okay....ich hoffe, ich hab alles richtig gemacht?!?
hier die LOGS
GMER Logfile: Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-03-31 10:55:51
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 Hitachi_ rev.BBFO
Running: 5c2eg6pk.exe; Driver: C:\Temp\pwdorkow.sys
---- System - GMER 1.0.15 ----
SSDT B8738844 ZwClose
SSDT B87387FE ZwCreateKey
SSDT B873884E ZwCreateSection
SSDT B87387F4 ZwCreateThread
SSDT B8738803 ZwDeleteKey
SSDT B873880D ZwDeleteValueKey
SSDT B873883F ZwDuplicateObject
SSDT spce.sys ZwEnumerateKey [0xB7ECDDA4]
SSDT spce.sys ZwEnumerateValueKey [0xB7ECE132]
SSDT B8738812 ZwLoadKey
SSDT spce.sys ZwOpenKey [0xB7EB50C0]
SSDT B87387E0 ZwOpenProcess
SSDT B87387E5 ZwOpenThread
SSDT spce.sys ZwQueryKey [0xB7ECE20A]
SSDT B8738867 ZwQueryValueKey
SSDT B873881C ZwReplaceKey
SSDT B8738858 ZwRequestWaitReplyPort
SSDT B8738817 ZwRestoreKey
SSDT B8738853 ZwSetContextThread
SSDT B873885D ZwSetSecurityObject
SSDT B8738808 ZwSetValueKey
SSDT B8738862 ZwSystemDebugControl
SSDT B87387EF ZwTerminateProcess
INT 0x62 ? 8A549BF8
INT 0x63 ? 8A4D9BF8
INT 0x63 ? 8A4D9BF8
INT 0x94 ? 8A49ABF8
INT 0xA4 ? 8A49ABF8
INT 0xA4 ? 8A49ABF8
INT 0xA4 ? 8A49ABF8
INT 0xB4 ? 8A49ABF8
INT 0xB4 ? 8A49ABF8
INT 0xB4 ? 8A49ABF8
INT 0xB4 ? 8A49ABF8
---- Kernel code sections - GMER 1.0.15 ----
? spce.sys Das System kann die angegebene Datei nicht finden. !
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB71A5380, 0x5414D5, 0xE8000020]
.text USBPORT.SYS!DllUnload B7185934 5 Bytes JMP 8A49A1D8
.text a6pxy6ss.SYS B6CAD386 35 Bytes [00, 00, 00, 00, 00, 00, 20, ...]
.text a6pxy6ss.SYS B6CAD3AA 24 Bytes [00, 00, 00, 00, 00, 00, 00, ...]
.text a6pxy6ss.SYS B6CAD3C4 3 Bytes [00, 80, 02]
.text a6pxy6ss.SYS B6CAD3C9 1 Byte [30]
.text a6pxy6ss.SYS B6CAD3C9 11 Bytes [30, 00, 00, 00, 5E, 02, 00, ...] {XOR [EAX], AL; ADD [EAX], AL; POP ESI; ADD AL, [EAX]; ADD [EAX], AL; ADD [EAX], AL}
.text ...
---- Kernel IAT/EAT - GMER 1.0.15 ----
IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [B7EB6042] spce.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [B7EB613E] spce.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [B7EB60C0] spce.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [B7EB6800] spce.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [B7EB66D6] spce.sys
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [B7EC5B90] spce.sys
IAT \SystemRoot\System32\Drivers\a6pxy6ss.SYS[HAL.dll!KfAcquireSpinLock] 18C4830E
IAT \SystemRoot\System32\Drivers\a6pxy6ss.SYS[HAL.dll!READ_PORT_UCHAR] 1C959E88
IAT \SystemRoot\System32\Drivers\a6pxy6ss.SYS[HAL.dll!KeGetCurrentIrql] 9E880000
IAT \SystemRoot\System32\Drivers\a6pxy6ss.SYS[HAL.dll!KfRaiseIrql] 00001CB1
IAT \SystemRoot\System32\Drivers\a6pxy6ss.SYS[HAL.dll!KfLowerIrql] 0E798366
IAT \SystemRoot\System32\Drivers\a6pxy6ss.SYS[HAL.dll!HalGetInterruptVector] 74AAB000
IAT \SystemRoot\System32\Drivers\a6pxy6ss.SYS[HAL.dll!HalTranslateBusAddress] 8986C636
IAT \SystemRoot\System32\Drivers\a6pxy6ss.SYS[HAL.dll!KeStallExecutionProcessor] 1A00001C
IAT \SystemRoot\System32\Drivers\a6pxy6ss.SYS[HAL.dll!KfReleaseSpinLock] 1C8B86C6
IAT \SystemRoot\System32\Drivers\a6pxy6ss.SYS[HAL.dll!READ_PORT_BUFFER_USHORT] C6020000
IAT \SystemRoot\System32\Drivers\a6pxy6ss.SYS[HAL.dll!READ_PORT_USHORT] 001C9686
IAT \SystemRoot\System32\Drivers\a6pxy6ss.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT] 86C60200
IAT \SystemRoot\System32\Drivers\a6pxy6ss.SYS[HAL.dll!WRITE_PORT_UCHAR] 00001CB2
IAT \SystemRoot\System32\Drivers\a6pxy6ss.SYS[WMILIB.SYS!WmiSystemControl] 8800001C
IAT \SystemRoot\System32\Drivers\a6pxy6ss.SYS[WMILIB.SYS!WmiCompleteRequest] 001CB99E
---- Devices - GMER 1.0.15 ----
Device \FileSystem\Ntfs \Ntfs 8A4D81F8
Device \FileSystem\Fastfat \FatCdrom 88147500
Device \Driver\usbuhci \Device\USBPDO-0 8A4271F8
Device \Driver\dmio \Device\DmControl\DmIoDaemon 8A4DA1F8
Device \Driver\dmio \Device\DmControl\DmConfig 8A4DA1F8
Device \Driver\dmio \Device\DmControl\DmPnP 8A4DA1F8
Device \Driver\dmio \Device\DmControl\DmInfo 8A4DA1F8
Device \Driver\usbuhci \Device\USBPDO-1 8A4271F8
Device \Driver\usbehci \Device\USBPDO-2 89A311F8
Device \Driver\usbuhci \Device\USBPDO-3 8A4271F8
Device \Driver\usbuhci \Device\USBPDO-4 8A4271F8
Device \Driver\usbuhci \Device\USBPDO-5 8A4271F8
Device \Driver\usbehci \Device\USBPDO-6 89A311F8
Device \Driver\sptd \Device\2606712958 spce.sys
Device \Driver\Ftdisk \Device\HarddiskVolume1 8A54A1F8
Device \Driver\Ftdisk \Device\HarddiskVolume2 8A54A1F8
Device \Driver\Cdrom \Device\CdRom0 899F91F8
Device \Driver\iaStor \Device\Ide\iaStor0 [B7D7C580] iaStor.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort0 [B7E08B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 [B7E08B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\iaStor \Device\Ide\IAAStorageDevice-0 [B7D7C580] iaStor.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\Ftdisk \Device\HarddiskVolume3 8A54A1F8
Device \Driver\Cdrom \Device\CdRom1 899F91F8
Device \Driver\Ftdisk \Device\HarddiskVolume4 8A54A1F8
Device \Driver\NetBT \Device\NetBT_Tcpip_{7BA174FC-A1AC-4D13-9136-0DDF9DBED659} 8817A1F8
Device \Driver\NetBT \Device\NetBt_Wins_Export 8817A1F8
Device \Driver\NetBT \Device\NetbiosSmb 8817A1F8
Device \Driver\PCI_PNP9208 \Device\0000004e spce.sys
Device \Driver\usbuhci \Device\USBFDO-0 8A4271F8
Device \Driver\usbuhci \Device\USBFDO-1 8A4271F8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 881561F8
Device \Driver\usbehci \Device\USBFDO-2 89A311F8
Device \FileSystem\MRxSmb \Device\LanmanRedirector 881561F8
Device \Driver\usbuhci \Device\USBFDO-3 8A4271F8
Device \Driver\usbuhci \Device\USBFDO-4 8A4271F8
Device \Driver\Ftdisk \Device\FtControl 8A54A1F8
Device \Driver\NetBT \Device\NetBT_Tcpip_{1458B29B-436D-4EDE-AAF2-0103BF23F020} 8817A1F8
Device \Driver\usbuhci \Device\USBFDO-5 8A4271F8
Device \Driver\usbehci \Device\USBFDO-6 89A311F8
Device \Driver\a6pxy6ss \Device\Scsi\a6pxy6ss1 899ED500
Device \Driver\a6pxy6ss \Device\Scsi\a6pxy6ss1Port2Path0Target0Lun0 899ED500
Device \FileSystem\Fastfat \Fat 88147500
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
Device \FileSystem\Cdfs \Cdfs 88148500
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x4D 0x0E 0xF1 0x16 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x8E 0xFA 0x93 0xFF ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xA4 0x4A 0x98 0xAE ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x4D 0x0E 0xF1 0x16 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x8E 0xFA 0x93 0xFF ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xA4 0x4A 0x98 0xAE ...
---- EOF - GMER 1.0.15 ----
--- --- ---
LOG von OSAM
OSAM Logfile: Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 17:57:31 on 02.04.2012
OS: Windows XP Professional Service Pack 3 (Build 2600)
Default Browser: Microsoft Corporation Internet Explorer 8.00.6001.18702
Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures
Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries
[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\WINDOWS\system32\DivXControlPanelApplet.cpl
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl
"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl
"PhysX.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\PhysX.cpl
"SscRdCpa.cpl" - "SuperSpeed Software, Inc." - C:\WINDOWS\system32\SscRdCpa.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\MLCFG32.CPL
"RAM Disk Devices" - "SuperSpeed Software, Inc." - C:\WINDOWS\System32\SscRdCpa.cpl
[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"a5vq80b8" (a5vq80b8) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\a5vq80b8.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Aspi32" (Aspi32) - "Adaptec" - C:\WINDOWS\system32\drivers\Aspi32.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys
"avkmgr" (avkmgr) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avkmgr.sys
"catchme" (catchme) - ? - C:\ComboFix\catchme.sys (File not found)
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys (File not found)
"HSF_DPV" (HSF_DPV) - "Conexant Systems, Inc." - C:\WINDOWS\System32\DRIVERS\HSX_DPV.sys
"HSXHWAZL" (HSXHWAZL) - "Conexant Systems, Inc." - C:\WINDOWS\System32\DRIVERS\HSXHWAZL.sys
"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys (File not found)
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys (File not found)
"mdmxsdk" (mdmxsdk) - "Conexant" - C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys (File not found)
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys
"sptd" (sptd) - "Duplex Secure Ltd." - C:\WINDOWS\System32\Drivers\sptd.sys (File is exclusively opened, access blocked)
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys
"StarOpen" (StarOpen) - ? - C:\WINDOWS\system32\drivers\StarOpen.sys (File found, but it contains no detailed information)
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys (File not found)
"winachsf" (winachsf) - "Conexant Systems, Inc." - C:\WINDOWS\System32\DRIVERS\HSX_CNXT.sys
"XAudio" (XAudio) - "Conexant Systems, Inc." - C:\WINDOWS\System32\DRIVERS\xaudio.sys
[Explorer]
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
{88FED34C-F0CA-4636-A375-3CB6248B04CD} "Local Groove Web Services Protocol" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - (File not found | COM-object registry key not found)
{1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - C:\Programme\NVIDIA Corporation\nView\nvshell.dll
{1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - C:\Programme\NVIDIA Corporation\nView\nvshell.dll
{A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.dll
{1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - c:\WINDOWS\system32\mscoree.dll
{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? - (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONFILTER.DLL
{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\MLSHEXT.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll
{ECF03A33-103D-11d2-854D-006008059367} "MyDocs Copy Hook" - "Microsoft Corporation" - C:\WINDOWS\system32\mydocs.dll
{ECF03A32-103D-11d2-854D-006008059367} "MyDocs Drop Target" - "Microsoft Corporation" - C:\WINDOWS\system32\mydocs.dll
{4a7ded0a-ad25-11d0-98a8-0800361b1103} "MyDocs menu and properties" - "Microsoft Corporation" - C:\WINDOWS\system32\mydocs.dll
{FFB699E0-306A-11d3-8BD1-00104B6F7516} "NVIDIA CPL Extension" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.dll
{1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - C:\Programme\NVIDIA Corporation\nView\nvshell.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\OLKFSTUB.DLL
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira Operations GmbH & Co. KG" - C:\Programme\Avira\AntiVir Desktop\shlext.dll
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? - (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Web Folders" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\MSONSEXT.DLL
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Programme\WinRAR\rarext.dll (File found, but it contains no detailed information)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad )-----
{35CEC8A3-2BE6-11D2-8773-92E220524153} "SysTray" - "Microsoft Corporation" - C:\WINDOWS\system32\stobject.dll
[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? - (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} "Java Plug-in 1.6.0_07" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.6.0_07\bin\npjpi160_07.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_20.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_20.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_20.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
"ICQ6" - "ICQ, LLC." - C:\Programme\ICQ6.5\ICQ.exe
{B119EB0C-C021-46CF-85B0-34A760E0D5FE} "IE7Pro Preferences" - "IE7Pro.com" - C:\Programme\ie7pro\IEPro.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
{00011268-E188-40DF-A514-835FCD78B1BF} "IE7Pro BHO" - "IE7Pro.com" - C:\Programme\ie7pro\IEPro.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\Giu\Startmenü\Programme\Autostart\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"DAEMON Tools Lite" - "DT Soft Ltd" - "C:\Programme\DAEMON Tools Lite\DTLite.exe" -autorun
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
"GrooveMonitor" - "Microsoft Corporation" - "C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe"
"IntelWireless" - "Intel(R) Corporation" - "C:\Programme\Gemeinsame Dateien\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray
"IntelZeroConfig" - "Intel(R) Corporation" - "C:\Programme\Intel\WiFi\bin\ZCfgSvc.exe"
"NvCplDaemon" - "NVIDIA Corporation" - RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
"NVHotkey" - "NVIDIA Corporation" - rundll32.exe nvHotkey.dll,Start
"NvMediaCenter" - "NVIDIA Corporation" - RunDLL32.exe NvMCTray.dll,NvTaskbarInit
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
"systray" - ? - C:\Programme\Dell\Dell Mobile Broadband\systray.exe
[Network Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order )-----
"IntelNetProvCredMan" - "Intel(R) Corporation" - C:\WINDOWS\system32\netprovcredman.dll
[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\msonpmon.dll
[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
"ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
"Automatic Updates" (wuauserv) - "Microsoft Corporation" - C:\WINDOWS\system32\wuauserv.dll
"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Programme\Avira\AntiVir Desktop\avguard.exe
"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Programme\Avira\AntiVir Desktop\sched.exe
"CiSvc" (CiSvc) - ? - C:\WINDOWS\system32\cisvc.exe (File not found)
"ERSvc" (ERSvc) - ? - C:\WINDOWS\System32\ersvc.dll (File not found)
"ICQ Service" (ICQ Service) - ? - C:\Programme\ICQ6Toolbar\ICQ Service.exe (File not found)
"Intel(R) PROSet/Wireless SSO Service" (WLANKEEPER) - "Intel(R) Corporation" - C:\Programme\Intel\WiFi\bin\WLKeeper.exe
"Intel® PROSet/Wireless Event Log" (EvtEng) - "Intel(R) Corporation" - C:\Programme\Intel\WiFi\bin\EvtEng.exe
"Intel® PROSet/Wireless Registry Service" (RegSrvc) - "Intel(R) Corporation" - C:\Programme\Gemeinsame Dateien\Intel\WirelessCommon\RegSrvc.exe
"Intel® PROSet/Wireless WiFi Service" (S24EventMonitor) - "Intel(R) Corporation" - C:\Programme\Intel\WiFi\bin\S24EvMon.exe
"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE
"Microsoft Office Groove Audit Service" (Microsoft Office Groove Audit Service) - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveAuditService.exe
"NMSAccessU" (NMSAccessU) - ? - C:\Programme\CDBurnerXP\NMSAccessU.exe (File found, but it contains no detailed information)
"NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\WINDOWS\system32\nvsvc32.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
"Windows CardSpace" (idsvc) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
"XAudioService" (XAudioService) - "Conexant Systems, Inc." - C:\WINDOWS\system32\DRIVERS\xaudio.exe
[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions )-----
{F9C77450-3A41-477E-9310-9ACD617BD9E3} "Group Policy Applications" - ? - gpprefcl.dll (File not found)
{728EE579-943C-4519-9EF7-AB56765798ED} "Group Policy Data Sources" - ? - gpprefcl.dll (File not found)
{1A6364EB-776B-4120-ADE1-B63A406A76B5} "Group Policy Device Settings" - ? - gpprefcl.dll (File not found)
{5794DAFD-BE60-433f-88A2-1A31939AC01F} "Group Policy Drive Maps" - ? - gpprefcl.dll (File not found)
{0E28E245-9368-4853-AD84-6DA3BA35BB75} "Group Policy Environment" - ? - gpprefcl.dll (File not found)
{7150F9BF-48AD-4da4-A49C-29EF4A8369BA} "Group Policy Files" - ? - gpprefcl.dll (File not found)
{A3F3E39B-5D83-4940-B954-28315B82F0A8} "Group Policy Folder Options" - ? - gpprefcl.dll (File not found)
{6232C319-91AC-4931-9385-E70C2B099F0E} "Group Policy Folders" - ? - gpprefcl.dll (File not found)
{74EE6C03-5363-4554-B161-627540339CAB} "Group Policy Ini Files" - ? - gpprefcl.dll (File not found)
{E47248BA-94CC-49c4-BBB5-9EB7F05183D0} "Group Policy Internet Settings" - ? - gpprefcl.dll (File not found)
{17D89FEC-5C44-4972-B12D-241CAEF74509} "Group Policy Local Users and Groups" - ? - gpprefcl.dll (File not found)
{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F} "Group Policy Network Options" - ? - gpprefcl.dll (File not found)
{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2} "Group Policy Network Shares" - ? - gpprefcl.dll (File not found)
{E62688F0-25FD-4c90-BFF5-F508B9D2E31F} "Group Policy Power Options" - ? - gpprefcl.dll (File not found)
{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D} "Group Policy Printers" - ? - gpprefcl.dll (File not found)
{E5094040-C46C-4115-B030-04FB2E545B00} "Group Policy Regional Options" - ? - gpprefcl.dll (File not found)
{B087BE9D-ED37-454f-AF9C-04291E351182} "Group Policy Registry" - ? - gpprefcl.dll (File not found)
{AADCED64-746C-4633-A97C-D61349046527} "Group Policy Scheduled Tasks" - ? - gpprefcl.dll (File not found)
{91FBB303-0CD5-4055-BF42-E512A681B325} "Group Policy Services" - ? - gpprefcl.dll (File not found)
{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7} "Group Policy Shortcuts" - ? - gpprefcl.dll (File not found)
{E4F48E54-F38D-4884-BFB9-D4D2E5729C18} "Group Policy Start Menu Settings" - ? - gpprefcl.dll (File not found)
===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---
LOG von aswMBR Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-04-02 18:00:02
-----------------------------
18:00:02.187 OS Version: Windows 5.1.2600 Service Pack 3
18:00:02.187 Number of processors: 2 586 0xF0D
18:00:02.187 ComputerName: GIU-LAPTOP UserName: Giu
18:00:03.468 Initialize success
18:02:21.578 AVAST engine defs: 12040200
18:02:57.796 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
18:02:57.796 Disk 0 Vendor: Hitachi_ BBFO Size: 238475MB BusType: 3
18:02:57.812 Disk 0 MBR read successfully
18:02:57.812 Disk 0 MBR scan
18:02:57.875 Disk 0 Windows XP default MBR code
18:02:57.875 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 117 MB offset 63
18:02:57.890 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 10240 MB offset 241664
18:02:57.906 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 225545 MB offset 21221865
18:02:57.906 Disk 0 Partition - 00 0F Extended LBA 2560 MB offset 483151872
18:02:57.937 Disk 0 Partition 4 00 DD MSDOS5.0 2559 MB offset 483153920
18:02:57.953 Disk 0 scanning sectors +488394752
18:02:58.046 Disk 0 scanning C:\WINDOWS\system32\drivers
18:03:07.890 Service scanning
18:03:26.625 Service sptd C:\WINDOWS\System32\Drivers\sptd.sys **LOCKED** 32
18:03:33.093 Modules scanning
18:03:45.078 Disk 0 trace - called modules:
18:03:45.093 ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys spvq.sys hal.dll >>UNKNOWN [0x8a4fa938]<<
18:03:45.093 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a553478]
18:03:45.093 3 CLASSPNP.SYS[b8108fd7] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x8a44a030]
18:03:46.203 AVAST engine scan C:\WINDOWS
18:03:59.125 AVAST engine scan C:\WINDOWS\system32
18:06:27.406 AVAST engine scan C:\WINDOWS\system32\drivers
18:06:43.140 AVAST engine scan C:\Dokumente und Einstellungen\Giu
18:07:44.812 File: C:\Dokumente und Einstellungen\Giu\Eigene Dateien\Downloads\OTL.exe **INFECTED** Win32:Malware-gen
18:13:32.843 Disk 0 MBR has been saved successfully to "C:\Dokumente und Einstellungen\Giu\Desktop\MBR.dat"
18:13:32.843 The log file has been saved successfully to "C:\Dokumente und Einstellungen\Giu\Desktop\aswMBR.txt"
|
aswMBR.exe und speichere die Datei auf deinem Desktop.