Das GMER Log:
GMER Logfile:
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-07-31 23:01:52
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 ST3250820AS rev.3.AAC
Running: xzmlcppf.exe; Driver: D:\Users\Markus\AppData\Local\Temp\pxdiypoc.sys
---- System - GMER 1.0.15 ----
SSDT 97653836 ZwCreateSection
SSDT 97653840 ZwRequestWaitReplyPort
SSDT 9765383B ZwSetContextThread
SSDT 97653845 ZwSetSecurityObject
SSDT 9765384A ZwSystemDebugControl
SSDT 976537D7 ZwTerminateProcess
---- Kernel code sections - GMER 1.0.15 ----
.text ntkrnlpa.exe!ZwRollbackEnlistment + 140D 82C4D3C9 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82C86D52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!KeRemoveQueueEx + 11F7 82C8DEAC 4 Bytes [36, 38, 65, 97] {CMP SS:[EBP-0x69], AH}
.text ntkrnlpa.exe!KeRemoveQueueEx + 1553 82C8E208 4 Bytes JMP E801228F
.text ntkrnlpa.exe!KeRemoveQueueEx + 1597 82C8E24C 4 Bytes [3B, 38, 65, 97]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1613 82C8E2C8 4 Bytes [45, 38, 65, 97] {INC EBP; CMP [EBP-0x69], AH}
.text ntkrnlpa.exe!KeRemoveQueueEx + 1667 82C8E31C 4 Bytes [4A, 38, 65, 97] {DEC EDX; CMP [EBP-0x69], AH}
.text ...
.text D:\Windows\system32\DRIVERS\atikmdag.sys section is writeable [0x90C21000, 0x2D5378, 0xE8000020]
.text D:\Windows\system32\DRIVERS\atksgt.sys section is writeable [0x9FA77300, 0x3B6D8, 0xE8000020]
.text D:\Windows\system32\DRIVERS\lirsgt.sys section is writeable [0x9FABA300, 0x1BEE, 0xE8000020]
---- User IAT/EAT - GMER 1.0.15 ----
IAT D:\Windows\system32\RunDll32.exe[3780] @ D:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [75D2FFF6] D:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT D:\Windows\system32\RunDll32.exe[3780] @ D:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [75D2FFF6] D:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT D:\Windows\system32\RunDll32.exe[3780] @ D:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [75D2FFF6] D:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT D:\Windows\system32\RunDll32.exe[3780] @ D:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [75D2FFF6] D:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT D:\Windows\system32\RunDll32.exe[3780] @ D:\Windows\system32\WININET.dll [KERNEL32.dll!GetProcAddress] [75D2FFF6] D:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT D:\Windows\system32\RunDll32.exe[3780] @ D:\Windows\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [75D2FFF6] D:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\volmgr \Device\HarddiskVolume12 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume13 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume5 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume6 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume7 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume8 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume9 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
Device \Driver\ACPI_HAL \Device\0000004d halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume10 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume11 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
---- Files - GMER 1.0.15 ----
File D:\Windows\Temp\TMP0000023FB5FDEC3756FF3C1C 0 bytes
---- EOF - GMER 1.0.15 ----
--- --- ---
lg Don Camillo
Und hier das OSAM Log:
OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 23:13:00 on 31.07.2012
OS: Windows 7 Home Premium Edition Service Pack 1 (Build 7601), 32-bit
Default Browser: Microsoft Corporation Internet Explorer 9.00.8112.16421
Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures
Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries
[Common]
-----( %SystemRoot%\Tasks )-----
"HP Photo Creations Communicator.job" - ? - D:\ProgramData\HP Photo Creations\MessageCheck.exe (File found, but it contains no detailed information)
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - D:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - D:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskUserS-1-5-21-3444524948-2078542172-2378634046-1000Core.job" - "Google Inc." - D:\Users\Markus\AppData\Local\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskUserS-1-5-21-3444524948-2078542172-2378634046-1000UA.job" - "Google Inc." - D:\Users\Markus\AppData\Local\Google\Update\GoogleUpdate.exe
"Adobe Flash Player Updater.job" - "Adobe Systems Incorporated" - D:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - D:\Windows\system32\FlashPlayerCPLApp.cpl
"PhysX.cpl" - "NVIDIA Corporation" - D:\Windows\system32\PhysX.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"mlcfg32.cpl" - "Microsoft Corporation" - D:\PROGRA~2\MICROS~2\Office12\MLCFG32.CPL
"QuickTime" - "Apple Inc." - D:\Program Files\QuickTime\QTSystem\QuickTime.cpl
[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"atksgt" (atksgt) - ? - D:\Windows\System32\DRIVERS\atksgt.sys (File found, but it contains no detailed information)
"avgntflt" (avgntflt) - "Avira GmbH" - D:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - D:\Windows\System32\DRIVERS\avipbb.sys
"avkmgr" (avkmgr) - "Avira GmbH" - D:\Windows\System32\DRIVERS\avkmgr.sys
"catchme" (catchme) - ? - D:\Users\Markus\AppData\Local\Temp\catchme.sys (File not found)
"ElbyCDIO Driver" (ElbyCDIO) - "Elaborate Bytes AG" - D:\Windows\System32\Drivers\ElbyCDIO.sys
"lirsgt" (lirsgt) - ? - D:\Windows\System32\DRIVERS\lirsgt.sys (File found, but it contains no detailed information)
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - D:\Windows\system32\drivers\mbam.sys
"pxdiypoc" (pxdiypoc) - ? - D:\Users\Markus\AppData\Local\Temp\pxdiypoc.sys (Hidden registry entry, rootkit activity | File not found)
"ssmdrv" (ssmdrv) - "Avira GmbH" - D:\Windows\System32\DRIVERS\ssmdrv.sys
"StarForce Protection Environment Driver (version 1.x)" (sfdrv01) - "Protection Technology (StarForce)" - D:\Windows\System32\drivers\sfdrv01.sys
"StarForce Protection Helper Driver (version 2.x)" (sfhlp02) - "Protection Technology (StarForce)" - D:\Windows\System32\drivers\sfhlp02.sys
"XDva398" (XDva398) - ? - D:\Windows\system32\XDva398.sys (File not found)
[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - D:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - D:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - D:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - D:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\iTunes\iTunesMiniPlayer.dll
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - D:\Program Files\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - D:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - D:\PROGRA~2\MICROS~2\Office12\MLSHEXT.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - D:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - D:\PROGRA~2\MICROS~2\Office12\OLKFSTUB.DLL
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira Operations GmbH & Co. KG" - D:\Program Files\Avira\AntiVir Desktop\shlext.dll
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - D:\Program Files\WinRAR\rarext.dll
[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? - (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{E06E2E99-0AA1-11D4-ABA6-0060082AA75C} "GpcContainer Class" - "Cisco WebEx LLC" - D:\Windows\Downloaded Program Files\ieatgpc.dll / https://intercalleurope.webex.com/client/WBXclient-T27L10NSP32EP1-13926/webex/ieatgpc1.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_33" - "Sun Microsystems, Inc." - D:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} "Java Plug-in 1.6.0_33" - "Sun Microsystems, Inc." - D:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_33" - "Sun Microsystems, Inc." - D:\Program Files\Java\jre6\bin\npjpi160_33.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
{7530BFB8-7293-4D34-9923-61A11451AFC5} "OnlineScanner Control" - "ESET" - D:\PROGRA~2\ESET\ESETON~1\ONLINE~1.OCX / hxxp://download.eset.com/special/eos/OnlineScanner.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - D:\Windows\system32\Macromed\Flash\Flash32_11_3_300_268.ocx / hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - D:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Click to Call" - "Skype Technologies S.A." - D:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "Google Toolbar" - "Google Inc." - D:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - D:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - D:\Program Files\Java\jre6\bin\jp2ssv.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Sun Microsystems, Inc." - D:\Program Files\Java\jre6\bin\ssv.dll
{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype Browser Helper" - "Skype Technologies S.A." - D:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - D:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"Tintenwarnungen überwachen - HP Officejet 6600 (Netzwerk).lnk" - "Hewlett-Packard Co." - D:\Program Files\HP\HP Officejet 6600\bin\HPStatusBL.dll (Shortcut exists | File exists)
"ZooskMessenger.lnk" - ? - D:\Program Files\ZooskMessenger\ZooskMessenger.exe (Shortcut exists | File found, but it contains no detailed information | File exists)
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"FILSHtray.lnk" - "FILSH Media GmbH" - D:\Program Files\FILSHtray\FILSHtray.exe (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"HP Officejet 6600 (NET)" - "Hewlett-Packard Co." - "D:\Program Files\HP\HP Officejet 6600\Bin\ScanToPCActivationApp.exe" -deviceID "CN1CP1H0WS05RN:NW" -scfn "HP Officejet 6600 (NET)" -AutoStart 1
"iCloudServices" - "Apple Inc." - D:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe
"MobileDocuments" - "Apple Inc." - D:\Program Files\Common Files\Apple\Internet Services\ubd.exe
"TomTomHOME.exe" - "TomTom" - "D:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe ARM" - "Adobe Systems Incorporated" - "D:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"APSDaemon" - "Apple Inc." - "D:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
"avgnt" - "Avira Operations GmbH & Co. KG" - "D:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"HP Software Update" - "Hewlett-Packard" - D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
"iTunesHelper" - "Apple Inc." - "C:\iTunes\iTunesHelper.exe"
"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "D:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
"NeroCheck" - "Ahead Software Gmbh" - D:\Windows\system32\NeroCheck.exe
"QuickTime Task" - "Apple Inc." - "D:\Program Files\QuickTime\QTTask.exe" -atboottime
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "D:\Program Files\Common Files\Java\Java Update\jusched.exe"
[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"HP 5D12 Status Monitor" - "Hewlett-Packard Co." - D:\Windows\system32\hpinksts5D12LM.dll
"HP Discovery Port Monitor (HP Officejet 6600)" - "Hewlett-Packard Co." - D:\Windows\system32\HPDiscoPM5D12.dll
[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - D:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
"Adobe Flash Player Update Service" (AdobeFlashPlayerUpdateSvc) - "Adobe Systems Incorporated" - D:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - D:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - D:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - D:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - D:\Program Files\Avira\AntiVir Desktop\sched.exe
"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - D:\Program Files\Bonjour\mDNSResponder.exe
"Google Software Updater" (gusvc) - "Google" - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - D:\Program Files\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - D:\Program Files\Google\Update\GoogleUpdate.exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - D:\Program Files\iPod\bin\iPodService.exe
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - D:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - D:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - D:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"Office Source Engine" (ose) - "Microsoft Corporation" - D:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"PnkBstrA" (PnkBstrA) - ? - D:\Windows\system32\PnkBstrA.exe (File found, but it contains no detailed information)
"Skype Updater" (SkypeUpdate) - "Skype Technologies" - D:\Program Files\Skype\Updater\Updater.exe
"TomTomHOMEService" (TomTomHOMEService) - "TomTom" - D:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - D:\Program Files\Bonjour\mdnsNSP.dll
===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---
If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
lg
Don Camillo
Und hier noch das Log-File von aswMBR:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-07-31 23:16:40
-----------------------------
23:16:40.276 OS Version: Windows 6.1.7601 Service Pack 1
23:16:40.276 Number of processors: 2 586 0xF06
23:16:40.276 ComputerName: MARKUS-PC UserName: Markus
23:16:41.212 Initialize success
23:18:20.592 AVAST engine defs: 12073102
23:18:41.278 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1
23:18:41.278 Disk 0 Vendor: ST3250820AS 3.AAC Size: 238475MB BusType: 3
23:18:41.278 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP2T0L0-2
23:18:41.278 Disk 1 Vendor: ST3250820AS 3.AAC Size: 238475MB BusType: 3
23:18:41.574 Disk 0 MBR read successfully
23:18:41.574 Disk 0 MBR scan
23:18:41.574 Disk 0 Windows 7 default MBR code
23:18:41.637 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
23:18:41.699 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 102300 MB offset 206848
23:18:41.762 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 136073 MB offset 209717248
23:18:41.996 Disk 0 scanning sectors +488394752
23:18:42.557 Disk 0 scanning D:\Windows\system32\drivers
23:20:04.194 Service scanning
23:20:29.232 Modules scanning
23:21:06.438 Disk 0 trace - called modules:
23:21:06.532 ntkrnlpa.exe CLASSPNP.SYS disk.sys ataport.SYS halmacpi.dll intelide.sys PCIIDEX.SYS atapi.sys
23:21:06.532 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86378460]
23:21:06.547 3 CLASSPNP.SYS[8b5a759e] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-1[0x85ec2030]
23:21:07.125 AVAST engine scan D:\Windows
23:21:14.737 AVAST engine scan D:\Windows\system32
23:40:57.059 AVAST engine scan D:\Windows\system32\drivers
23:43:44.871 AVAST engine scan D:\Users\Markus
23:54:18.220 Disk 0 MBR has been saved successfully to "D:\Users\Markus\Desktop\MBR.dat"
23:54:18.235 The log file has been saved successfully to "D:\Users\Markus\Desktop\aswMBR.txt"
lg
Don Camillo
aswMBR.exe und speichere die Datei auf deinem Desktop.