Trojaner-Board - Google-Links auf S**-Seiten weitergeleitet

So, gmer ist wie angekündigt beide male abgeschmiert...
Hier dann die anderen beiden angeforderten Logs:

____________________________________________________________________

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer: Quanta
BIOS Manufacturer: Hewlett-Packard
System Manufacturer: Hewlett-Packard
System Product Name: HP Pavilion dv6 Notebook PC
Logical Drives Mask: 0x0000005c

Kernel Drivers (total 208):
0x82451000 \SystemRoot\system32\ntkrnlpa.exe
0x8241E000 \SystemRoot\system32\hal.dll
0x8040B000 \SystemRoot\system32\kdcom.dll
0x80412000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x80482000 \SystemRoot\system32\PSHED.dll
0x80493000 \SystemRoot\system32\BOOTVID.dll
0x8049B000 \SystemRoot\system32\CLFS.SYS
0x804DC000 \SystemRoot\system32\CI.dll
0x805BC000 \SystemRoot\system32\drivers\klmdb.sys
0x80601000 \SystemRoot\system32\drivers\Wdf01000.sys
0x8067D000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x8068A000 \SystemRoot\System32\Drivers\sptd.sys
0x8078B000 \SystemRoot\System32\Drivers\WMILIB.SYS
0x80794000 \SystemRoot\System32\Drivers\SCSIPORT.SYS
0x807BA000 \SystemRoot\system32\drivers\acpi.sys
0x805CE000 \SystemRoot\system32\drivers\msisadrv.sys
0x805D6000 \SystemRoot\system32\drivers\pci.sys
0x82A06000 \SystemRoot\system32\drivers\isapnp.sys
0x82A15000 \SystemRoot\system32\drivers\mpio.sys
0x82A31000 \SystemRoot\System32\drivers\partmgr.sys
0x82A40000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x82A43000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x82A4D000 \SystemRoot\system32\drivers\volmgr.sys
0x82A5C000 \SystemRoot\System32\drivers\volmgrx.sys
0x82AA6000 \SystemRoot\system32\drivers\intelide.sys
0x82AAD000 \SystemRoot\system32\drivers\PCIIDEX.SYS
0x82ABB000 \SystemRoot\system32\drivers\aliide.sys
0x82AC2000 \SystemRoot\system32\drivers\amdide.sys
0x82AC9000 \SystemRoot\system32\drivers\cmdide.sys
0x82AD1000 \SystemRoot\System32\drivers\mountmgr.sys
0x82AE1000 \SystemRoot\system32\drivers\msdsm.sys
0x82AFB000 \SystemRoot\system32\drivers\nvraid.sys
0x82B16000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x82B37000 \SystemRoot\system32\drivers\pciide.sys
0x82B3E000 \SystemRoot\system32\drivers\viaide.sys
0x82B46000 \SystemRoot\system32\drivers\iastorv.sys
0x82BE7000 \SystemRoot\system32\drivers\atapi.sys
0x83002000 \SystemRoot\system32\drivers\ataport.SYS
0x83020000 \SystemRoot\system32\drivers\lsi_scsi.sys
0x8303A000 \SystemRoot\system32\drivers\storport.sys
0x8307B000 \SystemRoot\system32\drivers\msahci.sys
0x83085000 \SystemRoot\system32\drivers\hpcisss.sys
0x83090000 \SystemRoot\system32\drivers\adp94xx.sys
0x830FA000 \SystemRoot\system32\drivers\adpahci.sys
0x83146000 \SystemRoot\system32\drivers\adpu160m.sys
0x83161000 \SystemRoot\system32\drivers\adpu320.sys
0x83187000 \SystemRoot\system32\drivers\djsvs.sys
0x8319B000 \SystemRoot\system32\drivers\arc.sys
0x831B1000 \SystemRoot\system32\drivers\arcsas.sys
0x83209000 \SystemRoot\system32\drivers\elxstor.sys
0x8329D000 \SystemRoot\system32\drivers\i2omp.sys
0x832A7000 \SystemRoot\system32\drivers\iirsp.sys
0x832B7000 \SystemRoot\system32\drivers\iteatapi.sys
0x832C3000 \SystemRoot\system32\drivers\iteraid.sys
0x832CF000 \SystemRoot\system32\drivers\lsi_fc.sys
0x832E9000 \SystemRoot\system32\drivers\lsi_sas.sys
0x83301000 \SystemRoot\system32\drivers\megasas.sys
0x8330B000 \SystemRoot\system32\drivers\megasr.sys
0x833C2000 \SystemRoot\system32\drivers\mraid35x.sys
0x833CD000 \SystemRoot\system32\drivers\nfrd960.sys
0x833DB000 \SystemRoot\system32\drivers\nvstor.sys
0x8B205000 \SystemRoot\system32\drivers\ql2300.sys
0x8B33D000 \SystemRoot\system32\drivers\ql40xx.sys
0x8B392000 \SystemRoot\system32\drivers\sisraid2.sys
0x8B39F000 \SystemRoot\system32\drivers\sisraid4.sys
0x8B3B4000 \SystemRoot\system32\drivers\symc8xx.sys
0x8B3C0000 \SystemRoot\system32\drivers\sym_hi.sys
0x8B3CB000 \SystemRoot\system32\drivers\sym_u3.sys
0x8B400000 \SystemRoot\system32\drivers\uliahci.sys
0x8B43C000 \SystemRoot\system32\drivers\ulsata.sys
0x8B45D000 \SystemRoot\system32\drivers\ulsata2.sys
0x8B489000 \SystemRoot\system32\drivers\vsmraid.sys
0x8B4AA000 \SystemRoot\system32\drivers\fltmgr.sys
0x8B4DC000 \SystemRoot\system32\drivers\fileinfo.sys
0x8B4EC000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8B60E000 \SystemRoot\system32\drivers\ndis.sys
0x8B719000 \SystemRoot\system32\drivers\msrpc.sys
0x8B744000 \SystemRoot\system32\drivers\NETIO.SYS
0x8B803000 \SystemRoot\System32\drivers\tcpip.sys
0x8B8ED000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8BA0B000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8BB1B000 \SystemRoot\system32\drivers\wd.sys
0x8BB23000 \SystemRoot\system32\drivers\volsnap.sys
0x8BB5C000 \SystemRoot\System32\Drivers\spldr.sys
0x8BB64000 \SystemRoot\system32\drivers\sbp2port.sys
0x8BB79000 \SystemRoot\System32\Drivers\mup.sys
0x8BB88000 \SystemRoot\System32\drivers\ecache.sys
0x8BBAF000 \SystemRoot\system32\DRIVERS\hpdskflt.sys
0x8BBB8000 \SystemRoot\system32\drivers\disk.sys
0x8BBC9000 \SystemRoot\system32\drivers\crcdisk.sys
0x8BBF4000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x8BA00000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x8B908000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x8B917000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x8F601000 \SystemRoot\system32\DRIVERS\atikmdag.sys
0x8B91B000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8FBE6000 \SystemRoot\System32\drivers\watchdog.sys
0x8B55D000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8FBF2000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x8B9BB000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8B77F000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8FC02000 \SystemRoot\system32\DRIVERS\NETw5v32.sys
0x8FF8B000 \SystemRoot\system32\DRIVERS\Rtlh86.sys
0x8FFAD000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x8FFBD000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x8FFCB000 \SystemRoot\system32\DRIVERS\jmcr.sys
0x8FFE8000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x8FFFB000 \SystemRoot\system32\DRIVERS\HpqKbFiltr.sys
0x8B78E000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x8B799000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x8FC00000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x8B7C9000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x8B7D4000 \SystemRoot\system32\DRIVERS\enecir.sys
0x8B3D6000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8B9F9000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x8B7EC000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x8B7F5000 \SystemRoot\system32\DRIVERS\Accelerometer.sys
0x831C7000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8B600000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x833E8000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8B5EA000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x90202000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x90225000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x90234000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x90248000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x9025D000 \SystemRoot\system32\DRIVERS\termdd.sys
0x9026D000 \SystemRoot\system32\DRIVERS\swenum.sys
0x9026F000 \SystemRoot\system32\DRIVERS\ks.sys
0x90299000 \SystemRoot\system32\DRIVERS\circlass.sys
0x902A7000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x902B1000 \SystemRoot\system32\DRIVERS\umbus.sys
0x902BE000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x902F3000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x90304000 \SystemRoot\system32\drivers\HdAudio.sys
0x90343000 \SystemRoot\system32\drivers\portcls.sys
0x90370000 \SystemRoot\system32\drivers\drmk.sys
0x90395000 \SystemRoot\system32\DRIVERS\stwrt.sys
0x8B5F5000 \SystemRoot\system32\DRIVERS\hidir.sys
0x8B3EE000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x903F9000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x83200000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x831F6000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x82BEF000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x82BF8000 \SystemRoot\System32\Drivers\Null.SYS
0x80400000 \SystemRoot\System32\Drivers\Beep.SYS
0x9040C000 \SystemRoot\System32\drivers\vga.sys
0x90418000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x90439000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x90441000 \SystemRoot\system32\drivers\rdpencdd.sys
0x90449000 \SystemRoot\System32\Drivers\Msfs.SYS
0x90454000 \SystemRoot\System32\Drivers\Npfs.SYS
0x90462000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x9046B000 \SystemRoot\system32\DRIVERS\tdx.sys
0x90481000 \SystemRoot\system32\DRIVERS\smb.sys
0x90495000 \SystemRoot\system32\drivers\afd.sys
0x904DD000 \SystemRoot\System32\DRIVERS\netbt.sys
0x9050F000 \SystemRoot\system32\DRIVERS\pacer.sys
0x90525000 \SystemRoot\system32\DRIVERS\netbios.sys
0x90533000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x90546000 \SystemRoot\System32\drivers\truecrypt.sys
0x9057D000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0x90583000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x905BF000 \SystemRoot\system32\drivers\nsiproxy.sys
0x905C9000 \SystemRoot\System32\Drivers\dfsc.sys
0x90601000 \SystemRoot\system32\DRIVERS\avipbb.sys
0x90627000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys
0x90629000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x90632000 \SystemRoot\System32\Drivers\fastfat.SYS
0x9065A000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x90671000 \SystemRoot\System32\Drivers\usbvideo.sys
0x90692000 \SystemRoot\system32\DRIVERS\udfs.sys
0x906CD000 \SystemRoot\System32\Drivers\crashdmp.sys
0x906DA000 \SystemRoot\System32\Drivers\dump_dumpata.sys
0x906E5000 \SystemRoot\System32\Drivers\dump_msahci.sys
0x982F0000 \SystemRoot\System32\win32k.sys
0x906EF000 \SystemRoot\System32\drivers\Dxapi.sys
0x906F9000 \SystemRoot\system32\DRIVERS\monitor.sys
0x98510000 \SystemRoot\System32\TSDDD.dll
0x98530000 \SystemRoot\System32\cdd.dll
0x90708000 \SystemRoot\system32\drivers\luafv.sys
0x90723000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0x90738000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x90748000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x90772000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x9077C000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x9CA07000 \SystemRoot\system32\drivers\spsys.sys
0x9CAB7000 \SystemRoot\system32\drivers\HTTP.sys
0x9CB24000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x9CB41000 \SystemRoot\system32\DRIVERS\bowser.sys
0x9CB5A000 \SystemRoot\System32\drivers\mpsdrv.sys
0x9CB6F000 \SystemRoot\system32\drivers\mrxdav.sys
0x9CB90000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x9CBAF000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x9CBE8000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x9078F000 \SystemRoot\System32\DRIVERS\srv2.sys
0x9E206000 \SystemRoot\System32\DRIVERS\srv.sys
0x9E26C000 \SystemRoot\system32\DRIVERS\atksgt.sys
0x9E295000 \SystemRoot\system32\DRIVERS\hwpsgt.sys
0x9E2B7000 \SystemRoot\system32\DRIVERS\lemsgt.sys
0x9E2BA000 \SystemRoot\system32\DRIVERS\lirsgt.sys
0x9E2BF000 \SystemRoot\system32\drivers\peauth.sys
0x9E39D000 \SystemRoot\System32\Drivers\secdrv.SYS
0x9E3A7000 \SystemRoot\System32\drivers\tcpipreg.sys
0x9E3B3000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
0x9E3C8000 \SystemRoot\system32\DRIVERS\WUDFPf.sys
0x907B7000 \??\C:\Program Files\Hewlett-Packard\Media\DVD\000.fcl
0x9E3DA000 \??\C:\Users\user\AppData\Local\Temp\axldypog.sys
0x77AB0000 \Windows\System32\ntdll.dll

Processes (total 88):
0 System Idle Process
4 System
512 C:\Windows\System32\smss.exe
584 csrss.exe
648 C:\Windows\System32\wininit.exe
656 csrss.exe
692 C:\Windows\System32\services.exe
708 C:\Windows\System32\lsass.exe
716 C:\Windows\System32\lsm.exe
800 C:\Windows\System32\winlogon.exe
908 C:\Windows\System32\svchost.exe
992 C:\Windows\System32\svchost.exe
1032 C:\Windows\System32\svchost.exe
1084 C:\Windows\System32\Ati2evxx.exe
1100 C:\Windows\System32\svchost.exe
1132 C:\Windows\System32\svchost.exe
1152 C:\Windows\System32\svchost.exe
1196 C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_52c73ccb\stacsv.exe
1300 C:\Windows\System32\audiodg.exe
1516 C:\Windows\System32\SLsvc.exe
1536 C:\Windows\System32\svchost.exe
1596 C:\Windows\System32\Ati2evxx.exe
1640 C:\Windows\System32\hpservice.exe
1696 C:\Windows\System32\svchost.exe
1884 C:\Windows\System32\spoolsv.exe
1908 C:\Program Files\Avira\AntiVir Desktop\sched.exe
1920 C:\Windows\System32\svchost.exe
556 C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_52c73ccb\AEstSrv.exe
560 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
740 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
896 C:\Windows\System32\svchost.exe
1176 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
2188 C:\Program Files\PostgreSQL\8.3\bin\pg_ctl.exe
2204 C:\Windows\System32\svchost.exe
2228 C:\Program Files\SMINST\BLService.exe
2244 postgres.exe
2272 C:\Program Files\CyberLink\Shared files\RichVideo.exe
2308 C:\Windows\System32\svchost.exe
2352 C:\Windows\System32\svchost.exe
2464 C:\Windows\System32\SearchIndexer.exe
2560 WUDFHost.exe
2744 postgres.exe
2796 postgres.exe
2808 postgres.exe
2816 postgres.exe
2824 postgres.exe
3076 C:\Windows\System32\taskeng.exe
3300 C:\Windows\System32\dwm.exe
3312 C:\Windows\System32\taskeng.exe
3396 C:\Program Files\Google\Update\GoogleUpdate.exe
3416 C:\Windows\explorer.exe
3764 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
3772 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
3856 C:\Program Files\Hewlett-Packard\Media\DVD\DVDAgent.exe
3976 C:\Program Files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe
3992 C:\Program Files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
4032 C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
1412 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
2336 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
2460 C:\Program Files\Winamp\winampa.exe
2480 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
988 C:\Program Files\Hewlett-Packard\Media\TV\TVAgent.exe
2108 C:\Program Files\Epson Software\Event Manager\EEventManager.exe
2112 C:\Windows\WindowsMobile\wmdSync.exe
936 C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
3032 C:\Windows\System32\svchost.exe
3116 C:\Program Files\iTunes\iTunesHelper.exe
1268 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
3480 C:\Windows\ehome\ehtray.exe
3640 C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
3244 C:\Program Files\Windows Media Player\wmpnscfg.exe
3060 WmiPrvSE.exe
1396 C:\Windows\ehome\ehmsas.exe
2216 C:\Program Files\Windows Media Player\wmpnetwk.exe
4016 C:\Windows\System32\mobsync.exe
3464 C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
4572 C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
4972 C:\Program Files\iPod\bin\iPodService.exe
5144 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
5356 C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
5724 C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
6084 C:\Windows\System32\svchost.exe
6140 C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
5256 C:\Program Files\Opera\opera.exe
5848 <unknown>
3460 <unknown>
4872 C:\Users\user\Desktop\MBRCheck.exe
2148 C:\Windows\System32\conime.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000047`dd500000 (NTFS)

PhysicalDrive0 Model Number: FUJITSUMHZ2320BHG2, Rev: 8909

Size Device Name MBR Status
--------------------------------------------
298 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: E6CCDBFD8F5B3DAA80CE1AA64C67955A606A347D

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!

___________________________________________________________________________

OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 15:34:29 on 25.03.2011
 

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit

Default Browser: Opera Software Opera Internet Browser 11.01
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"Google Software Updater.job" - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"hpaccelerometercp.CPL" - "Hewlett-Packard Corporation" - C:\Windows\system32\hpaccelerometercp.CPL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"ProtectSmart Hard Drive Protection" - "Hewlett-Packard Corporation" - C:\Windows\system32\hpaccelerometercp.CPL

"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"atksgt" (atksgt) - ? - C:\Windows\System32\DRIVERS\atksgt.sys  (File found, but it contains no detailed information)

"avgio" (avgio) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avgio.sys

"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys

"axldypog" (axldypog) - ? - C:\Users\user\AppData\Local\Temp\axldypog.sys  (Hidden registry entry, rootkit activity | File not found)

"catchme" (catchme) - ? - C:\coFix\catchme.sys  (File not found)

"hwpsgt" (hwpsgt) - ? - C:\Windows\System32\DRIVERS\hwpsgt.sys  (File found, but it contains no detailed information)

"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)

"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)

"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)

"lemsgt" (lemsgt) - ? - C:\Windows\System32\DRIVERS\lemsgt.sys  (File found, but it contains no detailed information)

"lirsgt" (lirsgt) - ? - C:\Windows\System32\DRIVERS\lirsgt.sys  (File found, but it contains no detailed information)

"Power Control [2009/07/16 07:38:20]" ({55662437-DA8C-40c0-AADA-2C816A897A49}) - ? - C:\Program Files\Hewlett-Packard\Media\DVD\000.fcl

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys

"StarOpen" (StarOpen) - ? - C:\Windows\system32\drivers\StarOpen.sys  (File found, but it contains no detailed information)

"truecrypt" (truecrypt) - "TrueCrypt Foundation" - C:\Windows\System32\drivers\truecrypt.sys
 

[Explorer]

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{10880D85-AAD9-4558-ABDC-2AB1552D831F} "LightScribe Control Panel" - "Hewlett-Packard Company" - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll

{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----

{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)

{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll

{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)

{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)

{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll

{8D1636FD-CA49-4B4E-90E4-0A20E03A15E8} "JetFlExt Class" - "COWON America" - C:\Program Files\JetAudio\JetFlExt.dll

{00020d75-0000-0000-c000-000000000046} "lnkfile" - ? -   (File not found | COM-object registry key not found)

{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D} "Meine freigegebenen Ordner" - "Microsoft Corporation" - C:\Program Files\MSN Messenger\fsshext.8.1.0178.00.dll

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONFILTER.DLL

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll

{7F67036B-66F1-411A-AD85-759FB9C5B0DB} "ShellViewRTF" - "XSS" - C:\Program Files\Sminst\ShellvRTF.dll

{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - "Advanced Micro Devices, Inc." - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll

{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

<binary data> "{32099AAC-C132-4136-9E9A-4E364A424E17}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_19" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab

{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} "Java Plug-in 1.6.0_19" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_19" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_19.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab

{233C1507-6A77-46A4-9443-F871F945D258} "Shockwave ActiveX Control" - "Adobe Systems, Inc." - C:\Windows\system32\Adobe\Director\SwDir.dll / hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

{BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} "Zylom Games Player" - "Zylom Games" - C:\Windows\Downloaded Program Files\zylomgamesplayer.dll / hxxp://game.zylom.com/activex/zylomgamesplayer.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

"ICQ7.4" - "ICQ, LLC." - C:\Program Files\ICQ7.4\ICQ.exe

"PartyPoker.com" - ? - C:\Programs\PartyGaming\PartyPoker\RunApp.exe  (File not found)

"PokerStars" - "PokerStars" - C:\Program Files\PokerStars\PokerStarsUpdate.exe

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "SSVHelper Class" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\ssv.dll

{7E853D72-626A-48EC-A868-BA8D5E23E045} "{7E853D72-626A-48EC-A868-BA8D5E23E045}" - ? -   (File not found | COM-object registry key not found)
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE  (Shortcut exists | File exists)

"desktop.ini" - ? - C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"Anleitung.exe" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Anleitung.exe

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"DAEMON Tools Lite" - "DT Soft Ltd" - "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun

"LightScribe Control Panel" - "Hewlett-Packard Company" - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"AppleSyncNotifier" - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

"CLMLServer for HP TouchSmart" - "CyberLink" - "C:\Program Files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe"

"DVDAgent" - "CyberLink Corp." - "C:\Program Files\Hewlett-Packard\Media\DVD\DVDAgent.exe"

"EEventManager" - "SEIKO EPSON CORPORATION" - C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe

"HP Health Check Scheduler" - "Hewlett-Packard" - c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

"HP Software Update" - "Hewlett-Packard" - C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe

"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"

"Malwarebytes' Anti-Malware (reboot)" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

"QlbCtrl.exe" - " Hewlett-Packard Development Company, L.P." - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start

"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime

"StartCCC" - "Advanced Micro Devices, Inc." - "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

"TSMAgent" - "CyberLink Corp." - "C:\Program Files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe"

"TVAgent" - "CyberLink Corp." - "C:\Program Files\Hewlett-Packard\Media\TV\TVAgent.exe"

"UCam_Menu" - "CyberLink Corp." - "C:\Program Files\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Hewlett-Packard\Media\Webcam" update "Software\Hewlett-Packard\Media\Webcam"

"UpdateLBPShortCut" - "CyberLink Corp." - "C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"

"UpdateP2GoShortCut" - "CyberLink Corp." - "C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"

"UpdatePDIRShortCut" - "CyberLink Corp." - "C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerDirector" UpdateWithCreateOnce "SOFTWARE\CyberLink\PowerDirector\7.0"

"UpdatePSTShortCut" - "CyberLink Corp." - "C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"

"WinampAgent" - ? - "C:\Program Files\Winamp\winampa.exe"  (File found, but it contains no detailed information)

"WirelessAssistant" - "Hewlett-Packard" - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

"ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe

"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe

"Com4QLBEx" (Com4QLBEx) - "Hewlett-Packard Development Company, L.P." - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe

"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files\CyberLink\Shared files\RichVideo.exe

"Easybits Shared Services for Windows" (ezSharedSvc) - "EasyBits Sofware AS" - C:\Windows\System32\ezsvc7.dll

"GamesAppService" (GamesAppService) - "WildTangent, Inc." - C:\Program Files\WildTangent Games\App\GamesAppService.exe

"Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

"HP Health Check Service" (HP Health Check Service) - "Hewlett-Packard" - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe

"hpqwmiex" (hpqwmiex) - "Hewlett-Packard Development Company, L.P." - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe

"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"PostgreSQL Database Server 8.3" (pgsql-8.3) - "PostgreSQL Global Development Group" - C:\Program Files\PostgreSQL\8.3\bin\pg_ctl.exe

"Recovery Service for Windows" (Recovery Service for Windows) - ? - C:\Program Files\SMINST\BLService.exe
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----

"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru