Trojaner-Board - Dienst "Sicherheitscenter" lässt sich nicht starten - Googleumleitungen

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Dienst "Sicherheitscenter" lässt sich nicht starten - Googleumleitungen - Trojaner on Board ? (https://www.trojaner-board.de/95445-dienst-sicherheitscenter-laesst-starten-googleumleitungen-trojaner-on-board.html)

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Das Tool braucht nur einige Sekunden.
Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

GMER:

GMER Logfile:

Code:

GMER 1.0.15.15530 - hxxp://www.gmer.net

Rootkit scan 2011-02-09 00:11:57

Windows 6.1.7600  Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Hitachi_HTS543232L9A300 rev.FB4OC40C

Running: l4t392u1.exe; Driver: C:\Users\PATRIC~1\AppData\Local\Temp\afriqfoc.sys
 
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text           ntkrnlpa.exe!ZwSaveKeyEx + 13AD                                                                                     8305C599 1 Byte  [06]

.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                              83080F52 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

?               System32\Drivers\spzr.sys                                                                                           Das System kann den angegebenen Pfad nicht finden. !

PAGE            ataport.SYS!DllUnload + 1                                                                                           8B6B1AD7 1 Byte  [FD]

PAGE            ataport.SYS!DllUnload + 1                                                                                           8B6B1AD7 4 Bytes  JMP 8594E1D9 

.text           USBPORT.SYS!DllUnload                                                                                               925CFCA0 5 Bytes  JMP 859A04E0 

.text           a6jzddee.SYS                                                                                                        92EAE000 12 Bytes  CALL 79D96347 

.text           a6jzddee.SYS                                                                                                        92EAE00D 9 Bytes  [C7, 42, 83, 48, EB, 42, 83, ...] {MOV DWORD [EDX-0x7d], 0x8342eb48; ADD [EAX], AL}

.text           a6jzddee.SYS                                                                                                        92EAE017 20 Bytes  [00, DE, 47, 58, 8B, E6, 45, ...]

.text           a6jzddee.SYS                                                                                                        92EAE02C 149 Bytes  [00, 00, 00, 00, D0, 71, 05, ...]

.text           a6jzddee.SYS                                                                                                        92EAE0C3 8 Bytes  [00, 00, 00, 00, 00, 00, 00, ...] {ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL}

.text           ...                                                                                                                 

?               C:\Windows\system32\Drivers\PROCEXP113.SYS                                                                          Das System kann die angegebene Datei nicht finden. !
 

---- Kernel IAT/EAT - GMER 1.0.15 ----
 

IAT             \SystemRoot\system32\DRIVERS\atapi.sys[ataport.SYS!AtaPortReadPortUchar]                                            [8B488042] \SystemRoot\System32\Drivers\spzr.sys

IAT             \SystemRoot\system32\DRIVERS\atapi.sys[ataport.SYS!AtaPortWritePortUchar]                                           [8B4886D6] \SystemRoot\System32\Drivers\spzr.sys

IAT             \SystemRoot\system32\DRIVERS\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort]                                    [8B488800] \SystemRoot\System32\Drivers\spzr.sys

IAT             \SystemRoot\system32\DRIVERS\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort]                                     [8B48813E] \SystemRoot\System32\Drivers\spzr.sys

IAT             \SystemRoot\System32\Drivers\a6jzddee.SYS[ataport.SYS!AtaPortNotification]                                          00147880

IAT             \SystemRoot\System32\Drivers\a6jzddee.SYS[ataport.SYS!AtaPortQuerySystemTime]                                       78800C75

IAT             \SystemRoot\System32\Drivers\a6jzddee.SYS[ataport.SYS!AtaPortReadPortUchar]                                         06750015

IAT             \SystemRoot\System32\Drivers\a6jzddee.SYS[ataport.SYS!AtaPortStallExecution]                                        C25DC033

IAT             \SystemRoot\System32\Drivers\a6jzddee.SYS[ataport.SYS!AtaPortWritePortUchar]                                        458B0008

IAT             \SystemRoot\System32\Drivers\a6jzddee.SYS[ataport.SYS!AtaPortWritePortUlong]                                        6A006A08

IAT             \SystemRoot\System32\Drivers\a6jzddee.SYS[ataport.SYS!AtaPortGetPhysicalAddress]                                    50056A24

IAT             \SystemRoot\System32\Drivers\a6jzddee.SYS[ataport.SYS!AtaPortConvertPhysicalAddressToUlong]                         005AB7E8

IAT             \SystemRoot\System32\Drivers\a6jzddee.SYS[ataport.SYS!AtaPortGetScatterGatherList]                                  0001B800

IAT             \SystemRoot\System32\Drivers\a6jzddee.SYS[ataport.SYS!AtaPortGetParentBusType]                                      C25D0000

IAT             \SystemRoot\System32\Drivers\a6jzddee.SYS[ataport.SYS!AtaPortRequestCallback]                                       CCCC0008

IAT             \SystemRoot\System32\Drivers\a6jzddee.SYS[ataport.SYS!AtaPortWritePortBufferUshort]                                 CCCCCCCC

IAT             \SystemRoot\System32\Drivers\a6jzddee.SYS[ataport.SYS!AtaPortGetUnCachedExtension]                                  CCCCCCCC

IAT             \SystemRoot\System32\Drivers\a6jzddee.SYS[ataport.SYS!AtaPortCompleteRequest]                                       CCCCCCCC

IAT             \SystemRoot\System32\Drivers\a6jzddee.SYS[ataport.SYS!AtaPortCopyMemory]                                            53EC8B55

IAT             \SystemRoot\System32\Drivers\a6jzddee.SYS[ataport.SYS!AtaPortEtwTraceLog]                                           800C5D8B

IAT             \SystemRoot\System32\Drivers\a6jzddee.SYS[ataport.SYS!AtaPortCompleteAllActiveRequests]                             7500117B

IAT             \SystemRoot\System32\Drivers\a6jzddee.SYS[ataport.SYS!AtaPortReleaseRequestSenseIrb]                                127B806A

IAT             \SystemRoot\System32\Drivers\a6jzddee.SYS[ataport.SYS!AtaPortBuildRequestSenseIrb]                                  80647500

IAT             \SystemRoot\System32\Drivers\a6jzddee.SYS[ataport.SYS!AtaPortReadPortBufferUshort]                                  7500137B

IAT             \SystemRoot\System32\Drivers\a6jzddee.SYS[ataport.SYS!AtaPortInitialize]                                            157B805E

IAT             \SystemRoot\System32\Drivers\a6jzddee.SYS[ataport.SYS!AtaPortGetDeviceBase]                                         56587500

IAT             \SystemRoot\System32\Drivers\a6jzddee.SYS[ataport.SYS!AtaPortDeviceStateChange]                                     8008758B
 

---- User IAT/EAT - GMER 1.0.15 ----
 

IAT             C:\Windows\system32\rundll32.exe[1812] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress]               [75465E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT             C:\Windows\system32\rundll32.exe[1812] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress]                [75465E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT             C:\Windows\system32\rundll32.exe[1812] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress]              [75465E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT             C:\Windows\system32\rundll32.exe[1812] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress]             [75465E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
 

---- Devices - GMER 1.0.15 ----
 

Device          \FileSystem\Ntfs \Ntfs                                                                                              866331F8
 

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                              cbfs3.sys

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                             kbfiltr.sys

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                                             kbfiltr.sys
 

Device          \Driver\volmgr \Device\VolMgrControl                                                                                859501F8

Device          \Driver\usbuhci \Device\USBPDO-0                                                                                    869E51F8

Device          \Driver\usbuhci \Device\USBPDO-1                                                                                    869E51F8

Device          \Driver\usbuhci \Device\USBPDO-2                                                                                    869E51F8

Device          \Driver\usbehci \Device\USBPDO-3                                                                                    86690500

Device          \Driver\usbuhci \Device\USBPDO-4                                                                                    869E51F8
 

AttachedDevice  \Driver\tdx \Device\Tcp                                                                                             aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
 

Device          \Driver\usbuhci \Device\USBPDO-5                                                                                    869E51F8

Device          \Driver\usbuhci \Device\USBPDO-6                                                                                    869E51F8

Device          \Driver\volmgr \Device\HarddiskVolume1                                                                              859501F8
 

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                              fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
 

Device          \Driver\usbehci \Device\USBPDO-7                                                                                    86690500

Device          \Driver\volmgr \Device\HarddiskVolume2                                                                              859501F8
 

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                              fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
 

Device          \Driver\cdrom \Device\CdRom0                                                                                        869161F8

Device          \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0                                                                         866301F8

Device          \Driver\atapi \Device\Ide\IdePort0                                                                                  866301F8

Device          \Driver\atapi \Device\Ide\IdePort1                                                                                  866301F8

Device          \Driver\atapi \Device\Ide\IdePort2                                                                                  866301F8

Device          \Driver\atapi \Device\Ide\IdePort3                                                                                  866301F8

Device          \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-1                                                                         866301F8

Device          \Driver\msahci \Device\Ide\PciIde0Channel0                                                                          866311F8

Device          \Driver\msahci \Device\Ide\PciIde0Channel1                                                                          866311F8

Device          \Driver\msahci \Device\Ide\PciIde0Channel4                                                                          866311F8

Device          \Driver\msahci \Device\Ide\PciIde0Channel5                                                                          866311F8

Device          \Driver\volmgr \Device\HarddiskVolume3                                                                              859501F8
 

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                                              fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
 

Device          \Driver\cdrom \Device\CdRom1                                                                                        869161F8

Device          \Driver\PCI_PNP4429 \Device\00000066                                                                                spzr.sys

Device          \Driver\NetBT \Device\NetBT_Tcpip_{715D35D4-431A-4E55-BFE1-0016708772D9}                                            869D51F8

Device          \Driver\NetBT \Device\NetBt_Wins_Export                                                                             869D51F8

Device          \Driver\ACPI_HAL \Device\0000005a                                                                                   halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

Device          \Driver\sptd \Device\2768728430                                                                                     spzr.sys
 

AttachedDevice  \Driver\tdx \Device\Udp                                                                                             aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
 

Device          \Driver\usbuhci \Device\USBFDO-0                                                                                    869E51F8

Device          \Driver\usbuhci \Device\USBFDO-1                                                                                    869E51F8

Device          \Driver\usbuhci \Device\USBFDO-2                                                                                    869E51F8

Device          \Driver\usbehci \Device\USBFDO-3                                                                                    86690500

Device          \Driver\usbuhci \Device\USBFDO-4                                                                                    869E51F8

Device          \Driver\usbuhci \Device\USBFDO-5                                                                                    869E51F8

Device          \Driver\NetBT \Device\NetBT_Tcpip_{C6EF4E26-4E8C-4458-A58F-9D4550590474}                                            869D51F8

Device          \Driver\usbuhci \Device\USBFDO-6                                                                                    869E51F8

Device          \Driver\usbehci \Device\USBFDO-7                                                                                    86690500

Device          \Driver\a6jzddee \Device\Scsi\a6jzddee1Port4Path0Target0Lun0                                                        86B101F8

Device          \Driver\a6jzddee \Device\Scsi\a6jzddee1                                                                             86B101F8
 

---- Registry - GMER 1.0.15 ----
 

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s1                                                                  771343423

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s2                                                                  285507792

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@h0                                                                  1

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                    

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                 0

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                              0xBA 0xF3 0x9D 0x70 ...

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                 0xD4 0xC3 0x97 0x02 ...

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                 C:\Program Files\DAEMON Tools Lite\

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                           

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                     0x97 0x55 0xBD 0xBA ...

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                        0x20 0x01 0x00 0x00 ...

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                      

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                0x82 0xAB 0x2D 0xA8 ...

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                     0

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                  0xBB 0x70 0x11 0x68 ...

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                     0xD4 0xC3 0x97 0x02 ...

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                     C:\Program Files\DAEMON Tools Lite\

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)       

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                         0x97 0x55 0xBD 0xBA ...

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                            0x20 0x01 0x00 0x00 ...

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)  

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                    0x82 0xAB 0x2D 0xA8 ...
 

---- EOF - GMER 1.0.15 ----

--- --- ---

OSAM:
OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

Online Solutions. Complex Protection for Information Systems

Saved at 00:19:22 on 09.02.2011
 

OS: Windows 7  (Build 7600), 32-bit

Default Browser: Mozilla Corporation Firefox 3.6.13
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Boot Execute]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager )-----

"BootExecute" - ? - C:\Windows\system32\lsdelete.exe  (File found, but it contains no detailed information)
 

[Common]

-----( %SystemRoot%\Tasks )-----

"Ad-Aware Update (Weekly).job" - "Lavasoft                                                              " - C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl

"nvcpl.cpl" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"Adobe Gamma" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma.cpl

"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\MLCFG32.CPL

"Nero BurnRights" - "Nero AG" - C:\Program Files\Nero\Nero 9\Nero BurnRights\NeroBurnRights_cpl.cpl

"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"a6jzddee" (a6jzddee) - "Microsoft Corporation" - C:\Windows\system32\drivers\a6jzddee.sys  (Hidden registry entry, rootkit activity | File signed by Microsoft)

"afriqfoc" (afriqfoc) - ? - C:\Users\PATRIC~1\AppData\Local\Temp\afriqfoc.sys  (Hidden registry entry, rootkit activity | File not found)

"aswFsBlk" (aswFsBlk) - "ALWIL Software" - C:\Windows\System32\DRIVERS\aswFsBlk.sys

"aswMonFlt" (aswMonFlt) - "ALWIL Software" - C:\Windows\System32\DRIVERS\aswMonFlt.sys

"aswRdr" (aswRdr) - "ALWIL Software" - C:\Windows\system32\drivers\aswRdr.sys

"avast! Network Shield Support" (aswTdi) - "ALWIL Software" - C:\Windows\system32\drivers\aswTdi.sys

"avast! Self Protection" (aswSP) - "ALWIL Software" - C:\Windows\system32\drivers\aswSP.sys

"catchme" (catchme) - ? - C:\Users\PATRIC~1\AppData\Local\Temp\catchme.sys  (File not found)

"cbfs3" (cbfs3) - "EldoS Corporation" - C:\Windows\system32\drivers\cbfs3.sys

"Cisco Systems Inc. IPSec Driver" (CVPNDRVA) - "Cisco Systems, Inc." - C:\Windows\system32\Drivers\CVPNDRVA.sys

"GpdDevDPort" (GpdDevDPort) - ? - C:\Windows\system32\directport.sys  (File found, but it contains no detailed information)

"GpdKbFilter" (GpdKbFilter) - "Windows (R) Codename Longhorn DDK provider" - C:\Windows\system32\kbfiltr.sys

"Huawei DataCard USB Modem and USB Serial" (hwdatacard) - ? - C:\Windows\System32\DRIVERS\ewusbmdm.sys  (File not found)

"Lavasoft helper driver" (Lavasoft Kernexplorer) - ? - C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys  (File found, but it contains no detailed information)

"mbr" (mbr) - ? - C:\Users\PATRIC~1\AppData\Local\Temp\mbr.sys  (Hidden registry entry, rootkit activity | File not found)

"SASDIFSV" (SASDIFSV) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS

"SASKUTIL" (SASKUTIL) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS

"sptd" (sptd) - "Duplex Secure Ltd." - C:\Windows\System32\Drivers\sptd.sys  (File is exclusively opened, access blocked)
 

[Explorer]

-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

{88FED34C-F0CA-4636-A375-3CB6248B04CD} "Local Groove Web Services Protocol" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler )-----

{5FF49FE8-B332-4CB9-B102-FB6951629E55} "Virtual Storage Mount Notification" - "EldoS Corporation" - C:\Windows\system32\CbFsMntNtf3.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----

{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{472083B0-C522-11CF-8763-00608CC02F24} "avast" - "ALWIL Software" - C:\Program Files\Alwil Software\Avast4\ashShell.dll

{D66DC78C-4F61-447F-942B-3FB6980118CF} "CInfoTipShellExt Class" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\VISSHE.DLL

{A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.dll

{D8D1CE8C-B1EB-4E95-B63B-1531BA60E992} "DivX Property Handler" - "DivX, Inc." - C:\Program Files\DivX\DivX Plus Media Foundation Components\DivXPropertyHandler.dll

{83238FAE-D346-4E12-8734-D42F7554B3E6} "DivX Thumbnail Provider" - "DivX, Inc." - C:\Program Files\DivX\DivX Plus Media Foundation Components\DivXThumbnailProvider.dll

{E81FFB23-40E2-431C-A041-76AEA0E4B04C} "Enterprise-Projekte" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\NAMEEXT.DLL

{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

{506F4668-F13E-4AA1-BB04-B43203AB3CC0} "ImageExtractorShellExt Class" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\VISSHE.DLL

{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll

{DC70C4A5-2044-4c59-B806-DEFB9AE0DF7C} "KbLogiExt Class" - "Logitech, Inc." - C:\Program Files\Logitech\SetPoint\kbcplext.dll

{B9B9F083-2B04-452A-8691-83694AC1037B} "LogiExt Class" - "Logitech, Inc." - C:\Program Files\Logitech\SetPoint\mcplext.dll

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\ONFILTER.DLL

{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\MLSHEXT.DLL

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2} "NeroCoverEdLiveIcons Class" - "Nero AG" - C:\Program Files\Nero\Nero 9\Nero CoverDesigner\CoverEdExtension.dll

{3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} "NVIDIA CPL Context Menu Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvshext.dll

{FFB699E0-306A-11d3-8BD1-00104B6F7516} "NVIDIA CPL Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.dll

{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\OLKFSTUB.DLL

{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - C:\Program Files\Real\RealPlayer\rpshell.dll

{5FF49FE8-B332-4CB9-B102-FB6951629E55} "Virtual Storage Mount Notification" - "EldoS Corporation" - C:\Windows\system32\CbFsMntNtf3.dll

{0420B051-ECD8-4B18-9037-8739B4B6469F} "WebDavContextMenu Class" - "Deutsche Telekom AG" - C:\Windows\system32\WebDAV.ShellExtension.dll

{0774B5A9-ADB5-4D3A-915F-72C7EF9CD262} "WebDavOverlayUpload Class" - "Deutsche Telekom AG" - C:\Windows\system32\WebDAV.ShellExtension.dll

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll

{ABE00001-0123-ABED-1248-0248ADFA1909} "Zoom Player ShellExt" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad )-----

{5FF49FE8-B332-4CB9-B102-FB6951629E55} "Virtual Storage Mount Notification" - "EldoS Corporation" - C:\Windows\system32\CbFsMntNtf3.dll
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

<binary data> "SearchElf 1.2 Toolbar" - "Conduit Ltd." - C:\Program Files\SearchElf_1.2\tbSear.dll

<binary data> "{47833539-D0C5-4125-9FA8-0819E2EAAC93}" - ? -   (File not found | COM-object registry key not found)

-----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )-----

{f4e6547e-325b-403c-a3bb-ad29ed37a92f} "SearchElf 1.2 Toolbar" - "Conduit Ltd." - C:\Program Files\SearchElf_1.2\tbSear.dll

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_22.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\Windows\system32\Macromed\Flash\Flash10k.ocx / hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} "@C:\Windows\WindowsMobile\INetRepl.dll,-222" - "Microsoft Corporation" - C:\Windows\WindowsMobile\INetRepl.dll

{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll

{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} "ClsidExtension" - "Microsoft Corporation" - C:\Windows\WindowsMobile\INetRepl.dll

{53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

"ICQ7.2" - "ICQ, LLC." - C:\Program Files\ICQ7.2\ICQ.exe

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

{30F9B915-B755-4826-820B-08FBA6BD249D} "Conduit Engine" - "Conduit Ltd." - C:\Program Files\ConduitEngine\ConduitEngine.dll

{f4e6547e-325b-403c-a3bb-ad29ed37a92f} "SearchElf 1.2 Toolbar" - "Conduit Ltd." - C:\Program Files\SearchElf_1.2\tbSear.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{30F9B915-B755-4826-820B-08FBA6BD249D} "Conduit Engine" - "Conduit Ltd." - C:\Program Files\ConduitEngine\ConduitEngine.dll

{593DDEC6-7468-4cdd-90E1-42DADAA222E9} "DivX HiQ" - "DivX, LLC" - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll

{326E768D-4182-46FD-9C16-1449A49795F4} "DivX Plus Web Player HTML5 <video>" - "DivX, LLC" - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll

{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

{3049C3E9-B461-4BC5-8870-4C09146192CA} "RealPlayer Download and Record Plugin for Internet Explorer" - "RealPlayer" - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

{f4e6547e-325b-403c-a3bb-ad29ed37a92f} "SearchElf 1.2 Toolbar" - "Conduit Ltd." - C:\Program Files\SearchElf_1.2\tbSear.dll

{53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

{5FF49FE8-B332-4CB9-B102-FB6951629E55} "Virtual Storage Mount Notification" - "EldoS Corporation" - C:\Windows\system32\CbFsMntNtf3.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"Adobe Gamma.lnk" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe  (Shortcut exists | File exists)

"desktop.ini" - ? - C:\Users\Peter Klein\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

"Mediencenter Software.lnk" - "Deutsche Telekom AG" - C:\Program Files\Telekom\Mediencenter\MediencenterSoftware.exe  (Shortcut exists | File exists)

"Hardcopy.LNK" - "sw4you, Siegfried Weckmann" - C:\Program Files\Hardcopy\hardcopy.exe  (Shortcut exists | File exists)

"Wootch.appref-ms" - ? - C:\Users\Peter Klein\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wootch.appref-ms

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

"Logitech SetPoint.lnk" - "Logitech, Inc." - C:\Program Files\Logitech\SetPoint\SetPoint.exe  (Shortcut exists | File exists)

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"Appigo Sync" - "Appigo, Inc." - C:\Program Files\Appigo Sync\Appigo Sync.exe

"DAEMON Tools Lite" - "DT Soft Ltd" - "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun

"gStart" - "GARMIN Corp." - C:\Program Files\Garmin\gStart.exe

"SpybotSD TeaTimer" - "Safer-Networking Ltd." - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"AppleSyncNotifier" - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

"avast!" - "ALWIL Software" - "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"

"DivX Download Manager" - "DivX, LLC" - "C:\Program Files\DivX\DivX Plus Web Player\DDmService.exe" start

"DivXUpdate" - ? - "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

"GrooveMonitor" - "Microsoft Corporation" - "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"

"NvCplDaemon" - "NVIDIA Corporation" - RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

"OSD" - "ODM" - C:\Program Files\OEM\OSD_1.16\osd.exe

"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
 

[Network Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order )-----

"Virtual Network Shares CallbackFS v3" - "EldoS Corporation" - C:\Windows\System32\CbFsNetRdr3.dll
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\Windows\system32\mdimon.dll

"PDFCreator" - ? - C:\Windows\system32\pdfcmnnt.dll  (File found, but it contains no detailed information)

"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"Adobe LM Service" (Adobe LM Service) - "Adobe Systems" - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

"avast! Antivirus" (avast! Antivirus) - "ALWIL Software" - C:\Program Files\Alwil Software\Avast4\ashServ.exe

"avast! iAVS4 Control Service" (aswUpdSv) - "ALWIL Software" - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

"avast! Mail Scanner" (avast! Mail Scanner) - "ALWIL Software" - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

"avast! Web Scanner" (avast! Web Scanner) - "ALWIL Software" - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

"Brother BRAdminPro Scheduler" (BRA_Scheduler) - ? - C:\Program Files\Brother\BRAdmin Professional 3\bratimer.exe  (File found, but it contains no detailed information)

"Cisco Systems, Inc. VPN Service" (CVPND) - "Cisco Systems, Inc." - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe

"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe

"FLEXnet Licensing Service" (FLEXnet Licensing Service) - "Acresso Software Inc." - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

"Google Update Service (gupdate1ca4bca8a47b180)" (gupdate1ca4bca8a47b180) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"Google Updater Service" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe

"Lavasoft Ad-Aware Service" (Lavasoft Ad-Aware Service) - "Lavasoft" - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

"Logitech Bluetooth Service" (LBTServ) - "Logitech, Inc." - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe

"Machine Debug Manager" (MDM) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

"Mediencenter Service" (MCSWASVR) - "Deutsche Telekom AG" - C:\Program Files\Telekom\Mediencenter\WebDAV.AdminService.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

"Microsoft Office Groove Audit Service" (Microsoft Office Groove Audit Service) - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe

"Nero BackItUp Scheduler 4.0" (Nero BackItUp Scheduler 4.0) - "Nero AG" - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

"NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"OSD Service" (OsdService) - "TODO: <公司名稱>" - C:\Program Files\OEM\OSD_1.16\OsdService.exe

"SBSD Security Center Service" (SBSDWSCService) - "Safer Networking Ltd." - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe

"Sony Ericsson OMSI download service" (OMSI download service) - ? - C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe  (File found, but it contains no detailed information)

"VLC media player" (VLC media player) - "VideoLAN Team" - C:\Programme\VideoLAN\VLC_072\vlc.exe
 

[Winlogon]

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----

"LBTWlgn" - "Logitech, Inc." - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----

"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---
If You have questions or want to get some help, You can visit Online Solutions :: Index

MBRCheck:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows 7 Professional
Windows Information: (build 7600), 32-bit
Base Board Manufacturer: FUJITSU SIEMENS
BIOS Manufacturer: Phoenix
System Manufacturer: FUJITSU SIEMENS
System Product Name: AMILO Pi 3540
Logical Drives Mask: 0x0008003c

Kernel Drivers (total 167):
0x83019000 \SystemRoot\system32\ntkrnlpa.exe
0x83429000 \SystemRoot\system32\halmacpi.dll
0x80BB1000 \SystemRoot\system32\kdcom.dll
0x83629000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x836A1000 \SystemRoot\system32\PSHED.dll
0x836B2000 \SystemRoot\system32\BOOTVID.dll
0x836BA000 \SystemRoot\system32\CLFS.SYS
0x836FC000 \SystemRoot\system32\CI.dll
0x8B407000 \SystemRoot\system32\drivers\Wdf01000.sys
0x8B478000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x8B486000 \SystemRoot\System32\Drivers\spzr.sys
0x8B579000 \SystemRoot\System32\Drivers\WMILIB.SYS
0x8B582000 \SystemRoot\System32\Drivers\SCSIPORT.SYS
0x8B5A8000 \SystemRoot\system32\DRIVERS\ACPI.sys
0x8B5F0000 \SystemRoot\system32\DRIVERS\msisadrv.sys
0x837A7000 \SystemRoot\system32\DRIVERS\vdrvroot.sys
0x837B2000 \SystemRoot\system32\DRIVERS\pci.sys
0x837DC000 \SystemRoot\System32\drivers\partmgr.sys
0x8B5F8000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x837ED000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x83600000 \SystemRoot\system32\DRIVERS\volmgr.sys
0x8B632000 \SystemRoot\System32\drivers\volmgrx.sys
0x8B67D000 \SystemRoot\System32\drivers\mountmgr.sys
0x8B693000 \SystemRoot\system32\DRIVERS\atapi.sys
0x8B69C000 \SystemRoot\system32\DRIVERS\ataport.SYS
0x8B6BF000 \SystemRoot\system32\DRIVERS\msahci.sys
0x8B6C9000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x8B6D7000 \SystemRoot\system32\DRIVERS\amdxata.sys
0x8B6E0000 \SystemRoot\system32\drivers\fltmgr.sys
0x8B714000 \SystemRoot\system32\drivers\fileinfo.sys
0x8B725000 \SystemRoot\system32\DRIVERS\Lbd.sys
0x8B827000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8B956000 \SystemRoot\System32\Drivers\msrpc.sys
0x8B981000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8B994000 \SystemRoot\System32\Drivers\cng.sys
0x8B9F1000 \SystemRoot\System32\drivers\pcw.sys
0x8B800000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x8B734000 \SystemRoot\system32\drivers\ndis.sys
0x8BA05000 \SystemRoot\system32\drivers\NETIO.SYS
0x8BA43000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x8BA68000 \SystemRoot\System32\drivers\tcpip.sys
0x8BBB1000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8BBE2000 \SystemRoot\system32\DRIVERS\vmstorfl.sys
0x8BC14000 \SystemRoot\system32\DRIVERS\volsnap.sys
0x8BC53000 \SystemRoot\System32\Drivers\spldr.sys
0x8BC5B000 \SystemRoot\System32\drivers\rdyboost.sys
0x8BC88000 \SystemRoot\System32\Drivers\mup.sys
0x8BC98000 \SystemRoot\System32\drivers\hwpolicy.sys
0x8BCA0000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x8BCD2000 \SystemRoot\system32\DRIVERS\disk.sys
0x8BCE3000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x8BD3B000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8BD5A000 \SystemRoot\System32\Drivers\Null.SYS
0x8BD61000 \SystemRoot\System32\Drivers\Beep.SYS
0x8BD68000 \SystemRoot\System32\drivers\vga.sys
0x8BD74000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8BD95000 \SystemRoot\System32\drivers\watchdog.sys
0x8BDA2000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8BDAA000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8BDB2000 \SystemRoot\system32\drivers\rdprefmp.sys
0x8BDBA000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8BDC5000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8BDD3000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8BDEA000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8BDF5000 \SystemRoot\System32\Drivers\aswTdi.SYS
0x90016000 \SystemRoot\system32\drivers\afd.sys
0x90070000 \SystemRoot\System32\Drivers\aswRdr.SYS
0x90074000 \SystemRoot\System32\DRIVERS\netbt.sys
0x900A6000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x900AD000 \SystemRoot\system32\DRIVERS\pacer.sys
0x900CC000 \SystemRoot\system32\DRIVERS\netbios.sys
0x900DA000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x900ED000 \SystemRoot\system32\DRIVERS\termdd.sys
0x900FD000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
0x9011F000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
0x90125000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x90166000 \SystemRoot\system32\drivers\nsiproxy.sys
0x90170000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x9017A000 \SystemRoot\System32\drivers\discache.sys
0x90186000 \SystemRoot\system32\drivers\csc.sys
0x8B809000 \SystemRoot\System32\Drivers\dfsc.sys
0x91219000 \??\C:\Windows\system32\drivers\cbfs3.sys
0x91258000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x91266000 \SystemRoot\System32\Drivers\aswSP.SYS
0x91287000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x91C06000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
0x92565000 \SystemRoot\system32\DRIVERS\nvBridge.kmd
0x912A8000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x92567000 \SystemRoot\System32\drivers\dxgmms1.sys
0x925A0000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x925AB000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x9135F000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x9136E000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x92A2D000 \SystemRoot\system32\DRIVERS\NETw5x32.sys
0x92E30000 \SystemRoot\system32\DRIVERS\Rt86win7.sys
0x92E75000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x92E8D000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x92E9A000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x92EA7000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x92EAD000 \SystemRoot\System32\Drivers\a6jzddee.SYS
0x92EE6000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x92EEA000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x92EFC000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
0x92F09000 \SystemRoot\system32\DRIVERS\dne2000.sys
0x92F27000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x92F39000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x92F51000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x92F5C000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x92F7E000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x92F96000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x92FAD000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x92FC4000 \SystemRoot\system32\DRIVERS\rdpbus.sys
0x92FCE000 \SystemRoot\system32\DRIVERS\swenum.sys
0x9138D000 \SystemRoot\system32\DRIVERS\ks.sys
0x92FD0000 \SystemRoot\system32\DRIVERS\umbus.sys
0x9302E000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x93072000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x93203000 \SystemRoot\system32\drivers\RTKVHDA.sys
0x93512000 \SystemRoot\system32\drivers\portcls.sys
0x93541000 \SystemRoot\system32\drivers\drmk.sys
0x9355A000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x93571000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x93573000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x9357E000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x93591000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x93598000 \SystemRoot\system32\DRIVERS\LHidFilt.Sys
0x935A0000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x935AB000 \SystemRoot\system32\DRIVERS\LMouFilt.Sys
0x935B3000 \SystemRoot\System32\Drivers\crashdmp.sys
0x935C0000 \SystemRoot\System32\Drivers\dump_dumpata.sys
0x935CB000 \SystemRoot\System32\Drivers\dump_msahci.sys
0x935D5000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x99320000 \SystemRoot\System32\win32k.sys
0x935E6000 \SystemRoot\System32\drivers\Dxapi.sys
0x99580000 \SystemRoot\System32\TSDDD.dll
0x995B0000 \SystemRoot\System32\cdd.dll
0x93083000 \SystemRoot\system32\drivers\luafv.sys
0x9309E000 \SystemRoot\system32\DRIVERS\aswMonFlt.sys
0x930B5000 \SystemRoot\system32\DRIVERS\aswFsBlk.sys
0x930BD000 \SystemRoot\system32\drivers\WudfPf.sys
0x930D7000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x930E7000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x9312D000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x9313D000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x93150000 \SystemRoot\system32\drivers\HTTP.sys
0x931D5000 \SystemRoot\system32\DRIVERS\bowser.sys
0x931EE000 \SystemRoot\System32\drivers\mpsdrv.sys
0x93000000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x913C1000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x92FDE000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0xA2E0F000 \??\C:\Windows\system32\Drivers\CVPNDRVA.sys
0xA2E9F000 \SystemRoot\system32\drivers\peauth.sys
0xA2F36000 \SystemRoot\System32\Drivers\secdrv.SYS
0xA2F40000 \SystemRoot\System32\DRIVERS\srvnet.sys
0xA2F61000 \SystemRoot\System32\drivers\tcpipreg.sys
0xA2F6E000 \SystemRoot\System32\DRIVERS\srv2.sys
0xA0610000 \SystemRoot\System32\DRIVERS\srv.sys
0xA0661000 \??\C:\Windows\system32\directport.sys
0xA0669000 \??\C:\Windows\system32\kbfiltr.sys
0xA06E1000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0xA06EA000 \??\C:\Windows\system32\Drivers\PROCEXP113.SYS
0xA071D000 \??\C:\Users\PATRIC~1\AppData\Local\Temp\afriqfoc.sys
0xA0735000 \SystemRoot\system32\DRIVERS\monitor.sys
0x773C0000 \Windows\System32\ntdll.dll
0x484C0000 \Windows\System32\smss.exe
0x77600000 \Windows\System32\apisetschema.dll
0x10000000 \Program Files\DAEMON Tools Lite\Engine.dll

Processes (total 77):
0 System Idle Process
4 System
244 C:\Windows\System32\smss.exe
380 csrss.exe
440 C:\Windows\System32\wininit.exe
452 csrss.exe
492 C:\Windows\System32\services.exe
508 C:\Windows\System32\lsass.exe
516 C:\Windows\System32\lsm.exe
644 C:\Windows\System32\svchost.exe
720 C:\Windows\System32\nvvsvc.exe
760 C:\Windows\System32\svchost.exe
824 C:\Windows\System32\svchost.exe
856 C:\Windows\System32\svchost.exe
880 C:\Windows\System32\svchost.exe
1004 C:\Windows\System32\svchost.exe
1108 C:\Windows\System32\svchost.exe
1192 C:\Windows\System32\winlogon.exe
1292 C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
1312 C:\Program Files\Alwil Software\Avast4\ashServ.exe
1444 C:\Windows\System32\nvvsvc.exe
1520 C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
1720 C:\Windows\System32\taskeng.exe
1728 C:\Windows\System32\spoolsv.exe
1768 C:\Windows\System32\svchost.exe
1812 C:\Windows\System32\rundll32.exe
1872 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1896 C:\Program Files\Bonjour\mDNSResponder.exe
1924 C:\Program Files\Brother\BRAdmin Professional 3\bratimer.exe
1956 C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
2004 C:\Program Files\Telekom\Mediencenter\WebDAV.AdminService.exe
328 C:\Program Files\Common Files\microsoft shared\VS7DEBUG\mdm.exe
388 C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
876 C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
1140 C:\Program Files\OEM\OSD_1.16\OsdService.exe
1952 C:\Windows\System32\svchost.exe
1380 C:\Program Files\VideoLAN\VLC_072\vlc.exe
2072 C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
2324 unsecapp.exe
2404 WmiPrvSE.exe
2896 C:\Windows\System32\svchost.exe
2940 C:\Windows\System32\taskhost.exe
3004 C:\Windows\System32\dwm.exe
3212 C:\Windows\System32\svchost.exe
4012 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
3136 C:\Windows\WindowsMobile\wmdc.exe
2596 C:\Program Files\Alwil Software\Avast4\ashDisp.exe
3084 C:\Windows\System32\svchost.exe
3556 C:\Program Files\Common Files\Java\Java Update\jusched.exe
2772 C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
3144 C:\Windows\System32\SearchIndexer.exe
3540 C:\Program Files\DivX\DivX Update\DivXUpdate.exe
3484 C:\Program Files\DivX\DivX Plus Web Player\DDMService.exe
3764 C:\Program Files\iTunes\iTunesHelper.exe
3780 C:\Program Files\Garmin\gStart.exe
3808 C:\Program Files\DAEMON Tools Lite\DTLite.exe
3800 C:\Program Files\Appigo Sync\Appigo Sync.exe
3364 C:\Program Files\Logitech\SetPoint\SetPoint.exe
3316 C:\Program Files\Hardcopy\hardcopy.exe
1472 C:\Program Files\Telekom\Mediencenter\MediencenterSoftware.exe
672 C:\Program Files\Windows Media Player\wmpnetwk.exe
3868 C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
3332 C:\Program Files\iPod\bin\iPodService.exe
584 C:\Windows\explorer.exe
2336 C:\Windows\System32\mobsync.exe
1248 C:\Windows\System32\audiodg.exe
5200 C:\PROGRA~1\MICROS~1\Office12\OUTLOOK.EXE
3292 C:\Program Files\Mozilla Firefox\firefox.exe
5220 C:\Program Files\Mozilla Firefox\plugin-container.exe
3512 C:\Program Files\UltraEdit\uedit32.exe
5636 C:\Users\Peter Klein\Downloads\osam_autorun_manager_5_0_portable\osam.exe
616 C:\Windows\System32\SearchProtocolHost.exe
4144 C:\Windows\System32\SearchFilterHost.exe
6024 C:\Windows\explorer.exe
5028 C:\Users\Peter Klein\Desktop\MBRCheck.exe
5284 C:\Windows\System32\conhost.exe
4904 C:\Windows\System32\dllhost.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000002`32900000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000019`bcc00000 (NTFS)

PhysicalDrive0 Model Number: HitachiHTS543232L9A300, Rev: FB4OC40C

Size Device Name MBR Status
--------------------------------------------
298 GB \\.\PhysicalDrive0 Windows 7 MBR code detected
SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79

Done!

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Malwarebytes' Anti-Malware 1.50.1.1100
Malwarebytes

Datenbank Version: 5718

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

09.02.2011 15:01:19
mbam-log-2011-02-09 (15-01-19).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|T:\|)
Durchsuchte Objekte: 341491
Laufzeit: 1 Stunde(n), 55 Minute(n), 56 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 02/09/2011 at 05:38 PM

Application Version : 4.48.1000

Core Rules Database Version : 6365
Trace Rules Database Version: 4177

Scan type : Complete Scan
Total Scan Time : 02:19:13

Memory items scanned : 863
Memory threats detected : 0
Registry items scanned : 10602
Registry threats detected : 0
File items scanned : 183193
File threats detected : 3

Adware.Tracking Cookie
C:\Users\peter klein\AppData\Roaming\Microsoft\Windows\Cookies\peter_klein@stat.aldi[2].txt
C:\Users\peter klein\AppData\Roaming\Microsoft\Windows\Cookies\peter_klein@stat.aldi[1].txt
C:\Users\peter klein\AppData\Roaming\Microsoft\Windows\Cookies\peter_klein@xiti[1].txt

Hier die 2 Logs

muss ich mir nun weitere Sorgen machen?

Sieht ok aus, da wurden nur Cookies gefunden.
Noch Probleme oder weitere Funde in der Zwischenzeit?

ich hab bisher keine Probleme gehabt. Es scheint alles wieder "sauber" zu laufen!

BESTEN DANK !

Dann wären wir durch! :abklatsch:

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update

PDF-Reader aktualisieren
Dein Adobe Reader ist nicht aktuell, was ein großes Sicherheitsrisiko darstellt. Du solltest daher besser die alte Version über Systemsteuerung => Software deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst.

Ich empfehle einen alternativen PDF-Reader wie SumatraPDF oder Foxit PDF Reader, beide sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers, hier der direkte Downloadlink => http://filepony.de/?q=Flash+Player

Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.