| thaumaturgis | 23.04.2012 18:56 |
Hi,
also der GMER Scanner ist immer abgestürzt, da gibts also kein log.
hier ist die log datei vom OSAM Scanner: Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 19:22:30 on 23.04.2012
OS: Windows XP Professional Service Pack 3 (Build 2600)
Default Browser: Microsoft Corporation Internet Explorer 7.00.6000.17109
Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures
Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries
[Boot Execute]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager )-----
"BootExecute" - ? - C:\WINDOWS\system32\lsdelete.exe (File found, but it contains no detailed information)
[Common]
-----( %SystemRoot%\Tasks )-----
"Ad-Aware Update (Weekly).job" - "Lavasoft Limited " - C:\Programme\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"CMDVDPak.cpl" - "Sonic Solutions" - C:\WINDOWS\system32\CMDVDPak.cpl
"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl
"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl
"stac97.cpl" - "SigmaTel, Inc." - C:\WINDOWS\system32\stac97.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Avira AntiVir Personal" - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
"QuickTime" - "Apple Computer, Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl
[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"AEGIS Protocol (IEEE 802.1x) v3.4.5.0" (AegisP) - "Meetinghouse Data Communications" - C:\WINDOWS\System32\DRIVERS\AegisP.sys (Hidden registry entry, rootkit activity)
"AFD" (AFD) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\afd.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Asynchroner RAS -Medientreiber" (AsyncMac) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\asyncmac.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"ati2mtag" (ati2mtag) - "ATI Technologies Inc." - C:\WINDOWS\System32\DRIVERS\ati2mtag.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Audiostubtreiber" (audstub) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\audstub.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys (Hidden registry entry, rootkit activity)
"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys (Hidden registry entry, rootkit activity)
"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys (Hidden registry entry, rootkit activity)
"Beep" (Beep) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Beep.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Bereitstellungspunkt-Manager" (MountMgr) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\MountMgr.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Brother MFC Serial Port Interface WDM Driver" (BrSerIf) - "Brother Industries Ltd." - C:\WINDOWS\System32\Drivers\BrSerIf.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Brother MFC USB Serial WDM Driver" (BrUsbSer) - "Brother Industries Ltd." - C:\WINDOWS\System32\Drivers\BrUsbSer.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Brother USB Still Image driver" (BrScnUsb) - "Brother Industries Ltd." - C:\WINDOWS\System32\DRIVERS\BrScnUsb.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"catchme" (catchme) - ? - C:\ComboFix\catchme.sys (Hidden registry entry, rootkit activity | File not found)
"CD-ROM-Laufwerktreiber" (Cdrom) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\cdrom.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Cdaudio" (Cdaudio) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Cdaudio.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Cdfs" (Cdfs) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Cdfs.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"cercsr6" (cercsr6) - "Adaptec, Inc." - C:\WINDOWS\system32\drivers\cercsr6.sys (Hidden registry entry, rootkit activity)
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys (Hidden registry entry, rootkit activity | File not found)
"Creative AC3 Software Decoder" (ctac32k) - ? - C:\WINDOWS\System32\drivers\ctac32k.sys (Hidden registry entry, rootkit activity | File not found)
"Creative DVD-Audio Device Driver" (ctdvda2k) - "Creative Technology Ltd" - C:\WINDOWS\System32\drivers\ctdvda2k.sys (Hidden registry entry, rootkit activity)
"Creative OS Services Driver" (ossrv) - ? - C:\WINDOWS\System32\drivers\ctoss2k.sys (Hidden registry entry, rootkit activity | File not found)
"Creative Proxy Driver" (ctprxy2k) - ? - C:\WINDOWS\System32\drivers\ctprxy2k.sys (Hidden registry entry, rootkit activity | File not found)
"Creative SoundFont Management Device Driver" (ctsfm2k) - ? - C:\WINDOWS\System32\drivers\ctsfm2k.sys (Hidden registry entry, rootkit activity | File not found)
"dmload" (dmload) - "Microsoft Corp., Veritas Software." - C:\WINDOWS\System32\drivers\dmload.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"E-mu Plug-in Architecture Driver" (emupia) - ? - C:\WINDOWS\System32\drivers\emupia2k.sys (Hidden registry entry, rootkit activity | File not found)
"Fdc" (Fdc) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Fdc.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Filtertreiber für CD-Brennen" (Imapi) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\imapi.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Filtertreiber für digitale CD-Audiowiedergabe" (redbook) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\redbook.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Filtertreiber für IP-Verkehr" (IpFilterDriver) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ipfltdrv.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Filtertreiber für IPX-Verkehr" (NwlnkFlt) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\nwlnkflt.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Filtertreiber für Systemwiederherstellung" (sr) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\sr.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Fips" (Fips) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Fips.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Flpydisk" (Flpydisk) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Flpydisk.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"FltMgr" (FltMgr) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\fltmgr.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Fs_Rec" (Fs_Rec) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Fs_Rec.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"HTTP" (HTTP) - "Microsoft Corporation" - C:\WINDOWS\System32\Drivers\HTTP.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys (Hidden registry entry, rootkit activity | File not found)
"Intel AHCI Controller" (iastor) - "Intel Corporation" - C:\WINDOWS\System32\DRIVERS\iaStor.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Intel(R) PRO/1000 PCI Express Network Connection Driver" (e1express) - "Intel Corporation" - C:\WINDOWS\System32\DRIVERS\e1e5132.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Intel-Prozessortreiber" (intelppm) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\intelppm.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"IP/IP-Tunneltreiber" (IpInIp) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ipinip.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"IPSEC-Treiber" (IPSec) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ipsec.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"IPv6-Windows-Firewalltreiber" (Ip6Fw) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\ip6fw.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"IR-Enumeratordienst" (IRENUM) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\irenum.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"KSecDD" (KSecDD) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\KSecDD.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Laufwerktreiber" (Disk) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\disk.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Lavasoft helper driver" (Lavasoft Kernexplorer) - ? - C:\Programme\Lavasoft\Ad-Aware\KernExplorer.sys (Hidden registry entry, rootkit activity | File found, but it contains no detailed information)
"Lbd" (Lbd) - "Lavasoft AB" - C:\WINDOWS\System32\DRIVERS\Lbd.sys (Hidden registry entry, rootkit activity)
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys (Hidden registry entry, rootkit activity | File not found)
"Maus-HID-Treiber" (mouhid) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\mouhid.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Mausklassentreiber" (Mouclass) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\mouclass.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\WINDOWS\system32\drivers\mbam.sys (Hidden registry entry, rootkit activity)
"MHN-Treiber" (MHNDRV) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\mhndrv.sys (Hidden registry entry, rootkit activity)
"Microcode Updatetreiber" (Update) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\update.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Microsoft ACPI-Treiber" (ACPI) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ACPI.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Microsoft HID Class-Treiber" (hidusb) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\hidusb.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Microsoft Kernel GS Wavetablesynthesizer" (swmidi) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\swmidi.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Microsoft Kernel-Audiosplitter" (splitter) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\splitter.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Microsoft Kernel-DLS-Synthesizer" (DMusic) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\DMusic.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Microsoft Kernel-DRM-Audioentschlüsselung" (drmkaud) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\drmkaud.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Microsoft Kernel-Echounterdrückung" (aec) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\aec.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Microsoft Kernel-Systemaudiogerät" (sysaudio) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\sysaudio.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Microsoft Kernel-Waveaudiomixer" (kmixer) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\kmixer.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Microsoft Proxy für Streaming Clock" (MSPCLOCK) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\MSPCLOCK.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Microsoft Proxy für Streaming Quality Manager" (MSPQM) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\MSPQM.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Microsoft Standard-USB-Haupttreiber" (usbccgp) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\usbccgp.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Microsoft Streaming Service Proxy" (MSKSSRV) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\MSKSSRV.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Microsoft UAA-Bustreiber für High Definition Audio" (HDAudBus) - "Windows (R) Server 2003 DDK provider" - C:\WINDOWS\System32\DRIVERS\HDAudBus.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Microsoft USB-Druckerklasse" (usbprint) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\usbprint.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Microsoft USB-Standardhubtreiber" (usbhub) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\usbhub.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Microsoft-Systemverwaltungs-BIOS-Treiber" (mssmbios) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\mssmbios.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller" (usbehci) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\usbehci.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Miniporttreiber für universellen Microsoft USB-Hostcontroller" (usbuhci) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\usbuhci.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"mnmdd" (mnmdd) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\mnmdd.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Modem" (Modem) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Modem.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"MRXSMB" (MRxSmb) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\mrxsmb.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Msfs" (Msfs) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Msfs.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Mup" (Mup) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Mup.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"NDIS-Benutzermodus-E/A-Protokoll" (Ndisuio) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ndisuio.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"NDIS-Systemtreiber" (NDIS) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\NDIS.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"NDProxy" (NDProxy) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\NDProxy.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"NetBios über TCP/IP" (NetBT) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\netbt.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"NetBIOS-Schnittstelle" (NetBIOS) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\netbios.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver" (RTLWUSB) - "NETGEAR Inc." - C:\WINDOWS\System32\DRIVERS\wg111v2.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Npfs" (Npfs) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Npfs.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Ntfs" (Ntfs) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Ntfs.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Null" (Null) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Null.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Parallelanschluss (direkt)" (Raspti) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\raspti.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Parport" (Parport) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Parport.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Partitions-Manager" (PartMgr) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\PartMgr.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"ParVdm" (ParVdm) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\ParVdm.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"PCI-Bus-Treiber" (PCI) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\pci.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys (Hidden registry entry, rootkit activity | File not found)
"PCIIde" (PCIIde) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\pciide.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys (Hidden registry entry, rootkit activity | File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys (Hidden registry entry, rootkit activity | File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys (Hidden registry entry, rootkit activity | File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys (Hidden registry entry, rootkit activity | File not found)
"PnP-ISA/EISA-Bus-Treiber" (isapnp) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\isapnp.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Protokoll für ATM ARP-Client" (Atmarpc) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\atmarpc.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"QoS-Paketplaner" (PSched) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\psched.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"RAS-IP-ARP-Treiber" (Wanarp) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\wanarp.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"RAS-NDIS-TAPI-Treiber" (NdisTapi) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ndistapi.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"RAS-NDIS-WAN-Treiber" (NdisWan) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ndiswan.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Rdbss" (Rdbss) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\rdbss.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"RDPCDD" (RDPCDD) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\RDPCDD.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"RDPWD" (RDPWD) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\RDPWD.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Redirector für WebDav-Client" (MRxDAV) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\mrxdav.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Remotezugriff-PPPOE-Treiber" (RasPppoe) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\raspppoe.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Secdrv" (Secdrv) - "Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K." - C:\WINDOWS\System32\DRIVERS\secdrv.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Serial" (Serial) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Serial.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Sfloppy" (Sfloppy) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Sfloppy.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"SigmaTel High Definition Audio CODEC" (STHDA) - "SigmaTel, Inc." - C:\WINDOWS\System32\drivers\sthda.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Software-Bus-Treiber" (swenum) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\swenum.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Srv" (Srv) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\srv.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys (Hidden registry entry, rootkit activity)
"Standard-IDE/ESDI-Festplattencontroller" (atapi) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\atapi.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Standardpaketklassifizierung" (Gpc) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\msgpc.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Tastatur-HID-Treiber" (kbdhid) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\kbdhid.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Tastaturklassentreiber" (Kbdclass) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\kbdclass.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"TCP/IP-Protokolltreiber" (Tcpip) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\tcpip.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"TDPIPE" (TDPIPE) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\TDPIPE.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"TDTCP" (TDTCP) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\TDTCP.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Terminal-Gerätetreiber" (TermDD) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\termdd.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Treiber für automatische RAS-Verbindung" (RasAcd) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\rasacd.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Treiber für die Verwaltung logischer Datenträger" (dmio) - "Microsoft Corp., Veritas Software" - C:\WINDOWS\System32\drivers\dmio.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Treiber für direkte Parallelverbindung" (Ptilink) - "Parallel Technologies, Inc." - C:\WINDOWS\System32\DRIVERS\ptilink.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Treiber für IPX-Verkehrsweiterleitung" (NwlnkFwd) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\nwlnkfwd.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Treiber für Microsoft WINMM-WDM-Audiokompatibilität" (wdmaud) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\wdmaud.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Treiber für Terminalserver-Geräteumleitung" (rdpdr) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\rdpdr.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Treiber für Volume-Manager" (Ftdisk) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ftdisk.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"ufqorfob" (ufqorfob) - ? - C:\DOKUME~1\THOMAS~1\LOKALE~1\Temp\ufqorfob.sys (Hidden registry entry, rootkit activity | File not found)
"ufqorfod" (ufqorfod) - ? - C:\DOKUME~1\THOMAS~1\LOKALE~1\Temp\ufqorfod.sys (Hidden registry entry, rootkit activity | File not found)
"USB-Massenspeichertreiber" (usbstor) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS (Hidden registry entry, rootkit activity | File signed by Microsoft)
"VGA-Anzeigecontroller." (VgaSave) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\vga.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"VolSnap" (VolSnap) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\VolSnap.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"WAN-Miniport (L2TP)" (Rasl2tp) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\rasl2tp.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"WAN-Miniport (PPTP)" (PptpMiniport) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\raspptp.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys (Hidden registry entry, rootkit activity | File not found)
"Windows Socket 2.0 Non-IFS Service Provider Support Environment" (WS2IFSL) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\ws2ifsl.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"WpdUsb" (WpdUsb) - "Microsoft Corporation" - C:\WINDOWS\System32\Drivers\wpdusb.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Übersetzer für IP-Netzwerkadressen" (IpNat) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ipnat.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
[Explorer]
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
>{22d6f312-b0f6-11d0-94ab-0080c74c7e95} "Microsoft Windows Media Player" - "Microsoft Corporation" - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - (File not found | COM-object registry key not found)
{1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? - (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll
{640167b4-59b0-47a6-b335-a6b3c0695aea} "Portable Media Devices" - "Microsoft Corporation" - C:\WINDOWS\system32\audiodev.dll
{cc86590a-b60a-48e6-996b-41d25ed39a1e} "Portable Media Devices Menu" - "Microsoft Corporation" - C:\WINDOWS\system32\audiodev.dll
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? - (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Web Folders" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\MSONSEXT.DLL
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Programme\WinRAR\rarext.dll
{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD} "WMP Add To Playlist Launcher" - "Microsoft Corporation" - C:\WINDOWS\system32\wmpshell.dll
{8DD448E6-C188-4aed-AF92-44956194EB1F} "WMP Burn Audio CD Launcher" - "Microsoft Corporation" - C:\WINDOWS\system32\wmpshell.dll
{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C} "WMP Play As Playlist Launcher" - "Microsoft Corporation" - C:\WINDOWS\system32\wmpshell.dll
[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found)
<binary data> "ITBarLayout" - ? - (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_27" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_27.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} "Java Plug-in 1.6.0_27" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_27.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_27" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_27.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash10l.ocx / hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
"NETGEAR WG111v2 Smart Wizard.lnk" - ? - C:\Programme\NETGEAR\WG111v2\WG111v2.exe (Shortcut exists | File exists)
"NkbMonitor.exe.lnk" - "Nikon Corporation" - C:\Programme\Nikon\PictureProject\NkbMonitor.exe (Shortcut exists | File exists)
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\T****\Startmenü\Programme\Autostart\desktop.ini
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"
"ATIPTA" - "ATI Technologies, Inc." - "C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe"
"avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
"DMXLauncher" - ? - C:\Programme\Dell\Media Experience\DMXLauncher.exe (File found, but it contains no detailed information)
"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
"QuickTime Task" - "Apple Computer, Inc." - "C:\Programme\QuickTime\qttask.exe" -atboottime
"SigmatelSysTrayApp" - "SigmaTel, Inc." - stsystra.exe
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"CUSTPDF Writer Monitor x86" - ? - C:\WINDOWS\system32\custmon32.dll (File found, but it contains no detailed information)
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\msonpmon.dll
[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Hidden registry entry, rootkit activity)
"Ablagemappe" (ClipSrv) - "Microsoft Corporation" - C:\WINDOWS\system32\clipsrv.exe (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Anmeldedienst" (Netlogon) - "Microsoft Corporation" - C:\WINDOWS\system32\lsass.exe (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Anwendungsverwaltung" (AppMgmt) - "Microsoft Corporation" - C:\WINDOWS\System32\appmgmts.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Arbeitsstationsdienst" (lanmanworkstation) - "Microsoft Corporation" - C:\WINDOWS\System32\wkssvc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Hidden registry entry, rootkit activity)
"Ati HotKey Poller" (Ati HotKey Poller) - "ATI Technologies Inc." - C:\WINDOWS\system32\Ati2evxx.exe (Hidden registry entry, rootkit activity | File signed by Microsoft)
"ATI Smart" (ATI Smart) - ? - C:\WINDOWS\system32\ati2sgag.exe (Hidden registry entry, rootkit activity)
"Automatic Updates" (wuauserv) - "Microsoft Corporation" - C:\WINDOWS\system32\wuauserv.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Automatische Konfiguration (verkabelt)" (Dot3svc) - "Microsoft Corporation" - C:\WINDOWS\System32\dot3svc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Hidden registry entry, rootkit activity)
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe (Hidden registry entry, rootkit activity)
"COM+-Ereignissystem" (EventSystem) - "Microsoft Corporation" - C:\WINDOWS\system32\es.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"COM+-Systemanwendung" (COMSysApp) - "Microsoft Corporation" - C:\WINDOWS\system32\dllhost.exe (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Computerbrowser" (Browser) - "Microsoft Corporation" - C:\WINDOWS\System32\browser.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"CryptSvc" (CryptSvc) - "Microsoft Corporation" - C:\WINDOWS\System32\cryptsvc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"DCOM-Server-Prozessstart" (DcomLaunch) - "Microsoft Corporation" - C:\WINDOWS\system32\rpcss.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Designs" (Themes) - "Microsoft Corporation" - C:\WINDOWS\System32\shsvcs.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"DHCP-Client" (Dhcp) - "Microsoft Corporation" - C:\WINDOWS\System32\dhcpcsvc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Dienst für Seriennummern der tragbaren Medien" (WmdmPmSN) - "Microsoft Corporation" - C:\WINDOWS\system32\MsPMSNSv.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Distributed Transaction Coordinator" (MSDTC) - "Microsoft Corporation" - C:\WINDOWS\system32\msdtc.exe (Hidden registry entry, rootkit activity | File signed by Microsoft)
"DNS-Client" (Dnscache) - "Microsoft Corporation" - C:\WINDOWS\System32\dnsrslvr.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Druckwarteschlange" (Spooler) - "Microsoft Corporation" - C:\WINDOWS\system32\spoolsv.exe (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Ereignisprotokoll" (Eventlog) - "Microsoft Corporation" - C:\WINDOWS\system32\services.exe (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Extensible Authentication-Protokolldienst" (EapHost) - "Microsoft Corporation" - C:\WINDOWS\System32\eapsvc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Fehlerberichterstattungsdienst" (ERSvc) - "Microsoft Corporation" - C:\WINDOWS\System32\ersvc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Gatewaydienst auf Anwendungsebene" (ALG) - "Microsoft Corporation" - C:\WINDOWS\System32\alg.exe (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Geschützter Speicher" (ProtectedStorage) - "Microsoft Corporation" - C:\WINDOWS\system32\lsass.exe (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe (Hidden registry entry, rootkit activity)
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe (Hidden registry entry, rootkit activity)
"Gupta SQLBase Advoware" (Gupta SQLBase Advoware) - "Gupta Technologies, LLC" - C:\AdvoWeb\Advoware\Server\dbntsrv.exe (Hidden registry entry, rootkit activity)
"HID Input Service" (HidServ) - "Microsoft Corporation" - C:\WINDOWS\System32\hidserv.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Hilfe und Support" (helpsvc) - "Microsoft Corporation" - C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"HTTP-SSL" (HTTPFilter) - "Microsoft Corporation" - C:\WINDOWS\System32\w3ssl.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"IMAPI-CD-Brenn-COM-Dienste" (ImapiService) - "Microsoft Corporation" - C:\WINDOWS\system32\imapi.exe (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Indexdienst" (CiSvc) - "Microsoft Corporation" - C:\WINDOWS\system32\cisvc.exe (Hidden registry entry, rootkit activity | File signed by Microsoft)
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe (Hidden registry entry, rootkit activity)
"Integritätsschlüssel- und Zertifikatverwaltungsdienst" (hkmsvc) - "Microsoft Corporation" - C:\WINDOWS\System32\kmsvc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Intelligenter Hintergrundübertragungsdienst" (BITS) - "Microsoft Corporation" - C:\WINDOWS\system32\qmgr.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"IPSEC-Dienste" (PolicyAgent) - "Microsoft Corporation" - C:\WINDOWS\system32\lsass.exe (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe (Hidden registry entry, rootkit activity)
"Kompatibilität für schnelle Benutzerumschaltung" (FastUserSwitchingCompatibility) - "Microsoft Corporation" - C:\WINDOWS\System32\shsvcs.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Konfigurationsfreie drahtlose Verbindung" (WZCSVC) - "Microsoft Corporation" - C:\WINDOWS\System32\wzcsvc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Lavasoft Ad-Aware Service" (Lavasoft Ad-Aware Service) - "Lavasoft Limited" - C:\Programme\Lavasoft\Ad-Aware\AAWService.exe (Hidden registry entry, rootkit activity)
"Leistungsdatenprotokolle und Warnungen" (SysmonLog) - "Microsoft Corporation" - C:\WINDOWS\system32\smlogsvc.exe (Hidden registry entry, rootkit activity | File signed by Microsoft)
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Hidden registry entry, rootkit activity)
"Media Center Extender Service" (McrdSvc) - "Microsoft Corporation" - C:\WINDOWS\ehome\mcrdsvc.exe (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Media Center Receiver Service" (ehRecvr) - "Microsoft Corporation" - C:\WINDOWS\eHome\ehRecvr.exe (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Media Center-Planerdienst" (ehSched) - "Microsoft Corporation" - C:\WINDOWS\eHome\ehSched.exe (Hidden registry entry, rootkit activity | File signed by Microsoft)
"MHN" (MHN) - "Microsoft Corporation" - C:\WINDOWS\System32\mhn.dll (Hidden registry entry, rootkit activity)
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE (Hidden registry entry, rootkit activity)
"MS Software Shadow Copy Provider" (SwPrv) - "Microsoft Corporation" - C:\WINDOWS\system32\dllhost.exe (Hidden registry entry, rootkit activity | File signed by Microsoft)
"NAP-Agent (Network Access Protection)" (napagent) - "Microsoft Corporation" - C:\WINDOWS\System32\qagentrt.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"NetMeeting-Remotedesktop-Freigabe" (mnmsrvc) - "Microsoft Corporation" - C:\WINDOWS\system32\mnmsrvc.exe (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Netzwerkverbindungen" (Netman) - "Microsoft Corporation" - C:\WINDOWS\System32\netman.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Netzwerkversorgungsdienst" (xmlprov) - "Microsoft Corporation" - C:\WINDOWS\System32\xmlprov.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"NLA (Network Location Awareness)" (Nla) - "Microsoft Corporation" - C:\WINDOWS\System32\mswsock.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"NT-LM-Sicherheitsdienst" (NtLmSsp) - "Microsoft Corporation" - C:\WINDOWS\system32\lsass.exe (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Hidden registry entry, rootkit activity)
"Plug & Play" (PlugPlay) - "Microsoft Corporation" - C:\WINDOWS\system32\services.exe (Hidden registry entry, rootkit activity | File signed by Microsoft)
"QoS-RSVP" (RSVP) - "Microsoft Corporation" - C:\WINDOWS\system32\rsvp.exe (Hidden registry entry, rootkit activity | File signed by Microsoft)
"RAS-Verbindungsverwaltung" (RasMan) - "Microsoft Corporation" - C:\WINDOWS\System32\rasmans.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Remote-Registrierung" (RemoteRegistry) - "Microsoft Corporation" - C:\WINDOWS\system32\regsvc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Remoteprozeduraufruf (RPC)" (RpcSs) - "Microsoft Corporation" - C:\WINDOWS\System32\rpcss.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"RPC-Locator" (RpcLocator) - "Microsoft Corporation" - C:\WINDOWS\system32\locator.exe (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Secondary Logon" (seclogon) - "Microsoft Corporation" - C:\WINDOWS\System32\seclogon.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Server" (lanmanserver) - "Microsoft Corporation" - C:\WINDOWS\System32\srvsvc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Shellhardwareerkennung" (ShellHWDetection) - "Microsoft Corporation" - C:\WINDOWS\System32\shsvcs.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Sicherheitscenter" (wscsvc) - "Microsoft Corporation" - C:\WINDOWS\system32\wscsvc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Sicherheitskontenverwaltung" (SamSs) - "Microsoft Corporation" - C:\WINDOWS\system32\lsass.exe (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Sitzungs-Manager für Remotedesktophilfe" (RDSessMgr) - "Microsoft Corporation" - C:\WINDOWS\system32\sessmgr.exe (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Smartcard" (SCardSvr) - "Microsoft Corporation" - C:\WINDOWS\System32\SCardSvr.exe (Hidden registry entry, rootkit activity | File signed by Microsoft)
"SSDP Discovery Service" (SSDPSRV) - "Microsoft Corporation" - C:\WINDOWS\System32\ssdpsrv.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Systemereignisbenachrichtigung" (SENS) - "Microsoft Corporation" - C:\WINDOWS\system32\sens.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Systemwiederherstellungsdienst" (srservice) - "Microsoft Corporation" - C:\WINDOWS\system32\srsvc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Taskplaner" (Schedule) - "Microsoft Corporation" - C:\WINDOWS\system32\schedsvc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"TCP/IP-NetBIOS-Hilfsprogramm" (LmHosts) - "Microsoft Corporation" - C:\WINDOWS\System32\lmhsvc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Telefonie" (TapiSrv) - "Microsoft Corporation" - C:\WINDOWS\System32\tapisrv.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Telnet" (TlntSvr) - "Microsoft Corporation" - C:\WINDOWS\system32\tlntsvr.exe (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Terminaldienste" (TermService) - "Microsoft Corporation" - C:\WINDOWS\System32\termsrv.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Treibererweiterungen für Windows-Verwaltungsinstrumentation" (Wmi) - "Microsoft Corporation" - C:\WINDOWS\System32\advapi32.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Universeller Plug & Play-Gerätehost" (upnphost) - "Microsoft Corporation" - C:\WINDOWS\System32\upnphost.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Unterbrechungsfreie Stromversorgung" (UPS) - "Microsoft Corporation" - C:\WINDOWS\System32\ups.exe (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Verwaltung für automatische RAS-Verbindung" (RasAuto) - "Microsoft Corporation" - C:\WINDOWS\System32\rasauto.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Verwaltung logischer Datenträger" (dmserver) - "Microsoft Corp." - C:\WINDOWS\System32\dmserver.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Verwaltungsdienst für die Verwaltung logischer Datenträger" (dmadmin) - "Microsoft Corp., Veritas Software" - C:\WINDOWS\System32\dmadmin.exe (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Volumeschattenkopie" (VSS) - "Microsoft Corporation" - C:\WINDOWS\System32\vssvc.exe (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Webclient" (WebClient) - "Microsoft Corporation" - C:\WINDOWS\System32\webclnt.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Wechselmedien" (NtmsSvc) - "Microsoft Corporation" - C:\WINDOWS\system32\ntmssvc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Windows Audio" (AudioSrv) - "Microsoft Corporation" - C:\WINDOWS\System32\audiosrv.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Windows CardSpace" (idsvc) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (Hidden registry entry, rootkit activity)
"Windows Installer" (MSIServer) - "Microsoft Corporation" - C:\WINDOWS\system32\msiexec.exe (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (Hidden registry entry, rootkit activity)
"Windows User Mode Driver Framework" (UMWdf) - "Microsoft Corporation" - C:\WINDOWS\system32\wdfmgr.exe (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Windows-Bilderfassung (WIA)" (stisvc) - "Microsoft Corporation" - C:\WINDOWS\system32\wiaservc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Windows-Firewall/Gemeinsame Nutzung der Internetverbindung" (SharedAccess) - "Microsoft Corporation" - C:\WINDOWS\System32\ipnathlp.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Windows-Verwaltungsinstrumentation" (winmgmt) - "Microsoft Corporation" - C:\WINDOWS\system32\wbem\WMIsvc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Windows-Zeitgeber" (W32Time) - "Microsoft Corporation" - C:\WINDOWS\system32\w32time.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
"WMI-Leistungsadapter" (WmiApSrv) - "Microsoft Corporation" - C:\WINDOWS\system32\wbem\wmiapsrv.exe (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Überwachung verteilter Verknüpfungen (Client)" (TrkWks) - "Microsoft Corporation" - C:\WINDOWS\system32\trkwks.dll (Hidden registry entry, rootkit activity | File signed by Microsoft)
[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll (File not found)
===[ Logfile end ]=========================================[ Logfile end ]===
If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
und hier die Log-Datei von aswMBR: Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-04-23 19:25:39
-----------------------------
19:25:39.906 OS Version: Windows 5.1.2600 Service Pack 3
19:25:39.906 Number of processors: 2 586 0x403
19:25:39.906 ComputerName: THOMAS-8157C8E2 UserName:
19:25:40.234 Initialize success
19:34:33.640 AVAST engine defs: 12042300
19:35:00.593 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
19:35:00.593 Disk 0 Vendor: WDC_WD25 10.0 Size: 238418MB BusType: 3
19:35:00.609 Disk 0 MBR read successfully
19:35:00.609 Disk 0 MBR scan
19:35:00.656 Disk 0 Windows XP default MBR code
19:35:00.656 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 24999 MB offset 63
19:35:00.656 Disk 0 Partition - 00 0F Extended LBA 213410 MB offset 51199155
19:35:00.671 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 213410 MB offset 51199218
19:35:00.671 Disk 0 scanning sectors +488263545
19:35:00.765 Disk 0 scanning C:\WINDOWS\system32\drivers
19:35:11.109 Service scanning
19:35:22.875 Modules scanning
19:35:27.296 Disk 0 trace - called modules:
19:35:27.312 ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
19:35:27.328 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x894d8ab8]
19:35:27.328 3 CLASSPNP.SYS[ba0e8fd7] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x89dd0030]
19:35:27.687 AVAST engine scan C:\WINDOWS
19:35:43.359 AVAST engine scan C:\WINDOWS\system32
19:38:41.937 AVAST engine scan C:\WINDOWS\system32\drivers
19:38:57.593 AVAST engine scan C:\Dokumente und Einstellungen\T****
19:40:44.906 AVAST engine scan C:\Dokumente und Einstellungen\All Users
19:42:03.078 Scan finished successfully
19:44:16.531 Disk 0 MBR has been saved successfully to "D:\viren logs\MBR.dat"
19:44:16.562 The log file has been saved successfully to "D:\viren logs\aswMBR.txt"
Ich hoffe das ist das was du brauchst, hab versucht mich korrekt an die Anleitung zu halten ;)
Vielen Dank & Gruß! |
aswMBR.exe und speichere die Datei auf deinem Desktop.