Hier dann die aktuellen Logs vom PC.

GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2009-02-21 15:51:55
Windows 5.1.2600 Service Pack 3


---- System - GMER 1.0.14 ----

SSDT spqo.sys ZwCreateKey [0xF72870E0]
SSDT spqo.sys ZwEnumerateKey [0xF72A5CA2]
SSDT spqo.sys ZwEnumerateValueKey [0xF72A6030]
SSDT spqo.sys ZwOpenKey [0xF72870C0]
SSDT spqo.sys ZwQueryKey [0xF72A6108]
SSDT spqo.sys ZwQueryValueKey [0xF72A5F88]
SSDT spqo.sys ZwSetValueKey [0xF72A619A]
SSDT \??\C:\Programme\SUPERAntiSpyware\SASKUTIL.sys (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xAE6D7F20]

INT 0x62 ? 8A3C9BF8
INT 0x63 ? 8A3C9BF8
INT 0x73 ? 8A3C9BF8
INT 0x82 ? 8A3C9BF8
INT 0xA4 ? 8A439BF8
INT 0xB4 ? 8A439BF8

---- Kernel code sections - GMER 1.0.14 ----

? dkmhj.sys Das System kann die angegebene Datei nicht finden. !
? spqo.sys Das System kann die angegebene Datei nicht finden. !
.text USBPORT.SYS!DllUnload F601F8AC 5 Bytes JMP 8A4391D8
.text aff56qoe.SYS F5410386 35 Bytes [ 00, 00, 00, 00, 00, 00, 20, ... ]
.text aff56qoe.SYS F54103AA 24 Bytes [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text aff56qoe.SYS F54103C4 3 Bytes [ 00, 70, 02 ]
.text aff56qoe.SYS F54103C9 1 Byte [ 2E ]
.text aff56qoe.SYS F54103CB 9 Bytes [ 00, 00, 5C, 02, 00, 00, 00, ... ]
.text ...

---- Kernel IAT/EAT - GMER 1.0.14 ----

IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!KfAcquireSpinLock] 4B8BDF8B
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!READ_PORT_UCHAR] 8D3F0304
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!KeGetCurrentIrql] CB033043
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!KfRaiseIrql] 0673C13B
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!KfLowerIrql] C13B0003
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!HalGetInterruptVector] 8366FA72
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!HalTranslateBusAddress] 75000E7B
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!KeStallExecutionProcessor] 0B7D80E3
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!KfReleaseSpinLock] 307B8D00
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!READ_PORT_BUFFER_USHORT] 00AA840F
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!READ_PORT_USHORT] 83660000
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT] 6A000E7A
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!WRITE_PORT_UCHAR] C6647400
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[WMILIB.SYS!WmiSystemControl] 4F8B0200
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[WMILIB.SYS!WmiCompleteRequest] 968D5140
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F7298048] spqo.sys

---- Devices - GMER 1.0.14 ----

Device \FileSystem\Ntfs \Ntfs 8A3C81F8
Device \FileSystem\Fastfat \FatCdrom 89CD6500
Device \FileSystem\Udfs \UdfsCdRom 89D45500
Device \FileSystem\Udfs \UdfsDisk 89D45500
Device \Driver\sptd \Device\4210415302 spqo.sys
Device \Driver\usbohci \Device\USBPDO-0 8A1B21F8
Device \Driver\usbehci \Device\USBPDO-1 8A1B11F8
Device \Driver\NetBT \Device\NetBT_Tcpip_{325DA82C-A080-47FD-9DFD-9070D80C9EF2} 88FAE1F8
Device \Driver\prodrv06 \Device\ProDrv06 E1D78C30
Device \Driver\Ftdisk \Device\HarddiskVolume1 8A3CA1F8
Device \Driver\nvatabus \Device\00000071 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\Ftdisk \Device\HarddiskVolume2 8A3CA1F8
Device \Driver\Cdrom \Device\CdRom0 8A173500
Device \Driver\Ftdisk \Device\HarddiskVolume3 8A3CA1F8
Device \Driver\Cdrom \Device\CdRom1 8A173500
Device \Driver\prohlp02 \Device\ProHlp02 E1017398
Device \Driver\NetBT \Device\NetBt_Wins_Export 88FAE1F8
Device \Driver\NetBT \Device\NetbiosSmb 88FAE1F8
Device \Driver\usbstor \Device\00000079 89D17500
Device \Driver\usbstor \Device\00000079 sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\PCI_PNP0302 \Device\0000004f spqo.sys
Device \Driver\usbohci \Device\USBFDO-0 8A1B21F8
Device \Driver\nvatabus \Device\0000006d prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\nvatabus \Device\NvAta0 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\usbehci \Device\USBFDO-1 8A1B11F8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 89CFA1F8
Device \Driver\nvatabus \Device\NvAta1 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\nvatabus \Device\0000006e prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\usbstor \Device\0000007b 89D17500
Device \Driver\usbstor \Device\0000007b sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \FileSystem\MRxSmb \Device\LanmanRedirector 89CFA1F8
Device \Driver\nvatabus \Device\NvAta2 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\usbstor \Device\0000007c 89D17500
Device \Driver\usbstor \Device\0000007c sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\Ftdisk \Device\FtControl 8A3CA1F8
Device \Driver\usbstor \Device\0000007d 89D17500
Device \Driver\usbstor \Device\0000007d sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\usbstor \Device\0000007e 89D17500
Device \Driver\usbstor \Device\0000007e sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\usbstor \Device\0000007f 89D17500
Device \Driver\usbstor \Device\0000007f sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\aff56qoe \Device\Scsi\aff56qoe1Port3Path0Target0Lun0 89D931F8
Device \Driver\aff56qoe \Device\Scsi\aff56qoe1Port3Path0Target0Lun0 sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\aff56qoe \Device\Scsi\aff56qoe1 89D931F8
Device \Driver\aff56qoe \Device\Scsi\aff56qoe1 sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \FileSystem\Fastfat \Fat 89CD6500
Device \FileSystem\Cdfs \Cdfs 89C06500

---- Registry - GMER 1.0.14 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch@Epoch 11481
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x20 0x2A 0x20 0x18 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xD3 0xD4 0xE2 0x68 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x67 0x83 0xED 0x78 ...
Reg HKLM\SYSTEM\ControlSet002\Services\kwdyf@DisplayName Shell Support
Reg HKLM\SYSTEM\ControlSet002\Services\kwdyf@Type 32
Reg HKLM\SYSTEM\ControlSet002\Services\kwdyf@Start 2
Reg HKLM\SYSTEM\ControlSet002\Services\kwdyf@ErrorControl 0
Reg HKLM\SYSTEM\ControlSet002\Services\kwdyf@ImagePath %SystemRoot%\system32\svchost.exe -k netsvcs
Reg HKLM\SYSTEM\ControlSet002\Services\kwdyf@ObjectName LocalSystem
Reg HKLM\SYSTEM\ControlSet002\Services\kwdyf@Description Speichert Sicherheitsinformationen f?r lokale Benutzerkonten.
Reg HKLM\SYSTEM\ControlSet002\Services\kwdyf\Parameters
Reg HKLM\SYSTEM\ControlSet002\Services\kwdyf\Parameters@ServiceDll C:\WINDOWS\system32\hxiiuhx.dll
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x20 0x2A 0x20 0x18 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xD3 0xD4 0xE2 0x68 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x67 0x83 0xED 0x78 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x20 0x2A 0x20 0x18 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xD3 0xD4 0xE2 0x68 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x67 0x83 0xED 0x78 ...

---- EOF - GMER 1.0.14 ----

Hier noch der andere Log

ComboFix 09-02-19.01 - Kai 2009-02-21 15:53:19.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1031.18.2047.1589 [GMT 1:00]
ausgeführt von:: c:\dokumente und einstellungen\Kai\Desktop\gmer\ComboFix.exe
AV: BitDefender Antivirus *On-access scanning disabled* (Updated)
FW: BitDefender Firewall *disabled*

Achtung - Auf diesem PC ist keine Wiederherstellungskonsole installiert !!
.

((((((((((((((((((((((( Dateien erstellt von 2009-01-21 bis 2009-02-21 ))))))))))))))))))))))))))))))
.

2009-02-21 10:55 . 2009-02-21 10:55 4,352 --a------ c:\windows\system32\drivers\cleanhelper.sys
2009-02-21 09:23 . 2009-02-21 12:23 81,984 --a------ c:\windows\system32\bdod.bin
2009-02-21 09:18 . 2009-02-21 09:18 850 --a------ c:\windows\system32\ProductTweaks.xml
2009-02-21 09:18 . 2009-02-21 09:18 385 --a------ c:\windows\system32\user_gensett.xml
2009-02-20 23:16 . 2009-02-20 23:16 <DIR> d-------- c:\programme\BitDefender
2009-02-20 23:16 . 2009-02-20 23:47 <DIR> d-------- c:\dokumente und einstellungen\All Users\Anwendungsdaten\BitDefender
2009-02-20 23:15 . 2009-02-21 12:23 <DIR> d-------- c:\programme\Gemeinsame Dateien\BitDefender
2009-02-20 22:23 . 2009-02-20 22:23 216 --a------ c:\windows\system32\spupdsvc.inf
2009-02-20 22:14 . 2009-02-20 22:14 <DIR> d-------- c:\programme\MSXML 4.0
2009-02-20 22:11 . 2009-02-20 22:11 <DIR> d-------- c:\dokumente und einstellungen\Kai\Anwendungsdaten\Safer Networking
2009-02-20 20:44 . 2009-02-20 20:44 <DIR> d-------- c:\windows\system32\de
2009-02-20 20:44 . 2009-02-20 20:44 <DIR> d-------- c:\windows\system32\bits
2009-02-20 20:44 . 2009-02-20 20:44 <DIR> d-------- c:\windows\l2schemas
2009-02-20 20:43 . 2009-02-20 20:43 <DIR> d-------- c:\windows\ServicePackFiles
2009-02-20 20:40 . 2009-02-20 20:40 <DIR> d-------- c:\windows\EHome
2009-02-20 20:37 . 2008-12-11 11:57 333,952 -----c--- c:\windows\system32\dllcache\srv.sys
2009-02-20 20:36 . 2008-12-12 18:01 3,088,896 -----c--- c:\windows\system32\dllcache\mshtml.dll
2009-02-20 20:36 . 2008-10-16 02:00 1,499,136 -----c--- c:\windows\system32\dllcache\shdocvw.dll
2009-02-20 20:36 . 2008-10-16 02:00 671,744 -----c--- c:\windows\system32\dllcache\wininet.dll
2009-02-20 20:36 . 2008-10-16 02:00 620,544 -----c--- c:\windows\system32\dllcache\urlmon.dll
2009-02-20 20:36 . 2008-06-14 18:32 273,024 -----c--- c:\windows\system32\dllcache\bthport.sys
2009-02-20 20:35 . 2008-08-14 14:19 2,191,488 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2009-02-20 20:35 . 2008-08-14 14:19 2,147,840 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-02-20 20:35 . 2008-08-14 14:19 2,068,352 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2009-02-20 20:35 . 2008-08-14 14:19 2,026,496 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2009-02-20 20:35 . 2008-09-15 16:24 1,846,528 -----c--- c:\windows\system32\dllcache\win32k.sys
2009-02-20 20:33 . 2004-08-03 22:41 1,041,536 --------- c:\windows\system32\drivers\hsfdpsp2.sys
2009-02-20 20:29 . 2008-05-08 15:02 203,136 -----c--- c:\windows\system32\dllcache\rmcast.sys
2009-02-20 20:28 . 2008-09-04 18:15 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
2009-02-20 20:28 . 2008-04-11 20:04 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll
2009-02-20 20:28 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2009-02-20 20:28 . 2008-10-15 17:35 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
2009-02-20 20:28 . 2008-05-01 15:34 331,776 -----c--- c:\windows\system32\dllcache\msadce.dll
2009-02-20 20:23 . 2008-10-16 14:08 27,672 --a------ c:\windows\system32\wuapi.dll.mui
2009-02-20 13:49 . 2009-02-20 13:49 7,680 --ahs---- c:\windows\Thumbs.db
2009-02-19 22:53 . 2009-02-19 22:53 <DIR> d-------- c:\programme\CCleaner
2009-02-19 22:51 . 2009-02-19 22:51 <DIR> d-------- c:\dokumente und einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com
2009-02-19 22:50 . 2009-02-19 22:50 <DIR> d-------- c:\programme\SUPERAntiSpyware
2009-02-19 22:50 . 2009-02-19 22:50 <DIR> d-------- c:\programme\Malwarebytes' Anti-Malware
2009-02-19 22:50 . 2009-02-19 22:50 <DIR> d-------- c:\dokumente und einstellungen\Kai\Anwendungsdaten\SUPERAntiSpyware.com
2009-02-19 22:50 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-19 22:50 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-19 19:54 . 2009-02-21 15:46 250 --a------ c:\windows\gmer.ini
2009-02-19 08:16 . 2009-02-19 08:16 <DIR> d-------- c:\dokumente und einstellungen\Kai\Anwendungsdaten\Malwarebytes
2009-02-19 08:12 . 2009-02-19 08:12 <DIR> d-------- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2009-02-18 21:32 . 2009-02-18 21:32 <DIR> d-------- c:\programme\Trend Micro
2009-02-18 20:14 . 2009-02-18 20:14 <DIR> d-------- c:\dokumente und einstellungen\Kai\Anwendungsdaten\Ashampoo
2009-02-18 20:08 . 2009-02-18 20:08 <DIR> d-------- c:\programme\Ashampoo
2009-02-18 20:08 . 2009-02-18 20:08 <DIR> d-------- c:\dokumente und einstellungen\All Users\Anwendungsdaten\ashampoo
2009-02-18 17:44 . 2009-02-18 17:44 <DIR> d-------- c:\programme\Real
2009-02-18 17:44 . 2009-02-18 17:44 <DIR> d-------- c:\programme\Gemeinsame Dateien\Real
2009-02-18 17:44 . 2009-02-18 17:44 <DIR> d-------- C:\Program Files
2009-02-17 18:08 . 2009-02-17 18:08 <DIR> d-------- c:\programme\Alex Feinman
2009-02-17 17:54 . 2009-02-17 17:54 <DIR> d-------- c:\dokumente und einstellungen\All Users\Anwendungsdaten\TrueCrypt
2009-02-17 17:15 . 2009-02-19 15:15 <DIR> d-------- c:\programme\TrueCrypt
2009-02-16 16:15 . 2009-02-16 16:16 <DIR> d-------- c:\programme\ICQ6.5
2009-02-16 13:36 . 2009-02-19 22:19 <DIR> d-------- c:\programme\Lavasoft
2009-02-16 13:36 . 2009-02-16 13:36 <DIR> d-------- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Lavasoft
2009-02-16 11:07 . 2009-02-16 11:07 <DIR> d--h----- c:\windows\system32\CanonIJ Uninstaller Information
2009-02-16 11:07 . 2009-02-16 11:07 <DIR> d--h----- c:\programme\CanonBJ
2009-02-16 11:07 . 2009-02-16 11:07 <DIR> d--h----- c:\dokumente und einstellungen\All Users\Anwendungsdaten\CanonBJ
2009-02-16 11:07 . 2006-06-22 21:00 163,840 --a------ c:\windows\system32\CNMLM89.DLL
2009-02-16 11:00 . 2008-04-13 19:47 25,856 --a------ c:\windows\system32\drivers\usbprint.sys
2009-02-14 18:43 . 2009-02-14 18:43 <DIR> d-------- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Azureus
2009-02-14 18:42 . 2009-02-14 19:16 <DIR> d-------- c:\dokumente und einstellungen\Kai\Anwendungsdaten\Azureus
2009-02-10 15:35 . 2009-02-10 15:35 <DIR> d-------- c:\dokumente und einstellungen\Kai\Anwendungsdaten\DivX
2009-02-06 17:48 . 2009-02-06 17:53 <DIR> d-------- c:\programme\DivX
2009-02-05 14:14 . 2009-02-19 22:23 <DIR> d-------- C:\Downloads
2009-02-04 19:36 . 2009-02-10 15:26 <DIR> d-------- c:\programme\Free Download Manager
2009-01-23 23:31 . 2009-01-23 23:31 <DIR> d-------- c:\dokumente und einstellungen\Kai\Anwendungsdaten\Stardock
2009-01-23 23:30 . 2009-01-23 23:30 <DIR> d-------- c:\programme\Stardock
2009-01-23 23:30 . 2009-01-23 23:30 <DIR> d-------- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Stardock
2009-01-23 23:30 . 2009-01-23 23:30 <DIR> d--h-c--- c:\dokumente und einstellungen\All Users\Anwendungsdaten\{1EB63B4B-5639-4477-8E24-05C31B5F8019}

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-21 14:53 --------- d-----w c:\programme\PeerGuardian2
2009-02-21 09:55 --------- d-----w c:\programme\MultiRes
2009-02-20 22:47 --------- d-----w c:\programme\Mozilla Thunderbird
2009-02-19 21:47 --------- d-----w c:\programme\Spybot - Search & Destroy
2009-02-19 21:36 --------- d-----w c:\programme\Gemeinsame Dateien\Wise Installation Wizard
2009-02-19 21:25 --------- d-----w c:\dokumente und einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2009-02-19 14:17 --------- d-----w c:\programme\TV-Browser
2009-02-18 15:12 --------- d--h--w c:\programme\InstallShield Installation Information
2009-02-16 15:16 --------- d-----w c:\programme\ICQ6Toolbar
2009-02-13 14:35 --------- d-----w c:\dokumente und einstellungen\Kai\Anwendungsdaten\teamspeak2
2009-02-03 22:23 --------- d-----w c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft Help
2009-01-12 19:11 --------- d-----w c:\programme\Realtek AC97
2009-01-12 19:10 --------- d-----w c:\programme\AMD
2009-01-10 18:52 --------- d-----w c:\programme\eRightSoft
2009-01-07 06:17 --------- d-----w c:\programme\DAEMON Tools Toolbar
2009-01-07 06:17 --------- d-----w c:\programme\DAEMON Tools Lite
2009-01-06 18:37 --------- d-----w c:\dokumente und einstellungen\All Users\Anwendungsdaten\SweetIM
2009-01-06 11:01 --------- d-----w c:\dokumente und einstellungen\Kai\Anwendungsdaten\Samsung
2009-01-06 10:57 5,632 ----a-w c:\windows\system32\drivers\StarOpen.sys
2009-01-06 10:44 --------- d-----w c:\programme\Samsung
2009-01-06 10:43 --------- d-----w c:\programme\Gemeinsame Dateien\Adobe
2009-01-05 20:54 --------- d-----w c:\programme\JoWooD
2009-01-01 16:58 171,520 ----a-w c:\windows\patchw32.dll
2008-12-29 19:19 --------- d-----w c:\dokumente und einstellungen\Kai\Anwendungsdaten\gtk-2.0
2008-12-27 18:00 --------- d-----w c:\programme\Oblivion Improved
2008-12-27 17:53 1,700,352 ----a-w c:\windows\system32\gdiplus.dll
2008-12-26 16:15 --------- d-----w c:\dokumente und einstellungen\Kai\Anwendungsdaten\Magic Set Editor
2008-12-26 16:14 --------- d-----w c:\programme\Magic Set Editor 2
2008-12-21 16:26 --------- d-----w c:\dokumente und einstellungen\Kai\Anwendungsdaten\dvdcss
2008-12-21 15:34 --------- d-----w c:\programme\PSP Pandora Deluxe
2008-12-11 00:33 86,016 ----a-w c:\windows\system32\dpl100.dll
2008-12-11 00:33 200,704 ----a-w c:\windows\system32\dtu100.dll
2008-12-09 02:28 593,920 ----a-w c:\windows\system32\dpuGUI11.dll
2008-12-09 02:28 57,344 ----a-w c:\windows\system32\dpv11.dll
2008-12-09 02:28 344,064 ----a-w c:\windows\system32\dpus11.dll
2008-12-09 02:28 294,912 ----a-w c:\windows\system32\dpu11.dll
2008-11-30 22:43 73,216 ----a-w c:\windows\cadkasdeinst01.exe
2006-05-03 10:06 163,328 --sh--r c:\windows\system32\flvDX.dll
2007-02-21 11:47 31,232 --sh--r c:\windows\system32\msfDX.dll
2008-03-16 13:30 216,064 --sh--r c:\windows\system32\nbDX.dll
.

((((((((((((((((((((((((((((( SnapShot_2009-02-21_12.27.28,95 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-02-21 11:32:27 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_53c.dat
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MobMapUpdater"="e:\world of warcraft\MobMapUpdater\MobMapUpdater.exe" [2008-11-05 1770624]
"BLASC"="c:\programme\buffed\BLASC.exe" [2009-02-20 2246656]
"PeerGuardian"="c:\programme\PeerGuardian2\pg2.exe" [2005-09-18 1421824]
"ICQ"="c:\programme\ICQ6.5\ICQ.exe" [2008-12-17 172792]
"DAEMON Tools Lite"="c:\programme\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560]
"SUPERAntiSpyware"="c:\programme\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-01-15 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="c:\programme\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"QuickTime Task"="c:\programme\QuickTime\QTTask.exe" [2008-09-06 413696]
"SunJavaUpdateSched"="c:\programme\Java\jre6\bin\jusched.exe" [2008-11-10 136600]
"AtiPTA"="atiptaxx.exe" [2006-02-22 c:\windows\system32\atiptaxx.exe]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 c:\windows\soundman.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\programme\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 c:\programme\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i420vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"e:\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Programme\\Java\\jre6\\bin\\java.exe"=
"e:\\SpellForce 2 - Shadow Wars\\spellforce2.exe"=
"e:\\Neverwinter Nights 2\\nwn2main.exe"=
"e:\\Neverwinter Nights 2\\nwn2main_amdxp.exe"=
"e:\\Neverwinter Nights 2\\nwupdate.exe"=
"e:\\Neverwinter Nights 2\\nwn2server.exe"=
"e:\\World of Warcraft\\Launcher.exe"=
"c:\\Programme\\ICQ6.5\\ICQ.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"1846:TCP"= 1846:TCP:vsnzuwu

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R1 SASDIFSV;SASDIFSV;c:\programme\SUPERAntiSpyware\sasdifsv.sys [2009-01-15 8944]
R1 SASKUTIL;SASKUTIL;c:\programme\SUPERAntiSpyware\SASKUTIL.SYS [2009-01-15 55024]
R3 SASENUM;SASENUM;c:\programme\SUPERAntiSpyware\SASENUM.SYS [2009-01-15 7408]
S3 fsbl;F-Secure BlackLight Engine Driver;\??\c:\dokumente und einstellungen\Kai\Desktop\fsbldrv.sys --> c:\dokumente und einstellungen\Kai\Desktop\fsbldrv.sys [?]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\programme\NOS\bin\getPlus_HelperSvc.exe [2008-10-10 33752]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
kwdyf
.
Inhalt des "geplante Tasks" Ordners

2009-02-16 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\programme\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe []
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://start.icq.com/
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {325DA82C-A080-47FD-9DFD-9070D80C9EF2} = 192.168.0.1
FF - ProfilePath - c:\dokumente und einstellungen\Kai\Anwendungsdaten\Mozilla\Firefox\Profiles\k80wh876.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT498395&SearchSource=3&q=
FF - prefs.js: browser.search.selectedEngine - Wikipedia (de)
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/webhp?rls=org.mozilla:defficial&hl=de&sa=N&tab=fw
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=
FF - component: c:\dokumente und einstellungen\Kai\Anwendungsdaten\Mozilla\Firefox\Profiles\k80wh876.default\extensions\{fb7d98cb-b228-4ecb-acac-e7101156338e}\components\FFAlert.dll
FF - component: c:\programme\DAEMON Tools Toolbar\FirefoxDTT\components\DTToolbarFF.dll
FF - plugin: c:\programme\Mozilla Firefox\plugins\npgcplug.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-21 15:54:12
Windows 5.1.2600 Service Pack 3 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_USERS\S-1-5-21-1078081533-2145122553-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:07,3b,24,bf,92,a5,92,f8,f1,a1,2b,7e,76,5d,bb,ee,8c,ab,44,e6,a8,96,2e,
2c,d5,64,38,ef,ac,81,55,f5,a0,74,15,bf,e3,29,3b,b4,07,e3,e5,86,38,88,79,20,\
"??"=hex:41,e0,42,8c,cf,55,c7,95,2b,14,4d,f8,66,7b,0c,1b

[HKEY_USERS\S-1-5-21-1078081533-2145122553-839522115-1004\Software\SecuROM\License information*]
"datasecu"=hex:4c,24,a4,a4,55,c0,73,f4,e6,eb,e1,b4,0c,0d,9b,87,03,16,fc,73,52,
9c,a9,9f,b5,8c,4f,39,93,17,cf,87,81,aa,af,4c,63,5b,4f,81,31,ec,e0,2e,c4,7e,\
"rkeysecu"=hex:f5,0e,23,b5,bc,e0,7d,78,45,12,bc,7a,3d,73,04,a4
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'winlogon.exe'(816)
c:\programme\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
.
Zeit der Fertigstellung: 2009-02-21 15:55:26
ComboFix-quarantined-files.txt 2009-02-21 14:55:07
ComboFix2.txt 2009-02-21 11:28:22
ComboFix3.txt 2009-02-19 22:04:02

Vor Suchlauf: 17 Verzeichnis(se), 46.838.583.296 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 46,829,305,856 Bytes frei

238

Ich habe gerade nach einer automatischen Möglichkeit gesucht aber keine gefunden. Jetzt kommt sehr viel Handarbeit auf dich zu. Du musst jeden einzelen der Einträge von Hand entsperren.

1. Starte gmer
2. Scan
3. Karte: > > >
4. Karte: Registry
5. Pfad entlanghangeln: HKey_Local_Machine\SYSTEM\ControlSet002\Services\kwdyf
6. Screenshot machen, beim imagehoster hochladen und Link posten.

ciao, andreas

So in Ordnung?

Klick noch auf das Plus vor kwdyf und poste ein neuen Screenshot.

Jetzt machst du auf jeden der roten Einträge einen Doppelklick und löscht den Wert oder setzt ihn auf 0. Jede Warnmeldung, die von GMER kommt, mit Enter übergehen.

Deinstalliere vorübergehend die Daemon-Tools (kannst du zum Schluss wieder installieren). Deinstalliere AdAware und Spybot. Die versauen jedes Log.

Wenn du alle Einträge geändert hast, dann einen Neustart machen.

Folgendes Avengerskript ausführen:

Drivers to delete:
kwdyf 

registry keys to delete: 
HKLM\SYSTEM\ControlSet002\Services\kwdyf
         

Neues Gmer-Log posten.

ciao, andreas

AdAware und Spybot habe ich gar nicht mehr auf meinem Rechner die sind seid Donnerstag weg.

Logfile of The Avenger Version 2.0, (c) by Swandog46
h**p://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\kwdyf" not found!
Deletion of driver "kwdyf" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Registry key "HKLM\SYSTEM\ControlSet002\Services\kwdyf" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

GMER 1.0.14.14536 - h**p://www.gmer.net
Rootkit scan 2009-02-21 17:32:01
Windows 5.1.2600 Service Pack 3


---- System - GMER 1.0.14 ----

SSDT spyo.sys ZwCreateKey [0xF72870E0]
SSDT spyo.sys ZwEnumerateKey [0xF72A5CA2]
SSDT spyo.sys ZwEnumerateValueKey [0xF72A6030]
SSDT spyo.sys ZwOpenKey [0xF72870C0]
SSDT spyo.sys ZwQueryKey [0xF72A6108]
SSDT spyo.sys ZwQueryValueKey [0xF72A5F88]
SSDT spyo.sys ZwSetValueKey [0xF72A619A]
SSDT \??\C:\Programme\SUPERAntiSpyware\SASKUTIL.sys (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xAE6D7F20]

INT 0x01 \SystemRoot\system32\DRIVERS\ati2mtag.sys (ATI Radeon WindowsNT Miniport Driver/ATI Technologies Inc.) F53824F6
INT 0x03 \SystemRoot\system32\DRIVERS\ati2mtag.sys (ATI Radeon WindowsNT Miniport Driver/ATI Technologies Inc.) F538259C
INT 0x62 ? 8A3CABF8
INT 0x63 ? 8A3CABF8
INT 0x73 ? 8A3CABF8
INT 0x82 ? 8A3CABF8
INT 0xA4 ? 8A438BF8
INT 0xB4 ? 8A438BF8

---- Kernel code sections - GMER 1.0.14 ----

? tlvrsj.sys Das System kann die angegebene Datei nicht finden. !
? spyo.sys Das System kann die angegebene Datei nicht finden. !
.text USBPORT.SYS!DllUnload F59C58AC 5 Bytes JMP 8A4381D8

---- Kernel IAT/EAT - GMER 1.0.14 ----

IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F7298048] spyo.sys

---- Devices - GMER 1.0.14 ----

Device \FileSystem\Ntfs \Ntfs 8A3C91F8
Device \Driver\usbohci \Device\USBPDO-0 8A2711F8
Device \Driver\usbehci \Device\USBPDO-1 8A1B91F8
Device \Driver\NetBT \Device\NetBT_Tcpip_{325DA82C-A080-47FD-9DFD-9070D80C9EF2} 88F681F8
Device \Driver\prodrv06 \Device\ProDrv06 E1E65AA8
Device \Driver\Ftdisk \Device\HarddiskVolume1 8A3CB1F8
Device \Driver\Ftdisk \Device\HarddiskVolume2 8A3CB1F8
Device \Driver\Cdrom \Device\CdRom0 8A1811F8
Device \Driver\nvatabus \Device\00000072 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\Ftdisk \Device\HarddiskVolume3 8A3CB1F8
Device \Driver\prohlp02 \Device\ProHlp02 E101BE38
Device \Driver\NetBT \Device\NetBt_Wins_Export 88F681F8
Device \Driver\NetBT \Device\NetbiosSmb 88F681F8
Device \Driver\usbstor \Device\00000079 88F111F8
Device \Driver\usbstor \Device\00000079 sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\usbohci \Device\USBFDO-0 8A2711F8
Device \Driver\usbehci \Device\USBFDO-1 8A1B91F8
Device \Driver\nvatabus \Device\NvAta0 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 88F4F1F8
Device \Driver\nvatabus \Device\0000006e prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\usbstor \Device\0000007b 88F111F8
Device \Driver\usbstor \Device\0000007b sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\nvatabus \Device\NvAta1 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \FileSystem\MRxSmb \Device\LanmanRedirector 88F4F1F8
Device \Driver\usbstor \Device\0000007c 88F111F8
Device \Driver\usbstor \Device\0000007c sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\nvatabus \Device\0000006f prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\nvatabus \Device\NvAta2 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\usbstor \Device\0000007d 88F111F8
Device \Driver\usbstor \Device\0000007d sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\Ftdisk \Device\FtControl 8A3CB1F8
Device \Driver\usbstor \Device\0000007e 88F111F8
Device \Driver\usbstor \Device\0000007e sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\usbstor \Device\0000007f 88F111F8
Device \Driver\usbstor \Device\0000007f sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \FileSystem\Cdfs \Cdfs 89DAF1F8

---- Registry - GMER 1.0.14 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xEC 0x3F 0x08 0x24 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x20 0x2A 0x20 0x18 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xD3 0xD4 0xE2 0x68 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x67 0x83 0xED 0x78 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xEC 0x3F 0x08 0x24 ...

---- Files - GMER 1.0.14 ----

File C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb 65536 bytes

---- EOF - GMER 1.0.14 ----

Folgendes Avengerskript ausführen:

Drivers to delete:
spdt

Files to delete:
C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb
         

Neues Gmer-Log posten.

Bin in einer Stunde wieder da.

ciao, andreas

Ich habe Spybot vorhin noch mal installiert und dann den Schutz aus gemacht da der anscheinend auch noch nach dem löschen da bleibt, ist jetzt aber weider gelöscht. Keine Ahnung ob as jetzt was gebracht hat.

Logfile of The Avenger Version 2.0, (c) by Swandog46
h**p://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\spdt" not found!
Deletion of driver "spdt" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb" not found!
Deletion of file "C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Completed script processing.

*******************

Finished! Terminate.

GMER 1.0.14.14536 - h**p://www.gmer.net
Rootkit scan 2009-02-21 18:32:59
Windows 5.1.2600 Service Pack 3


---- System - GMER 1.0.14 ----

SSDT spow.sys ZwCreateKey [0xF72870E0]
SSDT spow.sys ZwEnumerateKey [0xF72A5CA2]
SSDT spow.sys ZwEnumerateValueKey [0xF72A6030]
SSDT spow.sys ZwOpenKey [0xF72870C0]
SSDT spow.sys ZwQueryKey [0xF72A6108]
SSDT spow.sys ZwQueryValueKey [0xF72A5F88]
SSDT spow.sys ZwSetValueKey [0xF72A619A]
SSDT \??\C:\Programme\SUPERAntiSpyware\SASKUTIL.sys (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xAE6CDF20]

INT 0x01 \SystemRoot\system32\DRIVERS\ati2mtag.sys (ATI Radeon WindowsNT Miniport Driver/ATI Technologies Inc.) F5C554F6
INT 0x03 \SystemRoot\system32\DRIVERS\ati2mtag.sys (ATI Radeon WindowsNT Miniport Driver/ATI Technologies Inc.) F5C5559C
INT 0x62 ? 8A3CBBF8
INT 0x63 ? 8A3CBBF8
INT 0x73 ? 8A3CBBF8
INT 0x82 ? 8A3CBBF8
INT 0xA4 ? 8A437BF8
INT 0xB4 ? 8A437BF8

---- Kernel code sections - GMER 1.0.14 ----

? kiepb.sys Das System kann die angegebene Datei nicht finden. !
? spow.sys Das System kann die angegebene Datei nicht finden. !
.text USBPORT.SYS!DllUnload F62988AC 5 Bytes JMP 8A4371D8

---- Kernel IAT/EAT - GMER 1.0.14 ----

IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F7298048] spow.sys

---- Devices - GMER 1.0.14 ----

Device \FileSystem\Ntfs \Ntfs 8A3CA1F8
Device \FileSystem\Fastfat \FatCdrom 89D9D1F8
Device \FileSystem\Udfs \UdfsCdRom 89DE4390
Device \FileSystem\Udfs \UdfsDisk 89DE4390
Device \Driver\usbohci \Device\USBPDO-0 8A1111F8
Device \Driver\usbehci \Device\USBPDO-1 8A1C21F8
Device \Driver\NetBT \Device\NetBT_Tcpip_{325DA82C-A080-47FD-9DFD-9070D80C9EF2} 88F4B1F8
Device \Driver\prodrv06 \Device\ProDrv06 E1E68C30
Device \Driver\nvatabus \Device\00000070 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\Ftdisk \Device\HarddiskVolume1 8A3CC1F8
Device \Driver\Ftdisk \Device\HarddiskVolume2 8A3CC1F8
Device \Driver\Cdrom \Device\CdRom0 8A1A41F8
Device \Driver\Ftdisk \Device\HarddiskVolume3 8A3CC1F8
Device \Driver\nvatabus \Device\00000073 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\usbstor \Device\00000080 89D0A500
Device \Driver\usbstor \Device\00000080 sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\usbstor \Device\00000081 89D0A500
Device \Driver\usbstor \Device\00000081 sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\usbstor \Device\00000082 89D0A500
Device \Driver\usbstor \Device\00000082 sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\prohlp02 \Device\ProHlp02 E100D0E0
Device \Driver\NetBT \Device\NetBt_Wins_Export 88F4B1F8
Device \Driver\NetBT \Device\NetbiosSmb 88F4B1F8
Device \Driver\usbohci \Device\USBFDO-0 8A1111F8
Device \Driver\usbstor \Device\0000007a 89D0A500
Device \Driver\usbstor \Device\0000007a sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\usbehci \Device\USBFDO-1 8A1C21F8
Device \Driver\nvatabus \Device\NvAta0 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 89CF3500
Device \Driver\usbstor \Device\0000007b 89D0A500
Device \Driver\usbstor \Device\0000007b sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\nvatabus \Device\NvAta1 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\nvatabus \Device\0000006f prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \FileSystem\MRxSmb \Device\LanmanRedirector 89CF3500
Device \Driver\nvatabus \Device\NvAta2 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\usbstor \Device\0000007d 89D0A500
Device \Driver\usbstor \Device\0000007d sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\Ftdisk \Device\FtControl 8A3CC1F8
Device \Driver\usbstor \Device\0000007e 89D0A500
Device \Driver\usbstor \Device\0000007e sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\usbstor \Device\0000007f 89D0A500
Device \Driver\usbstor \Device\0000007f sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \FileSystem\Fastfat \Fat 89D9D1F8
Device \FileSystem\Cdfs \Cdfs 8A0D61F8

---- Registry - GMER 1.0.14 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xEC 0x3F 0x08 0x24 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x20 0x2A 0x20 0x18 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xD3 0xD4 0xE2 0x68 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x67 0x83 0xED 0x78 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xEC 0x3F 0x08 0x24 ...

---- EOF - GMER 1.0.14 ----

Hier bin ich wieder: Deinstalliere SuperAntiSpyware

Folgendes Avengerskript ausführen:

registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\sptd 
HKLM\SYSTEM\ControlSet002\Services\sptd
HKLM\SYSTEM\ControlSet003\Services\sptd
         

Neues Gmer-Log posten.

ciao, andreas

Den Avenger Log kann ich dies mal nicht posten weil der Editor irgendeinen Error hatte.

GMER 1.0.14.14536 - h**p://www.gmer.net
Rootkit scan 2009-02-21 19:25:36
Windows 5.1.2600 Service Pack 3


---- System - GMER 1.0.14 ----

SSDT spvu.sys ZwCreateKey [0xF72870E0]
SSDT spvu.sys ZwEnumerateKey [0xF72A5CA2]
SSDT spvu.sys ZwEnumerateValueKey [0xF72A6030]
SSDT spvu.sys ZwOpenKey [0xF72870C0]
SSDT spvu.sys ZwQueryKey [0xF72A6108]
SSDT spvu.sys ZwQueryValueKey [0xF72A5F88]
SSDT spvu.sys ZwSetValueKey [0xF72A619A]

INT 0x01 \SystemRoot\system32\DRIVERS\ati2mtag.sys (ATI Radeon WindowsNT Miniport Driver/ATI Technologies Inc.) F58B84F6
INT 0x03 \SystemRoot\system32\DRIVERS\ati2mtag.sys (ATI Radeon WindowsNT Miniport Driver/ATI Technologies Inc.) F58B859C
INT 0x62 ? 8A3CBBF8
INT 0x63 ? 8A3CBBF8
INT 0x73 ? 8A3CBBF8
INT 0x82 ? 8A3CBBF8
INT 0xA4 ? 8A2EABF8
INT 0xB4 ? 8A2EABF8

---- Kernel code sections - GMER 1.0.14 ----

? spvu.sys Das System kann die angegebene Datei nicht finden. !
.text USBPORT.SYS!DllUnload F5EFB8AC 5 Bytes JMP 8A2EA1D8

---- Kernel IAT/EAT - GMER 1.0.14 ----

IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F7288040] spvu.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F728813C] spvu.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F72880BE] spvu.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F72887FC] spvu.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F72886D2] spvu.sys
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F7298048] spvu.sys

---- Devices - GMER 1.0.14 ----

Device \FileSystem\Ntfs \Ntfs 8A3CA1F8
Device \FileSystem\Fastfat \FatCdrom 89B9F1F8
Device \Driver\usbohci \Device\USBPDO-0 8A2801F8
Device \Driver\usbehci \Device\USBPDO-1 8A1E91F8
Device \Driver\NetBT \Device\NetBT_Tcpip_{325DA82C-A080-47FD-9DFD-9070D80C9EF2} 88F901F8
Device \Driver\prodrv06 \Device\ProDrv06 E1DE3C30
Device \Driver\Ftdisk \Device\HarddiskVolume1 8A3CC1F8
Device \Driver\Cdrom \Device\CdRom0 8A1A01F8
Device \Driver\Ftdisk \Device\HarddiskVolume2 8A3CC1F8
Device \Driver\Ftdisk \Device\HarddiskVolume3 8A3CC1F8
Device \Driver\usbstor \Device\00000075 89D62500
Device \Driver\usbstor \Device\00000075 sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\usbstor \Device\00000076 89D62500
Device \Driver\usbstor \Device\00000076 sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\prohlp02 \Device\ProHlp02 E164F278
Device \Driver\usbstor \Device\00000077 89D62500
Device \Driver\usbstor \Device\00000077 sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\NetBT \Device\NetBt_Wins_Export 88F901F8
Device \Driver\usbstor \Device\00000078 89D62500
Device \Driver\usbstor \Device\00000078 sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\NetBT \Device\NetbiosSmb 88F901F8
Device \Driver\usbstor \Device\00000079 89D62500
Device \Driver\usbstor \Device\00000079 sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\nvatabus \Device\0000006a prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\nvatabus \Device\0000006b prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\usbohci \Device\USBFDO-0 8A2801F8
Device \Driver\usbstor \Device\0000007a 89D62500
Device \Driver\usbstor \Device\0000007a sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\usbehci \Device\USBFDO-1 8A1E91F8
Device \Driver\nvatabus \Device\NvAta0 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 88F701F8
Device \Driver\usbstor \Device\0000007b 89D62500
Device \Driver\usbstor \Device\0000007b sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\nvatabus \Device\0000006e prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\nvatabus \Device\NvAta1 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \FileSystem\MRxSmb \Device\LanmanRedirector 88F701F8
Device \Driver\usbstor \Device\0000007c 89D62500
Device \Driver\usbstor \Device\0000007c sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\nvatabus \Device\NvAta2 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\Ftdisk \Device\FtControl 8A3CC1F8
Device \FileSystem\Fastfat \Fat 89B9F1F8
Device \FileSystem\Cdfs \Cdfs 89F1B1F8

---- Registry - GMER 1.0.14 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xEC 0x3F 0x08 0x24 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x20 0x2A 0x20 0x18 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xD3 0xD4 0xE2 0x68 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x67 0x83 0xED 0x78 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xEC 0x3F 0x08 0x24 ...
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109E60070400000000000F01FEC\Usage@ProductNonBootFilesIntl_1031 978649229

---- EOF - GMER 1.0.14 ----

Den Avenger Log kann ich dies mal nicht posten weil der Editor irgendeinen Error hatte.

Wär schon schön, wenn man wüsste, welchen.

Gleicher Weg wie vorhin. Mit GMER in einen Registrierungsschlüssel (einer reicht zum Testen) irgendwas Rotes ändern, so dass die Warnmeldung von GMER kommt. Das ganze dann insgesamt dreimal für

1. HKLM\SYSTEM\CurrentControlSet\Services\sptd
2. HKLM\SYSTEM\ControlSet002\Services\sptd
3. HKLM\SYSTEM\ControlSet003\Services\sptd

Neustart, Anvengerskript nocheinmal laufen lassen.

ciao, andreas

Da stand irgentwas von das Programm wird von einer anderen Datei benutzt oder so.

OK. Ich glaub ich habe eine Lösung:

My system won't boot after installation of v4, or problems with SPTD.SYS - THE DAEMONS HOME

Du musst im abgesicherten Modus starten, an der richtigen Stelle ESC drücken und einen Registryeintrag ändern.

ciao, andreas

p.s.: Lade in der Zwischenzeit mal den Unhooker, wir müssen noch den spvu.sys rausbekommen.

Sieht ein bisschen weniger aus

GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2009-02-21 20:14:51
Windows 5.1.2600 Service Pack 3


---- System - GMER 1.0.14 ----

INT 0x01 \SystemRoot\system32\DRIVERS\ati2mtag.sys (ATI Radeon WindowsNT Miniport Driver/ATI Technologies Inc.) F5B904F6
INT 0x03 \SystemRoot\system32\DRIVERS\ati2mtag.sys (ATI Radeon WindowsNT Miniport Driver/ATI Technologies Inc.) F5B9059C

---- Devices - GMER 1.0.14 ----

Device \Driver\prodrv06 \Device\ProDrv06 E1E53300
Device \Driver\usbstor \Device\00000075 sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\usbstor \Device\00000076 sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\prohlp02 \Device\ProHlp02 E164F6B0
Device \Driver\usbstor \Device\00000077 sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\usbstor \Device\00000078 sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\usbstor \Device\00000079 sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\nvatabus \Device\0000006a prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\nvatabus \Device\0000006b prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\usbstor \Device\0000007a sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\nvatabus \Device\NvAta0 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\usbstor \Device\0000007b sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\nvatabus \Device\0000006e prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\nvatabus \Device\NvAta1 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\usbstor \Device\0000007c sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\nvatabus \Device\NvAta2 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)

---- Registry - GMER 1.0.14 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xEC 0x3F 0x08 0x24 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x20 0x2A 0x20 0x18 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xD3 0xD4 0xE2 0x68 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x67 0x83 0xED 0x78 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xEC 0x3F 0x08 0x24 ...

---- EOF - GMER 1.0.14 ----