/2010 18:30:44
VBASE007.VDF : 7.10.7.219 2048 Bytes 02/06/2010 18:30:44
VBASE008.VDF : 7.10.7.220 2048 Bytes 02/06/2010 18:30:44
VBASE009.VDF : 7.10.7.221 2048 Bytes 02/06/2010 18:30:44
VBASE010.VDF : 7.10.7.222 2048 Bytes 02/06/2010 18:30:45
VBASE011.VDF : 7.10.7.223 2048 Bytes 02/06/2010 18:30:45
VBASE012.VDF : 7.10.7.224 2048 Bytes 02/06/2010 18:30:45
VBASE013.VDF : 7.10.8.37 270336 Bytes 10/06/2010 14:58:13
VBASE014.VDF : 7.10.8.38 2048 Bytes 10/06/2010 14:58:13
VBASE015.VDF : 7.10.8.39 2048 Bytes 10/06/2010 14:58:13
VBASE016.VDF : 7.10.8.40 2048 Bytes 10/06/2010 14:58:13
VBASE017.VDF : 7.10.8.41 2048 Bytes 10/06/2010 14:58:13
VBASE018.VDF : 7.10.8.42 2048 Bytes 10/06/2010 14:58:14
VBASE019.VDF : 7.10.8.43 2048 Bytes 10/06/2010 14:58:14
VBASE020.VDF : 7.10.8.44 2048 Bytes 10/06/2010 14:58:14
VBASE021.VDF : 7.10.8.45 2048 Bytes 10/06/2010 14:58:14
VBASE022.VDF : 7.10.8.46 2048 Bytes 10/06/2010 14:58:14
VBASE023.VDF : 7.10.8.47 2048 Bytes 10/06/2010 14:58:14
VBASE024.VDF : 7.10.8.48 2048 Bytes 10/06/2010 14:58:14
VBASE025.VDF : 7.10.8.49 2048 Bytes 10/06/2010 14:58:14
VBASE026.VDF : 7.10.8.50 2048 Bytes 10/06/2010 14:58:14
VBASE027.VDF : 7.10.8.51 2048 Bytes 10/06/2010 14:58:15
VBASE028.VDF : 7.10.8.52 2048 Bytes 10/06/2010 14:58:15
VBASE029.VDF : 7.10.8.53 2048 Bytes 10/06/2010 14:58:15
VBASE030.VDF : 7.10.8.54 2048 Bytes 10/06/2010 14:58:15
VBASE031.VDF : 7.10.8.62 55808 Bytes 11/06/2010 06:18:56
Engineversion : 8.2.2.6
AEVDF.DLL : 8.1.2.0 106868 Bytes 02/05/2010 03:40:28
AESCRIPT.DLL : 8.1.3.31 1352058 Bytes 02/06/2010 18:33:21
AESCN.DLL : 8.1.6.1 127347 Bytes 13/05/2010 13:34:00
AESBX.DLL : 8.1.3.1 254324 Bytes 02/05/2010 03:40:29
AERDL.DLL : 8.1.4.6 541043 Bytes 02/05/2010 03:40:26
AEPACK.DLL : 8.2.1.1 426358 Bytes 19/03/2010 14:30:15
AEOFFICE.DLL : 8.1.1.0 201081 Bytes 13/05/2010 13:34:00
AEHEUR.DLL : 8.1.1.33 2724214 Bytes 04/06/2010 08:31:07
AEHELP.DLL : 8.1.11.5 242038 Bytes 02/06/2010 18:31:07
AEGEN.DLL : 8.1.3.10 377205 Bytes 02/06/2010 18:31:02
AEEMU.DLL : 8.1.2.0 393588 Bytes 02/05/2010 03:40:16
AECORE.DLL : 8.1.15.3 192886 Bytes 13/05/2010 13:33:58
AEBB.DLL : 8.1.1.0 53618 Bytes 02/05/2010 03:40:13
AVWINLL.DLL : 9.0.0.3 18177 Bytes 12/12/2008 08:47:59
AVPREF.DLL : 9.0.3.0 44289 Bytes 09/09/2009 09:12:26
AVREP.DLL : 8.0.0.7 159784 Bytes 19/02/2010 17:07:02
AVREG.DLL : 9.0.0.0 36609 Bytes 05/12/2008 10:32:09
AVARKT.DLL : 9.0.0.3 292609 Bytes 24/03/2009 15:05:41
AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 30/01/2009 10:37:08
SQLITE3.DLL : 3.6.1.0 326401 Bytes 28/01/2009 15:03:49
SMTPLIB.DLL : 9.2.0.25 28417 Bytes 02/02/2009 08:21:33
NETNT.DLL : 9.0.0.0 11521 Bytes 05/12/2008 10:32:10
RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 15/05/2009 15:39:58
RCTEXT.DLL : 9.0.73.0 86785 Bytes 20/11/2009 09:33:33
Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp
Logging.............................: low
Primary action......................: interactive
Secondary action....................: ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:,
Process scan........................: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium
Start of the scan: 12 June 2010 11:21
Starting search for hidden objects.
'128386' objects were checked, '0' hidden objects were found.
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'jucheck.exe' - '1' Module(s) have been scanned
Scan process 'unsecapp.exe' - '1' Module(s) have been scanned
Scan process 'iPodService.exe' - '1' Module(s) have been scanned
Scan process 'ehrecvr.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'wmpnetwk.exe' - '1' Module(s) have been scanned
Scan process 'RapportService.exe' - '0' Module(s) have been scanned
Scan process 'wmplayer.exe' - '1' Module(s) have been scanned
Scan process 'wmpnscfg.exe' - '1' Module(s) have been scanned
Scan process 'WmiPrvSE.exe' - '1' Module(s) have been scanned
Scan process 'ehsched.exe' - '1' Module(s) have been scanned
Scan process 'VzFw.exe' - '1' Module(s) have been scanned
Scan process 'WUDFHost.exe' - '1' Module(s) have been scanned
Scan process 'VzCdbSvc.exe' - '1' Module(s) have been scanned
Scan process 'XAudio.exe' - '1' Module(s) have been scanned
Scan process 'VESMgrSub.exe' - '1' Module(s) have been scanned
Scan process 'SearchIndexer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'VCSW.exe' - '1' Module(s) have been scanned
Scan process 'VESMgr.exe' - '1' Module(s) have been scanned
Scan process 'TomTomHOMEService.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'stacsv.exe' - '1' Module(s) have been scanned
Scan process 'sprtlisten.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'NSUService.exe' - '1' Module(s) have been scanned
Scan process 'NMSAccessU.exe' - '1' Module(s) have been scanned
Scan process 'KService.exe' - '1' Module(s) have been scanned
Scan process 'iviRegMgr.exe' - '1' Module(s) have been scanned
Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'ehmsas.exe' - '1' Module(s) have been scanned
Scan process 'ehtray.exe' - '1' Module(s) have been scanned
Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'PhotoshopElementsFileAgent.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'AppMonUtility.exe' - '1' Module(s) have been scanned
Scan process 'MSASCui.exe' - '1' Module(s) have been scanned
Scan process 'VAIOUpdt.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'taskeng.exe' - '1' Module(s) have been scanned
Scan process 'taskeng.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'taskeng.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'dwm.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'st330service.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'SLsvc.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'audiodg.exe' - '0' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'RapportMgmtService.exe' - '0' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsm.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'wininit.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
71 processes with 71 modules were scanned
Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!
[INFO] Please restart the search with Administrator rights
Master boot sector HD2
[INFO] No virus was found!
[INFO] Please restart the search with Administrator rights
Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Starting to scan executable files (registry).
The registry was scanned ( '44' files ).

Starting the file scan:
Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
[NOTE] This file is a Windows system file.
[NOTE] This file cannot be opened for scanning.
Catched Exception ScanSearch in file C:\Users\bob\AppData\Local\Microsoft\Windows Defender\FileTracker\{2B713174-4E98-4B0F-9272-F0124BF7BF58}:
ACCESS_VIOLATION
EAX = 00000000 EBX = 76BD1C5D
ECX = 00000080 EDX = 00000000
ESI = 00000000 EDI = 76c197e0
EIP = 00448881 EBP = 03D6E30C
ESP = 03D6E308 Flg = 00010296
CS = 00000023 SS = 0000001B
C:\Users\bob\Downloads\downloads\zaSetup_80_065_000_en.exe
[0] Archive type: ZIP SFX (self extracting)
--> SWITCHUNINST_44ZONE LABS.EXE
[1] Archive type: RSRC
--> WINDOWS6.0-KB929547-V2-X64.MSU
[1] Archive type: CAB (Microsoft)
--> Windows6.0-KB929547-v2-x64.cab
[WARNING] No further files can be extracted from this archive. The archive will be closed
C:\Windows\System32\drivers\sptd.sys
[WARNING] The file could not be opened!

End of the scan: 12 June 2010 13:24
Used time: 2:02:59 Hour(s)
The scan has been done completely.
27508 Scanned directories
545007 Files were scanned
0 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 files were deleted
0 Viruses and unwanted programs were repaired
0 Files were moved to quarantine
0 Files were renamed
2 Files cannot be scanned
545005 Files not concerned
9114 Archives were scanned
4 Warnings
1 Notes
128386 Objects were scanned with rootkit scan
0 Hidden objects were found

The_Grandmaster

I'm not exactly sure if that's bad or can be ignored so will have to wait for someone with more experience.

You could run malwarebytes in the mean time as there's no harm in doing so (written by alienRIK):

Download MALWAREBYTES (Make sure you click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_ma..._anti_malware/
Open malwarebytes and goto UPDATE and click 'check for updates'. After its updated goto SCANNER and click PERFORM FULL SCAN then click SCAN
Remove everything thats found (needs to be ticked)
Post the COMPLETE log here AFTER youve deleted everything it finds

tronator

missile wrote: »

Catched Exception ScanSearch

off-topic: Avira is clearly a German company

on-topic: Reboot in safe mode, log in as Administrator and scan again.

The_Grandmaster

still off-topic: I thought Germans prided themselves on being able to speak excellent English!

tronator

The_Grandmaster wrote: »

still off-topic: I thought Germans prided themselves on being able to speak excellent English!

even more off-topic: Do you wanna guess what nationality I am?

dogmaryxx

The warnings just mean that files could not be scanned. Those files are locked by the OS . Avira just warns you about it. There is nothing you can do about it. It's a normal warning, and nothing is wrong.

fiddiwebb

tronator wrote: »

even more off-topic: Do you wanna guess what nationality I am?

Ohhh...er...a wool weigher, so sheep = Welsh :think:

or maybe a Cockney?

I'm grasping at straws 'aint I

tronator

dogmaryxx wrote: »

The warnings just mean that files could not be scanned. Those files are locked by the OS . Avira just warns you about it. There is nothing you can do about it. It's a normal warning, and nothing is wrong.

I wouldn't let it stand as is. The file which is locked could also be a virus, which is running at the moment. So booting in safe mode and doing the scan again should solve the problem. Of course, you will never be able to scan the pagefile.sys once you booted Windows.

The_Grandmaster

tronator wrote: »

even more off-topic: Do you wanna guess what nationality I am?

I have a feeling you're German - but you could be bluffing!

Back on-topic: I think there is no harm in rebooting in safe mode and running scan again. If it works, great! If not... We shall have to think of something else to do! Or leave it as it is *shrug*

dogmaryxx

The warnings in the scanner log usually refer to files, which were being accessed by other programs and thus could not be checked for malware by AntiVir.
In general, this has nothing to do with virus suspicions. In order to reduce the number of warnings, close all applications before starting the scan.

The_Grandmaster

Ok then - I guess that's sorted.

Another off-topic: when avira finds 'patterns of recognition' is that worth worrying about? Should it be sent? I've seen it in the past but never knew the answer.