Trojaner-Board - "TR/Crypt.XPACK.Gen2" auf Rechner

Hallo Cosinus,

war mal wieder unterwegs und konnte nicht antworten ;-((
Lt. Besitzer des PC´s war gestern der Trojaner "TR/Spy.Farko.k" auf dem System und wurde von AntiVir gelöscht
hier mal das log von mbr (heute 13.45)

Zitat:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x000003fc

Kernel Drivers (total 112):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806E6000 \WINDOWS\system32\hal.dll
0xF7ADC000 \WINDOWS\system32\KDCOM.DLL
0xF79EC000 \WINDOWS\system32\BOOTVID.dll
0xF74AC000 ACPI.sys
0xF7ADE000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF749B000 pci.sys
0xF75DC000 isapnp.sys
0xF75EC000 ohci1394.sys
0xF75FC000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xF7BA4000 pciide.sys
0xF785C000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF7AE0000 viaide.sys
0xF7AE2000 intelide.sys
0xF760C000 MountMgr.sys
0xF747C000 ftdisk.sys
0xF7864000 PartMgr.sys
0xF761C000 VolSnap.sys
0xF7464000 atapi.sys
0xF762C000 disk.sys
0xF763C000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF7444000 fltmgr.sys
0xF7432000 sr.sys
0xF764C000 PxHelp20.sys
0xF741B000 KSecDD.sys
0xF738E000 Ntfs.sys
0xF7361000 NDIS.sys
0xF7347000 Mup.sys
0xF76BC000 \SystemRoot\system32\DRIVERS\nic1394.sys
0xF6C84000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xF67DA000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xF67C6000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF7914000 \SystemRoot\system32\DRIVERS\usbohci.sys
0xF67A2000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF791C000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF6C74000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF6C64000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF6C54000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF677F000 \SystemRoot\system32\DRIVERS\ks.sys
0xF6757000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xF7924000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF6743000 \SystemRoot\system32\DRIVERS\parport.sys
0xF6C44000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF792C000 \SystemRoot\system32\DRIVERS\PS2.sys
0xF7934000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF793C000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF672F000 \SystemRoot\system32\DRIVERS\Rtnicxp.sys
0xF7C5A000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF6C34000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF7AD8000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF6718000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF6C24000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF6C14000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF7944000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF6707000 \SystemRoot\system32\DRIVERS\psched.sys
0xF6C04000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF794C000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF7954000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF76DC000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF7B02000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF66A9000 \SystemRoot\system32\DRIVERS\update.sys
0xF731B000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF76EC000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF76FC000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF7B04000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF3CA6000 \SystemRoot\system32\drivers\RtkHDAud.sys
0xF3C82000 \SystemRoot\system32\drivers\portcls.sys
0xF770C000 \SystemRoot\system32\drivers\drmk.sys
0xF7B08000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7D12000 \SystemRoot\System32\Drivers\Null.SYS
0xF7B0A000 \SystemRoot\System32\Drivers\Beep.SYS
0xF796C000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF7974000 \SystemRoot\System32\drivers\vga.sys
0xF7B0C000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7B0E000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF797C000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF7984000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF7A84000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xF3BFF000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xF3BA6000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xF3B7E000 \SystemRoot\system32\DRIVERS\netbt.sys
0xF3B58000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xF3B36000 \SystemRoot\System32\drivers\afd.sys
0xF772C000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xF773C000 \SystemRoot\system32\DRIVERS\netbios.sys
0xF798C000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0xF775C000 \SystemRoot\system32\DRIVERS\arp1394.sys
0xF3A6B000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xF39FB000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF776C000 \SystemRoot\System32\Drivers\Fips.SYS
0xF39D4000 \SystemRoot\system32\DRIVERS\avipbb.sys
0xF7B12000 \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys
0xF7AA0000 \SystemRoot\system32\DRIVERS\usbscan.sys
0xF7994000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0xF3988000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xF3970000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF7B18000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF3C7A000 \SystemRoot\System32\drivers\Dxapi.sys
0xF79A4000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7C16000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\nv4_disp.dll
0xBA4A9000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0xBA4E8000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xB9A4C000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xB99E7000 \SystemRoot\system32\drivers\wdmaud.sys
0xBA369000 \SystemRoot\system32\drivers\sysaudio.sys
0xB96E9000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xB9379000 \SystemRoot\system32\DRIVERS\srv.sys
0xB8A06000 \SystemRoot\System32\Drivers\HTTP.sys
0x7C910000 \WINDOWS\system32\ntdll.dll

Processes (total 44):
0 System Idle Process
4 System
512 C:\WINDOWS\system32\smss.exe
576 csrss.exe
604 C:\WINDOWS\system32\winlogon.exe
648 C:\WINDOWS\system32\services.exe
660 C:\WINDOWS\system32\lsass.exe
836 C:\WINDOWS\system32\svchost.exe
884 svchost.exe
952 C:\WINDOWS\system32\svchost.exe
1044 svchost.exe
1100 svchost.exe
1200 C:\WINDOWS\system32\spoolsv.exe
1320 C:\Programme\Avira\AntiVir Desktop\sched.exe
1392 svchost.exe
1616 C:\WINDOWS\explorer.exe
1748 C:\WINDOWS\RTHDCPL.EXE
1780 C:\Programme\CyberLink\PowerCinema\PCMService.exe
1804 C:\WINDOWS\system32\rundll32.exe
1812 C:\Programme\HP\HP Software Update\hpwuSchd2.exe
1872 C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
1884 C:\Programme\Avira\AntiVir Desktop\avgnt.exe
1900 C:\Programme\Adobe\Reader 9.0\Reader\reader_sl.exe
1936 C:\PROGRA~1\GEMEIN~1\INSTAL~1\UPDATE~1\issch.exe
1956 C:\WINDOWS\system32\ctfmon.exe
2000 C:\Programme\EPSON\EPSON SMART PANEL for Scanner\EspMain.exe
2012 C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe
136 C:\Programme\FRITZ!DSL\StCenter.exe
452 C:\Programme\Avira\AntiVir Desktop\avguard.exe
532 C:\Programme\FRITZ!DSL\IGDCTRL.EXE
548 C:\Programme\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
584 C:\Programme\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
1328 C:\Programme\Java\jre6\bin\jqs.exe
1052 C:\WINDOWS\system32\nvsvc32.exe
1624 C:\Programme\Avira\AntiVir Desktop\avshadow.exe
1828 C:\WINDOWS\system32\svchost.exe
2244 C:\Programme\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
2368 C:\WINDOWS\system32\wuauclt.exe
3540 alg.exe
3736 C:\WINDOWS\system32\svchost.exe
3884 C:\Programme\Mozilla Firefox\firefox.exe
1520 C:\hp\KBD\kbd.exe
172 C:\WINDOWS\system\hpsysdrv.exe
2436 C:\Dokumente und Einstellungen\HP_Besitzer\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000044`598dd400 (FAT32)

PhysicalDrive0 Model Number: WDCWD3000JS-60PDB0, Rev: 21.00M21

Size Device Name MBR Status
--------------------------------------------
279 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: 1767459F00D32DFB18808B1403F5E319EE9E0999

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Hier der von OSAM

OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 13:49:40 on 26.07.2011
 

OS: Windows XP Home Edition Service Pack 3 (Build 2600)

Default Browser: Microsoft Corporation Internet Explorer 8.00.6001.18702
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"AppleSoftwareUpdate.job" - "Apple Inc." - C:\Programme\Apple Software Update\SoftwareUpdate.exe

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\WINDOWS\system32\FlashPlayerCPLApp.cpl

"ISUSPM.cpl" - "InstallShield Software Corporation" - C:\WINDOWS\system32\ISUSPM.cpl

"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl

"nvtuicpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvtuicpl.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"Avira AntiVir Personal - Free Antivirus " - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl

"QuickTime" - "Apple Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys

"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys

"catchme" (catchme) - ? - C:\DOKUME~1\HP_BES~1\LOKALE~1\Temp\catchme.sys  (File not found)

"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)

"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)

"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)

"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)

"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)

"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)

"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)

"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)

"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys

"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)
 

[Explorer]

-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{BDEADF00-C265-11d0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

-----( HKLM\Software\Classes\Protocols\Handler )-----

{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - c:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Programme\7-Zip\7-zip.dll

{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)

{1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)

{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -   (File not found | COM-object registry key not found)

{1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office\OLKFSTUB.DLL

{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - C:\Programme\Real\RealPlayer\rpshell.dll

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll

{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -   (File not found | COM-object registry key not found)

{7F67036B-66F1-411A-AD85-759FB9C5B0DB} "ShellViewRTF" - "XSS" - C:\WINDOWS\system32\ShellvRTF.dll
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "Google Toolbar" - "Google Inc." - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBarLayout" - ? -   (File not found | COM-object registry key not found)

<binary data> "{C4069E3A-68F1-403E-B40E-20066696354B}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} "get_atlcom Class" - "NOS Microsystems Ltd." - C:\WINDOWS\Downloaded Program Files\gp.ocx / hxxp://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_20.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_20.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_20.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} "{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}" - ? -   (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_05-windows-i586.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

"Hilfe zu Verbindungen" - ? - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

{327C2873-E90D-4c37-AA9D-10AC9BABA46C} "Easy-WebPrint" - ? - C:\Programme\Canon\Easy-WebPrint\Toolband.dll

<binary data> "Google Toolbar" - "Google Inc." - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{68F9551E-0411-48E4-9AAF-4BC42A6A46BE} "EWPBrowseObject Class" - ? - C:\Programme\Canon\Easy-WebPrint\EWPBrowseLoader.dll

{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll

{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Programme\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll

{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
 

[Logon]

-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----

"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini

"EPSON SMART PANEL for Scanner.lnk" - "NewSoft" - C:\Programme\EPSON\EPSON SMART PANEL for Scanner\EspMain.exe  (Shortcut exists | File exists)

"HP Digital Imaging Monitor.lnk" - "Hewlett-Packard Development Company, L.P." - C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe  (Shortcut exists | File exists)

"Microsoft Office.lnk" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office\OSA9.EXE  (Shortcut exists | File exists)

-----( %UserProfile%\Startmenü\Programme\Autostart )-----

"desktop.ini" - ? - C:\Dokumente und Einstellungen\HP_Besitzer\Startmenü\Programme\Autostart\desktop.ini

"FRITZ!DSL Startcenter.lnk" - "AVM Berlin" - C:\Programme\FRITZ!DSL\StCenter.exe  (Shortcut exists | File exists)

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"swg" - "Google Inc." - "C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min

"Easy-PrintToolBox" - "CANON INC." - C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon

"HP Software Update" - "Hewlett-Packard Development Company, L.P." - C:\Programme\HP\HP Software Update\HPwuSchd2.exe

"HPBootOp" - "Hewlett-Packard Company" - "C:\Programme\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run

"HPHUPD08" - "Hewlett-Packard" - c:\Programme\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe

"ISUSPM Startup" - "InstallShield Software Corporation" - C:\PROGRA~1\GEMEIN~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup

"ISUSScheduler" - "InstallShield Software Corporation" - "C:\PROGRA~1\GEMEIN~1\INSTAL~1\UPDATE~1\issch.exe" -start

"nwiz" - "NVIDIA Corporation" - nwiz.exe /installquiet /keeploaded /nodetect

"PCMService" - "CyberLink Corp." - "C:\Programme\CyberLink\PowerCinema\PCMService.exe"

"QuickTime Task" - "Apple Inc." - "C:\Programme\QuickTime\qttask.exe" -atboottime

"Recguard" - ? - C:\WINDOWS\SMINST\RECGUARD.EXE

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"

"TkBellExe" - "RealNetworks, Inc." - "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe"  -osboot
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"avm:" - "AVM Berlin GmbH" - C:\WINDOWS\system32\avmprmon.dll

"HP Standard TCP/IP Port" - "Hewlett Packard" - C:\WINDOWS\system32\HpTcpMon.dll
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"Anwendungsverwaltung" (AppMgmt) - ? - C:\WINDOWS\System32\appmgmts.dll  (File not found)

"ASP.NET-Statusdienst" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe

"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe

"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe

"AVM FRITZ!web Routing Service" (de_serv) - "AVM Berlin" - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe

"AVM IGD CTRL Service" (AVM IGD CTRL Service) - "AVM Berlin" - C:\Programme\FRITZ!DSL\IGDCTRL.EXE

"CyberLink Background Capture Service (CBCS)" (CLCapSvc) - ? - C:\Programme\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe

"CyberLink Media Library Service" (CyberLink Media Library Service) - "Cyberlink" - C:\Programme\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe

"CyberLink Task Scheduler (CTS)" (CLSched) - ? - C:\Programme\CyberLink\PowerCinema\Kernel\TV\CLSched.exe

"getPlus(R) Helper" (getPlus(R) Helper) - "NOS Microsystems Ltd." - C:\Programme\NOS\bin\getPlus_HelperSvc.exe

"Google Software Updater" (gusvc) - "Google" - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe

"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe

"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe
 

[Winlogon]

-----( HKCU\Control Panel\IOProcs )-----

"MVB" - ? - mvfs32.dll  (File not found)

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions )-----

{c6dc5466-785a-11d2-84d0-00c04fb169f7} "Softwareinstallation" - ? - appmgmts.dll  (File not found)
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---
If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru[/QUOTE]

ich hoffe Du kannst damit etwas anfangen :-))