Hallo,
hier kommt erst mal die GMER log: Code:
GMER 1.0.15.15281 - hxxp://www.gmer.net
Rootkit scan 2010-09-02 14:42:57
Windows 5.1.2600 Service Pack 3
Running: dsmxs0qz.exe; Driver: C:\DOKUME~1\RALFSI~1\LOKALE~1\Temp\kwtyraoc.sys
---- System - GMER 1.0.15 ----
SSDT F8BCC466 ZwCreateKey
SSDT F8BCC45C ZwCreateThread
SSDT F8BCC46B ZwDeleteKey
SSDT F8BCC475 ZwDeleteValueKey
SSDT F8BCC47A ZwLoadKey
SSDT F8BCC448 ZwOpenProcess
SSDT F8BCC44D ZwOpenThread
SSDT F8BCC484 ZwReplaceKey
SSDT F8BCC47F ZwRestoreKey
SSDT F8BCC470 ZwSetValueKey
---- Kernel code sections - GMER 1.0.15 ----
.text C:\WINDOWS\System32\DRIVERS\nv4_mini.sys section is writeable [0xF7B1C360, 0x307F47, 0xE8000020]
---- Devices - GMER 1.0.15 ----
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
---- EOF - GMER 1.0.15 ----
und jetzt noch osam: Code:
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>Report of OSAM: Autorun Manager v5.0.11926.0</title>
<style type="text/css">
body
{
margin : 10px 10px 10px 20px;
color : #000000;
background-color : #fffbf0;
font : 10pt Tahoma, Verdana, Arial, Helvetica, sans-serif;
scrollbar-3dlight-color : #fffbf0;
scrollbar-arrow-color : #000000;
scrollbar-darkshadow-color: #000000;
scrollbar-face-color : #fffbf0;
scrollbar-highlight-color : #000000;
scrollbar-shadow-color : #fffbf0;
scrollbar-track-color : #fffbf0;
}
a:link
{
color: #e15616;
}
a:visited
{
color: #e15616;
}
a:hover
{
color: #e4743f;
}
a:active
{
color: #e4743f;
}
.header1
{
font-size : 115%;
font-weight: bold;
margin-left: 0px;
}
table
{
border-collapse: collapse;
border : 1px solid #000000;
cellpadding : 0;
cellspacing : 0;
width : 90%;
}
td,th
{
font-size : 12px;
color : #000000;
background : #fffbf0;
border : 1px solid #000000;
text-align : left;
vertical-align: top;
padding : 2px 4px 2px 4px;
}
.cap
{
font-weight: bold;
font-size : 10pt;
padding : 2px 4px 2px 4px;
border : 1px solid #000000;
}
.group
{
font-weight: bold;
font-size : 10pt;
padding : 2px 4px 2px 4px;
text-align : center;
}
.reg
{
font-weight: bold;
font-size : 10pt;
border : 0px none;
padding : 2px 4px 2px 4px;
}
.notfound
{
background-color: #B3DDFF;
}
.blocked
{
background-color: #FF96EB;
}
.nodetails
{
background-color: #FFFF75;
}
.trusted
{
background-color: #C8FFC8;
}
.rootkit
{
background-color: #FF8696;
}
td.rs { text-align: center; vertical-align: center; font-family: courier; }
td.rs.rm { background: #F90424; title: "Malware"; }
td.rs.ri { background: #F90424; title: "Infected"; color: #21F411; }
td.rs.rw { background: #F90424; title: "Unwanted"; }
td.rs.rs { background: #F90424; title: "Suspicious"; }
td.rs.rt { background: #21F411; title: "Trusted"; }
td.rs.rc { background: #21F411; title: "Checked"; }
td.rs.ry { background: #21F411; title: "Up-to-You"; }
td.rs.rr { background: #F6EB13; title: "Riskware"; }
td.rs.ru { background: #D4D0C8; title: "Unknown"; }
td.rs.rn { background: #FFFFFF; title: "Not checked"; }
</style>
</head>
<body>
<p><span class="header1">Report of OSAM: Autorun Manager v5.0.11926.0</span><br>
<a href="hxxp://www.online-solutions.ru/en/" target="_blank">hxxp://www.online-solutions.ru/en/</a><br>
Saved at 14:58:44 on 02.09.2010</p>
<b>OS</b>: Windows XP Home Edition Service Pack 3 (Build 2600)<br>
<b>Default Browser</b>: Mozilla Corporation Firefox 3.6.8<br>
<br><b>Scanner Settings</b><br>
<input type="checkbox" disabled checked>Rootkits detection (hidden registry)<br>
<input type="checkbox" disabled checked>Rootkits detection (hidden files)<br>
<input type="checkbox" disabled checked>Retrieve files information<br>
<input type="checkbox" disabled checked>Check Microsoft signatures<br>
<br><b>Filters</b><br>
<input type="checkbox" disabled>Trusted entries<br>
<input type="checkbox" disabled>Empty entries<br>
<input type="checkbox" disabled checked>Hidden registry entries (rootkit activity)<br>
<input type="checkbox" disabled checked>Exclusively opened files<br>
<input type="checkbox" disabled checked>Not found files<br>
<input type="checkbox" disabled checked>Files without detailed information<br>
<input type="checkbox" disabled checked>Existing files<br>
<input type="checkbox" disabled>Non-startable services<br>
<input type="checkbox" disabled>Non-startable drivers<br>
<input type="checkbox" disabled checked>Active entries<br>
<input type="checkbox" disabled checked>Disabled entries<br>
<br>
<table border="1" cellpadding="0" cellspacing="0">
<tr>
<th class="cap" width="20"> </th>
<th class="cap">Risk</th>
<th class="cap">Name</th>
<th class="cap">Publisher</th>
<th class="cap">Full Path</th>
<th class="cap">Status</th>
</tr>
<tr>
<td class="group" colspan="6">Common</td>
</tr>
<tr>
<td class="reg" colspan="6">%SystemRoot%\Tasks</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs ry">|||| </td>
<td>"AppleSoftwareUpdate.job"</td>
<td>"Apple Inc."</td>
<td>C:\Programme\Apple Software Update\SoftwareUpdate.exe</td>
<td>File exists</td>
</tr>
<tr>
<td class="group" colspan="6">Control Panel Objects</td>
</tr>
<tr>
<td class="reg" colspan="6">%SystemRoot%\system32</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>"infocardcpl.cpl"</td>
<td>"Microsoft Corporation"</td>
<td>C:\WINDOWS\system32\infocardcpl.cpl</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>"javacpl.cpl"</td>
<td>"Sun Microsystems, Inc."</td>
<td>C:\WINDOWS\system32\javacpl.cpl</td>
<td>File exists</td>
</tr>
<tr>
<td class="reg" colspan="6">HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>"Avira AntiVir Personal"</td>
<td>"Avira GmbH"</td>
<td>C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>"QuickTime"</td>
<td>"Apple Inc."</td>
<td>C:\Programme\QuickTime\QTSystem\QuickTime.cpl</td>
<td>File exists</td>
</tr>
<tr>
<td class="group" colspan="6">Drivers</td>
</tr>
<tr>
<td class="reg" colspan="6">HKLM\SYSTEM\CurrentControlSet\Services</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>"avgio" (avgio)</td>
<td>"Avira GmbH"</td>
<td>C:\Programme\Avira\AntiVir Desktop\avgio.sys</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>"avgntflt" (avgntflt)</td>
<td>"Avira GmbH"</td>
<td>C:\WINDOWS\System32\DRIVERS\avgntflt.sys</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>"avipbb" (avipbb)</td>
<td>"Avira GmbH"</td>
<td>C:\WINDOWS\System32\DRIVERS\avipbb.sys</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>"AVM Eject" (avmeject)</td>
<td>"AVM Berlin"</td>
<td>C:\WINDOWS\System32\drivers\avmeject.sys</td>
<td>File exists</td>
</tr>
<tr>
<td class="notfound"><input type="checkbox" disabled checked></td>
<td class="rs rn"> </td>
<td class="notfound">"catchme" (catchme)</td>
<td class="notfound"></td>
<td class="notfound">C:\DOKUME~1\RALFSI~1\LOKALE~1\Temp\catchme.sys</td>
<td class="notfound">File not found</td>
</tr>
<tr>
<td class="notfound"><input type="checkbox" disabled checked></td>
<td class="rs rn"> </td>
<td class="notfound">"Changer" (Changer)</td>
<td class="notfound"></td>
<td class="notfound">C:\WINDOWS\system32\drivers\Changer.sys</td>
<td class="notfound">File not found</td>
</tr>
<tr>
<td class="notfound"><input type="checkbox" disabled checked></td>
<td class="rs rn"> </td>
<td class="notfound">"i2omgmt" (i2omgmt)</td>
<td class="notfound"></td>
<td class="notfound">C:\WINDOWS\system32\drivers\i2omgmt.sys</td>
<td class="notfound">File not found</td>
</tr>
<tr>
<td class="rootkit"><input type="checkbox" disabled checked></td>
<td class="rs rn"> </td>
<td class="rootkit">"kwtyraoc" (kwtyraoc)</td>
<td class="rootkit"></td>
<td class="rootkit">C:\DOKUME~1\RALFSI~1\LOKALE~1\Temp\kwtyraoc.sys</td>
<td class="rootkit">Hidden registry entry, rootkit activity | File not found</td>
</tr>
<tr>
<td class="notfound"><input type="checkbox" disabled checked></td>
<td class="rs rn"> </td>
<td class="notfound">"lbrtfdc" (lbrtfdc)</td>
<td class="notfound"></td>
<td class="notfound">C:\WINDOWS\system32\drivers\lbrtfdc.sys</td>
<td class="notfound">File not found</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>"MACNDIS5 NDIS Protocol Driver" (MACNDIS5)</td>
<td>"Marmiko IT-Solutions GmbH"</td>
<td>C:\PROGRA~1\GEMEIN~1\MARMIK~1\MACNDIS5.SYS</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>"MIINPazX NDIS Protocol Driver" (MIINPazX)</td>
<td>"Deutsche Telekom AG, Marmiko IT-Solutions GmbH"</td>
<td>C:\PROGRA~1\GEMEIN~1\MARMIK~1\MInfraIS\MIINPazX.SYS</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>"MTOnlPktAlyX NDIS Protocol Driver" (MTOnlPktAlyX)</td>
<td>"Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH"</td>
<td>C:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis1\MTOnlPktAlyX.SYS</td>
<td>File exists</td>
</tr>
<tr>
<td class="notfound"><input type="checkbox" disabled checked></td>
<td class="rs rn"> </td>
<td class="notfound">"PCIDump" (PCIDump)</td>
<td class="notfound"></td>
<td class="notfound">C:\WINDOWS\system32\drivers\PCIDump.sys</td>
<td class="notfound">File not found</td>
</tr>
<tr>
<td class="notfound"><input type="checkbox" disabled checked></td>
<td class="rs rn"> </td>
<td class="notfound">"PDCOMP" (PDCOMP)</td>
<td class="notfound"></td>
<td class="notfound">C:\WINDOWS\system32\drivers\PDCOMP.sys</td>
<td class="notfound">File not found</td>
</tr>
<tr>
<td class="notfound"><input type="checkbox" disabled checked></td>
<td class="rs rn"> </td>
<td class="notfound">"PDFRAME" (PDFRAME)</td>
<td class="notfound"></td>
<td class="notfound">C:\WINDOWS\system32\drivers\PDFRAME.sys</td>
<td class="notfound">File not found</td>
</tr>
<tr>
<td class="notfound"><input type="checkbox" disabled checked></td>
<td class="rs rn"> </td>
<td class="notfound">"PDRELI" (PDRELI)</td>
<td class="notfound"></td>
<td class="notfound">C:\WINDOWS\system32\drivers\PDRELI.sys</td>
<td class="notfound">File not found</td>
</tr>
<tr>
<td class="notfound"><input type="checkbox" disabled checked></td>
<td class="rs rn"> </td>
<td class="notfound">"PDRFRAME" (PDRFRAME)</td>
<td class="notfound"></td>
<td class="notfound">C:\WINDOWS\system32\drivers\PDRFRAME.sys</td>
<td class="notfound">File not found</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>"ssmdrv" (ssmdrv)</td>
<td>"Avira GmbH"</td>
<td>C:\WINDOWS\System32\DRIVERS\ssmdrv.sys</td>
<td>File exists</td>
</tr>
<tr>
<td class="notfound"><input type="checkbox" disabled checked></td>
<td class="rs rn"> </td>
<td class="notfound">"WDICA" (WDICA)</td>
<td class="notfound"></td>
<td class="notfound">C:\WINDOWS\system32\drivers\WDICA.sys</td>
<td class="notfound">File not found</td>
</tr>
<tr>
<td class="group" colspan="6">Explorer</td>
</tr>
<tr>
<td class="reg" colspan="6">HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath"</td>
<td>"Microsoft Corporation"</td>
<td>c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install</td>
<td>File exists</td>
</tr>
<tr>
<td class="reg" colspan="6">HKLM\Software\Classes\Folder\shellex\ColumnHandlers</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension"</td>
<td>"Adobe Systems, Inc."</td>
<td>C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll</td>
<td>File exists</td>
</tr>
<tr>
<td class="reg" colspan="6">HKLM\Software\Classes\Protocols\Filter</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1"</td>
<td>"Microsoft Corporation"</td>
<td>C:\WINDOWS\system32\mscoree.dll</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1"</td>
<td>"Microsoft Corporation"</td>
<td>C:\WINDOWS\system32\mscoree.dll</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1"</td>
<td>"Microsoft Corporation"</td>
<td>C:\WINDOWS\system32\mscoree.dll</td>
<td>File exists</td>
</tr>
<tr>
<td class="reg" colspan="6">HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs ry">|||| </td>
<td>{1C311AAA-D8B1-4A0A-BEE5-2387FEC583DA} "Burn4Freecontext menu"</td>
<td>"Ikysasoft s.r.l. uninominale"</td>
<td>C:\WINDOWS\system32\B4FM.dll</td>
<td>File exists</td>
</tr>
<tr>
<td class="notfound"><input type="checkbox" disabled checked></td>
<td class="rs rn"> </td>
<td class="notfound">{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung"</td>
<td class="notfound"></td>
<td class="notfound">deskpan.dll</td>
<td class="notfound">File not found</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>{1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache"</td>
<td>"Microsoft Corporation"</td>
<td>c:\WINDOWS\system32\mscoree.dll</td>
<td>File exists</td>
</tr>
<tr>
<td class="notfound"><input type="checkbox" disabled checked></td>
<td class="rs rn"> </td>
<td class="notfound">{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist"</td>
<td class="notfound"></td>
<td class="notfound"></td>
<td class="notfound">File not found | COM-object registry key not found</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes"</td>
<td>"Apple Inc."</td>
<td>C:\Programme\iTunes\iTunesMiniPlayer.dll</td>
<td>File exists</td>
</tr>
<tr>
<td class="notfound"><input type="checkbox" disabled checked></td>
<td class="rs rn"> </td>
<td class="notfound">{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung"</td>
<td class="notfound"></td>
<td class="notfound"></td>
<td class="notfound">File not found | COM-object registry key not found</td>
</tr>
<tr>
<td class="notfound"><input type="checkbox" disabled checked></td>
<td class="rs rn"> </td>
<td class="notfound">{32683183-48a0-441b-a342-7c2a440a9478} "Media Band"</td>
<td class="notfound"></td>
<td class="notfound"></td>
<td class="notfound">File not found | COM-object registry key not found</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning"</td>
<td>"Avira GmbH"</td>
<td>C:\Programme\Avira\AntiVir Desktop\shlext.dll</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References"</td>
<td>"Microsoft Corporation"</td>
<td>c:\WINDOWS\system32\dfshim.dll</td>
<td>File exists</td>
</tr>
<tr>
<td class="notfound"><input type="checkbox" disabled checked></td>
<td class="rs rn"> </td>
<td class="notfound">{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung"</td>
<td class="notfound"></td>
<td class="notfound"></td>
<td class="notfound">File not found | COM-object registry key not found</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References"</td>
<td>"Microsoft Corporation"</td>
<td>c:\WINDOWS\system32\dfshim.dll</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR"</td>
<td>"Alexander Roshal"</td>
<td>C:\Programme\WinRAR\rarext.dll</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>{E0D79304-84BE-11CE-9641-444553540000} "WinZip"</td>
<td>"WinZip Computing, Inc."</td>
<td>C:\PROGRA~1\WinZip\WZSHLSTB.DLL</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>{E0D79305-84BE-11CE-9641-444553540000} "WinZip"</td>
<td>"WinZip Computing, Inc."</td>
<td>C:\PROGRA~1\WinZip\WZSHLSTB.DLL</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>{E0D79306-84BE-11CE-9641-444553540000} "WinZip"</td>
<td>"WinZip Computing, Inc."</td>
<td>C:\PROGRA~1\WinZip\WZSHLSTB.DLL</td>
<td>File exists</td>
</tr>
<tr>
<td class="group" colspan="6">Internet Explorer</td>
</tr>
<tr>
<td class="reg" colspan="6">HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars</td>
</tr>
<tr>
<td class="notfound"><input type="checkbox" disabled checked></td>
<td class="rs rn"> </td>
<td class="notfound">{32683183-48a0-441b-a342-7c2a440a9478} "{32683183-48a0-441b-a342-7c2a440a9478}"</td>
<td class="notfound"></td>
<td class="notfound"></td>
<td class="notfound">File not found | COM-object registry key not found</td>
</tr>
<tr>
<td class="reg" colspan="6">HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser</td>
</tr>
<tr>
<td class="notfound"><input type="checkbox" disabled checked></td>
<td class="rs rn"> </td>
<td class="notfound">ITBar7Height "ITBar7Height"</td>
<td class="notfound"></td>
<td class="notfound"></td>
<td class="notfound">File not found | COM-object registry key not found</td>
</tr>
<tr>
<td class="notfound"><input type="checkbox" disabled checked></td>
<td class="rs rn"> </td>
<td class="notfound"><binary data> "ITBar7Layout"</td>
<td class="notfound"></td>
<td class="notfound"></td>
<td class="notfound">File not found | COM-object registry key not found</td>
</tr>
<tr>
<td class="notfound"><input type="checkbox" disabled checked></td>
<td class="rs rn"> </td>
<td class="notfound"><binary data> "ITBarLayout"</td>
<td class="notfound"></td>
<td class="notfound"></td>
<td class="notfound">File not found | COM-object registry key not found</td>
</tr>
<tr>
<td class="reg" colspan="6">HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs ry">|||| </td>
<td>{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} "Java Plug-in 1.4.2_03"<br>hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab</td>
<td>"JavaSoft / Sun Microsystems, Inc."</td>
<td>C:\Programme\Java\j2re1.4.2_03\bin\npjpi142_03.dll</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs ry">|||| </td>
<td>{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_20"<br>hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab</td>
<td>"Sun Microsystems, Inc."</td>
<td>C:\Programme\Java\jre6\bin\npjpi160_20.dll</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs ry">|||| </td>
<td>{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} "Java Plug-in 1.6.0_20"<br>hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab</td>
<td>"Sun Microsystems, Inc."</td>
<td>C:\Programme\Java\jre6\bin\npjpi160_20.dll</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs ry">|||| </td>
<td>{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_20"<br>hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab</td>
<td>"Sun Microsystems, Inc."</td>
<td>C:\Programme\Java\jre6\bin\npjpi160_20.dll</td>
<td>File exists</td>
</tr>
<tr>
<td class="reg" colspan="6">HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper"</td>
<td>"Adobe Systems Incorporated"</td>
<td>C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs ry">|||| </td>
<td>{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper"</td>
<td>"Sun Microsystems, Inc."</td>
<td>C:\Programme\Java\jre6\bin\jp2ssv.dll</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs ry">|||| </td>
<td>{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class"</td>
<td>"Sun Microsystems, Inc."</td>
<td>C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll</td>
<td>File exists</td>
</tr>
<tr>
<td class="group" colspan="6">Logon</td>
</tr>
<tr>
<td class="reg" colspan="6">%AllUsersProfile%\Startmenü\Programme\Autostart</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>"desktop.ini"</td>
<td></td>
<td>C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini</td>
<td>File exists</td>
</tr>
<tr>
<td class="reg" colspan="6">%UserProfile%\Startmenü\Programme\Autostart</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>"desktop.ini"</td>
<td></td>
<td>C:\Dokumente und Einstellungen\Ralf Sievert\Startmenü\Programme\Autostart\desktop.ini</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs ru"> </td>
<td>"Netzmanager.lnk"</td>
<td>"Deutsche Telekom AG"</td>
<td>C:\Programme\Netzmanager\netzmanager.exe</td>
<td>Shortcut exists | File exists</td>
</tr>
<tr>
<td class="reg" colspan="6">HKLM\Software\Microsoft\Windows\CurrentVersion\Run</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs ry">|||| </td>
<td>"Adobe ARM"</td>
<td>"Adobe Systems Incorporated"</td>
<td>"C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs ry">|||| </td>
<td>"Adobe Reader Speed Launcher"</td>
<td>"Adobe Systems Incorporated"</td>
<td>"C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>"avgnt"</td>
<td>"Avira GmbH"</td>
<td>"C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>"AVMWlanClient"</td>
<td>"AVM Berlin"</td>
<td>C:\Programme\avmwlanstick\wlangui.exe</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs ry">|||| </td>
<td>"iTunesHelper"</td>
<td>"Apple Inc."</td>
<td>"C:\Programme\iTunes\iTunesHelper.exe"</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs ry">|||| </td>
<td>"QuickTime Task"</td>
<td>"Apple Inc."</td>
<td>"C:\Programme\QuickTime\QTTask.exe" -atboottime</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs ry">|||| </td>
<td>"SunJavaUpdateSched"</td>
<td>"Sun Microsystems, Inc."</td>
<td>"C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"</td>
<td>File exists</td>
</tr>
<tr>
<td class="group" colspan="6">Services</td>
</tr>
<tr>
<td class="reg" colspan="6">HKLM\SYSTEM\CurrentControlSet\Services</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32)</td>
<td>"Microsoft Corporation"</td>
<td>C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe</td>
<td>File exists</td>
</tr>
<tr>
<td class="notfound"><input type="checkbox" disabled checked></td>
<td class="rs rn"> </td>
<td class="notfound">"Anwendungsverwaltung" (AppMgmt)</td>
<td class="notfound"></td>
<td class="notfound">C:\WINDOWS\System32\appmgmts.dll</td>
<td class="notfound">File not found</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>"Apple Mobile Device" (Apple Mobile Device)</td>
<td>"Apple Inc."</td>
<td>C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>"ASP.NET State Service" (aspnet_state)</td>
<td>"Microsoft Corporation"</td>
<td>C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>"Avira AntiVir Guard" (AntiVirService)</td>
<td>"Avira GmbH"</td>
<td>C:\Programme\Avira\AntiVir Desktop\avguard.exe</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>"Avira AntiVir Planer" (AntiVirSchedulerService)</td>
<td>"Avira GmbH"</td>
<td>C:\Programme\Avira\AntiVir Desktop\sched.exe</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>"AVM WLAN Connection Service" (AVM WLAN Connection Service)</td>
<td>"AVM Berlin"</td>
<td>C:\Programme\avmwlanstick\WlanNetService.exe</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>"Dienst "Bonjour"" (Bonjour Service)</td>
<td>"Apple Inc."</td>
<td>C:\Programme\Bonjour\mDNSResponder.exe</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>"iPod-Dienst" (iPod Service)</td>
<td>"Apple Inc."</td>
<td>C:\Programme\iPod\bin\iPodService.exe</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>"Java Quick Starter" (JavaQuickStarterService)</td>
<td>"Sun Microsystems, Inc."</td>
<td>C:\Programme\Java\jre6\bin\jqs.exe</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs ru"> </td>
<td>"Netzmanager Infrastruktur Informationssystem Dienst" (Netzmanager Service)</td>
<td>"Deutsche Telekom AG"</td>
<td>C:\Programme\Netzmanager\NMInfraIS2\Netzmanager_Service.exe</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>"T-Online WLAN Adapter Steuerungsdienst" (MZCCntrl)</td>
<td>"Deutsche Telekom AG, Marmiko IT-Solutions GmbH"</td>
<td>C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>"Windows CardSpace" (idsvc)</td>
<td>"Microsoft Corporation"</td>
<td>C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe</td>
<td>File exists</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0)</td>
<td>"Microsoft Corporation"</td>
<td>c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe</td>
<td>File exists</td>
</tr>
<tr>
<td class="group" colspan="6">Winlogon</td>
</tr>
<tr>
<td class="reg" colspan="6">HKCU\Control Panel\IOProcs</td>
</tr>
<tr>
<td class="notfound"><input type="checkbox" disabled checked></td>
<td class="rs rn"> </td>
<td class="notfound">"MVB"</td>
<td class="notfound"></td>
<td class="notfound">mvfs32.dll</td>
<td class="notfound">File not found</td>
</tr>
<tr>
<td class="reg" colspan="6">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions</td>
</tr>
<tr>
<td class="notfound"><input type="checkbox" disabled checked></td>
<td class="rs rn"> </td>
<td class="notfound">{c6dc5466-785a-11d2-84d0-00c04fb169f7} "Softwareinstallation"</td>
<td class="notfound"></td>
<td class="notfound">appmgmts.dll</td>
<td class="notfound">File not found</td>
</tr>
<tr>
<td class="group" colspan="6">Winsock Providers</td>
</tr>
<tr>
<td class="reg" colspan="6">HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries</td>
</tr>
<tr>
<td><input type="checkbox" disabled checked></td>
<td class="rs rt">||||||</td>
<td>"mdnsNSP"</td>
<td>"Apple Inc."</td>
<td>C:\Programme\Bonjour\mdnsNSP.dll</td>
<td>File exists</td>
</tr>
</table>
<p>If You have questions or want to get some help, You can visit <a href="hxxp://forum.online-solutions.ru" target="_blank">hxxp://forum.online-solutions.ru</a></p>
</body></html>
|
