| ThePhantom79 | 08.11.2010 09:33 |
Hi,
ich habe in der Zwischenzeit aus Verzweifelung noch ein Offline-Scan mit der Desinfec't gemacht, und folgende Viren wurden gefunden (sdb2 ist meine Bootpartition):
/media/sdb2/ProgramData/Microsoft/Windows/WER/ReportQueue/Kernel_0_0_15ae5f7d/WER5EE1.tmpatk.kdmp
last modified on Date: 2010-11-01 Time: 08:38:40, Size: 122500 bytes
ALERT: TR/Agent.8704.76 ; trojan ; Is the Trojan horse TR/Agent.8704.76
/media/sdb2/Windows/System32/config/systemprofile/AppData/LocalLow/Sun/Java/Deployment/cache/6.0/30/2cf4ec9e-55e34edd
last modified on Date: 2010-11-02 Time: 17:38:05, Size: 3732 bytes
ALERT: bpac/a.class <<< JAVA/Agent.2212 ; virus ; Contains detection pattern of the Java virus JAVA/Agent.2212
/media/sdb2/Windows/System32/config/systemprofile/AppData/LocalLow/Sun/Java/Deployment/cache/6.0/62/4c865cbe-73e9d9dc
last modified on Date: 2010-11-04 Time: 22:44:33, Size: 3732 bytes
ALERT: bpac/a.class <<< JAVA/Agent.2212 ; virus ; Contains detection pattern of the Java virus JAVA/Agent.2212
Hier nun die gwünschten Logs:
GMER: Code:
GMER 1.0.15.15477 - h**p://www.gmer.net
Rootkit scan 2010-11-02 19:33:30
Windows 6.1.7600
Running: 5pr8zszx.exe; Driver: C:\Users\*****\AppData\Local\Temp\kgldiuod.sys
---- Kernel code sections - GMER 1.0.15 ----
.text ntkrnlpa.exe!ZwSaveKeyEx + 13AD 82C51599 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82C75F52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
PAGE ntkrnlpa.exe!ZwAlpcSendWaitReceivePort + 2 82E83135 5 Bytes JMP 8941DC50
PAGE ntkrnlpa.exe!NtRequestWaitReplyPort + 2 82E84B5D 5 Bytes JMP 8941DBB0
PAGE ntkrnlpa.exe!NtRequestPort + 2 82E98DC3 5 Bytes JMP 8941DB10
? System32\Drivers\spzp.sys Das System kann den angegebenen Pfad nicht finden. !
.text C:\Windows\system32\DRIVERS\atikmdag.sys section is writeable [0x91807000, 0x2FBFB8, 0xE8000020]
.text USBPORT.SYS!DllUnload 915D5CA0 5 Bytes JMP 8706C1D8
.text a20x9xs7.SYS 98E34000 12 Bytes [44, 38, 02, 83, EE, 36, 02, ...] {INC ESP; CMP [EDX], AL; SUB ESI, 0x36; ADD AL, [EBX-0x7cfde860]}
.text a20x9xs7.SYS 98E3400D 9 Bytes [17, 02, 83, 48, 3B, 02, 83, ...] {POP SS; ADD AL, [EBX-0x7cfdc4b8]; ADD [EAX], AL}
.text a20x9xs7.SYS 98E34017 170 Bytes [00, DE, 87, 5A, 83, E6, 85, ...]
.text a20x9xs7.SYS 98E340C3 8 Bytes [00, 00, 00, 00, 00, 00, 00, ...] {ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL}
.text a20x9xs7.SYS 98E340CE 4 Bytes [00, 00, 00, 00] {ADD [EAX], AL; ADD [EAX], AL}
.text ...
.text autochk.exe 002211D1 2 Bytes [F1, 19]
.text autochk.exe 002211D4 3 Bytes [94, F1, 19]
.text autochk.exe 002211D8 3 Bytes [AC, 5E, 18]
.text autochk.exe 002211DC 1 Byte [03]
.text autochk.exe 002211E0 3 Bytes [7C, EE, 19]
.text ...
---- Kernel IAT/EAT - GMER 1.0.15 ----
IAT \SystemRoot\system32\DRIVERS\atapi.sys[ataport.SYS!AtaPortReadPortUchar] [834AC042] \SystemRoot\System32\Drivers\spzp.sys
IAT \SystemRoot\system32\DRIVERS\atapi.sys[ataport.SYS!AtaPortWritePortUchar] [834AC6D6] \SystemRoot\System32\Drivers\spzp.sys
IAT \SystemRoot\system32\DRIVERS\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort] [834AC800] \SystemRoot\System32\Drivers\spzp.sys
IAT \SystemRoot\system32\DRIVERS\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort] [834AC13E] \SystemRoot\System32\Drivers\spzp.sys
IAT \SystemRoot\System32\Drivers\a20x9xs7.SYS[ataport.SYS!AtaPortNotification] 00147880
IAT \SystemRoot\System32\Drivers\a20x9xs7.SYS[ataport.SYS!AtaPortQuerySystemTime] 78800C75
IAT \SystemRoot\System32\Drivers\a20x9xs7.SYS[ataport.SYS!AtaPortReadPortUchar] 06750015
IAT \SystemRoot\System32\Drivers\a20x9xs7.SYS[ataport.SYS!AtaPortStallExecution] C25DC033
IAT \SystemRoot\System32\Drivers\a20x9xs7.SYS[ataport.SYS!AtaPortWritePortUchar] 458B0008
IAT \SystemRoot\System32\Drivers\a20x9xs7.SYS[ataport.SYS!AtaPortWritePortUlong] 6A006A08
IAT \SystemRoot\System32\Drivers\a20x9xs7.SYS[ataport.SYS!AtaPortGetPhysicalAddress] 50056A24
IAT \SystemRoot\System32\Drivers\a20x9xs7.SYS[ataport.SYS!AtaPortConvertPhysicalAddressToUlong] 005AB7E8
IAT \SystemRoot\System32\Drivers\a20x9xs7.SYS[ataport.SYS!AtaPortGetScatterGatherList] 0001B800
IAT \SystemRoot\System32\Drivers\a20x9xs7.SYS[ataport.SYS!AtaPortGetParentBusType] C25D0000
IAT \SystemRoot\System32\Drivers\a20x9xs7.SYS[ataport.SYS!AtaPortRequestCallback] CCCC0008
IAT \SystemRoot\System32\Drivers\a20x9xs7.SYS[ataport.SYS!AtaPortWritePortBufferUshort] CCCCCCCC
IAT \SystemRoot\System32\Drivers\a20x9xs7.SYS[ataport.SYS!AtaPortGetUnCachedExtension] CCCCCCCC
IAT \SystemRoot\System32\Drivers\a20x9xs7.SYS[ataport.SYS!AtaPortCompleteRequest] CCCCCCCC
IAT \SystemRoot\System32\Drivers\a20x9xs7.SYS[ataport.SYS!AtaPortCopyMemory] 53EC8B55
IAT \SystemRoot\System32\Drivers\a20x9xs7.SYS[ataport.SYS!AtaPortEtwTraceLog] 800C5D8B
IAT \SystemRoot\System32\Drivers\a20x9xs7.SYS[ataport.SYS!AtaPortCompleteAllActiveRequests] 7500117B
IAT \SystemRoot\System32\Drivers\a20x9xs7.SYS[ataport.SYS!AtaPortReleaseRequestSenseIrb] 127B806A
IAT \SystemRoot\System32\Drivers\a20x9xs7.SYS[ataport.SYS!AtaPortBuildRequestSenseIrb] 80647500
IAT \SystemRoot\System32\Drivers\a20x9xs7.SYS[ataport.SYS!AtaPortReadPortBufferUshort] 7500137B
IAT \SystemRoot\System32\Drivers\a20x9xs7.SYS[ataport.SYS!AtaPortInitialize] 157B805E
IAT \SystemRoot\System32\Drivers\a20x9xs7.SYS[ataport.SYS!AtaPortGetDeviceBase] 56587500
IAT \SystemRoot\System32\Drivers\a20x9xs7.SYS[ataport.SYS!AtaPortDeviceStateChange] 8008758B
---- Devices - GMER 1.0.15 ----
Device \Device\Ide\IdeDeviceP6T0L0-8 -> \??\IDE#DiskSAMSUNG_HD103SJ_________________________1AJ100E4#5&17b185bc&0&4.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xE7 0xA9 0xA8 0xA2 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x6B 0x92 0x83 0x6A ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x2D 0xDE 0x8D 0x46 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12 0x8E 0xFC 0x29 0x02 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xE7 0xA9 0xA8 0xA2 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x6B 0x92 0x83 0x6A ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x2D 0xDE 0x8D 0x46 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12 0x8E 0xFC 0x29 0x02 ...
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs@C:\Program Files\Pinnacle\Studio 14\Content\MotionTitles\-Looks\Standard\01 \x2013 Soft Shadow Looks.ixLook 1
Reg HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug@StoreLocation C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_7.3.7600.16385_83d89db3bee8694b325a46ad46dd6fefb24c93ab_1328d8d3
Reg HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles@CheckingForSolutionDialog 0x7C 0x04 0x06 0x00 ...
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Devices@AliveDeviceCount 1
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Devices@FunctionalDMRCount 1
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Devices\E4-7C-F9-7A-7F-B6@Alive 0
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\UDNRenderers@AliveDeviceCount 1
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\UDNRenderers@FunctionalDMRCount 1
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\UDNRenderers\592DE09F-959F-69CD-2F8E-FBB9AF9EB41F@Alive 0
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b 0xC8 0x28 0x51 0xAF ...
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b 0x6A 0x9C 0xD6 0x61 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016 0xFF 0x7C 0x85 0xE0 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48 0x3E 0x1E 0x9E 0xE0 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472 0xCD 0x44 0xCD 0xB9 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d 0xB0 0x18 0xED 0xA7 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b 0xFB 0xA7 0x78 0xE6 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d 0x83 0x6C 0x56 0x8B ...
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3 0xF6 0x0F 0x4E 0x58 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b 0x3D 0xCE 0xEA 0x26 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6 0x2A 0xB7 0xCC 0xB5 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2 0xFA 0xEA 0x66 0x7F ...
---- Disk sectors - GMER 1.0.15 ----
Disk \Device\Harddisk0\DR0 sector 01: copy of MBR
Disk \Device\Harddisk0\DR0 sector 02: copy of MBR
Disk \Device\Harddisk0\DR0 sector 03: copy of MBR
Disk \Device\Harddisk0\DR0 sector 04: copy of MBR
Disk \Device\Harddisk0\DR0 sector 05: copy of MBR
Disk \Device\Harddisk0\DR0 sector 06: copy of MBR
Disk \Device\Harddisk0\DR0 sector 07: copy of MBR
Disk \Device\Harddisk0\DR0 sector 08: copy of MBR
Disk \Device\Harddisk0\DR0 sector 09: copy of MBR
Disk \Device\Harddisk0\DR0 sector 10: copy of MBR
Disk \Device\Harddisk0\DR0 sector 11: copy of MBR
Disk \Device\Harddisk0\DR0 sector 12: copy of MBR
Disk \Device\Harddisk0\DR0 sector 13: copy of MBR
Disk \Device\Harddisk0\DR0 sector 14: copy of MBR
Disk \Device\Harddisk0\DR0 sector 15: copy of MBR
Disk \Device\Harddisk0\DR0 sector 16: copy of MBR
Disk \Device\Harddisk0\DR0 sector 17: copy of MBR
Disk \Device\Harddisk0\DR0 sector 18: copy of MBR
Disk \Device\Harddisk0\DR0 sector 19: copy of MBR
Disk \Device\Harddisk0\DR0 sector 20: copy of MBR
Disk \Device\Harddisk0\DR0 sector 21: copy of MBR
Disk \Device\Harddisk0\DR0 sector 22: copy of MBR
Disk \Device\Harddisk0\DR0 sector 23: copy of MBR
Disk \Device\Harddisk0\DR0 sector 24: copy of MBR
Disk \Device\Harddisk0\DR0 sector 25: copy of MBR
Disk \Device\Harddisk0\DR0 sector 26: copy of MBR
Disk \Device\Harddisk0\DR0 sector 27: copy of MBR
Disk \Device\Harddisk0\DR0 sector 28: copy of MBR
Disk \Device\Harddisk0\DR0 sector 29: copy of MBR
Disk \Device\Harddisk0\DR0 sector 30: copy of MBR
Disk \Device\Harddisk0\DR0 sector 31: copy of MBR
Disk \Device\Harddisk0\DR0 sector 32: copy of MBR
Disk \Device\Harddisk0\DR0 sector 33: copy of MBR
Disk \Device\Harddisk0\DR0 sector 34: copy of MBR
Disk \Device\Harddisk0\DR0 sector 35: copy of MBR
Disk \Device\Harddisk0\DR0 sector 36: copy of MBR
Disk \Device\Harddisk0\DR0 sector 37: copy of MBR
Disk \Device\Harddisk0\DR0 sector 38: copy of MBR
Disk \Device\Harddisk0\DR0 sector 39: copy of MBR
Disk \Device\Harddisk0\DR0 sector 40: copy of MBR
Disk \Device\Harddisk0\DR0 sector 41: copy of MBR
Disk \Device\Harddisk0\DR0 sector 42: copy of MBR
Disk \Device\Harddisk0\DR0 sector 43: copy of MBR
Disk \Device\Harddisk0\DR0 sector 44: copy of MBR
Disk \Device\Harddisk0\DR0 sector 45: copy of MBR
Disk \Device\Harddisk0\DR0 sector 46: copy of MBR
Disk \Device\Harddisk0\DR0 sector 47: copy of MBR
Disk \Device\Harddisk0\DR0 sector 48: copy of MBR
Disk \Device\Harddisk0\DR0 sector 49: copy of MBR
Disk \Device\Harddisk0\DR0 sector 50: copy of MBR
Disk \Device\Harddisk0\DR0 sector 51: copy of MBR
Disk \Device\Harddisk0\DR0 sector 52: copy of MBR
Disk \Device\Harddisk0\DR0 sector 53: copy of MBR
Disk \Device\Harddisk0\DR0 sector 54: copy of MBR
Disk \Device\Harddisk0\DR0 sector 55: copy of MBR
Disk \Device\Harddisk0\DR0 sector 56: copy of MBR
Disk \Device\Harddisk0\DR0 sector 57: copy of MBR
Disk \Device\Harddisk0\DR0 sector 58: copy of MBR
Disk \Device\Harddisk0\DR0 sector 59: copy of MBR
Disk \Device\Harddisk0\DR0 sector 60: copy of MBR
Disk \Device\Harddisk0\DR0 sector 61: copy of MBR
Disk \Device\Harddisk0\DR0 sector 62: copy of MBR
Disk \Device\Harddisk0\DR0 sector 63: copy of MBR
---- EOF - GMER 1.0.15 ----
OSAM: Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 10:08:25 on 08.11.2010
OS: Windows 7 Ultimate Edition (Build 7600), 32-bit
Default Browser: Mozilla Corporation Firefox 3.6.12
Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures
Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries
[Common]
-----( %SystemRoot%\Tasks )-----
"Funambol Outlook Sync Client - *****.job" - "Funambol" - C:\Program Files\Funambol\Outlook Client\OutlookPlugin.exe
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
[Control Panel Objects]
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLCFG32.CPL
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl
[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"aa9lgrmo" (aa9lgrmo) - "Microsoft Corporation" - C:\Windows\system32\drivers\aa9lgrmo.sys (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Apple Mobile Device Ethernet Service" (Netaapl) - "Apple Inc." - C:\Windows\System32\DRIVERS\netaapl.sys
"catchme" (catchme) - ? - C:\Users\CHRIST~1\AppData\Local\Temp\catchme.sys (File not found)
"CrystalSysInfo" (CrystalSysInfo) - ? - C:\Program Files\MediaCoder\SysInfo.sys (File found, but it contains no detailed information)
"kgldiuod" (kgldiuod) - ? - C:\Users\CHRIST~1\AppData\Local\Temp\kgldiuod.sys (Hidden registry entry, rootkit activity | File not found)
"SASDIFSV" (SASDIFSV) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
"SASKUTIL" (SASKUTIL) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
"SbieDrv" (SbieDrv) - "tzuk" - C:\Program Files\Sandboxie\SbieDrv.sys
"sptd" (sptd) - "Duplex Secure Ltd." - C:\Windows\System32\Drivers\sptd.sys (File is exclusively opened, access blocked)
"StarOpen" (StarOpen) - ? - C:\Windows\system32\drivers\StarOpen.sys (File found, but it contains no detailed information)
"truecrypt" (truecrypt) - "TrueCrypt Foundation" - C:\Windows\System32\drivers\truecrypt.sys
"VMware hcmon" (hcmon) - "VMware, Inc." - C:\Windows\system32\drivers\hcmon.sys
"VMware Network Application Interface" (VMnetuserif) - "VMware, Inc." - C:\Windows\system32\drivers\vmnetuserif.sys
"VMware vmci" (vmci) - "VMware, Inc." - C:\Windows\system32\Drivers\vmci.sys
"VMware VMparport" (VMparport) - "VMware, Inc." - C:\Windows\system32\Drivers\VMparport.sys
"VMware vmx86" (vmx86) - "VMware, Inc." - C:\Windows\system32\Drivers\vmx86.sys
[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL
{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? - (File not found | COM-object registry key not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{79BC0345-1015-11D2-A299-006008312725} "///FAST project settings" - ? - C:\Program Files\Pinnacle\Studio 14\Programs\BlueShellExt.dll (File found, but it contains no detailed information)
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll
{872A9397-E0D6-4e28-B64D-52B8D0A7EA35} "DisplayCplExt Class" - "Advanced Micro Devices, Inc." - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiamaxx.dll
{6567D0AE-32DF-11D7-BC71-00408103CEAF} "ExplExt Class" - "Barad-Dur, LLC." - C:\Program Files\BitKinex\win32\bitkinexwe.dll
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll
{DC70C4A5-2044-4c59-B806-DEFB9AE0DF7C} "KbLogiExt Class" - "Logitech, Inc." - C:\Program Files\Logitech\SetPoint\kbcplext.dll
{B9B9F083-2B04-452A-8691-83694AC1037B} "LogiExt Class" - "Logitech, Inc." - C:\Program Files\Logitech\SetPoint\mcplext.dll
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL
{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - "Advanced Micro Devices, Inc." - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll
{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83} "UnlockerShellExtension" - ? - C:\Program Files\Unlocker\UnlockerCOM.dll (File found, but it contains no detailed information)
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll
[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? - (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found)
<binary data> "ITBarLayout" - ? - (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{82774781-8F4E-11D1-AB1C-0000F8773BF0} "DLC Class" - "Microsoft Corporation" - C:\Windows\Downloaded Program Files\grTransferCtrl.dll / https://transfers.ds.microsoft.com/FTM/TransferSource/grTransferCtrl.cab
{45B69029-F3AB-4204-92DE-D5140C3E8E74} "F5 Networks Auto Update" - "F5 Networks" - C:\Windows\Downloaded Program Files\InstallerControl.dll / C:\Users\CHRIST~1\AppData\Local\Temp\IXP000.TMP\InstallerControl.cab
{41EF3CD2-D8CC-4438-84B1-280BB4E77C8E} "F5 Networks Dynamic Application Tunnel Control" - "F5 Networks" - C:\Windows\Downloaded Program Files\TunnelServerX.dll / C:\Users\CHRIST~1\AppData\Local\Temp\f5tmp\f5tunsrv.cab
{E0FF21FA-B857-45C5-8621-F120A0C17FF2} "F5 Networks Host Control" - "F5 Networks" - C:\Windows\Downloaded Program Files\urxhost.dll / C:\Users\CHRIST~1\AppData\Local\Temp\f5tmp\urxhost.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_22.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
{C3F79A2B-B9B4-4A66-B012-3EE46475B072} "MessengerStatsClient Class" - "Microsoft Corporation" - C:\Windows\Downloaded Program Files\MessengerStatsPAClient.dll / hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
{5C051655-FCD5-4969-9182-770EA5AA5565} "Solitaire Showdown Class" - "Microsoft Corporation" - C:\Windows\Downloaded Program Files\SolitaireShowdown.dll / hxxp://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
{4A85DBE0-BFB2-4119-8401-186A7C6EB653} "{4A85DBE0-BFB2-4119-8401-186A7C6EB653}" - "Microsoft Corporation" - C:\Windows\Downloaded Program Files\MJSS.ocx / hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/mjss/MJSS.cab109791.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} "@C:\Windows\WindowsMobile\INetRepl.dll,-222" - "Microsoft Corporation" - C:\Windows\WindowsMobile\INetRepl.dll
{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} "ClsidExtension" - "Microsoft Corporation" - C:\Windows\WindowsMobile\INetRepl.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
{38E51477-DDB4-4aed-9D61-D0C193E10749} "Rip YouTube File" - ? - C:\Program Files\SoundTaxi\YouTubeRipper.dll
{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype add-on for Internet Explorer" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype add-on for Internet Explorer" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
{02478D38-C3F9-4efb-9B51-7695ECA05670} "{02478D38-C3F9-4efb-9B51-7695ECA05670}" - ? - (File not found | COM-object registry key not found)
{5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? - (File not found | COM-object registry key not found)
[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"Air Mouse.lnk" - ? - C:\Program Files\Air Mouse\Air Mouse\Air Mouse.exe (Shortcut exists | File exists)
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"Logitech SetPoint.lnk" - "Logitech, Inc." - C:\Program Files\Logitech\SetPoint\SetPoint.exe (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"DAEMON Tools Lite" - "DT Soft Ltd" - "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
"GMX SMS-Manager" - "1&1 Internet AG" - C:\Program Files\GMX\GMX SMS-Manager\SMSMngr.exe
"Messenger (Yahoo!)" - "Yahoo! Inc." - "C:\PROGRA~1\Yahoo!\Messenger\YahooMessenger.exe" -quiet
"SandboxieControl" - "tzuk" - "C:\Program Files\Sandboxie\SbieCtrl.exe"
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"CamserviceOG" - "Guillemot Corporation S.A." - C:\Program Files\Hercules\Deluxe Optical Glass\XtrCtrl.exe /startup
"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"
"Malwarebytes Anti-Malware (reboot)" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
"MSSE" - "Microsoft Corporation" - "C:\Program Files\Microsoft Security Essentials\msseces.exe" -hide -runkey
"PDFPrint" - "Geek Software GmbH" - C:\Program Files\pdf24\pdf24.exe
"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime
"StartCCC" - "Advanced Micro Devices, Inc." - "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"FRITZ!fax Color Monitor" - "AVM Berlin" - C:\Windows\system32\FritzVistaColorMon.dll
"FRITZ!fax Port Monitor" - "AVM Berlin" - C:\Windows\system32\FritzVistaMon.dll
[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"BitKinex File Transfer Service" (BitKinex) - ? - C:\Program Files\BitKinex\bitkinexsvc.exe
"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe
"FLEXnet Licensing Service" (FLEXnet Licensing Service) - "Acresso Software Inc." - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe
"Logitech Bluetooth Service" (LBTServ) - "Logitech, Inc." - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Microsoft Antimalware Service" (MsMpSvc) - "Microsoft Corporation" - C:\Program Files\Microsoft Security Essentials\MsMpEng.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"NMSAccessU" (NMSAccessU) - ? - C:\Program Files\CDBurnerXP\NMSAccessU.exe (File found, but it contains no detailed information)
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"Sandboxie Service" (SbieSvc) - "tzuk" - C:\Program Files\Sandboxie\SbieSvc.exe
"SBSD Security Center Service" (SBSDWSCService) - "Safer Networking Ltd." - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
"SMServer" (SMServer) - "SMServer" - C:\Windows\system32\snmvtsvc.exe
"Steam Client Service" (Steam Client Service) - "Valve Corporation" - C:\Program Files\Common Files\Steam\SteamService.exe
"STSService" (STSService) - ? - C:\Program Files\SoundTaxi Media Suite\STSService.exe (File found, but it contains no detailed information)
"VMware Authorization Service" (VMAuthdService) - "VMware, Inc." - C:\Program Files\VMware\VMware Server\vmware-authd.exe
"VMware DHCP Service" (VMnetDHCP) - "VMware, Inc." - C:\Windows\system32\vmnetdhcp.exe
"VMware Host Agent" (VMwareHostd) - ? - C:\Program Files\VMware\VMware Server\vmware-hostd.exe (File found, but it contains no detailed information)
"VMware NAT Service" (VMware NAT Service) - "VMware, Inc." - C:\Windows\system32\vmnat.exe
"VMware Server Web Access" (VMwareServerWebAccess) - "Apache Software Foundation" - C:\Program Files\VMware\VMware Server\tomcat\bin\Tomcat6.exe
"VMware VSS Writer" (vmwriter) - "VMware, Inc." - C:\Program Files\VMware\VMware Server\vmVssWriter.exe
"Yahoo! Updater" (YahooAUService) - "Yahoo! Inc." - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
[Winlogon]
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"LBTWlgn" - "Logitech, Inc." - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )-----
"VMCI sockets DGRAM" - "VMware, Inc." - C:\Program Files\VMware\VMware Server\vsocklib.dll
"VMCI sockets STREAM" - "VMware, Inc." - C:\Program Files\VMware\VMware Server\vsocklib.dll
===[ Logfile end ]=========================================[ Logfile end ]===
If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
MBRCheck: Code:
MBRCheck, version 1.2.3
(c) 2010, AD
Command-line:
Windows Version: Windows 7 Ultimate Edition
Windows Information: (build 7600), 32-bit
Base Board Manufacturer: Gigabyte Technology Co., Ltd.
BIOS Manufacturer: Award Software International, Inc.
System Manufacturer: Gigabyte Technology Co., Ltd.
System Product Name: EP45-DS3
Logical Drives Mask: 0x0001debd
Kernel Drivers (total 224):
0x82C46000 \SystemRoot\system32\ntkrnlpa.exe
0x82C0F000 \SystemRoot\system32\halmacpi.dll
0x86DD7000 \SystemRoot\system32\kdcom.dll
0x8321A000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x83292000 \SystemRoot\system32\PSHED.dll
0x832A3000 \SystemRoot\system32\BOOTVID.dll
0x832AB000 \SystemRoot\system32\CLFS.SYS
0x832ED000 \SystemRoot\system32\CI.dll
0x8343F000 \SystemRoot\system32\drivers\Wdf01000.sys
0x834B0000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x834BE000 \SystemRoot\System32\Drivers\spir.sys
0x835B1000 \SystemRoot\System32\Drivers\WMILIB.SYS
0x835BA000 \SystemRoot\System32\Drivers\SCSIPORT.SYS
0x83398000 \SystemRoot\system32\DRIVERS\ACPI.sys
0x835E0000 \SystemRoot\system32\DRIVERS\msisadrv.sys
0x835E8000 \SystemRoot\system32\DRIVERS\vdrvroot.sys
0x83400000 \SystemRoot\system32\DRIVERS\pci.sys
0x8342A000 \SystemRoot\System32\drivers\partmgr.sys
0x833E0000 \SystemRoot\system32\DRIVERS\volmgr.sys
0x8363C000 \SystemRoot\System32\drivers\volmgrx.sys
0x83687000 \SystemRoot\system32\DRIVERS\pciide.sys
0x8368E000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x8369C000 \SystemRoot\System32\drivers\mountmgr.sys
0x836B2000 \SystemRoot\system32\DRIVERS\atapi.sys
0x836BB000 \SystemRoot\system32\DRIVERS\ataport.SYS
0x836DE000 \SystemRoot\system32\DRIVERS\msahci.sys
0x836E8000 \SystemRoot\system32\DRIVERS\amdxata.sys
0x836F1000 \SystemRoot\system32\drivers\fltmgr.sys
0x83725000 \SystemRoot\system32\drivers\fileinfo.sys
0x8BE22000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8BF51000 \SystemRoot\System32\Drivers\msrpc.sys
0x8BF7C000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8BF8F000 \SystemRoot\System32\Drivers\cng.sys
0x8BFEC000 \SystemRoot\System32\drivers\pcw.sys
0x8BE00000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x83736000 \SystemRoot\system32\drivers\ndis.sys
0x8C03F000 \SystemRoot\system32\drivers\NETIO.SYS
0x8C07D000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x8C0A2000 \SystemRoot\System32\drivers\tcpip.sys
0x8C000000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8C031000 \SystemRoot\system32\DRIVERS\vmstorfl.sys
0x8C223000 \SystemRoot\system32\DRIVERS\volsnap.sys
0x8C262000 \SystemRoot\System32\Drivers\spldr.sys
0x8C26A000 \SystemRoot\System32\drivers\rdyboost.sys
0x8C297000 \SystemRoot\System32\Drivers\mup.sys
0x8C2A7000 \SystemRoot\System32\drivers\hwpolicy.sys
0x8C2AF000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x8C2E1000 \SystemRoot\system32\DRIVERS\disk.sys
0x8C2F2000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x8C34A000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8C369000 \SystemRoot\system32\DRIVERS\MpFilter.sys
0x8C38C000 \SystemRoot\System32\Drivers\Null.SYS
0x8C393000 \SystemRoot\System32\Drivers\Beep.SYS
0x8C39A000 \SystemRoot\System32\drivers\vga.sys
0x8C3A6000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8C3C7000 \SystemRoot\System32\drivers\watchdog.sys
0x8C3D4000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8C3DC000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8C3E4000 \SystemRoot\system32\drivers\rdprefmp.sys
0x8C3EC000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8C200000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8BE09000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8C20E000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x90C27000 \SystemRoot\system32\drivers\afd.sys
0x90C81000 \SystemRoot\System32\DRIVERS\netbt.sys
0x90CB3000 \SystemRoot\system32\drivers\ws2ifsl.sys
0x90CBC000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x90CC3000 \SystemRoot\system32\DRIVERS\pacer.sys
0x90CE2000 \SystemRoot\system32\DRIVERS\vpcnfltr.sys
0x90CF2000 \SystemRoot\system32\DRIVERS\netbios.sys
0x90D00000 \SystemRoot\system32\DRIVERS\serial.sys
0x90D1A000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x90D2D000 \SystemRoot\system32\drivers\vpcvmm.sys
0x90D74000 \SystemRoot\System32\drivers\truecrypt.sys
0x90DA9000 \SystemRoot\system32\DRIVERS\termdd.sys
0x90DB9000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
0x90DDB000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
0x91436000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x91477000 \SystemRoot\system32\drivers\nsiproxy.sys
0x91481000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x9148B000 \SystemRoot\System32\drivers\discache.sys
0x91497000 \SystemRoot\system32\drivers\csc.sys
0x914FB000 \SystemRoot\System32\Drivers\dfsc.sys
0x91513000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x91521000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x91542000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x91554000 \SystemRoot\system32\DRIVERS\atikmpag.sys
0x9163A000 \SystemRoot\system32\DRIVERS\atikmdag.sys
0x95033000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x950EA000 \SystemRoot\System32\drivers\dxgmms1.sys
0x95123000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x95142000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x9514D000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x95198000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x95411000 \SystemRoot\system32\drivers\HCW85BDA.sys
0x95566000 \SystemRoot\system32\drivers\BdaSup.SYS
0x95569000 \SystemRoot\system32\drivers\ks.sys
0x9559D000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x955A3000 \SystemRoot\system32\DRIVERS\Rt86win7.sys
0x955C8000 \SystemRoot\system32\DRIVERS\1394ohci.sys
0x955F4000 \SystemRoot\system32\DRIVERS\fdc.sys
0x95400000 \SystemRoot\system32\DRIVERS\serenum.sys
0x951A7000 \SystemRoot\system32\DRIVERS\parport.sys
0x951BF000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x9540A000 \SystemRoot\system32\DRIVERS\L8042Kbd.sys
0x951D7000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x91600000 \SystemRoot\System32\Drivers\aa9lgrmo.SYS
0x951E4000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
0x95000000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x95012000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x951F1000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x91BD4000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x91584000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x9159C000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x915B3000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x91BF6000 \SystemRoot\system32\DRIVERS\rdpbus.sys
0x915CA000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x9540E000 \SystemRoot\system32\DRIVERS\swenum.sys
0x91400000 \SystemRoot\system32\DRIVERS\MarvinBus.sys
0x915D7000 \SystemRoot\system32\DRIVERS\umbus.sys
0x915E5000 \SystemRoot\system32\DRIVERS\vpcusb.sys
0x90DE1000 \SystemRoot\system32\DRIVERS\usbrpm.sys
0x951FC000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x83600000 \SystemRoot\system32\DRIVERS\vpchbus.sys
0x95E1E000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x95E62000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0x95E6C000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x95E7D000 \SystemRoot\system32\drivers\AtiHdmi.sys
0x95E9B000 \SystemRoot\system32\drivers\portcls.sys
0x95ECA000 \SystemRoot\system32\drivers\drmk.sys
0x95EE3000 \SystemRoot\system32\drivers\HdAudio.sys
0x82150000 \SystemRoot\System32\win32k.sys
0x95F33000 \SystemRoot\System32\drivers\Dxapi.sys
0x95F3D000 \SystemRoot\System32\Drivers\crashdmp.sys
0x95F4A000 \SystemRoot\System32\Drivers\dump_dumpata.sys
0x95F55000 \SystemRoot\System32\Drivers\dump_msahci.sys
0x95F5F000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x95F70000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0x95F87000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x95F9E000 \SystemRoot\system32\DRIVERS\usbscan.sys
0x95FAC000 \SystemRoot\system32\DRIVERS\usbprint.sys
0x95FB7000 \SystemRoot\System32\Drivers\LUsbFilt.Sys
0x95FBD000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x95FC8000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x95FDB000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x95FE2000 \SystemRoot\system32\DRIVERS\LHidFilt.Sys
0x95FEA000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x95FF5000 \SystemRoot\system32\DRIVERS\LMouFilt.Sys
0x99E0C000 \SystemRoot\system32\DRIVERS\snpstd3.sys
0x9A7F0000 \SystemRoot\system32\DRIVERS\STREAM.SYS
0x95E00000 \SystemRoot\system32\DRIVERS\hxctlflt.sys
0x90C00000 \SystemRoot\system32\drivers\usbaudio.sys
0x99E00000 \SystemRoot\system32\DRIVERS\monitor.sys
0x823B0000 \SystemRoot\System32\TSDDD.dll
0x82000000 \SystemRoot\System32\ATMFD.DLL
0x82050000 \SystemRoot\System32\cdd.dll
0x8C317000 \SystemRoot\system32\drivers\luafv.sys
0x83200000 \SystemRoot\system32\drivers\WudfPf.sys
0x9502A000 \SystemRoot\system32\DRIVERS\vmnetbridge.sys
0x95E19000 \SystemRoot\system32\DRIVERS\VMNET.SYS
0x90C14000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x8C332000 \SystemRoot\system32\DRIVERS\rspndr.sys
0xA001E000 \SystemRoot\system32\drivers\HTTP.sys
0xA00A3000 \SystemRoot\system32\DRIVERS\bowser.sys
0xA00BC000 \SystemRoot\System32\drivers\mpsdrv.sys
0xA00CE000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xA00F1000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0xA012C000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0xA0147000 \??\C:\Windows\system32\drivers\hcmon.sys
0xA0151000 \SystemRoot\system32\DRIVERS\parvdm.sys
0xA0158000 \??\C:\Windows\system32\Drivers\vmci.sys
0xA0164000 \??\C:\Windows\system32\Drivers\VMparport.sys
0x9FE27000 \??\C:\Windows\system32\Drivers\vmx86.sys
0x9FEF7000 \SystemRoot\system32\drivers\peauth.sys
0x9FF8E000 \SystemRoot\System32\Drivers\secdrv.SYS
0x9FF98000 \??\C:\Program Files\Sandboxie\SbieDrv.sys
0x9FFB8000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x9FFD9000 \SystemRoot\System32\drivers\tcpipreg.sys
0x9FFE6000 \??\C:\Windows\system32\drivers\vmnetuserif.sys
0xA0166000 \SystemRoot\System32\DRIVERS\srv2.sys
0xA3E1A000 \SystemRoot\System32\DRIVERS\srv.sys
0xA3ECE000 \SystemRoot\System32\Drivers\fastfat.SYS
0xA3F83000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0xA3F8C000 \??\C:\Users\CHRIST~1\AppData\Local\Temp\kgldiuod.sys
0x77670000 \Windows\System32\ntdll.dll
0x479E0000 \Windows\System32\smss.exe
0x778B0000 \Windows\System32\apisetschema.dll
0x00650000 \Windows\System32\autochk.exe
0x10000000 \Program Files\DAEMON Tools Lite\Engine.dll
0x77890000 \Windows\System32\normaliz.dll
0x77530000 \Windows\System32\urlmon.dll
0x77860000 \Windows\System32\imagehlp.dll
0x77840000 \Windows\System32\sechost.dll
0x77390000 \Windows\System32\setupapi.dll
0x777B0000 \Windows\System32\oleaut32.dll
0x76740000 \Windows\System32\shell32.dll
0x765E0000 \Windows\System32\ole32.dll
0x765D0000 \Windows\System32\psapi.dll
0x76500000 \Windows\System32\msctf.dll
0x764B0000 \Windows\System32\gdi32.dll
0x76420000 \Windows\System32\clbcatq.dll
0x763C0000 \Windows\System32\difxapi.dll
0x761C0000 \Windows\System32\iertutil.dll
0x760C0000 \Windows\System32\wininet.dll
0x760A0000 \Windows\System32\imm32.dll
0x76020000 \Windows\System32\comdlg32.dll
0x75F40000 \Windows\System32\kernel32.dll
0x75F00000 \Windows\System32\ws2_32.dll
0x75EB0000 \Windows\System32\Wldap32.dll
0x75EA0000 \Windows\System32\nsi.dll
0x75E90000 \Windows\System32\lpk.dll
0x75DE0000 \Windows\System32\msvcrt.dll
0x75D80000 \Windows\System32\shlwapi.dll
0x75CB0000 \Windows\System32\user32.dll
0x75C00000 \Windows\System32\rpcrt4.dll
0x75B60000 \Windows\System32\advapi32.dll
0x75AC0000 \Windows\System32\usp10.dll
0x759A0000 \Windows\System32\crypt32.dll
0x75950000 \Windows\System32\KernelBase.dll
0x75920000 \Windows\System32\wintrust.dll
0x75890000 \Windows\System32\comctl32.dll
0x75870000 \Windows\System32\devobj.dll
0x75840000 \Windows\System32\cfgmgr32.dll
0x75830000 \Windows\System32\msasn1.dll
Processes (total 77):
0 System Idle Process
4 System
320 C:\Windows\System32\smss.exe
480 csrss.exe
568 C:\Windows\System32\wininit.exe
576 csrss.exe
616 C:\Windows\System32\services.exe
632 C:\Windows\System32\lsass.exe
640 C:\Windows\System32\lsm.exe
752 C:\Windows\System32\svchost.exe
840 C:\Windows\System32\svchost.exe
888 C:\Windows\System32\winlogon.exe
924 C:\Program Files\Microsoft Security Essentials\MsMpEng.exe
1000 C:\Windows\System32\atiesrxx.exe
1060 C:\Windows\System32\svchost.exe
1136 C:\Windows\System32\svchost.exe
1176 C:\Windows\System32\svchost.exe
1468 C:\Windows\System32\svchost.exe
1572 C:\Windows\System32\atieclxx.exe
1632 C:\Windows\System32\svchost.exe
1856 C:\Windows\System32\spoolsv.exe
1884 C:\Windows\System32\svchost.exe
2040 C:\Windows\System32\svchost.exe
128 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
364 C:\Program Files\BitKinex\bitkinexsvc.exe
416 C:\Program Files\Bonjour\mDNSResponder.exe
388 C:\Windows\System32\svchost.exe
436 C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
1620 C:\Program Files\CDBurnerXP\NMSAccessU.exe
1908 C:\Program Files\Sandboxie\SbieSvc.exe
1592 C:\Windows\System32\svchost.exe
2068 C:\Windows\System32\vmnat.exe
2128 C:\Program Files\VMware\VMware Server\tomcat\bin\tomcat6.exe
2168 C:\Windows\System32\svchost.exe
2176 C:\Windows\System32\conhost.exe
2200 C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
2292 C:\Program Files\VMware\VMware Server\vmware-authd.exe
2380 C:\Windows\System32\vmnetdhcp.exe
2488 C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
2744 C:\Program Files\VMware\VMware Server\vmware-hostd.exe
3020 WmiPrvSE.exe
3080 C:\Windows\System32\svchost.exe
3912 C:\Windows\System32\taskhost.exe
4016 C:\Windows\System32\dwm.exe
4040 C:\Windows\explorer.exe
2776 C:\Windows\WindowsMobile\wmdc.exe
1972 C:\Program Files\Hercules\Deluxe Optical Glass\XtrCtrl.exe
3060 C:\Windows\System32\svchost.exe
2996 C:\Program Files\pdf24\pdf24.exe
3088 C:\Program Files\Common Files\Java\Java Update\jusched.exe
1692 C:\Program Files\iTunes\iTunesHelper.exe
3368 C:\Program Files\Microsoft Security Essentials\msseces.exe
3376 C:\Program Files\GMX\GMX SMS-Manager\SMSMngr.exe
3388 C:\Program Files\Sandboxie\SbieCtrl.exe
3408 C:\Program Files\DAEMON Tools Lite\DTLite.exe
3872 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
3708 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
3164 C:\Program Files\Air Mouse\Air Mouse\Air Mouse.exe
1548 C:\Program Files\Logitech\SetPoint\SetPoint.exe
3676 C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
4280 C:\Program Files\Yahoo!\Messenger\Ymsgr_tray.exe
4376 C:\Windows\System32\SearchIndexer.exe
4448 C:\Program Files\iPod\bin\iPodService.exe
4624 C:\Program Files\Windows Media Player\wmpnetwk.exe
5036 C:\Windows\System32\svchost.exe
5580 C:\Program Files\Mozilla Firefox\firefox.exe
3600 C:\Windows\System32\taskmgr.exe
3452 C:\Users\*****\Desktop\5pr8zszx.exe
4124 C:\Windows\System32\audiodg.exe
116 C:\Windows\System32\notepad.exe
3760 C:\Program Files\Mozilla Firefox\firefox.exe
6108 C:\Windows\System32\SearchProtocolHost.exe
5880 C:\Windows\System32\SearchFilterHost.exe
3696 C:\Windows\explorer.exe
2372 C:\Users\*****\Desktop\MBRCheck.exe
4776 C:\Windows\System32\conhost.exe
3140 C:\Windows\System32\dllhost.exe
\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`06500000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000030`da500000 (NTFS)
\\.\E: --> \\.\PhysicalDrive0 at offset 0x0000007a`18600000 (NTFS)
\\.\O: --> \\.\PhysicalDrive1 at offset 0x00000018`74aece00 (NTFS)
\\.\P: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS)
\\.\Q: --> \\.\PhysicalDrive1 at offset 0x00000009`54921c00 (NTFS)
PhysicalDrive0 Model Number: SAMSUNGHD103SJ, Rev: 1AJ100E4
PhysicalDrive1 Model Number: SAMSUNGSP2504C, Rev: VT100-33
Size Device Name MBR Status
--------------------------------------------
931 GB \\.\PhysicalDrive0 Windows 7 MBR code detected
SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79
232 GB \\.\PhysicalDrive1 Windows 2008 MBR code detected
SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979
Done!
|
