home

tcpz-x86d.sys

TCP-Z Kernel driver. It's safe only come with TCP-Z!

deepxw Software

The file tcpz-x86d.sys, “TCP/IP Half Open Connection Utility Driver For TCP-Z” by deepxw Software has been detected as a potentially unwanted program by 19 anti-malware scanners. It runs as a Windows kernel mode device driver named “TCP Half Open Limited Patcher ( TCP-Z)”.
Publisher:
deepxw  (signed by deepxw Software)

Product:
TCP-Z Kernel driver. It's safe only come with TCP-Z!

Description:
TCP/IP Half Open Connection Utility Driver For TCP-Z

Version:
6.0.6000.3009 built by: WinDDK

MD5:
1d1e2ac3195b7d199337557ca9ab84cf

SHA-1:
1ac8d3db5647b3bcba39c3b48a647207d4651be7

Scanner detections:
19 / 68

Status:
Potentially unwanted

Analysis date:
4/24/2024 12:35:14 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Trojan.Agent
7.1.1

avast!
Win32:Tcpz-C [PUP]
2014.9-140904

Baidu Antivirus
Trojan.Win32.TCPZ
4.0.3.1494

Bkav FE
W32.Agent10S.Rootkit
1.3.0.4959

Dr.Web
Tool.TcpZ
9.0.1.0247

ESET NOD32
Win32/TCPZ
8.9655

Fortinet FortiGate
W32/Dx.LCE!tr
9/4/2014

K7 AntiVirus
Trojan
13.176.11702

Malwarebytes
Rootkit.Agent
v2014.09.04.03

McAfee
Generic.dx!1D1E2AC3195B
5600.7018

Microsoft Security Essentials
HackTool:WinNT/Tcpz.C
1.10401

NANO AntiVirus
Trojan.Win32.SdBot.hjuf
0.28.0.59048

Norman
Suspicious_Gen2.VDAL
11.20140904

nProtect
Backdoor/W32.Agent.12136
14.04.08.01

Sophos
TCP-Z TCP Patch and Monitor
4.98

Total Defense
Win32/FakeAV.CEH
37.0.10867

Trend Micro House Call
HKTL_TCPZ
7.2.247

Trend Micro
HKTL_TCPZ
10.465.04

VIPRE Antivirus
Backdoor.Win32.IRCBot.jsm
28158

File size:
11.9 KB (12,136 bytes)

Product version:
6.0.6000.3009

Copyright:
Copyright (c) deepxw Corp.1998-2008

Original file name:
tcpz.sys

File type:
Driver (Win32 SYS)

Digital Signature
Signed by:
deepxw Software

Authority:
deepxw Software

Valid from:
1/18/2008 9:00:00 PM

Valid to:
12/31/2011 9:00:00 PM

Subject:
CN=deepxw Software, E=deepxw, O=deepxw Software

Issuer:
CN=deepxw Software, E=deepxw, O=deepxw Software

Serial number:
18232ACE5210A6B04D8617A50040AF4C

File PE Metadata
Compilation timestamp:
12/27/2008 12:33:05 PM

OS version:
5.2

OS bitness:
Win32

Subsystem:
Native (none required)

Linker version:
7.10

CTPH (ssdeep):
192:y9lZJLLBNcFf2EmeLBUssUuwyowJL/Btx9:y9lZdPcFf8+BLdYJL3x9

Entry address:
0x4005

Entry point:
8B, FF, 55, 8B, EC, A1, 04, 30, 01, 00, 85, C0, B9, 40, BB, 00, 00, 74, 04, 3B, C1, 75, 23, 8B, 15, 40, 20, 01, 00, B8, 04, 30, 01, 00, C1, E8, 08, 33, 02, 25, FF, FF, 00, 00, A3, 04, 30, 01, 00, 75, 07, 8B, C1, A3, 04, 30, 01, 00, F7, D0, A3, 00, 30, 01, 00, 5D, E9, C8, DA, FF, FF, 94, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 5C, 42, 00, 00, 0C, 20, 00, 00, 88, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 92, 42, 00, 00, 00, 20, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
5.5742

Code size:
4.5 KB (4,608 bytes)

Driver
Display name:
TCP Half Open Limited Patcher ( TCP-Z)

Service name:
TCPZ

Type:
Kernel device driver (KernelDriver)


Remove tcpz-x86d.sys - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.