Trojan.Agent gefunden

 
Report of OSAM: Autorun Manager v5.0.11926.0
Online Solutions. Complex Protection for Information Systems
Saved at 21:05:52 on 30.03.2010
OS: Windows XP Professional Service Pack 3 (Build 2600)
Default Browser: Mozilla Corporation Firefox 3.6.2
 
Scanner Settings
Rootkits detection (hidden registry)
Rootkits detection (hidden files)
Retrieve files information
Check Microsoft signatures
 
Filters
Trusted entries
Empty entries
Hidden registry entries (rootkit activity)
Exclusively opened files
Not found files
Files without detailed information
Existing files
Non-startable services
Non-startable drivers
Active entries
Disabled entries
 
    Risk     Name     Publisher     Full Path     Status
Control Panel Objects
%SystemRoot%\system32
    ||||||     "infocardcpl.cpl"     "Microsoft Corporation"     C:\WINDOWS\system32\infocardcpl.cpl     File exists
    ||||||     "javacpl.cpl"     "Sun Microsystems, Inc."     C:\WINDOWS\system32\javacpl.cpl     File exists
    ||||||     "nvcpl.cpl"     "NVIDIA Corporation"     C:\WINDOWS\system32\nvcpl.cpl     File exists
HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls
         "Avira AntiVir Personal"     "Avira GmbH"     C:\PROGRA~1\Avira\AntiVir Desktop\avconfig.cpl     File exists
    ||||||     "ECSEPM"     "Sony Ericsson Mobile Communications AB"     C:\Programme\Sony Ericsson\Mobile2\Mobile Phone Monitor\ecsepm.cpl     File exists
Drivers
HKLM\SYSTEM\CurrentControlSet\Services
    ||||||     "ASUS Video3D Service" (Video3D)     "ASUSTeK COMPUTER INC."     C:\WINDOWS\System32\Drivers\Video3D32.sys     File exists
    ||||||     "ASUS Virtual Video Capture Device Driver" (asusgsb)     "ASUSTeK Computer Inc."     C:\WINDOWS\System32\drivers\asusgsb.sys     File exists
    ||||||     "avgio" (avgio)     "Avira GmbH"     C:\Programme\Avira\AntiVir Desktop\avgio.sys     File exists
         "avgntflt" (avgntflt)     "Avira GmbH"     C:\WINDOWS\System32\DRIVERS\avgntflt.sys     File exists
         "avipbb" (avipbb)     "Avira GmbH"     C:\WINDOWS\System32\DRIVERS\avipbb.sys     File exists
         "Changer" (Changer)         C:\WINDOWS\system32\drivers\Changer.sys     File not found
    ||||||     "EIO" (EIO)     "ASUSTeK Computer Inc."     C:\WINDOWS\system32\drivers\EIO.sys     File exists
    ||||||     "Enhanced Display Driver Helper Service" (asuskbnt)     "ASUSTeK COMPUTER INC."     C:\WINDOWS\System32\drivers\atkkbnt.sys     File exists
         "i2omgmt" (i2omgmt)         C:\WINDOWS\system32\drivers\i2omgmt.sys     File not found
         "lbrtfdc" (lbrtfdc)         C:\WINDOWS\system32\drivers\lbrtfdc.sys     File not found
         "PCIDump" (PCIDump)         C:\WINDOWS\system32\drivers\PCIDump.sys     File not found
         "PDCOMP" (PDCOMP)         C:\WINDOWS\system32\drivers\PDCOMP.sys     File not found
         "PDFRAME" (PDFRAME)         C:\WINDOWS\system32\drivers\PDFRAME.sys     File not found
         "PDRELI" (PDRELI)         C:\WINDOWS\system32\drivers\PDRELI.sys     File not found
         "PDRFRAME" (PDRFRAME)         C:\WINDOWS\system32\drivers\PDRFRAME.sys     File not found
    ||||||     "PxHelp20" (PxHelp20)     "Sonic Solutions"     C:\WINDOWS\System32\Drivers\PxHelp20.sys     File exists
         "ssmdrv" (ssmdrv)     "Avira GmbH"     C:\WINDOWS\System32\DRIVERS\ssmdrv.sys     File exists
    ||||||     "Trust HID-compliant Mouse Driver" (Amusbprt)     "(Standard Mouse Types)"     C:\WINDOWS\System32\DRIVERS\Amusbprt.sys     File exists
    ||||||     "Trust Mouse Filter Driver" (Amfilter)     "(Standard Mouse Types)"     C:\WINDOWS\System32\DRIVERS\Amfilter.sys     File exists
    ||||||     "USB RNDIS Adapter" (usb_rndisx)     "Microsoft Corporation"     C:\WINDOWS\System32\DRIVERS\usb8023x.sys     File exists
         "WDICA" (WDICA)         C:\WINDOWS\system32\drivers\WDICA.sys     File not found
    ||||||     "Windows Driver Foundation - User-mode Driver Framework Platform Driver" (WudfPf)     "Microsoft Corporation"     C:\WINDOWS\System32\DRIVERS\WudfPf.sys     File exists
    ||||||     "Windows Driver Foundation - User-mode Driver Framework Reflector" (WudfRd)     "Microsoft Corporation"     C:\WINDOWS\System32\DRIVERS\wudfrd.sys     File exists
         "winebe" (winebe)     "Microsoft Corporation"     C:\WINDOWS\system32\drivers\winebe.sys     File exists
Explorer
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components
    ||||||     {89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath"     "Microsoft Corporation"     c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install     File exists
         >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} "Windows Media Player"     "Microsoft Corporation"     C:\WINDOWS\inf\unregmp2.exe /ShowWMP     File exists
HKLM\Software\Classes\Folder\shellex\ColumnHandlers
    ||||||     {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension"     "Adobe Systems, Inc."     C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll     File exists
HKLM\Software\Classes\Protocols\Filter
    ||||||     {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1"     "Microsoft Corporation"     C:\WINDOWS\system32\mscoree.dll     File exists
    ||||||     {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1"     "Microsoft Corporation"     C:\WINDOWS\system32\mscoree.dll     File exists
    ||||||     {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1"     "Microsoft Corporation"     C:\WINDOWS\system32\mscoree.dll     File exists
HKLM\Software\Classes\Protocols\Handler
    ||||     {828030A1-22C1-4009-854F-8E305202313F} "livecall"     "Microsoft Corporation"     C:\PROGRA~1\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll     File exists
    ||||     {828030A1-22C1-4009-854F-8E305202313F} "msnim"     "Microsoft Corporation"     C:\PROGRA~1\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll     File exists
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
         {42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung"         deskpan.dll     File not found
    ||||||     {1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer"     "NVIDIA Corporation"     C:\Programme\NVIDIA Corporation\nView\nvshell.dll     File exists
    ||||||     {1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu"     "NVIDIA Corporation"     C:\Programme\NVIDIA Corporation\nView\nvshell.dll     File exists
    ||||||     {A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class"     "NVIDIA Corporation"     C:\WINDOWS\system32\nvcpl.dll     File exists
    ||||||     {1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache"     "Microsoft Corporation"     c:\WINDOWS\system32\mscoree.dll     File exists
         {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung"             File not found | COM-object registry key not found
    ||||||     {49BF5420-FA7F-11cf-8011-00A0C90A8F78} "Mobiles Gerät"     "Microsoft Corporation"     C:\PROGRA~1\Microsoft ActiveSync\Wcesview.dll     File exists
    ||||||     {FFB699E0-306A-11d3-8BD1-00104B6F7516} "NVIDIA CPL Extension"     "NVIDIA Corporation"     C:\WINDOWS\system32\nvcpl.dll     File exists
    ||||||     {1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu"     "NVIDIA Corporation"     C:\Programme\NVIDIA Corporation\nView\nvshell.dll     File exists
    ||||||     {35786D3C-B075-49b9-88DD-029876E11C01} "Portable Devices"     "Microsoft Corporation"     C:\WINDOWS\system32\wpdshext.dll     File exists
    ||||||     {D6791A63-E7E2-4fee-BF52-5DED8E86E9B8} "Portable Devices Menu"     "Microsoft Corporation"     C:\WINDOWS\system32\wpdshext.dll     File exists
    ||||||     {640167b4-59b0-47a6-b335-a6b3c0695aea} "Portable Media Devices"     "Microsoft Corporation"     C:\WINDOWS\system32\audiodev.dll     File exists
         {45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning"     "Avira GmbH"     C:\Programme\Avira\AntiVir Desktop\shlext.dll     File exists
    ||||||     {E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References"     "Microsoft Corporation"     c:\WINDOWS\system32\dfshim.dll     File exists
         {764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung"             File not found | COM-object registry key not found
    ||||||     {e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References"     "Microsoft Corporation"     c:\WINDOWS\system32\dfshim.dll     File exists
    ||||||     {A5110426-177D-4e08-AB3F-785F10B4439C} "Sony Ericsson Datei-Manager"     "Sony Ericsson Mobile Communications AB"     C:\Programme\Sony Ericsson\Mobile2\File Manager\fmgrgui.dll     File exists
         {52B87208-9CCF-42C9-B88E-069281105805} "Trojan Remover Shell Extension"             File not found | COM-object registry key not found
    ||||||     {BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner"     "Microsoft Corporation"     C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\msonsext.dll     File exists
    ||||||     {B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR"         C:\Programme\WinRAR\rarext.dll     File exists
    ||||||     {F1B9284F-E9DC-4e68-9D7E-42362A59F0FD} "WMP Add To Playlist Launcher"     "Microsoft Corporation"     C:\WINDOWS\system32\wmpshell.dll     File exists
    ||||||     {8DD448E6-C188-4aed-AF92-44956194EB1F} "WMP Burn Audio CD Launcher"     "Microsoft Corporation"     C:\WINDOWS\system32\wmpshell.dll     File exists
    ||||||     {CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C} "WMP Play As Playlist Launcher"     "Microsoft Corporation"     C:\WINDOWS\system32\wmpshell.dll     File exists
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
    ||||||     {AAA288BA-9A4C-45B0-95D7-94D524869DB5} "WPDShServiceObj Class"     "Microsoft Corporation"     C:\WINDOWS\system32\wpdshserviceobj.dll     File exists
Internet Explorer
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
         ITBar7Height "ITBar7Height"             File not found | COM-object registry key not found
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units
    ||||     {8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_17"
hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab     "Sun Microsystems, Inc."     C:\Programme\Java\jre6\bin\npjpi160_17.dll     File exists
    ||||     {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} "Java Plug-in 1.6.0_17"
hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab     "Sun Microsystems, Inc."     C:\Programme\Java\jre6\bin\npjpi160_17.dll     File exists
    ||||     {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_17"
hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab     "Sun Microsystems, Inc."     C:\Programme\Java\jre6\bin\npjpi160_17.dll     File exists
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions
    ||||     {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} "ClsidExtension"     "Microsoft Corporation"     C:\PROGRA~1\Microsoft ActiveSync\INetRepl.dll     File exists
    ||||||     {53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension"     "Safer Networking Limited"     C:\Programme\Spybot - Search & Destroy\SDHelper.dll     File exists
    ||||     {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} "Create Mobile Favorite"     "Microsoft Corporation"     C:\PROGRA~1\Microsoft ActiveSync\INetRepl.dll     File exists
    ||     "PokerStars"     "PokerStars"     C:\Programme\PokerStars\PokerStarsUpdate.exe     File exists
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
    ||||||     {18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper"     "Adobe Systems Incorporated"     C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll     File exists
    ||||     {DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper"     "Sun Microsystems, Inc."     C:\Programme\Java\jre6\bin\jp2ssv.dll     File exists
    ||||     {E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class"     "Sun Microsystems, Inc."     C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll     File exists
    ||||||     {53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection"     "Safer Networking Limited"     C:\Programme\Spybot - Search & Destroy\SDHelper.dll     File exists
    ||||||     {9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm"     "Microsoft Corporation"     C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll     File exists
         {5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}"             File not found | COM-object registry key not found
Logon
%AllUsersProfile%\Startmenü\Programme\Autostart
    ||||||     "desktop.ini"         C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini     File exists
%UserProfile%\Startmenü\Programme\Autostart
    ||||||     "desktop.ini"         C:\Dokumente und Einstellungen\carlo und sarah\Startmenü\Programme\Autostart\desktop.ini     File exists
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    ||||     "EA Core"     "Electronic Arts"     "C:\Programme\Electronic Arts\EADM\Core.exe" -silent     File exists
    ||||     "H/PC Connection Agent"     "Microsoft Corporation"     "C:\Programme\Microsoft ActiveSync\wcescomm.exe"     File exists
    ||||     "msnmsgr"     "Microsoft Corporation"     "C:\Programme\Windows Live\Messenger\msnmsgr.exe" /background     File exists
         "NCsoft Launcher"     "NCSoft"     C:\Programme\NCsoft\Launcher\NCLauncher.exe /Minimized     File exists
         "Skype"     "Skype Technologies S.A."     "C:\Programme\Skype\\Phone\Skype.exe" /nosplash /minimized     File exists
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    ||||     "Adobe Reader Speed Launcher"     "Adobe Systems Incorporated"     "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"     File exists
         "ASUSGamerOSD"         C:\Program Files\ASUS\GamerOSD\GamerOSD.exe     File not found
         "avgnt"     "Avira GmbH"     "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min     File exists
    ||||     "NvMediaCenter"     "NVIDIA Corporation"     RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit     File exists
         "nwiz"         nwiz.exe /installquiet     File not found
    ||||     "Sony Ericsson PC Suite"     "Sony Ericsson Mobile Communications AB"     "C:\Programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions     File exists
    ||||     "WheelMouse"         C:\Programme\Trust\GM-4600 Gamer Mouse\Amoumain.exe     File found, but it contains no detailed information
Services
HKLM\SYSTEM\CurrentControlSet\Services
    ||||||     ".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32)     "Microsoft Corporation"     C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe     File exists
    ||||||     "ASP.NET-Zustandsdienst" (aspnet_state)     "Microsoft Corporation"     C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe     File exists
    ||||||     "ATK Keyboard Service" (ATKKeyboardService)     "ASUSTeK COMPUTER INC."     C:\WINDOWS\ATKKBService.exe     File exists
    ||||||     "Automatische Updates" (wuauserv)     "Microsoft Corporation"     C:\WINDOWS\system32\wuauserv.dll     File exists
         "Avira AntiVir Guard" (AntiVirService)     "Avira GmbH"     C:\Programme\Avira\AntiVir Desktop\avguard.exe     File exists
         "Avira AntiVir Planer" (AntiVirSchedulerService)     "Avira GmbH"     C:\Programme\Avira\AntiVir Desktop\sched.exe     File exists
    ||||     "InstallDriver Table Manager" (IDriverT)     "Macrovision Corporation"     C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe     File exists
    ||||||     "Java Quick Starter" (JavaQuickStarterService)     "Sun Microsystems, Inc."     C:\Programme\Java\jre6\bin\jqs.exe     File exists
    ||||||     "NVIDIA Display Driver Service" (NVSvc)     "NVIDIA Corporation"     C:\WINDOWS\system32\nvsvc32.exe     File exists
    ||||||     "Portable Media Serial Number Service" (WmdmPmSN)     "Microsoft Corporation"     C:\WINDOWS\system32\mspmsnsv.dll     File exists
    ||||||     "VNC Server Version 4" (WinVNC4)     "RealVNC Ltd."     C:\Programme\RealVNC\VNC4\WinVNC4.exe     File exists
    ||||||     "Windows CardSpace" (idsvc)     "Microsoft Corporation"     c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe     File exists
    ||||||     "Windows Driver Foundation - User-mode Driver Framework" (WudfSvc)     "Microsoft Corporation"     C:\WINDOWS\System32\WUDFSvc.dll     File exists
    ||||     "Windows Media Player-Netzwerkfreigabedienst" (WMPNetworkSvc)     "Microsoft Corporation"     C:\Programme\Windows Media Player\WMPNetwk.exe     File exists
    ||||||     "Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0)     "Microsoft Corporation"     c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe     File exists
Winlogon
HKCU\Control Panel\IOProcs
         "MVB"         mvfs32.dll     File not found
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
    ||||     "WgaLogon"     "Microsoft Corporation"     C:\WINDOWS\system32\WgaLogon.dll     File exists
 
If You have questions or want to get some help, You can visit Online Solutions :: Index