Trojaner-Board - Logfile nach Infizierung durch Microsoft Security Essentials Alert und soo -.-

hab jez am ende des gmer scans die warnung erhalten dass iwelche rootkits gefunden wurden die mein system blablabla.. konnte aber nur auf ok und nicht auf ja ode nein klicken

hier ist jez das log

GMER Logfile:

Code:

GMER 1.0.15.15530 - hxxp://www.gmer.net

Rootkit scan 2010-12-11 11:48:00

Windows 6.1.7600  Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD50 rev.01.0

Running: f4tty8qp.exe; Driver: C:\Users\renshen\AppData\Local\Temp\pwkyikob.sys
 
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text           ntkrnlpa.exe!ZwSaveKeyEx + 13AD                                                                                                   83048579 1 Byte  [06]

.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                                            8306CF52 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

?               System32\Drivers\oxwdeebg.sys                                                                                                     Ein an das System angeschlossenes Gerät funktioniert nicht. !

.text           peauth.sys                                                                                                                        AD950C9D 28 Bytes  CALL 214868C3 

.text           peauth.sys                                                                                                                        AD950CC1 28 Bytes  CALL 214868E7 
 

---- User code sections - GMER 1.0.15 ----
 

?               C:\Windows\System32\svchost.exe[4624]                                                                                             image checksum mismatch; number of sections mismatch; time/date stamp mismatch; unknown module: OLEAUT32.dll

?               C:\Windows\System32\svchost.exe[4820]                                                                                             image checksum mismatch; time/date stamp mismatch; 
 

---- Kernel IAT/EAT - GMER 1.0.15 ----
 

IAT             \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisOpenAdapter]                                                                [9170D0C2] \SystemRoot\system32\DRIVERS\afwcore.sys (Agnitum Firewall Core Driver/Agnitum Ltd.)

IAT             \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisOpenAdapter]                                                               [9170D0C2] \SystemRoot\system32\DRIVERS\afwcore.sys (Agnitum Firewall Core Driver/Agnitum Ltd.)

IAT             \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter]                                                                [9170D0C2] \SystemRoot\system32\DRIVERS\afwcore.sys (Agnitum Firewall Core Driver/Agnitum Ltd.)
 

---- User IAT/EAT - GMER 1.0.15 ----
 

IAT             C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe[2536] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress]   [758F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT             C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe[2536] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress]     [758F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT             C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe[2536] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress]    [758F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT             C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe[2536] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress]  [758F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT             C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe[2536] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress]   [758F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [msvcrt.dll!__wgetmainargs]                               017AC7E9

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [msvcrt.dll!_exit]                                        11E3E800

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [msvcrt.dll!_XcptFilter]                                  8A0F0000

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [msvcrt.dll!exit]                                         00004019

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [msvcrt.dll!_initterm]                                    F766E828

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [msvcrt.dll!_amsg_exit]                                   8AB7AFC7

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [msvcrt.dll!__setusermatherr]                             8056FF46

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [msvcrt.dll!memcpy]                                       39F5A5FC

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [msvcrt.dll!_controlfp]                                   66D830CC

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [msvcrt.dll!_except_handler4_common]                      737FC2F7

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [msvcrt.dll!?terminate@@YAXXZ]                            60FFC683

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [msvcrt.dll!__set_app_type]                               E2BA0F66

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [msvcrt.dll!__p__fmode]                                   EC839C07

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [msvcrt.dll!__p__commode]                                 90870FD8

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [msvcrt.dll!_cexit]                                       04000040

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!LocalAlloc]                                 17B8E91C

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!CloseHandle]                                04890000

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!DelayLoadFailureHook]                       7C896024

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!GetProcAddress]                             0EE91C24

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!GetLastError]                               6600000C

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!FreeLibrary]                                2FF1A30F

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!InterlockedCompareExchange]                 000338E8

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!LoadLibraryExA]                             CDE9B800

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!InterlockedExchange]                        600000A7

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!Sleep]                                      00102BE8

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!SetUnhandledExceptionFilter]                B28C0F00

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!GetModuleHandleA]                           52000017

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!QueryPerformanceCounter]                    60005DDC

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!GetTickCount]                               24648D9C

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!GetSystemTimeAsFileTime]                    03DEE928

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!UnhandledExceptionFilter]                   4CE80000

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!DeactivateActCtx]                           9C00000E

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!LoadLibraryExW]                             88242488

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!ActivateActCtx]                             44892404

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!lstrcmpW]                                   081CE824

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!RegCloseKey]                                9D302474

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!RegOpenKeyExW]                              08247C88

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!HeapSetInformation]                         3424648D

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!lstrcmpiW]                                  0003B3E9

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!lstrlenW]                                   40AFE800

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!LCMapStringW]                               60600000

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!RegQueryValueExW]                           0000F2E8

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!ReleaseActCtx]                              38148B00

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!CreateActCtxW]                              000A74E9

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!ExpandEnvironmentStringsW]                  ED839C00

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!GetCommandLineW]                            40A4E902

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!ExitProcess]                                BC0F0000

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!SetProcessAffinityUpdateMode]               F0C02FC4

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!RegDisablePredefinedCacheEx]                00458B06

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!GetProcessHeap]                             044D8A8B

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!SetErrorMode]                               11B2E8F9

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!RegisterWaitForSingleObjectEx]              6BE80000

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!LocalFree]                                  9C000002

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!HeapFree]                                   0012A6E9

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!WideCharToMultiByte]                        90C2F700

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [ntdll.dll!RtlAllocateHeap]                               00156CE8

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [ntdll.dll!RtlLengthRequiredSid]                          00000000

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [ntdll.dll!RtlSubAuthoritySid]                            0F4BE900

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [ntdll.dll!RtlInitializeSid]                              9C980001

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [ntdll.dll!RtlCopySid]                                    C3B60F66

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [ntdll.dll!RtlSubAuthorityCountSid]                       E904458B

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [ntdll.dll!RtlInitializeCriticalSection]                  0000089F

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [ntdll.dll!RtlSetProcessIsCritical]                       24448F9C

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [ntdll.dll!RtlImageNtHeader]                              F3E99C28

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [ntdll.dll!RtlUnhandledExceptionFilter]                   E9000000

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [ntdll.dll!EtwEventWrite]                                 00000999

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [ntdll.dll!EtwEventEnabled]                               BDC3E9CB

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [ntdll.dll!EtwEventRegister]                              648D0001

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [ntdll.dll!RtlFreeHeap]                                   8E0F2424

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [RPCRT4.dll!RpcMgmtSetServerStackSize]                    8DC42404

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [RPCRT4.dll!I_RpcMapWin32Status]                          E9302464

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIf]                        000002E8

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [RPCRT4.dll!RpcMgmtWaitServerListen]                      68C33166

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [RPCRT4.dll!RpcMgmtStopServerListening]                   143C84A8

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIfEx]                      FF02ED83

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [RPCRT4.dll!RpcServerRegisterIf]                          66042474

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [RPCRT4.dll!RpcServerUseProtseqEpW]                       C6004589

IAT             C:\Windows\System32\svchost.exe[4624] @ C:\Windows\System32\svchost.exe [RPCRT4.dll!RpcServerListen]                              66772404

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [msvcrt.dll!__wgetmainargs]                               51EC8B55

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [msvcrt.dll!_exit]                                        1845DB51

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [msvcrt.dll!_XcptFilter]                                  F855DD56

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [msvcrt.dll!exit]                                         E8084DDC

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [msvcrt.dll!_initterm]                                    000004D2

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [msvcrt.dll!_amsg_exit]                                   FF184589

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [msvcrt.dll!__setusermatherr]                             40515C15

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [msvcrt.dll!memcpy]                                       F845DD00

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [msvcrt.dll!_controlfp]                                   8B104DDC

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [msvcrt.dll!_except_handler4_common]                      1865DAF0

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [msvcrt.dll!?terminate@@YAXXZ]                            0004B9E8

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [msvcrt.dll!__set_app_type]                               8BC88B00

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [msvcrt.dll!__p__fmode]                                   F74199C6

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [msvcrt.dll!__p__commode]                                 C28B5EF9

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [msvcrt.dll!_cexit]                                       C9184503

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!LocalAlloc]                                 40515C15

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!CloseHandle]                                244C8B00

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!DelayLoadFailureHook]                       748D9908

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!GetProcAddress]                             FEF70109

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!GetLastError]                               2BC28B5E

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!FreeLibrary]                                244403C1

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!InterlockedCompareExchange]                 15FFC308

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!LoadLibraryExA]                             [0040515C] C:\Windows\System32\svchost.exe (Hostprozess für Windows-Dienste/Microsoft Corporation)

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!InterlockedExchange]                        04244C8B

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!Sleep]                                      F9F74199

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!SetUnhandledExceptionFilter]                FFC3C28B

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!GetModuleHandleA]                           40515C15

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!QueryPerformanceCounter]                    646A9900

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!GetTickCount]                               33F9F759

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!GetSystemTimeAsFileTime]                    24543BC0

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!UnhandledExceptionFilter]                   C09C0F04

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!DeactivateActCtx]                           EC8B55C3

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!LoadLibraryExW]                             0204EC81

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!ActivateActCtx]                             68560000

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!lstrcmpW]                                   515415FF

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!RegCloseKey]                                00FFB8F0

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!RegOpenKeyExW]                              8D500000

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!HeapSetInformation]                         FFFEFC8D

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!lstrcmpiW]                                  C93351FF

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!lstrlenW]                                   558D5151

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!LCMapStringW]                               8D5052FC

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!RegQueryValueExW]                           FFFDFC85

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!ReleaseActCtx]                              FF5150FF

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!CreateActCtxW]                              40504415

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!ExpandEnvironmentStringsW]                  56216A00

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!GetCommandLineW]                            FFFC75FF

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!ExitProcess]                                40515815

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!SetProcessAffinityUpdateMode]               0CC48300

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!RegDisablePredefinedCacheEx]                C01BD8F7

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!GetProcessHeap]                             EC8B55C3

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!SetErrorMode]                               458B5151

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!RegisterWaitForSingleObjectEx]              33565308

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!LocalFree]                                  57C88BF6

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!HeapFree]                                   33FC7589

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [KERNEL32.dll!WideCharToMultiByte]                        01518DFF

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [ntdll.dll!RtlAllocateHeap]                               802974CA

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [ntdll.dll!RtlLengthRequiredSid]                          7420063C

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [ntdll.dll!RtlSubAuthoritySid]                            [75FF850A] C:\Windows\system32\iertutil.dll (Run time utility for Internet Explorer/Microsoft Corporation)

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [ntdll.dll!RtlInitializeSid]                              45FF470C

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [ntdll.dll!RtlCopySid]                                    8506EBFC

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [ntdll.dll!RtlSubAuthorityCountSid]                       330274FF

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [ntdll.dll!RtlInitializeCriticalSection]                  46C88BFF

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [ntdll.dll!RtlSetProcessIsCritical]                       8A01518D

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [ntdll.dll!RtlImageNtHeader]                              DB844119

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [ntdll.dll!RtlUnhandledExceptionFilter]                   CA2BF975

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [ntdll.dll!EtwEventWrite]                                 D772F13B

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [ntdll.dll!EtwEventEnabled]                               5FFC458B

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [ntdll.dll!EtwEventRegister]                              C3C95B5E

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [ntdll.dll!RtlFreeHeap]                                   83EC8B55

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [RPCRT4.dll!RpcMgmtSetServerStackSize]                    FF0A7500

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [RPCRT4.dll!I_RpcMapWin32Status]                          45C7F845

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIf]                        000001FC

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [RPCRT4.dll!RpcMgmtWaitServerListen]                      0C4D8B00

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [RPCRT4.dll!RpcMgmtStopServerListening]                   F84D3941

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIfEx]                      016A3275

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [RPCRT4.dll!RpcServerRegisterIf]                          15FF5750

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [RPCRT4.dll!RpcServerUseProtseqEpW]                       [00405150] C:\Windows\System32\svchost.exe (Hostprozess für Windows-Dienste/Microsoft Corporation)

IAT             C:\Windows\System32\svchost.exe[4820] @ C:\Windows\System32\svchost.exe [RPCRT4.dll!RpcServerListen]                              EB0CC483
 

---- Devices - GMER 1.0.15 ----
 

Device          \FileSystem\Ntfs \Ntfs                                                                                                            88BCAA98
 

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                                           Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                                                           Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)
 

Device          \Driver\ACPI_HAL \Device\00000048                                                                                                 halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)
 

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                                                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
 

Device          \Driver\nsiproxy \Device\Nsi                                                                                                      afwcore.sys (Agnitum Firewall Core Driver/Agnitum Ltd.)
 

---- Services - GMER 1.0.15 ----
 

Service          (*** hidden *** )                                                                                                                [BOOT] oxwdeebg                                                                                                                                       <-- ROOTKIT !!!
 

---- Registry - GMER 1.0.15 ----
 

Reg             HKLM\SYSTEM\CurrentControlSet\services\oxwdeebg@orjezo                                                                            -766984395

Reg             HKLM\SYSTEM\CurrentControlSet\services\oxwdeebg@Type                                                                              1

Reg             HKLM\SYSTEM\CurrentControlSet\services\oxwdeebg@Start                                                                             0

Reg             HKLM\SYSTEM\CurrentControlSet\services\oxwdeebg@ErrorControl                                                                      0

Reg             HKLM\SYSTEM\CurrentControlSet\services\oxwdeebg@Group                                                                             Boot Bus Extender

Reg             HKLM\SYSTEM\ControlSet002\services\oxwdeebg@orjezo                                                                                -766984395

Reg             HKLM\SYSTEM\ControlSet002\services\oxwdeebg@Type                                                                                  1

Reg             HKLM\SYSTEM\ControlSet002\services\oxwdeebg@Start                                                                                 0

Reg             HKLM\SYSTEM\ControlSet002\services\oxwdeebg@ErrorControl                                                                          0

Reg             HKLM\SYSTEM\ControlSet002\services\oxwdeebg@Group                                                                                 Boot Bus Extender
 

---- EOF - GMER 1.0.15 ----

--- --- ---

ok

OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 16:39:58 on 11.12.2010
 

OS: Windows 7 Home Premium Edition (Build 7600), 32-bit

Default Browser: Mozilla Corporation Firefox 3.6.13
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"GoogleUpdateTaskUserS-1-5-21-1539451478-733840103-1462338374-1000Core.job" - "Google Inc." - C:\Users\Nhan\AppData\Local\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskUserS-1-5-21-1539451478-733840103-1462338374-1000UA.job" - "Google Inc." - C:\Users\Nhan\AppData\Local\Google\Update\GoogleUpdate.exe

"RegistryBooster.job" - "Uniblue Systems Limited" - C:\Program Files\Uniblue\RegistryBooster\rbmonitor.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl

"ISUSPM.cpl" - "Macrovision Corporation" - C:\Windows\system32\ISUSPM.cpl

"nvcpl.cpl" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\MLCFG32.CPL

"Nero BurnRights" - "Nero AG" - C:\Program Files\Nero\Nero8\Nero Toolkit\NeroBurnRights.cpl

"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"afwcore" (afwcore) - "Agnitum Ltd." - C:\Windows\System32\DRIVERS\afwcore.sys

"Agnitum Firewall Driver" (AFW) - "Agnitum Ltd." - C:\Windows\System32\DRIVERS\afw.sys

"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys

"BdSpy" (BdSpy) - "BullGuard Ltd." - C:\Windows\System32\DRIVERS\BdSpy.sys

"catchme" (catchme) - ? - C:\Users\renshen\AppData\Local\Temp\catchme.sys  (File not found)

"esgiguard" (esgiguard) - ? - C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys  (File not found)

"oxwdeebg" (oxwdeebg) - ? - C:\Windows\system32\drivers\oxwdeebg.sys  (Hidden registry entry, rootkit activity | File not found)

"Profos" (Profos) - "BitDefender S.R.L." - C:\Program Files\BullGuard Ltd\BullGuard\antirootkit\profos.sys

"Realtek IR Driver" (RtsUIR) - ? - C:\Windows\System32\DRIVERS\Rts516xIR.sys  (File not found)

"Realtek Smartcard Reader Driver" (USBCCID) - ? - C:\Windows\System32\DRIVERS\RtsUCcid.sys  (File not found)

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys
 

[Explorer]

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{7D4D6379-F301-4311-BEBA-E26EB0561882} "NeroDigitalColumnHandler Class" - "Nero AG" - C:\Program Files\Common Files\Nero\Lib\NeroDigitalExt.dll

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL

{88FED34C-F0CA-4636-A375-3CB6248B04CD} "Local Groove Web Services Protocol" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\GRA32A~1.DLL

{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll

{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL

{6318E0AB-2E93-11D1-B8ED-00608CC9A71F} "VoilaXctl Class" - "Belarc, Inc." - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll

{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----

{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\GR469A~1.DLL

{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll

{9458E603-FF43-4134-9036-04B4C71791E3} "BackupCopyHook Class" - "BullGuard Ltd." - C:\Program Files\BullGuard Ltd\BullGuard\BackupShellHook.dll

{1F25C6E4-E60D-421A-863F-D0C76F6AB211} "BullGuard Online-Laufwerk" - "BullGuard Ltd." - C:\Program Files\BullGuard Ltd\BullGuard\BackupShellNamespace.dll

{D66DC78C-4F61-447F-942B-3FB6980118CF} "CInfoTipShellExt Class" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\VISSHE.DLL

{0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll

 "CorelDRAW Shell Extension Component" - ? -   (File not found | COM-object registry key not found)

{A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.dll

{E81FFB23-40E2-431C-A041-76AEA0E4B04C} "Enterprise-Projekte" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\NAMEEXT.DLL

{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\GR469A~1.DLL

{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\GR469A~1.DLL

{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\GR469A~1.DLL

{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\GR469A~1.DLL

{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\GR469A~1.DLL

{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\GR469A~1.DLL

{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\GR469A~1.DLL

{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\GR469A~1.DLL

{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\GR469A~1.DLL

{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\GR469A~1.DLL

{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\GR469A~1.DLL

{506F4668-F13E-4AA1-BB04-B43203AB3CC0} "ImageExtractorShellExt Class" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\VISSHE.DLL

{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONFILTER.DLL

{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\MLSHEXT.DLL

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2} "NeroCoverEdLiveIcons Class" - "Nero AG" - C:\Program Files\Nero\Nero8\Nero CoverDesigner\CoverEdExtension.dll

{B327765E-D724-4347-8B16-78AE18552FC3} "NeroDigitalIconHandler Class" - "Nero AG" - C:\Program Files\Common Files\Nero\Lib\NeroDigitalExt.dll

{7F1CF152-04F8-453A-B34C-E609530A9DC8} "NeroDigitalPropSheetHandler Class" - "Nero AG" - C:\Program Files\Common Files\Nero\Lib\NeroDigitalExt.dll

{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C} "NvAppShExt Class" - "NVIDIA Corporation" - C:\Windows\system32\Nv3DAppShExt.dll

{3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} "NVIDIA CPL Context Menu Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvshext.dll

{FFB699E0-306A-11d3-8BD1-00104B6F7516} "NVIDIA CPL Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\OLKFSTUB.DLL

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll

{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll

{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe
 

[Internet Explorer]

-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

"eBay - Der weltweite Online-Marktplatz" - ? - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4  (HTTP value)

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBarLayout" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_18" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} "Java Plug-in 1.6.0_18" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_18" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_18.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

{27FD17FB-CF63-486b-B2BE-8D8781CBEA01} "BullGuard" - "BullGuard Ltd." - C:\Program Files\BullGuard Ltd\BullGuard\Antiphishing\IE\BGAntiphishingIE.dll

"eBay - Der weltweite Online-Marktplatz" - ? - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4  (HTTP value)

"ICQ7" - "ICQ, LLC." - C:\Program Files\ICQ7.0\ICQ.exe

{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen" - "Microsoft Corporation" - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

<binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll

{855F3B16-6D32-4FE6-8A56-BBB695989046} "ICQToolBar" - "ICQ" - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll

<binary data> "Yahoo! Toolbar" - "Yahoo! Inc." - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{02478D38-C3F9-4efb-9B51-7695ECA05670} "&Yahoo! Toolbar Helper" - "Yahoo! Inc." - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{FC872B94-35E3-4B94-B028-184A2A1C7CCE} "BGAntiphishingBHO Class" - "BullGuard Ltd." - C:\Program Files\BullGuard Ltd\BullGuard\Antiphishing\IE\BGAntiphishingIEBHO.dll

{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\GR469A~1.DLL

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} "Search Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} "SingleInstance Class" - "Yahoo! Inc" - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} "Windows Live Toolbar Helper" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll

{5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? -   (File not found | COM-object registry key not found)
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE  (Shortcut exists | File exists)

"desktop.ini" - ? - C:\Users\renshen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"Adobe Gamma Loader.lnk" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe  (Shortcut exists | File exists)

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

"BullGuard" - "BullGuard Ltd." - "C:\Program Files\BullGuard Ltd\BullGuard\BullGuard.exe" -boot

"ClamWin" - "alch" - "C:\Program Files\ClamWin\bin\ClamTray.exe" --logon

"CLMLServer" - "CyberLink" - "C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe"

"DivXUpdate" - ? - "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

"GrooveMonitor" - "Microsoft Corporation" - "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

"HotkeyApp" - "Wistron" - "C:\Program Files\Launch Manager\HotkeyApp.exe"

"IAStorIcon" - "Intel Corporation" - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"

"LMgrVolOSD" - "Wistron Corp." - "C:\Program Files\Launch Manager\OSD.exe"

"Malwarebytes Anti-Malware (reboot)" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

"NBKeyScan" - "Nero AG" - "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

"NvCplDaemon" - "NVIDIA Corporation" - RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

"PDVD9LanguageShortcut" - "CyberLink Corp." - "C:\Program Files\CyberLink\PowerDVD9\Language\Language.exe"

"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime

"UCam_Menu" - "CyberLink Corp." - "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\3.0"

"Wbutton" - "Wistron Corp." - "C:\Program Files\Launch Manager\Wbutton.exe"
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\Windows\system32\mdimon.dll

"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe

"BgRaSvc" (BgRaSvc) - "BullGuard Ltd." - C:\Program Files\BullGuard Ltd\BullGuard\Support\BgRaSvc.exe

"BullGuard antiphishing service" (BsBrowser) - "BullGuard Ltd." - C:\Program Files\BullGuard Ltd\BullGuard\BsBrowser.dll

"BullGuard e-mail monitoring service" (BsMailProxy) - "BullGuard Ltd." - C:\Program Files\BullGuard Ltd\BullGuard\BsMailProxy\BsMailProxy.dll

"BullGuard firewall service" (BsFire) - "BullGuard Ltd." - C:\Program Files\BullGuard Ltd\BullGuard\BsFire.dll

"BullGuard main service" (BsMain) - "BullGuard Ltd." - C:\Program Files\BullGuard Ltd\BullGuard\BsMain.dll

"BullGuard on-access service" (BsFileScan) - "BullGuard Ltd." - C:\Program Files\BullGuard Ltd\BullGuard\BsFileScan.dll

"BullGuard scanning service" (BsScanner) - "BullGuard Ltd." - C:\Program Files\BullGuard Ltd\BullGuard\BullGuardScanner.exe

"BullGuard update service" (BsUpdate) - "BullGuard Ltd." - C:\Program Files\BullGuard Ltd\BullGuard\BullGuardUpdate.exe

"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files\CyberLink\Shared files\RichVideo.exe

"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe

"FABS - Helping agent for MAGIX media database" (Fabs) - "MAGIX AG" - C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe

"Firebird Server - MAGIX Instance" (FirebirdServerMAGIXInstance) - "MAGIX®" - C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe

"ICQ Service" (ICQ Service) - ? - C:\Program Files\ICQ6Toolbar\ICQ Service.exe

"Intel(R) Management & Security Application User Notification Service" (UNS) - "Intel Corporation" - C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

"Intel(R) Management and Security Application Local Management Service" (LMS) - "Intel Corporation" - C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

"Intel(R) Rapid Storage Technology" (IAStorDataMgrSvc) - "Intel Corporation" - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe

"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

"Microsoft Office Groove Audit Service" (Microsoft Office Groove Audit Service) - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe

"Nero BackItUp Scheduler 3" (Nero BackItUp Scheduler 3) - "Nero AG" - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

"NMIndexingService" (NMIndexingService) - "Nero AG" - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

"NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"PLFlash DeviceIoControl Service" (PLFlash DeviceIoControl Service) - "Prolific Technology Inc." - C:\Windows\system32\IoctlSvc.exe

"ProtexisLicensing" (ProtexisLicensing) - ? - C:\Windows\system32\PSIService.exe

"SeaPort" (SeaPort) - "Microsoft Corporation" - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

"WisLMSvc" (WisLMSvc) - "Wistron Corp." - C:\Program Files\Launch Manager\WisLMSvc.exe

"Yahoo! Updater" (YahooAUService) - "Yahoo! Inc." - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----

"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )-----

"BGLsp" - "BullGuard Ltd." - C:\Windows\system32\BGLsp.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru