| Turkish87 | 19.06.2012 13:24 |
Hi, hier die Logs:
GMER: Code:
GMER Logfile:
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-06-19 13:40:44
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-5 WDC_WD1600AAJS-00WAA0 rev.58.01D58
Running: p3j01417.exe; Driver: C:\DOKUME~1\0\LOKALE~1\Temp\pxddipod.sys
---- System - GMER 1.0.15 ----
SSDT F7B9C634 ZwClose
SSDT F7B9C5EE ZwCreateKey
SSDT F7B9C63E ZwCreateSection
SSDT F7B9C5E4 ZwCreateThread
SSDT F7B9C5F3 ZwDeleteKey
SSDT F7B9C5FD ZwDeleteValueKey
SSDT F7B9C62F ZwDuplicateObject
SSDT F7B9C602 ZwLoadKey
SSDT F7B9C5D0 ZwOpenProcess
SSDT F7B9C5D5 ZwOpenThread
SSDT F7B9C657 ZwQueryValueKey
SSDT F7B9C60C ZwReplaceKey
SSDT F7B9C648 ZwRequestWaitReplyPort
SSDT F7B9C607 ZwRestoreKey
SSDT F7B9C643 ZwSetContextThread
SSDT F7B9C64D ZwSetSecurityObject
SSDT F7B9C5F8 ZwSetValueKey
SSDT F7B9C652 ZwSystemDebugControl
SSDT F7B9C5DF ZwTerminateProcess
---- User code sections - GMER 1.0.15 ----
.text C:\Dokumente und Einstellungen\0\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe[3964] ntdll.dll!NtCreateFile + 6 7C91D0B4 4 Bytes [28, 00, 2B, 00] {SUB [EAX], AL; SUB EAX, [EAX]}
.text C:\Dokumente und Einstellungen\0\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe[3964] ntdll.dll!NtCreateFile + B 7C91D0B9 1 Byte [E2]
.text C:\Dokumente und Einstellungen\0\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe[3964] ntdll.dll!NtMapViewOfSection + 6 7C91D524 1 Byte [28]
.text C:\Dokumente und Einstellungen\0\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe[3964] ntdll.dll!NtMapViewOfSection + 6 7C91D524 4 Bytes [28, 03, 2B, 00] {SUB [EBX], AL; SUB EAX, [EAX]}
.text C:\Dokumente und Einstellungen\0\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe[3964] ntdll.dll!NtMapViewOfSection + B 7C91D529 1 Byte [E2]
.text C:\Dokumente und Einstellungen\0\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe[3964] ntdll.dll!NtOpenFile + 6 7C91D5A4 4 Bytes [68, 00, 2B, 00]
.text C:\Dokumente und Einstellungen\0\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe[3964] ntdll.dll!NtOpenFile + B 7C91D5A9 1 Byte [E2]
.text C:\Dokumente und Einstellungen\0\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe[3964] ntdll.dll!NtOpenProcess + 6 7C91D604 4 Bytes [A8, 01, 2B, 00] {TEST AL, 0x1; SUB EAX, [EAX]}
.text C:\Dokumente und Einstellungen\0\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe[3964] ntdll.dll!NtOpenProcess + B 7C91D609 1 Byte [E2]
.text C:\Dokumente und Einstellungen\0\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe[3964] ntdll.dll!NtOpenProcessToken + 6 7C91D614 4 Bytes CALL 7B92011A
.text C:\Dokumente und Einstellungen\0\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe[3964] ntdll.dll!NtOpenProcessToken + B 7C91D619 1 Byte [E2]
.text C:\Dokumente und Einstellungen\0\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe[3964] ntdll.dll!NtOpenProcessTokenEx + 6 7C91D624 4 Bytes [A8, 02, 2B, 00] {TEST AL, 0x2; SUB EAX, [EAX]}
.text C:\Dokumente und Einstellungen\0\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe[3964] ntdll.dll!NtOpenProcessTokenEx + B 7C91D629 1 Byte [E2]
.text C:\Dokumente und Einstellungen\0\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe[3964] ntdll.dll!NtOpenThread + 6 7C91D664 4 Bytes [68, 01, 2B, 00]
.text C:\Dokumente und Einstellungen\0\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe[3964] ntdll.dll!NtOpenThread + B 7C91D669 1 Byte [E2]
.text C:\Dokumente und Einstellungen\0\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe[3964] ntdll.dll!NtOpenThreadToken + 6 7C91D674 4 Bytes [68, 02, 2B, 00]
.text C:\Dokumente und Einstellungen\0\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe[3964] ntdll.dll!NtOpenThreadToken + B 7C91D679 1 Byte [E2]
.text C:\Dokumente und Einstellungen\0\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe[3964] ntdll.dll!NtOpenThreadTokenEx + 6 7C91D684 4 Bytes CALL 7B92018B
.text C:\Dokumente und Einstellungen\0\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe[3964] ntdll.dll!NtOpenThreadTokenEx + B 7C91D689 1 Byte [E2]
.text C:\Dokumente und Einstellungen\0\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe[3964] ntdll.dll!NtQueryAttributesFile + 6 7C91D714 4 Bytes [A8, 00, 2B, 00] {TEST AL, 0x0; SUB EAX, [EAX]}
.text C:\Dokumente und Einstellungen\0\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe[3964] ntdll.dll!NtQueryAttributesFile + B 7C91D719 1 Byte [E2]
.text C:\Dokumente und Einstellungen\0\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe[3964] ntdll.dll!NtQueryFullAttributesFile + 6 7C91D7B4 4 Bytes CALL 7B9202B9
.text C:\Dokumente und Einstellungen\0\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe[3964] ntdll.dll!NtQueryFullAttributesFile + B 7C91D7B9 1 Byte [E2]
.text C:\Dokumente und Einstellungen\0\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe[3964] ntdll.dll!NtSetInformationFile + 6 7C91DC64 4 Bytes [28, 01, 2B, 00] {SUB [ECX], AL; SUB EAX, [EAX]}
.text C:\Dokumente und Einstellungen\0\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe[3964] ntdll.dll!NtSetInformationFile + B 7C91DC69 1 Byte [E2]
.text C:\Dokumente und Einstellungen\0\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe[3964] ntdll.dll!NtSetInformationThread + 6 7C91DCB4 4 Bytes [28, 02, 2B, 00] {SUB [EDX], AL; SUB EAX, [EAX]}
.text C:\Dokumente und Einstellungen\0\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe[3964] ntdll.dll!NtSetInformationThread + B 7C91DCB9 1 Byte [E2]
.text C:\Dokumente und Einstellungen\0\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe[3964] ntdll.dll!NtUnmapViewOfSection + 6 7C91DF14 1 Byte [68]
.text C:\Dokumente und Einstellungen\0\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe[3964] ntdll.dll!NtUnmapViewOfSection + 6 7C91DF14 4 Bytes [68, 03, 2B, 00]
.text C:\Dokumente und Einstellungen\0\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe[3964] ntdll.dll!NtUnmapViewOfSection + B 7C91DF19 1 Byte [E2]
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\Dokumente und Einstellungen\0\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe[3964] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!CreateNamedPipeW] 003E0010
---- Devices - GMER 1.0.15 ----
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
---- EOF - GMER 1.0.15 ----
--- --- ---
OSAM:
OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 13:50:32 on 19.06.2012
OS: Windows XP Professional Service Pack 3 (Build 2600)
Default Browser: Microsoft Corporation Internet Explorer 8.00.6001.18702
Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures
Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries
[Common]
-----( %SystemRoot%\Tasks )-----
"Adobe Flash Player Updater.job" - "Adobe Systems Incorporated" - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
"RegUse.job" - "Honlyn (Macao Commercial Offshore) Limited" - C:\Programme\RegUse\RegUse.exe
[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl
"javacpl.cpl" - "Oracle Corporation" - C:\WINDOWS\system32\javacpl.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"NokiaConnectionManager" - "Nokia" - C:\PROGRA~1\Nokia\NOKIAP~1\CONNEC~1.CPL
[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Apple Mobile USB Driver" (USBAAPL) - ? - C:\WINDOWS\System32\Drivers\usbaapl.sys (File not found)
"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys
"avkmgr" (avkmgr) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avkmgr.sys
"catchme" (catchme) - ? - C:\DOKUME~1\0\LOKALE~1\Temp\catchme.sys (File not found)
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys (File not found)
"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys (File not found)
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys (File not found)
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\WINDOWS\system32\drivers\mbam.sys
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys (File not found)
"pxddipod" (pxddipod) - ? - C:\DOKUME~1\0\LOKALE~1\Temp\pxddipod.sys (Hidden registry entry, rootkit activity | File not found)
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys (File not found)
[Explorer]
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
-----( HKLM\Software\Classes\Protocols\Handler )-----
{3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
{CD00020A-8B95-11D1-82DB-00C04FB1625D} "Microsoft PKM KnowledgePluggable Class" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Programme\7-Zip\7-zip.dll
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - (File not found | COM-object registry key not found)
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? - (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\OFFICE11\msohev.dll
{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A} "Nokia Phone Browser" - "Nokia" - C:\Programme\Nokia\Nokia PC Suite 6\PhoneBrowser.dll
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira Operations GmbH & Co. KG" - C:\Programme\Avira\AntiVir Desktop\shlext.dll
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? - (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "AOL Deutschland Toolbar" - "AOL Inc." - C:\Programme\AOL Deutschland Toolbar\aoldetb.dll
ITBar7Height "ITBar7Height" - ? - (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found)
<binary data> "SweetPacks Toolbar for Internet Explorer" - "SweetIM Technologies Ltd." - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
<binary data> "{D7E97865-918F-41E4-9CD0-25AB1C574CE8}" - ? - (File not found | COM-object registry key not found)
-----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )-----
{EEE6C35D-6118-11DC-9C72-001320C79847} "SweetIM ToolbarURLSearchHook Class" - "SweetIM Technologies Ltd." - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
{D3D233D5-9F6D-436C-B6C7-E63F77503B30} "{D3D233D5-9F6D-436C-B6C7-E63F77503B30}" - ? - (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
{567d4d94-8077-4682-b887-945f3d644116} "AOL Deutschland Toolbar" - "AOL Inc." - C:\Programme\AOL Deutschland Toolbar\aoldetb.dll
<binary data> "SweetPacks Toolbar for Internet Explorer" - "SweetIM Technologies Ltd." - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{2d3b1910-86c2-4d4b-b1db-124b3ea35bef} "AOL Deutschland Toolbar Loader" - "AOL Inc." - C:\Programme\AOL Deutschland Toolbar\aoldetb.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Oracle Corporation" - C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Oracle Corporation" - C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll
{EEE6C35C-6118-11DC-9C72-001320C79847} "SweetPacks Browser Helper" - "SweetIM Technologies Ltd." - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
"Microsoft Office.lnk" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office10\OSA.EXE (Shortcut exists | File exists)
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\0\Startmenü\Programme\Autostart\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"PcSync" - "Time Information Services Ltd." - C:\Programme\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"
"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
"PCSuiteTrayApplication" - "Nokia" - C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
"RegUse" - "Honlyn (Macao Commercial Offshore) Limited" - C:\Programme\RegUse\RegUse.exe
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
"SweetIM" - "SweetIM Technologies Ltd." - C:\Programme\SweetIM\Messenger\SweetIM.exe
[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
"Adobe Flash Player Update Service" (AdobeFlashPlayerUpdateSvc) - "Adobe Systems Incorporated" - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
"ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Programme\Avira\AntiVir Desktop\avguard.exe
"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Programme\Avira\AntiVir Desktop\sched.exe
"Java Quick Starter" (JavaQuickStarterService) - "Oracle Corporation" - C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
"Windows CardSpace" (idsvc) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"WgaLogon" - "Microsoft Corporation" - C:\WINDOWS\system32\WgaLogon.dll
===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---
If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
aswMBR: Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-06-19 13:51:00
-----------------------------
13:51:00.640 OS Version: Windows 5.1.2600 Service Pack 3
13:51:00.640 Number of processors: 2 586 0x1C02
13:51:00.640 ComputerName: HORLING UserName: 0
13:51:01.265 Initialize success
13:53:46.156 AVAST engine defs: 12061900
13:54:11.343 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-5
13:54:11.343 Disk 0 Vendor: WDC_WD1600AAJS-00WAA0 58.01D58 Size: 152627MB BusType: 3
13:54:11.421 Disk 0 MBR read successfully
13:54:11.421 Disk 0 MBR scan
13:54:11.468 Disk 0 Windows XP default MBR code
13:54:11.484 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 132144 MB offset 63
13:54:11.484 Disk 0 Partition - 00 0F Extended LBA 20481 MB offset 270630990
13:54:11.531 Disk 0 Partition 2 00 0B FAT32 MSDOS5.0 20481 MB offset 270631053
13:54:11.562 Disk 0 scanning sectors +312576705
13:54:11.671 Disk 0 scanning C:\WINDOWS\system32\drivers
13:54:30.765 Service scanning
13:54:44.406 Modules scanning
13:55:07.187 Disk 0 trace - called modules:
13:55:07.218 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
13:55:07.218 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8652fab8]
13:55:07.234 3 CLASSPNP.SYS[f75c8fd7] -> nt!IofCallDriver -> \Device\00000062[0x86586510]
13:55:07.234 5 ACPI.sys[f745e620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-5[0x86585940]
13:55:07.609 AVAST engine scan C:\WINDOWS
13:55:34.875 AVAST engine scan C:\WINDOWS\system32
14:01:43.750 AVAST engine scan C:\WINDOWS\system32\drivers
14:02:22.343 AVAST engine scan C:\Dokumente und Einstellungen\0
14:12:16.859 AVAST engine scan C:\Dokumente und Einstellungen\All Users
14:12:57.828 Scan finished successfully
14:18:42.734 Disk 0 MBR has been saved successfully to "C:\Dokumente und Einstellungen\0\Desktop\MBR.dat"
14:18:42.734 The log file has been saved successfully to "C:\Dokumente und Einstellungen\0\Desktop\aswMBR.txt"
VG,
Metin |
aswMBR.exe und speichere die Datei auf deinem Desktop.