OSAM Logfile:
Code:
Alles auswählen Aufklappen ATTFilter
Report of OSAM : Autorun Manager v5.0.11926.0
Online Solutions. Complex Protection for Information Systems
Saved at 15:33:32 on 02.06.2011
OS: Windows 2000 Professional Service Pack 4 (Build 2195)
Default Browser: Mozilla Corporation Firefox 4.0.1
Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures
Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries
[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"CTDetect.cpl" - "Creative Technology Ltd." - C:\WINNT\system32\CTDetect.cpl
"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINNT\system32\javacpl.cpl
"joy.cpl" - "Microsoft Corporation" - C:\WINNT\system32\joy.cpl
"nvtuicpl.cpl" - "NVIDIA Corporation" - C:\WINNT\system32\nvtuicpl.cpl
"slcpappl.cpl" - ? - C:\WINNT\system32\slcpappl.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Avira AntiVir Personal" - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINNT\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\WINNT\System32\DRIVERS\avipbb.sys
"Bluetooth Audio Service" (BlueletAudio) - ? - C:\WINNT\System32\DRIVERS\blueletaudio.sys (File not found)
"Bluetooth HID Enumerator" (BTHidEnum) - ? - C:\WINNT\System32\Drivers\vbtenum.sys (File not found)
"Bluetooth HID Manager Service" (BTHidMgr) - ? - C:\WINNT\System32\Drivers\BTHidMgr.sys (File not found)
"Bluetooth PAN Network Adapter" (BT) - ? - C:\WINNT\System32\DRIVERS\btnetdrv.sys (File not found)
"Bluetooth SCO Audio Service" (BlueletSCOAudio) - ? - C:\WINNT\System32\DRIVERS\BlueletSCOAudio.sys (File not found)
"Bluetooth USB For Bluetooth Service" (Btcsrusb) - ? - C:\WINNT\System32\Drivers\btcusb.sys (File not found)
"Bluetooth VComm Manager Service" (VcommMgr) - ? - C:\WINNT\System32\Drivers\VcommMgr.sys (File not found)
"catchme" (catchme) - ? - C:\cofi.exe15214c\catchme.sys (File not found)
"Cdr4_2K" (Cdr4_2K) - "Sonic Solutions" - C:\WINNT\system32\drivers\Cdr4_2K.sys
"Cdralw2k" (Cdralw2k) - "Sonic Solutions" - C:\WINNT\system32\drivers\Cdralw2k.sys
"cdrbsvsd" (cdrbsvsd) - "B.H.A Corporation" - C:\WINNT\system32\drivers\cdrbsvsd.sys
"Changer" (Changer) - ? - C:\WINNT\system32\drivers\Changer.sys (File not found)
"lbrtfdc" (lbrtfdc) - ? - C:\WINNT\system32\drivers\lbrtfdc.sys (File not found)
"Mtlmnt5" (Mtlmnt5) - " " - C:\WINNT\System32\DRIVERS\Mtlmnt5.sys
"Mtlstrm" (Mtlstrm) - " " - C:\WINNT\System32\DRIVERS\Mtlstrm.sys
"NetGroup Packet Filter Driver (devolo)" (NPF_devolo) - "CACE Technologies" - C:\WINNT\system32\drivers\npf_devolo.sys
"NtMtlFax" (NtMtlFax) - " " - C:\WINNT\System32\DRIVERS\NtMtlFax.sys
"nv" (nv) - "NVIDIA Corporation" - C:\WINNT\System32\DRIVERS\nv4_mini.sys
"PCIDump" (PCIDump) - ? - C:\WINNT\system32\drivers\PCIDump.sys (File not found)
"PfModNT" (PfModNT) - "Creative Technology Ltd." - C:\WINNT\System32\PfModNT.sys
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINNT\System32\Drivers\PxHelp20.sys
"recagent" (RecAgent) - " " - C:\WINNT\System32\DRIVERS\RecAgent.sys
"SecDrv" (SecDrv) - "Macrovision Europe Ltd" - C:\WINNT\system32\drivers\SECDRV.SYS
"sglfb" (sglfb) - ? - C:\WINNT\system32\drivers\sglfb.sys (File not found)
"SlNtHal" (SlNtHal) - " " - C:\WINNT\System32\DRIVERS\Slnthal.sys
"SlWdmSup" (SlWdmSup) - "Vireo Software" - C:\WINNT\System32\DRIVERS\SlWdmSup.sys
"Sony Digital Imaging Video2" (sonypvs1) - "Sony Corporation" - C:\WINNT\System32\DRIVERS\sonypvs1.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINNT\System32\DRIVERS\ssmdrv.sys
"tga" (tga) - ? - C:\WINNT\system32\drivers\tga.sys (File not found)
"ufpyqaow" (ufpyqaow) - ? - C:\DOKUME~1\Paulsen\LOKALE~1\Temp\ufpyqaow.sys (Hidden registry entry, rootkit activity | File not found)
"USB Soft Modem Driver" (Slnt7554) - " " - C:\WINNT\System32\DRIVERS\slnt7554.sys
"viaide" (viaide) - "VIA Technologies, Inc." - C:\WINNT\System32\DRIVERS\viaide.sys
"Virtual Serial port driver" (VComm) - ? - C:\WINNT\System32\DRIVERS\VComm.sys (File not found)
[Explorer]
-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{BDEADF00-C265-11d0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11} "CRLUpdate" - "Microsoft Corporation" - %SystemRoot%\system32\updcrl.exe -e -u %SystemRoot%\system32\verisignpub1.crl
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Handler )-----
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - (File not found | COM-object registry key not found)
{2C49B5D0-ACE7-4D17-9DF0-A254A6C5A0C5} "dBpowerAMP Music Converter" - ? - (File not found | COM-object registry key not found)
{FED7043D-346A-414D-ACD7-550D052499A7} "dBpowerAMP Music Converter 1" - ? - (File not found | COM-object registry key not found)
{1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - C:\WINNT\System32\nvshell.dll
{1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - C:\WINNT\System32\nvshell.dll
{73B24247-042E-4EF5-ADC2-42F62E6FD654} "ICQ Lite Shell Extension" - ? - (File not found | COM-object registry key not found)
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? - (File not found | COM-object registry key not found)
{1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - C:\WINNT\System32\nvshell.dll
{0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL
{4ADF8C01-0AC7-4403-888C-012E6EA2F67E} "S2PCISE.S2PCISE" - ? - mscoree.dll (File not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shell-Erweiterungen für die Dateikomprimierung" - ? - (File not found | COM-object registry key not found)
{DBD8E168-244D-448C-9922-25508950D1DC} "Ulead UDF Driver" - ? - (File not found | COM-object registry key not found)
{8FF88D27-7BD0-11D1-BFB7-00AA00262A11} "WinAceContext Menu (Add) Extension" - "e-merge GmbH" - C:\Programme\WinAce\arcext.dll
{8FF88D21-7BD0-11D1-BFB7-00AA00262A11} "WinAceContext Menu Extension" - "e-merge GmbH" - C:\Programme\WinAce\arcext.dll
{8FF88D25-7BD0-11D1-BFB7-00AA00262A11} "WinAceDrag-Drop Extension" - "e-merge GmbH" - C:\Programme\WinAce\arcext.dll
{8FF88D23-7BD0-11D1-BFB7-00AA00262A11} "WinAceProperty Sheet Extension" - "e-merge GmbH" - C:\Programme\WinAce\arcext.dll
[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "ITBarLayout" - ? - (File not found | COM-object registry key not found)
<binary data> "Yahoo! Toolbar mit Pop-Up-Blocker" - ? - (File not found | COM-object registry key not found)
<binary data> "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" - ? - (File not found | COM-object registry key not found)
<binary data> "{855F3B16-6D32-4FE6-8A56-BBB695989046}" - ? - (File not found | COM-object registry key not found)
<binary data> "{DFEFCDEE-CF1A-4FC8-88AD-48514E463B27}" - ? - (File not found | COM-object registry key not found)
<binary data> "{FD2FD708-1F6F-4B68-B141-C5778F0C19BB}" - ? - (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} "CSEQueryObject Object" - "MyHeritage Ltd." - C:\WINNT\Downloaded Program Files\SearchEngineQuery.dll / hxxp://www.myheritage.de/Genoogle/Components/ActiveX/SearchEngineQuery.dll
DirectAnimation Java Classes "DirectAnimation Java Classes" - ? - (File not found | COM-object registry key not found) / file://C:\WINNT\Java\classes\dajava.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_25" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_25.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} "Java Plug-in 1.6.0_25" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_25.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_25" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_25.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
Microsoft XML Parser for Java "Microsoft XML Parser for Java" - ? - (File not found | COM-object registry key not found) / file://C:\WINNT\Java\classes\xmldso.cab
{5AE58FCF-6F6A-49B2-B064-02492C66E3F4} "MUCatalogWebControl Class" - "Microsoft Corporation" - C:\WINNT\system32\MicrosoftUpdateCatalogWebControl.dll / hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1238789717601
{6E718D87-6909-4FCE-92D4-EDCB2F725727} "Navigram Control" - "Navigram" - C:\Programme\Navigram\NavigramEngine\navigram.ocx / hxxp://www.navigram.com/engine/v911/Navigram.cab
{17492023-C23A-453E-A040-C7C580BBF700} "Windows Genuine Advantage Validation Tool" - "Microsoft Corporation" - C:\WINNT\system32\LegitCheckControl.DLL / hxxp://go.microsoft.com/fwlink/?linkid=39204
{9F1C11AA-197B-4942-BA54-47A8489BB47F} "{9F1C11AA-197B-4942-BA54-47A8489BB47F}" - ? - (File not found | COM-object registry key not found) / hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38952.4579166667
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
{DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} "{DFEFCDEE-CF1A-4FC8-88AD-48514E463B27}" - ? - (File not found | COM-object registry key not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"EPSON Status Monitor 3 Environment Check 2.lnk" - "SEIKO EPSON CORPORATION" - C:\WINNT\system32\spool\drivers\w32x86\3\E_SRCV02.EXE (Shortcut exists | File exists)
"Microsoft Office.lnk" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office\OSA9.EXE (Shortcut exists | File exists)
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"Desktop.ini" - ? - C:\Dokumente und Einstellungen\Paulsen\Startmenü\Programme\Autostart\Desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"Picasa Media Detector" - "Google Inc." - C:\Programme\Picasa2\PicasaMediaDetector.exe
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
"NvCplDaemon" - "NVIDIA Corporation" - RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe
"Creative Service for CDROM Access" (Creative Service for CDROM Access) - "Creative Technology Ltd" - C:\WINNT\System32\CTSvcCDA.exe
"Dienst für Seriennummern der tragbaren Medien" (WmdmPmSN) - "Microsoft Corporation" - C:\WINNT\system32\mspmsnsv.dll
"EPSON Printer Status Agent2" (EPSONStatusAgent2) - "SEIKO EPSON CORPORATION" - C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe
"Google Updater Service" (gusvc) - "Google" - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe
"NVIDIA Display Driver Service" (NVSvc) - "NVIDIA Corporation" - C:\WINNT\System32\nvsvc32.exe
"Taskplaner" (Schedule) - ? - C:\WINNT\system32\MSTask.exe (File not found)
"WMDM PMSP Service" (WMDM PMSP Service) - "Microsoft Corporation" - C:\WINNT\system32\mspmspsv.exe
[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll (File not found)
===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---
If You have questions or want to get some help, You can visit Online Solutions :: Index