Trojaner-Board - svchost,exe fasf 100%

Trojaner-Board (https://www.trojaner-board.de/)

- Mülltonne (https://www.trojaner-board.de/muelltonne/)

- - svchost,exe fasf 100% (https://www.trojaner-board.de/47010-svchost-exe-fasf-100-a.html)

svchost,exe fasf 100%

Code:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 22:04:04, on 15.12.2007

Platform: Windows Vista SP1, v.652 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.17036)

Boot mode: Normal
 

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\System32\oodtray.exe

C:\Program Files\OO Software\CleverCache\ooccctrl.exe

C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\TrueCrypt\TrueCrypt.exe

C:\Program Files\SharpSoft\Vista Battery Saver\VistaBatterySaver.exe

C:\Windows\ehome\ehtray.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\RamCleaner\RamCleaner.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Users\Yasar\Desktop\Toolz\HiJackThis202.exe

C:\Windows\System32\notepad.exe
 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 

O1 - Hosts file is located at: C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: ::1 localhost

O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O4 - HKLM\..\Run: [OODefragTray] C:\Windows\system32\oodtray.exe

O4 - HKLM\..\Run: [ooccctrl.exe] C:\Program Files\OO Software\CleverCache\ooccctrl.exe /tasktray

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\Hp\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKCU\..\Run: [TrueCrypt] "C:\Program Files\TrueCrypt\TrueCrypt.exe" /q preferences

O4 - HKCU\..\Run: [RamCleaner] C:\Program Files\RamCleaner\ramcore.exe -s

O4 - HKCU\..\Run: [VistaBatterySaver] C:\Program Files\SharpSoft\Vista Battery Saver\VistaBatterySaver.exe

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll

O13 - Gopher Prefix: 

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: O&O Defrag - O&O Software GmbH - C:\Windows\system32\oodag.exe

O23 - Service: O&O CleverCache Agent (OOCleverCacheAgent) - O&O Software GmbH - C:\Program Files\OO Software\CleverCache\ooccag.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe

O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe

O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
 

--

End of file - 5653 bytes

hier die startlog in 2 teile...

Code:

StartupList report, 15.12.2007, 21:58:36

StartupList version: 1.52.2

Started from : C:\Users\Yasar\Desktop\Toolz\HiJackThis202.EXE

Detected: Windows Vista SP1, v.652 (WinNT 6.00.1905)

Detected: Internet Explorer v7.00 (7.00.6001.17036)

* Using default options

* Including empty and uninteresting sections

* Showing rarely important sections

==================================================
 

Running processes:
 

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\System32\oodtray.exe

C:\Program Files\OO Software\CleverCache\ooccctrl.exe

C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\TrueCrypt\TrueCrypt.exe

C:\Program Files\SharpSoft\Vista Battery Saver\VistaBatterySaver.exe

C:\Windows\ehome\ehtray.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\RamCleaner\RamCleaner.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Users\Yasar\Desktop\Toolz\HiJackThis202.exe
 

--------------------------------------------------
 

Listing of startup folders:
 

Shell folders Startup:

[C:\Users\Yasar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup]

*No files*
 

Shell folders AltStartup:

*Folder not found*
 

User shell folders Startup:

*Folder not found*
 

User shell folders AltStartup:

*Folder not found*
 

Shell folders Common Startup:

[C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup]

*No files*
 

Shell folders Common AltStartup:

*Folder not found*
 

User shell folders Common Startup:

*Folder not found*
 

User shell folders Alternate Common Startup:

*Folder not found*
 

--------------------------------------------------
 

Checking Windows NT UserInit:
 

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

UserInit = C:\Windows\system32\userinit.exe,
 

[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]

*Registry key not found*
 

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

*Registry value not found*
 

[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]

*Registry key not found*
 

--------------------------------------------------
 

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
 

OODefragTray = C:\Windows\system32\oodtray.exe

ooccctrl.exe = C:\Program Files\OO Software\CleverCache\ooccctrl.exe /tasktray

SunJavaUpdateSched = "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

SynTPEnh = C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

HP Software Update = c:\Program Files\Hp\HP Software Update\HPWuSchd2.exe

NvSvc = RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart

NvCplDaemon = RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

NvMediaCenter = RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

avgnt = "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
 

--------------------------------------------------
 

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
 

*No values found*
 

--------------------------------------------------
 

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
 

*No values found*
 

--------------------------------------------------
 

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
 

*No values found*
 

--------------------------------------------------
 

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
 

*No values found*
 

--------------------------------------------------
 

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
 

TrueCrypt = "C:\Program Files\TrueCrypt\TrueCrypt.exe" /q preferences

RamCleaner = C:\Program Files\RamCleaner\ramcore.exe -s

VistaBatterySaver = C:\Program Files\SharpSoft\Vista Battery Saver\VistaBatterySaver.exe

ehTray.exe = C:\Windows\ehome\ehTray.exe
 

--------------------------------------------------
 

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
 

*No values found*
 

--------------------------------------------------
 

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
 

*Registry key not found*
 

--------------------------------------------------
 

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
 

*Registry key not found*
 

--------------------------------------------------
 

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
 

*Registry key not found*
 

--------------------------------------------------
 

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
 

*Registry key not found*
 

--------------------------------------------------
 

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
 

*Registry key not found*
 

--------------------------------------------------
 

Autorun entries in Registry subkeys of:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
 

[OptionalComponents]

 = 
 

[avp6_post_uninstall]

*No values found*
 

--------------------------------------------------
 

Autorun entries in Registry subkeys of:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No subkeys found*
 

--------------------------------------------------
 

Autorun entries in Registry subkeys of:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No subkeys found*
 

--------------------------------------------------
 

Autorun entries in Registry subkeys of:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

*No subkeys found*
 

--------------------------------------------------
 

Autorun entries in Registry subkeys of:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*No subkeys found*
 

--------------------------------------------------
 

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

*No subkeys found*
 

--------------------------------------------------
 

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No subkeys found*
 

--------------------------------------------------
 

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*Registry key not found*
 

--------------------------------------------------
 

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*
 

--------------------------------------------------
 

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*
 

--------------------------------------------------
 

Autorun entries in Registry subkeys of:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*
 

--------------------------------------------------
 

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*
 

--------------------------------------------------
 

File association entry for .EXE:

HKEY_CLASSES_ROOT\exefile\shell\open\command
 

(Default) = "%1" %*
 

--------------------------------------------------
 

File association entry for .COM:

HKEY_CLASSES_ROOT\comfile\shell\open\command
 

(Default) = "%1" %*
 

--------------------------------------------------
 

File association entry for .BAT:

HKEY_CLASSES_ROOT\batfile\shell\open\command
 

(Default) = "%1" %*
 

--------------------------------------------------
 

File association entry for .PIF:

HKEY_CLASSES_ROOT\piffile\shell\open\command
 

(Default) = "%1" %*
 

--------------------------------------------------
 

File association entry for .SCR:

HKEY_CLASSES_ROOT\scrfile\shell\open\command
 

(Default) = "%1" /S
 

--------------------------------------------------
 

File association entry for .HTA:

HKEY_CLASSES_ROOT\htafile\shell\open\command
 

(Default) = C:\Windows\system32\mshta.exe "%1" %*
 

--------------------------------------------------
 

File association entry for .TXT:

HKEY_CLASSES_ROOT\txtfile\shell\open\command
 

(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1
 

--------------------------------------------------
 

Enumerating Active Setup stub paths:

HKLM\Software\Microsoft\Active Setup\Installed Components

(* = disabled by HKCU twin)
 

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]

StubPath = C:\Windows\system32\unregmp2.exe /ShowWMP
 

[>{26923b43-4d38-484f-9b9e-de460746276c}] *

StubPath = C:\Windows\system32\ie4uinit.exe -UserIconConfig
 

[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] *

StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 

[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *

StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
 

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *

StubPath = "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
 

[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *

StubPath = %SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI
 

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *

StubPath = regsvr32.exe /s /n /i:U shell32.dll
 

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *

StubPath = C:\Windows\system32\ie4uinit.exe -BaseSettings
 

[{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *

StubPath = C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
 

--------------------------------------------------
 

Enumerating ICQ Agent Autostart apps:

HKCU\Software\Mirabilis\ICQ\Agent\Apps
 

*Registry key not found*
 

--------------------------------------------------
 

Load/Run keys from C:\Windows\WIN.INI:
 

load=*INI section not found*

run=*INI section not found*

Code:

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No subkeys found*
 

--------------------------------------------------
 

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*Registry key not found*
 

--------------------------------------------------
 

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*
 

--------------------------------------------------
 

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*
 

--------------------------------------------------
 

Autorun entries in Registry subkeys of:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*
 

--------------------------------------------------
 

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*
 

--------------------------------------------------
 

File association entry for .EXE:

HKEY_CLASSES_ROOT\exefile\shell\open\command
 

(Default) = "%1" %*
 

--------------------------------------------------
 

File association entry for .COM:

HKEY_CLASSES_ROOT\comfile\shell\open\command
 

(Default) = "%1" %*
 

--------------------------------------------------
 

File association entry for .BAT:

HKEY_CLASSES_ROOT\batfile\shell\open\command
 

(Default) = "%1" %*
 

--------------------------------------------------
 

File association entry for .PIF:

HKEY_CLASSES_ROOT\piffile\shell\open\command
 

(Default) = "%1" %*
 

--------------------------------------------------
 

File association entry for .SCR:

HKEY_CLASSES_ROOT\scrfile\shell\open\command
 

(Default) = "%1" /S
 

--------------------------------------------------
 

File association entry for .HTA:

HKEY_CLASSES_ROOT\htafile\shell\open\command
 

(Default) = C:\Windows\system32\mshta.exe "%1" %*
 

--------------------------------------------------
 

File association entry for .TXT:

HKEY_CLASSES_ROOT\txtfile\shell\open\command
 

(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1
 

--------------------------------------------------
 

Enumerating Active Setup stub paths:

HKLM\Software\Microsoft\Active Setup\Installed Components

(* = disabled by HKCU twin)
 

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]

StubPath = C:\Windows\system32\unregmp2.exe /ShowWMP
 

[>{26923b43-4d38-484f-9b9e-de460746276c}] *

StubPath = C:\Windows\system32\ie4uinit.exe -UserIconConfig
 

[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] *

StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 

[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *

StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
 

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *

StubPath = "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
 

[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *

StubPath = %SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI
 

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *

StubPath = regsvr32.exe /s /n /i:U shell32.dll
 

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *

StubPath = C:\Windows\system32\ie4uinit.exe -BaseSettings
 

[{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *

StubPath = C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
 

--------------------------------------------------
 

Enumerating ICQ Agent Autostart apps:

HKCU\Software\Mirabilis\ICQ\Agent\Apps
 

*Registry key not found*
 

--------------------------------------------------
 

Load/Run keys from C:\Windows\WIN.INI:
 

load=*INI section not found*

run=*INI section not found*
 

Load/Run keys from Registry:
 

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*

HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*

HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*

HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*

HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*

HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*

HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*

HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*

HKCU\..\Windows NT\CurrentVersion\Windows: load=

HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*

HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*

HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*

HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=
 

--------------------------------------------------
 

Shell & screensaver key from C:\Windows\SYSTEM.INI:
 

Shell=*INI section not found*

SCRNSAVE.EXE=*INI section not found*

drivers=*INI section not found*
 

Shell & screensaver key from Registry:
 

Shell=explorer.exe

SCRNSAVE.EXE=C:\Windows\system32\logon.scr

drivers=*Registry value not found*
 

Policies Shell key:
 

HKCU\..\Policies: Shell=*Registry key not found*

HKLM\..\Policies: Shell=*Registry value not found*
 

--------------------------------------------------
 

Checking for EXPLORER.EXE instances:
 

C:\Windows\Explorer.exe: PRESENT!
 

C:\Explorer.exe: not present

C:\Windows\Explorer\Explorer.exe: not present

C:\Windows\System\Explorer.exe: not present

C:\Windows\System32\Explorer.exe: not present

C:\Windows\Command\Explorer.exe: not present

C:\Windows\Fonts\Explorer.exe: not present
 

--------------------------------------------------
 

Checking for superhidden extensions:
 

.lnk: HIDDEN! (arrow overlay: yes)

.pif: HIDDEN! (arrow overlay: yes)

.exe: not hidden

.com: not hidden

.bat: not hidden

.hta: not hidden

.scr: not hidden

.shs: *Registry key not found*

.shb: *Registry key not found*

.vbs: not hidden

.vbe: not hidden

.wsh: not hidden

.scf: HIDDEN! (arrow overlay: NO!)

.url: HIDDEN! (arrow overlay: yes)

.js: not hidden

.jse: not hidden
 

--------------------------------------------------
 

Verifying REGEDIT.EXE integrity:
 

- Regedit.exe found in C:\Windows

- .reg open command is normal (regedit.exe %1)

- Company name OK: 'Microsoft Corporation'

- Original filename NOT OK: 'REGEDIT.EXE.MUI'

- File description: 'Registrierungs-Editor'
 

Registry check failed!
 

--------------------------------------------------
 

Enumerating Browser Helper Objects:
 

(no name) - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

(no name) - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}

(no name) - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
 

--------------------------------------------------
 

Enumerating Task Scheduler jobs:
 

1-Klick-Wartung.job
 

--------------------------------------------------
 

Enumerating Download Program Files:
 

[BDSCANONLINE Control]

InProcServer32 = C:\Windows\BDOSCAN8\oscan82.ocx

CODEBASE = http://download.bitdefender.com/resources/scan8/oscan8.cab
 

[{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}]

CODEBASE = http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
 

--------------------------------------------------
 

Enumerating Winsock LSP files:
 

NameSpace #1: C:\Windows\system32\NLAapi.dll

NameSpace #2: C:\Windows\system32\napinsp.dll

NameSpace #3: C:\Windows\system32\pnrpnsp.dll

NameSpace #4: C:\Windows\system32\pnrpnsp.dll

NameSpace #5: C:\Windows\System32\mswsock.dll

NameSpace #6: C:\Windows\System32\winrnr.dll

Protocol #1: C:\Windows\system32\mswsock.dll

Protocol #2: C:\Windows\system32\mswsock.dll

Protocol #3: C:\Windows\system32\mswsock.dll

Protocol #4: C:\Windows\system32\mswsock.dll

Protocol #5: C:\Windows\system32\mswsock.dll

Protocol #6: C:\Windows\system32\mswsock.dll

Protocol #7: C:\Windows\system32\mswsock.dll

Protocol #8: C:\Windows\system32\mswsock.dll

Protocol #9: C:\Windows\system32\mswsock.dll

Protocol #10: C:\Windows\system32\mswsock.dll

Protocol #11: C:\Windows\system32\mswsock.dll

Protocol #12: C:\Windows\system32\mswsock.dll

Protocol #13: C:\Windows\system32\mswsock.dll

Protocol #14: C:\Windows\system32\mswsock.dll

Protocol #15: C:\Windows\system32\mswsock.dll

Protocol #16: C:\Windows\system32\mswsock.dll

Protocol #17: C:\Windows\system32\mswsock.dll

Protocol #18: C:\Windows\system32\mswsock.dll

Protocol #19: C:\Windows\system32\mswsock.dll

Protocol #20: C:\Windows\system32\mswsock.dll

Protocol #21: C:\Windows\system32\mswsock.dll

Protocol #22: C:\Windows\system32\mswsock.dll

Protocol #23: C:\Windows\system32\mswsock.dll

Protocol #24: C:\Windows\system32\mswsock.dll
 

--------------------------------------------------

Code:

Enumerating Windows NT/2000/XP services
 

Ad-Aware 2007 Service: "C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe" (manual start)

Microsoft ACPI-Treiber: system32\drivers\acpi.sys (system)

AddFiltr: "C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe" (disabled)

adp94xx: \SystemRoot\system32\drivers\adp94xx.sys (disabled)

adpahci: \SystemRoot\system32\drivers\adpahci.sys (disabled)

adpu160m: \SystemRoot\system32\drivers\adpu160m.sys (disabled)

adpu320: \SystemRoot\system32\drivers\adpu320.sys (disabled)

@%SystemRoot%\system32\aelupsvc.dll,-1: %systemroot%\system32\svchost.exe -k netsvcs (autostart)

Ancilliary Function Driver for Winsock: \SystemRoot\system32\drivers\afd.sys (system)

Intel AGP Bus Filter: \SystemRoot\system32\drivers\agp440.sys (manual start)

aic78xx: \SystemRoot\system32\drivers\djsvs.sys (disabled)

@%SystemRoot%\system32\Alg.exe,-112: %SystemRoot%\System32\alg.exe (manual start)

aliide: \SystemRoot\system32\drivers\aliide.sys (disabled)

AMD AGP Bus Filter Driver: \SystemRoot\system32\drivers\amdagp.sys (manual start)

amdide: \SystemRoot\system32\drivers\amdide.sys (disabled)

AMD K7 Processor Driver: \SystemRoot\system32\drivers\amdk7.sys (disabled)

AMD K8-Prozessortreiber: system32\DRIVERS\amdk8.sys (manual start)

AntiVir PersonalEdition Classic Planer: "C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe" (autostart)

AntiVir PersonalEdition Classic Guard: "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe" (autostart)

@%systemroot%\system32\appinfo.dll,-100: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)

arc: \SystemRoot\system32\drivers\arc.sys (disabled)

arcsas: \SystemRoot\system32\drivers\arcsas.sys (disabled)

Asynchroner RAS -Medientreiber: system32\DRIVERS\asyncmac.sys (manual start)

IDE-Kanal: system32\drivers\atapi.sys (system)

@%SystemRoot%\system32\audiosrv.dll,-204: %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted (autostart)

@%SystemRoot%\system32\audiosrv.dll,-200: %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted (autostart)

avgio: \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys (system)

avgntflt: \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys (manual start)

avipbb: system32\DRIVERS\avipbb.sys (system)

Broadcom Extensible 802.11-Netzwerkadaptertreiber: system32\DRIVERS\bcmwl6.sys (manual start)

Treiber für Broadcom 802.11-Netzwerkadapter: system32\DRIVERS\bcmwl6.sys (manual start)

@%SystemRoot%\system32\bfe.dll,-1001: %systemroot%\system32\svchost.exe -k LocalServiceNoNetwork (autostart)

@%SystemRoot%\system32\qmgr.dll,-1000: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Bowser: system32\DRIVERS\bowser.sys (manual start)

Brother USB Mass-Storage Lower Filter Driver: \SystemRoot\system32\drivers\brfiltlo.sys (manual start)

Brother USB Mass-Storage Upper Filter Driver: \SystemRoot\system32\drivers\brfiltup.sys (manual start)

@%systemroot%\system32\browser.dll,-100: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Brother MFC Serial Port Interface Driver (WDM): \SystemRoot\system32\drivers\brserid.sys (disabled)

Brother WDM Serial driver: \SystemRoot\system32\drivers\brserwdm.sys (disabled)

Brother MFC USB Fax Only Modem: \SystemRoot\system32\drivers\brusbmdm.sys (disabled)

Brother MFC USB Serial WDM Driver: \SystemRoot\system32\drivers\brusbser.sys (manual start)

Bluetooth Serial Communications Driver: \SystemRoot\system32\drivers\bthmodem.sys (disabled)

CD/DVD File System Reader: system32\DRIVERS\cdfs.sys (disabled)

CD-ROM-Laufwerktreiber: system32\DRIVERS\cdrom.sys (system)

@%SystemRoot%\System32\certprop.dll,-11: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)

Consumer IR Devices: \SystemRoot\system32\drivers\circlass.sys (disabled)

Common Log (CLFS): System32\CLFS.sys (system)

Microsoft .NET Framework NGEN v2.0.50727_X86: %systemroot%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (manual start)

Treiber für Microsoft-ACPI-Kontrollmethodenkompatible Batterie: system32\DRIVERS\CmBatt.sys (manual start)

cmdide: \SystemRoot\system32\drivers\cmdide.sys (disabled)

Microsoft Composite Battery-Treiber: system32\DRIVERS\compbatt.sys (system)

@comres.dll,-947: %SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (manual start)

Crcdisk Filter Driver: system32\drivers\crcdisk.sys (system)

Transmeta Crusoe Processor Driver: \SystemRoot\system32\drivers\crusoe.sys (disabled)

@%SystemRoot%\system32\cryptsvc.dll,-1001: %SystemRoot%\system32\svchost.exe -k NetworkService (autostart)

@oleres.dll,-5012: %SystemRoot%\system32\svchost.exe -k DcomLaunch (autostart)

@%systemroot%\system32\drivers\dfsc.sys,-101: System32\Drivers\dfsc.sys (system)

@dfsrres.dll,-101: %SystemRoot%\system32\DFSR.exe (manual start)

@%SystemRoot%\system32\dhcpcsvc.dll,-100: %SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted (autostart)

Laufwerktreiber: system32\drivers\disk.sys (system)

@%SystemRoot%\System32\dnsapi.dll,-101: %SystemRoot%\system32\svchost.exe -k NetworkService (autostart)

@%systemroot%\system32\dot3svc.dll,-1102: %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted (manual start)

@%systemroot%\system32\dps.dll,-500: %SystemRoot%\System32\svchost.exe -k LocalServiceNoNetwork (autostart)

Microsoft Kernel-DRM-Audioentschlüsselung: system32\drivers\drmkaud.sys (manual start)

LDDM Graphics Subsystem: \SystemRoot\System32\drivers\dxgkrnl.sys (manual start)

Intel(R) PRO/1000 NDIS 6 Adapter Driver: system32\DRIVERS\E1G60I32.sys (manual start)

eabfiltr: system32\DRIVERS\eabfiltr.sys (system)

@%systemroot%\system32\eapsvc.dll,-1: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

ReadyBoost Caching Driver: System32\drivers\ecache.sys (system)

@%SystemRoot%\ehome\ehrecvr.exe,-101: %systemroot%\ehome\ehRecvr.exe (manual start)

@%SystemRoot%\ehome\ehsched.exe,-101: %systemroot%\ehome\ehsched.exe (manual start)

@%SystemRoot%\ehome\ehstart.dll,-101: %windir%\system32\svchost.exe -k LocalServiceNoNetwork (autostart)

elxstor: \SystemRoot\system32\drivers\elxstor.sys (disabled)

@%SystemRoot%\system32\emdmgmt.dll,-1000: %systemroot%\system32\svchost.exe -k LocalSystemNetworkRestricted (autostart)

@%SystemRoot%\system32\wevtsvc.dll,-200: %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted (autostart)

@comres.dll,-2450: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)

Floppy Disk Controller Driver: system32\DRIVERS\fdc.sys (disabled)

@%systemroot%\system32\fdPHost.dll,-100: %SystemRoot%\system32\svchost.exe -k LocalService (manual start)

@%systemroot%\system32\fdrespub.dll,-100: %SystemRoot%\system32\svchost.exe -k LocalService (manual start)

File Information FS MiniFilter: system32\drivers\fileinfo.sys (system)

FileTrace: system32\drivers\filetrace.sys (manual start)

Floppy Disk Driver: system32\DRIVERS\flpydisk.sys (disabled)

FltMgr: system32\drivers\fltmgr.sys (system)

@%SystemRoot%\system32\PresentationHost.exe,-3309: %systemroot%\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe (manual start)

USB Serial Converter Driver: system32\drivers\ftdibus.sys (manual start)

USB Serial Port Driver: system32\drivers\ftser2k.sys (manual start)

Microsoft Generic AGPv3.0 Filter for K8 Processor Platforms: \SystemRoot\system32\drivers\gagp30kx.sys (manual start)

gmer: System32\DRIVERS\gmer.sys (manual start)

@gpapi.dll,-112: %systemroot%\system32\svchost.exe -k netsvcs (autostart)

HBtnKey: system32\DRIVERS\cpqbttn.sys (manual start)

Microsoft UAA Function Driver for High Definition Audio Service: system32\drivers\CHDART.sys (manual start)

Microsoft-UAA-Bustreiber für High Definition Audio: system32\DRIVERS\HDAudBus.sys (manual start)

Microsoft Bluetooth HID Miniport: \SystemRoot\system32\drivers\hidbth.sys (disabled)

Microsoft Infrared HID Driver: \SystemRoot\system32\drivers\hidir.sys (disabled)

@%SystemRoot%\System32\hidserv.dll,-101: %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted (manual start)

Microsoft HID Class Driver: \SystemRoot\system32\drivers\hidusb.sys (disabled)

@%SystemRoot%\system32\kmsvc.dll,-6: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

HpCISSs: \SystemRoot\system32\drivers\hpcisss.sys (disabled)

hpqwmiex: C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe (disabled)

HSFHWAZL: system32\DRIVERS\VSTAZL3.SYS (manual start)

HSF_DPV: system32\DRIVERS\HSX_DPV.sys (manual start)

HSXHWAZL: system32\DRIVERS\HSXHWAZL.sys (manual start)

HTTP: system32\drivers\HTTP.sys (manual start)

i2omp: \SystemRoot\system32\drivers\i2omp.sys (disabled)

i8042-Tastatur- und PS/2-Mausanschluss-Treiber: system32\DRIVERS\i8042prt.sys (system)

Intel RAID Controller Vista: \SystemRoot\system32\drivers\iastorv.sys (disabled)

@%systemroot%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelInstallRC.dll,-8193: "%systemroot%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe" (manual start)

iirsp: \SystemRoot\system32\drivers\iirsp.sys (disabled)

@%SystemRoot%\system32\ikeext.dll,-501: %systemroot%\system32\svchost.exe -k netsvcs (autostart)

File Security Driver: \SystemRoot\system32\drivers\ikfilesec.sys (manual start)

System Filter Driver: system32\drivers\iksysflt.sys (manual start)

System Security Driver: system32\drivers\iksyssec.sys (manual start)

intelide: \SystemRoot\system32\drivers\intelide.sys (disabled)

Intel Processor Driver: system32\DRIVERS\intelppm.sys (disabled)

IO.DLL Driver: \??\C:\Windows\system32\drivers\io.sys (autostart)

@%systemroot%\system32\IPBusEnum.dll,-102: %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted (manual start)

@%systemroot%\system32\rascfg.dll,-32013: system32\DRIVERS\ipfltdrv.sys (manual start)

@%SystemRoot%\system32\iphlpsvc.dll,-200: %SystemRoot%\System32\svchost.exe -k NetSvcs (autostart)

IPMIDRV: \SystemRoot\system32\drivers\ipmidrv.sys (disabled)

IP Network Address Translator: system32\DRIVERS\ipnat.sys (manual start)

IR Bus Enumerator: system32\drivers\irenum.sys (manual start)

PnP ISA/EISA Bus Driver: \SystemRoot\system32\drivers\isapnp.sys (disabled)

iScsiPort-Treiber: system32\DRIVERS\msiscsi.sys (manual start)

ITEATAPI_Service_Install: \SystemRoot\system32\drivers\iteatapi.sys (disabled)

ITERAID_Service_Install: \SystemRoot\system32\drivers\iteraid.sys (disabled)

Tastaturklassentreiber: system32\DRIVERS\kbdclass.sys (system)

Tastatur-HID-Treiber: system32\DRIVERS\kbdhid.sys (system)

@keyiso.dll,-100: %SystemRoot%\system32\lsass.exe (manual start)

kl1: system32\DRIVERS\kl1.sys (disabled)

KLIF: system32\DRIVERS\klif.sys (disabled)

KSecDD: System32\Drivers\ksecdd.sys (system)

@comres.dll,-2946: %SystemRoot%\System32\svchost.exe -k NetworkService (autostart)

Server: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)

@%systemroot%\system32\wkssvc.dll,-100: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)

E/A-Treiber für Verbindungsschicht-Topologieerkennungszuordnung: system32\DRIVERS\lltdio.sys (autostart)

@%SystemRoot%\system32\lltdres.dll,-1: %SystemRoot%\System32\svchost.exe -k LocalService (manual start)

@%SystemRoot%\system32\lmhsvc.dll,-101: %SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted (autostart)

LSI_FC: \SystemRoot\system32\drivers\lsi_fc.sys (disabled)

LSI_SAS: \SystemRoot\system32\drivers\lsi_sas.sys (disabled)

LSI_SCSI: \SystemRoot\system32\drivers\lsi_scsi.sys (disabled)

UAC File Virtualization: \SystemRoot\system32\drivers\luafv.sys (autostart)

@%SystemRoot%\ehome\ehres.dll,-15501: %SystemRoot%\system32\svchost.exe -k LocalService (disabled)

mdmxsdk: system32\DRIVERS\mdmxsdk.sys (autostart)

megasas: \SystemRoot\system32\drivers\megasas.sys (disabled)

@%systemroot%\system32\mmcss.dll,-100: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)

Modem: system32\drivers\modem.sys (manual start)

Microsoft Monitor-Klassenfunktionstreiber-Dienst: system32\DRIVERS\monitor.sys (manual start)

Mausklassentreiber: system32\DRIVERS\mouclass.sys (system)

Mouse HID Driver: \SystemRoot\system32\drivers\mouhid.sys (disabled)

Mount Point Manager: System32\drivers\mountmgr.sys (system)

Microsoft Multi-Path Bus Driver: \SystemRoot\system32\drivers\mpio.sys (disabled)

@%SystemRoot%\system32\FirewallAPI.dll,-23092: System32\drivers\mpsdrv.sys (manual start)

@%SystemRoot%\system32\FirewallAPI.dll,-23090: %SystemRoot%\system32\svchost.exe -k LocalServiceNoNetwork (autostart)

Mraid35x: \SystemRoot\system32\drivers\mraid35x.sys (disabled)

WebDav Client Redirector Driver: \SystemRoot\system32\drivers\mrxdav.sys (manual start)

SMB MiniRedirector Wrapper and Engine: system32\DRIVERS\mrxsmb.sys (manual start)

SMB 1.x MiniRedirector: system32\DRIVERS\mrxsmb10.sys (manual start)

SMB 2.0 MiniRedirector: system32\DRIVERS\mrxsmb20.sys (manual start)

msahci: \SystemRoot\system32\drivers\msahci.sys (disabled)

Microsoft Multi-Path Device Specific Module: \SystemRoot\system32\drivers\msdsm.sys (disabled)

@comres.dll,-2797: %SystemRoot%\System32\msdtc.exe (manual start)

ISA/EISA-Klassentreiber: system32\drivers\msisadrv.sys (system)

@%SystemRoot%\system32\iscsidsc.dll,-5000: %systemroot%\system32\svchost.exe -k netsvcs (manual start)

@%SystemRoot%\system32\msimsg.dll,-27: %systemroot%\system32\msiexec /V (manual start)

Microsoft Streaming Service Proxy: system32\drivers\MSKSSRV.sys (manual start)

Microsoft Proxy für Streaming Clock: system32\drivers\MSPCLOCK.sys (manual start)

Microsoft Proxy für Streaming Quality Manager: system32\drivers\MSPQM.sys (manual start)

Microsoft-Systemverwaltungs-BIOS-Treiber: system32\DRIVERS\mssmbios.sys (manual start)

Microsoft Streaming Tee/Sink-to-Sink-Konvertierung: system32\drivers\MSTEE.sys (manual start)

Mup: System32\Drivers\mup.sys (system)

@%SystemRoot%\system32\qagentrt.dll,-6: %SystemRoot%\System32\svchost.exe -k NetworkService (manual start)

NativeWiFi-Filter: system32\DRIVERS\nwifi.sys (manual start)

NDIS System Driver: system32\drivers\ndis.sys (system)

@%systemroot%\system32\rascfg.dll,-32001: system32\DRIVERS\ndistapi.sys (manual start)

NDIS-Benutzermodus-E/A-Protokoll: system32\DRIVERS\ndisuio.sys (manual start)

@%systemroot%\system32\rascfg.dll,-32002: system32\DRIVERS\ndiswan.sys (manual start)

NetBIOS Interface: system32\DRIVERS\netbios.sys (system)

NETBT: System32\DRIVERS\netbt.sys (autostart)

@%SystemRoot%\System32\netlogon.dll,-102: %systemroot%\system32\lsass.exe (manual start)

@%SystemRoot%\system32\netman.dll,-109: %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted (manual start)

@%SystemRoot%\system32\netprof.dll,-246: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)

@%systemroot%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelInstallRC.dll,-8201: "%systemroot%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe" (disabled)

nfrd960: \SystemRoot\system32\drivers\nfrd960.sys (disabled)

@%SystemRoot%\System32\nlasvc.dll,-1: %SystemRoot%\System32\svchost.exe -k NetworkService (autostart)

@%SystemRoot%\system32\nsisvc.dll,-200: %systemroot%\system32\svchost.exe -k LocalService (autostart)

NSI proxy service: system32\drivers\nsiproxy.sys (system)

N-trig HID Tablet Driver: \SystemRoot\system32\drivers\ntrigdigi.sys (disabled)

NVIDIA nForce Networking Controller Driver: system32\DRIVERS\nvmfdx32.sys (manual start)

nvlddmkm: system32\DRIVERS\nvlddmkm.sys (manual start)

nvraid: \SystemRoot\system32\drivers\nvraid.sys (disabled)

nvsmu: system32\DRIVERS\nvsmu.sys (manual start)

nvstor: system32\drivers\nvstor.sys (system)

nvstor32: system32\DRIVERS\nvstor32.sys (system)

NVIDIA nForce AGP Bus Filter: \SystemRoot\system32\drivers\nv_agp.sys (manual start)

O&O Defrag: C:\Windows\system32\oodag.exe (autostart)

NEC FireWarden OHCI Compliant IEEE 1394 Host Controller: \SystemRoot\system32\drivers\ohci1394.sys (disabled)

O&O CleverCache Agent: "C:\Program Files\OO Software\CleverCache\ooccag.exe" (autostart)

@%SystemRoot%\system32\p2psvc.dll,-8004: %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted (manual start)

@%SystemRoot%\system32\p2psvc.dll,-8006: %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted (manual start)

Parallel port driver: \SystemRoot\system32\drivers\parport.sys (disabled)

Partition Manager: System32\drivers\partmgr.sys (system)

Parvdm: \SystemRoot\system32\drivers\parvdm.sys (autostart)

@%SystemRoot%\system32\pcasvc.dll,-1: %systemroot%\system32\svchost.exe -k LocalSystemNetworkRestricted (autostart)

PCI-Bus-Treiber: system32\drivers\pci.sys (system)

pciide: system32\drivers\pciide.sys (system)

pcmcia: \SystemRoot\system32\drivers\pcmcia.sys (disabled)

PEAUTH: system32\drivers\peauth.sys (autostart)

@%systemroot%\system32\pla.dll,-500: %SystemRoot%\System32\svchost.exe -k LocalServiceNoNetwork (manual start)

@%SystemRoot%\system32\umpnpmgr.dll,-100: %SystemRoot%\system32\svchost.exe -k DcomLaunch (autostart)

@%SystemRoot%\system32\p2psvc.dll,-8002: %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted (manual start)

@%SystemRoot%\system32\p2psvc.dll,-8000: %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted (manual start)

@%SystemRoot%\System32\polstore.dll,-5010: %SystemRoot%\system32\svchost.exe -k NetworkServiceNetworkRestricted (autostart)

WAN-Miniport (PPTP): system32\DRIVERS\raspptp.sys (manual start)

Processor Driver: \SystemRoot\system32\drivers\processr.sys (disabled)

@%systemroot%\system32\profsvc.dll,-300: %systemroot%\system32\svchost.exe -k netsvcs (autostart)

@%systemroot%\system32\psbase.dll,-300: %SystemRoot%\system32\lsass.exe (manual start)

@%SystemRoot%\System32\drivers\pacer.sys,-101: system32\DRIVERS\pacer.sys (system)

QLogic Fibre Channel Miniport Driver: \SystemRoot\system32\drivers\ql2300.sys (disabled)

QLogic iSCSI Miniport Driver: \SystemRoot\system32\drivers\ql40xx.sys (disabled)

@%SystemRoot%\system32\qwave.dll,-1: %windir%\system32\svchost.exe -k LocalService (manual start)

@%SystemRoot%\system32\drivers\qwavedrv.sys,-1: \SystemRoot\system32\drivers\qwavedrv.sys (manual start)

Remote Access Auto Connection Driver: System32\DRIVERS\rasacd.sys (system)

@%Systemroot%\system32\rasauto.dll,-200: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)

WAN-Miniport (L2TP): system32\DRIVERS\rasl2tp.sys (manual start)

@%Systemroot%\system32\rasmans.dll,-200: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)

@%systemroot%\system32\rascfg.dll,-32007: system32\DRIVERS\raspppoe.sys (manual start)

@%systemroot%\system32\sstpsvc.dll,-202: system32\DRIVERS\rassstp.sys (manual start)

Redirected Buffering Sub Sysytem: system32\DRIVERS\rdbss.sys (system)

RDPCDD: System32\DRIVERS\RDPCDD.sys (system)

Terminal Server Device Redirector Driver: \SystemRoot\system32\drivers\rdpdr.sys (disabled)

RDP Encoder Mirror Driver: system32\drivers\rdpencdd.sys (system)

@%Systemroot%\system32\mprdim.dll,-200: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)

@regsvc.dll,-1: %SystemRoot%\system32\svchost.exe -k regsvc (manual start)

RPC-Locator: %SystemRoot%\system32\locator.exe (manual start)

@oleres.dll,-5010: %SystemRoot%\system32\svchost.exe -k rpcss (autostart)

Antwort für Verbindungsschicht-Topologieerkennung: system32\DRIVERS\rspndr.sys (autostart)

@%SystemRoot%\system32\samsrv.dll,-1: %SystemRoot%\system32\lsass.exe (autostart)

SBP-2 Transport/Protocol Bus Driver: \SystemRoot\system32\drivers\sbp2port.sys (disabled)

@%SystemRoot%\System32\SCardSvr.dll,-1: %SystemRoot%\system32\svchost.exe -k LocalService (manual start)

@%SystemRoot%\system32\schedsvc.dll,-100: %systemroot%\system32\svchost.exe -k netsvcs (autostart)

@%SystemRoot%\System32\certprop.dll,-13: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)

PC Tools Auxiliary Service: C:\Program Files\Spyware Doctor\svcntaux.exe (manual start)

PC Tools Security Service: C:\Program Files\Spyware Doctor\swdsvc.exe (manual start)

@%SystemRoot%\system32\sdrsvc.dll,-107: %SystemRoot%\system32\svchost.exe -k SDRSVC (manual start)

@%SystemRoot%\system32\seclogon.dll,-7001: %windir%\system32\svchost.exe -k netsvcs (autostart)

@%SystemRoot%\system32\Sens.dll,-200: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)

Prolific2 Serial port driver: system32\DRIVERS\ser2pl.sys (manual start)

Serenum Filter Driver: system32\DRIVERS\serenum.sys (manual start)

Serial Port Driver: \SystemRoot\system32\drivers\serial.sys (manual start)

Serial Mouse Driver: \SystemRoot\system32\drivers\sermouse.sys (disabled)

@%SystemRoot%\System32\SessEnv.dll,-1026: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

SFF Storage Class Driver: \SystemRoot\system32\drivers\sffdisk.sys (disabled)

SFF Storage Protocol Driver for MMC: \SystemRoot\system32\drivers\sffp_mmc.sys (manual start)

SFF Storage Protocol Driver for SDBus: \SystemRoot\system32\drivers\sffp_sd.sys (manual start)

High-Capacity Floppy Disk Drive: \SystemRoot\system32\drivers\sfloppy.sys (disabled)

@%SystemRoot%\system32\ipnathlp.dll,-106: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)

Shellhardwareerkennung: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

SIS AGP Bus Filter: \SystemRoot\system32\drivers\sisagp.sys (manual start)

SiSRaid2: \SystemRoot\system32\drivers\sisraid2.sys (disabled)

SiSRaid4: \SystemRoot\system32\drivers\sisraid4.sys (disabled)

@%SystemRoot%\system32\SLsvc.exe,-101: %SystemRoot%\system32\SLsvc.exe (autostart)

@%SystemRoot%\system32\SLUINotify.dll,-103: %SystemRoot%\system32\svchost.exe -k LocalService (manual start)

@%SystemRoot%\system32\tcpipcfg.dll,-50005: system32\DRIVERS\smb.sys (system)

@%SystemRoot%\system32\snmptrap.exe,-3: %SystemRoot%\System32\snmptrap.exe (manual start)

@%systemroot%\system32\spoolsv.exe,-1: %SystemRoot%\System32\spoolsv.exe (autostart)

sptd: System32\Drivers\sptd.sys (system)

srv: System32\DRIVERS\srv.sys (manual start)

srv2: System32\DRIVERS\srv2.sys (manual start)

srvnet: System32\DRIVERS\srvnet.sys (manual start)

SAMSUNG USB Composite Device driver (WDM): system32\DRIVERS\sscdbus.sys (manual start)

SAMSUNG CDMA Modem Filter: system32\DRIVERS\sscdmdfl.sys (manual start)

SAMSUNG CDMA Modem Drivers: system32\DRIVERS\sscdmdm.sys (manual start)

SSDP-Suche: %SystemRoot%\system32\svchost.exe -k LocalService (disabled)

ssmdrv: system32\DRIVERS\ssmdrv.sys (system)

@%SystemRoot%\system32\sstpsvc.dll,-200: %SystemRoot%\system32\svchost.exe -k LocalService (manual start)

@%SystemRoot%\system32\wiaservc.dll,-9: %SystemRoot%\system32\svchost.exe -k imgsvc (autostart)

Software-Bus-Treiber: system32\DRIVERS\swenum.sys (manual start)

@%SystemRoot%\System32\swprv.dll,-103: %SystemRoot%\System32\svchost.exe -k swprv (manual start)

Symc8xx: \SystemRoot\system32\drivers\symc8xx.sys (disabled)

Sym_hi: \SystemRoot\system32\drivers\sym_hi.sys (disabled)

Sym_u3: \SystemRoot\system32\drivers\sym_u3.sys (disabled)

Synaptics TouchPad Driver: system32\DRIVERS\SynTP.sys (manual start)

@%SystemRoot%\system32\sysmain.dll,-1000: %systemroot%\system32\svchost.exe -k LocalSystemNetworkRestricted (autostart)

@%SystemRoot%\system32\TabSvc.dll,-100: %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted (autostart)

@%SystemRoot%\system32\tapisrv.dll,-10100: %SystemRoot%\System32\svchost.exe -k NetworkService (manual start)

@%SystemRoot%\system32\tbssvc.dll,-100: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)

@%SystemRoot%\system32\tcpipcfg.dll,-50003: System32\drivers\tcpip.sys (system)

Microsoft IPv6-Protokolltreiber: system32\DRIVERS\tcpip.sys (manual start)

TCP/IP Registry Compatibility: System32\drivers\tcpipreg.sys (autostart)

TDPIPE: system32\drivers\tdpipe.sys (manual start)

TDTCP: system32\drivers\tdtcp.sys (manual start)

@%SystemRoot%\system32\tcpipcfg.dll,-50004: system32\DRIVERS\tdx.sys (system)

Terminal-Gerätetreiber: system32\DRIVERS\termdd.sys (system)

@%SystemRoot%\System32\termsrv.dll,-268: %SystemRoot%\System32\svchost.exe -k NetworkService (autostart)

@%SystemRoot%\System32\shsvcs.dll,-8192: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

@%systemroot%\system32\mmcss.dll,-102: %SystemRoot%\system32\svchost.exe -k LocalService (manual start)

@%SystemRoot%\system32\trkwks.dll,-1: %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted (autostart)

truecrypt: \??\C:\Program Files\TrueCrypt\truecrypt.sys (disabled)

@%SystemRoot%\servicing\TrustedInstaller.exe,-100: %SystemRoot%\servicing\TrustedInstaller.exe (manual start)

Terminal Services Security Filter Driver: System32\DRIVERS\tssecsrv.sys (manual start)

Code:

@%SystemRoot%\System32\TuneUpDefragService.exe,-1: %SystemRoot%\System32\TuneUpDefragService.exe (manual start)

Microsoft Tun-Miniportadaptertreiber: system32\DRIVERS\tunmp.sys (manual start)

Microsoft-IPv6-Tunnelminiport-Adaptertreiber: system32\DRIVERS\tunnel.sys (system)

Microsoft AGPv3.5 Filter: \SystemRoot\system32\drivers\uagp35.sys (manual start)

udfs: system32\DRIVERS\udfs.sys (disabled)

@%SystemRoot%\system32\ui0detect.exe,-101: %SystemRoot%\system32\UI0Detect.exe (manual start)

Uli AGP Bus Filter: \SystemRoot\system32\drivers\uliagpkx.sys (manual start)

uliahci: \SystemRoot\system32\drivers\uliahci.sys (disabled)

UlSata: \SystemRoot\system32\drivers\ulsata.sys (disabled)

ulsata2: \SystemRoot\system32\drivers\ulsata2.sys (disabled)

UMBus-Enumerator-Treiber: system32\DRIVERS\umbus.sys (manual start)

@%systemroot%\system32\upnphost.dll,-213: %SystemRoot%\system32\svchost.exe -k LocalService (manual start)

Microsoft USB Generic Parent Driver: \SystemRoot\system32\drivers\usbccgp.sys (disabled)

eHome Infrared Receiver (USBCIR): \SystemRoot\system32\drivers\usbcir.sys (disabled)

Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller: system32\DRIVERS\usbehci.sys (manual start)

USB2-aktivierter Hub: system32\DRIVERS\usbhub.sys (manual start)

Miniporttreiber für Microsoft USB Open Host-Controller: system32\DRIVERS\usbohci.sys (manual start)

Microsoft USB PRINTER Class: \SystemRoot\system32\drivers\usbprint.sys (disabled)

USB-Massenspeichertreiber: system32\DRIVERS\USBSTOR.SYS (manual start)

Microsoft USB Universal Host Controller Miniport Driver: system32\DRIVERS\usbuhci.sys (disabled)

@%SystemRoot%\system32\dwm.exe,-2000: %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted (autostart)

@%SystemRoot%\System32\uxtuneup.dll,-4096: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

@%SystemRoot%\system32\vds.exe,-100: %SystemRoot%\System32\vds.exe (manual start)

vga: system32\DRIVERS\vgapnp.sys (manual start)

VgaSave: \SystemRoot\System32\drivers\vga.sys (system)

VIA AGP Bus Filter: \SystemRoot\system32\drivers\viaagp.sys (manual start)

VIA C7 Processor Driver: \SystemRoot\system32\drivers\viac7.sys (disabled)

viaide: \SystemRoot\system32\drivers\viaide.sys (disabled)

Treiber für Volume-Manager: system32\drivers\volmgr.sys (system)

Dynamic Volume Manager: System32\drivers\volmgrx.sys (system)

Speichervolumes: system32\drivers\volsnap.sys (system)

vsmraid: \SystemRoot\system32\drivers\vsmraid.sys (disabled)

@%systemroot%\system32\vssvc.exe,-102: %systemroot%\system32\vssvc.exe (manual start)

Windows-Zeitgeber: %SystemRoot%\system32\svchost.exe -k LocalService (disabled)

Wacom Serial Pen HID Driver: \SystemRoot\system32\drivers\wacompen.sys (disabled)

Remote Access IP ARP Driver: system32\DRIVERS\wanarp.sys (manual start)

Remote Access IPv6 ARP Driver: system32\DRIVERS\wanarp.sys (system)

@%SystemRoot%\system32\wcncsvc.dll,-3: %SystemRoot%\System32\svchost.exe -k LocalService (manual start)

@%SystemRoot%\system32\WcsPlugInService.dll,-200: %SystemRoot%\system32\svchost.exe -k wcssvc (manual start)

Microsoft Watchdog Timer Driver: \SystemRoot\system32\drivers\wd.sys (disabled)

Kernel Mode Driver Frameworks service: system32\drivers\Wdf01000.sys (system)

@%systemroot%\system32\wdi.dll,-502: %SystemRoot%\System32\svchost.exe -k wdisvc (manual start)

@%systemroot%\system32\wdi.dll,-500: %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted (manual start)

@%systemroot%\system32\webclnt.dll,-100: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)

@%SystemRoot%\system32\wecsvc.dll,-200: %SystemRoot%\system32\svchost.exe -k NetworkService (manual start)

@%SystemRoot%\System32\wercplsupport.dll,-101: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

@%SystemRoot%\System32\wersvc.dll,-100: %SystemRoot%\System32\svchost.exe -k WerSvcGroup (autostart)

winachsf: system32\DRIVERS\HSX_CNXT.sys (manual start)

Windows-Defender: %SystemRoot%\System32\svchost.exe -k secsvcs (disabled)

@%SystemRoot%\system32\winhttp.dll,-100: %SystemRoot%\system32\svchost.exe -k LocalService (manual start)

@%Systemroot%\system32\wbem\wmisvc.dll,-205: %systemroot%\system32\svchost.exe -k netsvcs (autostart)

@%Systemroot%\system32\wsmsvc.dll,-101: %SystemRoot%\System32\svchost.exe -k NetworkService (manual start)

@%SystemRoot%\System32\wlansvc.dll,-257: %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted (autostart)

Microsoft Windows Management Interface for ACPI: system32\DRIVERS\wmiacpi.sys (manual start)

@%Systemroot%\system32\wbem\wmiapsrv.exe,-110: %systemroot%\system32\wbem\WmiApSrv.exe (manual start)

@%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101: "%ProgramFiles%\Windows Media Player\wmpnetwk.exe" (manual start)

@%SystemRoot%\system32\wpcsvc.dll,-100: %SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted (manual start)

@%SystemRoot%\system32\wpdbusenum.dll,-100: %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted (autostart)

WpdUsb: system32\DRIVERS\wpdusb.sys (manual start)

Winsock IFS driver: \SystemRoot\system32\drivers\ws2ifsl.sys (disabled)

@%SystemRoot%\System32\wscsvc.dll,-200: %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted (autostart)

@%systemroot%\system32\SearchIndexer.exe,-103: %systemroot%\system32\SearchIndexer.exe /Embedding (autostart)

@%systemroot%\system32\wuaueng.dll,-105: %systemroot%\system32\svchost.exe -k netsvcs (autostart)

WUDFRd: system32\DRIVERS\WUDFRd.sys (manual start)

@%SystemRoot%\system32\wudfsvc.dll,-1000: %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted (autostart)

XAudio: system32\DRIVERS\xaudio.sys (autostart)

XAudioService: %SystemRoot%\system32\DRIVERS\xaudio.exe (autostart)
 
 

--------------------------------------------------
 

Enumerating Windows NT logon/logoff scripts:

*No scripts set to run*
 

Windows NT checkdisk command:

BootExecute = autocheck autochk *
 

Windows NT 'Wininit.ini':

PendingFileRenameOperations: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47643a84\UPDENGVDFTEST|||C
 

--------------------------------------------------
 

Enumerating ShellServiceObjectDelayLoad items:
 

WebCheck: C:\Windows\system32\webcheck.dll
 

--------------------------------------------------

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
 

*Registry key not found*
 

--------------------------------------------------
 

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
 

*Registry key not found*
 

--------------------------------------------------
 

End of report, 47.973 bytes

Report generated in 0,187 seconds
 

Command line options:

   /verbose  - to add additional info on each section

   /complete - to include empty sections and unsuspicious data

   /full     - to include several rarely-important sections

   /force9x  - to include Win9x-only startups even if running on WinNT

   /forcent  - to include WinNT-only startups even if running on Win9x

   /forceall - to include all Win9x and WinNT startups, regardless of platform

   /history  - to list version history only

kaspersky, antivir, escan, spybot, adware, trojan remover haben nix gefunden

Hallo,

wäre schön, wenn du dein genaues Problem mal schildern würdest, sonst können wir Dir nicht helfen. :)