Trojaner-Board - C:\directory\CyberGate\install\server.exe

hallo, hier sind die logs

GMER Logfile:

Code:

GMER 1.0.15.15530 - hxxp://www.gmer.net

Rootkit scan 2011-01-10 16:47:41

Windows 6.1.7600  Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD50 rev.01.0

Running: nkwb0c3f.exe; Driver: C:\Users\Caroline\AppData\Local\Temp\pxdcrkog.sys
 
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text           ntkrnlpa.exe!ZwSaveKeyEx + 13AD                                                                                             82C48599 1 Byte  [06]

.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                                      82C6CF52 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
 

---- User IAT/EAT - GMER 1.0.15 ----
 

IAT             C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2864] @ C:\windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress]  [753F5E25] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT             C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2864] @ C:\windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress]     [753F5E25] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT             C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2864] @ C:\windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress]    [753F5E25] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT             C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2864] @ C:\windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress]   [753F5E25] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT             C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2864] @ C:\windows\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress]   [753F5E25] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT             C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2864] @ C:\windows\system32\WININET.dll [KERNEL32.dll!GetProcAddress]   [753F5E25] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT             C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2864] @ C:\windows\system32\Secur32.dll [KERNEL32.dll!GetProcAddress]   [753F5E25] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
 

---- Devices - GMER 1.0.15 ----
 

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                                      fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                                      fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                                                      fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                                                                                      fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume5                                                                                      fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
 

Device          \Driver\ACPI_HAL \Device\0000004a                                                                                           halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)
 

---- Registry - GMER 1.0.15 ----
 

Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002269ec2d88                                                 

Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002269ec2d88 (not active ControlSet)                             
 

---- EOF - GMER 1.0.15 ----

--- --- ---

osam logfile:

OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 19:13:53 on 10.01.2011
 

OS: Windows 7 Home Premium Edition (Build 7600), 32-bit

Default Browser: Mozilla Corporation Firefox 3.6.13
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Control Panel Objects]

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"Nero BurnRights 10" - "Nero AG" - C:\Program Files\Nero\Nero 10\Nero BurnRights\NeroBurnRights_10.cpl

"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"avgntflt" (avgntflt) - "Avira GmbH" - C:\windows\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\windows\System32\DRIVERS\avipbb.sys

"Bridge0" (Bridge0) - "Lenovo" - C:\windows\System32\drivers\WDBridge.sys

"catchme" (catchme) - ? - C:\Users\Caroline\AppData\Local\Temp\catchme.sys  (File not found)

"FsUsbExDisk" (FsUsbExDisk) - ? - C:\windows\system32\FsUsbExDisk.SYS  (File found, but it contains no detailed information)

"funfrm" (funfrm) - ? - C:\windows\system32\drivers\funfrm.sys

"Huawei DataCard USB Modem and USB Serial" (hwdatacard) - ? - C:\windows\System32\DRIVERS\ewusbmdm.sys  (File not found)

"LibUsb-Win32 - Kernel Driver, Version 0.1.12.2" (libusb0) - "hxxp://libusb-win32.sourceforge.net" - C:\windows\System32\drivers\libusb0.sys

"MBAMSwissArmy" (MBAMSwissArmy) - "Malwarebytes Corporation" - C:\windows\system32\drivers\mbamswissarmy.sys

"pxdcrkog" (pxdcrkog) - ? - C:\Users\Caroline\AppData\Local\Temp\pxdcrkog.sys  (Hidden registry entry, rootkit activity | File not found)

"Realtek IR Driver" (RtsUIR) - ? - C:\windows\System32\DRIVERS\Rts516xIR.sys  (File not found)

"Realtek Smartcard Reader Driver" (USBCCID) - ? - C:\windows\System32\DRIVERS\RtsUCcid.sys  (File not found)

"RtsUStor.Sys Realtek USB Card Reader" (RSUSBSTOR) - ? - C:\windows\System32\Drivers\RtsUStor.sys  (File not found)

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\windows\System32\DRIVERS\ssmdrv.sys

"WimFltr" (WimFltr) - "Microsoft Corporation" - C:\windows\System32\DRIVERS\wimfltr.sys

"WinRing0_1_2_0" (WinRing0_1_2_0) - ? - D:\test\ECECECEC\WinRing0.sys  (File not found)
 

[Explorer]

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807553E5-5146-11D5-A672-00B0D022E945} "text/xml" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL

{3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL

{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL

{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL

{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL

{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----

{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll

{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\OFFICE11\msohev.dll

{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL

{F764812A-132C-4013-9960-5CBBEB408A0E} "NeroShellExt Class" - "Nero AG" - C:\Program Files\Common Files\Nero\NeroShellExt\NeroShellExt.dll

{0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll

{771C7324-DA80-49D3-8017-753B0AF60951} "VeriFace Enc" - ? -   (File not found | COM-object registry key not found)

{DF4F5AE4-E795-4C12-BC26-7726C27F71AE} "VeriFace file icon extension" - ? -   (File not found | COM-object registry key not found)

{2d3dd4c0-3bd7-11d2-821e-444553540000} "WdmidleDeviceShellExtension" - ? - c:\program files\lenovo\energy management\powcpl.dll  (File found, but it contains no detailed information)

{EB6024B6-1632-4CC7-94B1-3334A34B4554} "Web Sites" - "Microsoft Corporation" - C:\Program Files\Microsoft Expression\Web 3\fpnse.dll

{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL

{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll

{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

<binary data> "{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_21" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} "Java Plug-in 1.6.0_21" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_21" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_21.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

{E2883E8F-472F-4FB0-9522-AC9BF37916A7} "{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" - ? -   (File not found | COM-object registry key not found) / hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen" - "Microsoft Corporation" - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Recherchieren" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

<binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} "Search Helper" - "Microsoft Corp." - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} "Windows Live Toolbar Helper" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\Caroline\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"msnmsgr" - "Microsoft Corporation" - "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

"TomTomHOME.exe" - "TomTom" - "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

"Energy Management" - "Lenovo (Beijing) Limited" - C:\Program Files\Lenovo\Energy Management\Energy Management.exe

"EnergyUtility" - "Lenovo(beijing) Limited" - C:\Program Files\Lenovo\Energy Management\utility.exe

"IAAnotif" - "Intel Corporation" - C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe

"Malwarebytes' Anti-Malware (reboot)" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

"NBAgent" - "Nero AG" - "C:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe" /WinStart

"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime

"SmartAudio" - ? - C:\Program Files\CONEXANT\SAII\SAIICpl.exe /t

"UpdateP2GShortCut" - "CyberLink Corp." - "C:\Program Files\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\5.0"

"Wi-Fi Sync" - ? - "C:\Program Files\Wi-Fi Sync\wifisync.exe"
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\windows\system32\mdimon.dll
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@C:\Program Files\Nero\Update\NASvc.exe,-200" (NAUpdate) - "Nero AG" - C:\Program Files\Nero\Update\NASvc.exe

"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe

"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe

"IGRS" (IGRS) - "Lenovo Group Limited" - C:\Program Files\Lenovo\ReadyComm\common\IGRS.exe

"Intel(R) Matrix Storage Event Monitor" (IAANTMON) - "Intel Corporation" - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe

"Lenovo ReadyComm AppSvc" (Lenovo ReadyComm AppSvc) - "Lenovo Group Limited" - C:\Program Files\Lenovo\ReadyComm\AppSvc.exe

"Lenovo ReadyComm ConnSvc" (Lenovo ReadyComm ConnSvc) - "Lenovo Group Limited" - C:\Program Files\Lenovo\ReadyComm\ConnSvc.exe

"Machine Debug Manager" (MDM) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"SeaPort" (SeaPort) - "Microsoft Corp." - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

"ServiceLayer" (ServiceLayer) - "Nokia." - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

"SQL Server VSS Writer" (SQLWriter) - "Microsoft Corporation" - c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

"TomTomHOMEService" (TomTomHOMEService) - "TomTom" - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----

"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

MBRcheck:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows 7 Home Premium Edition
Windows Information: (build 7600), 32-bit
Base Board Manufacturer: LENOVO
BIOS Manufacturer: LENOVO
System Manufacturer: LENOVO
System Product Name: 0880
Logical Drives Mask: 0x0000003c

Kernel Drivers (total 179):
0x82C05000 \SystemRoot\system32\ntkrnlpa.exe
0x83015000 \SystemRoot\system32\halmacpi.dll
0x80BA6000 \SystemRoot\system32\kdcom.dll
0x83219000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x83291000 \SystemRoot\system32\PSHED.dll
0x832A2000 \SystemRoot\system32\BOOTVID.dll
0x832AA000 \SystemRoot\system32\CLFS.SYS
0x832EC000 \SystemRoot\system32\CI.dll
0x88820000 \SystemRoot\system32\drivers\Wdf01000.sys
0x88891000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x8889F000 \SystemRoot\system32\DRIVERS\ACPI.sys
0x888E7000 \SystemRoot\system32\DRIVERS\WMILIB.SYS
0x888F0000 \SystemRoot\system32\DRIVERS\msisadrv.sys
0x888F8000 \SystemRoot\system32\DRIVERS\pci.sys
0x88922000 \SystemRoot\system32\DRIVERS\vdrvroot.sys
0x8892D000 \SystemRoot\System32\drivers\partmgr.sys
0x8893E000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x88946000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x88951000 \SystemRoot\system32\DRIVERS\volmgr.sys
0x88961000 \SystemRoot\System32\drivers\volmgrx.sys
0x889AC000 \SystemRoot\System32\drivers\mountmgr.sys
0x88A0A000 \SystemRoot\system32\DRIVERS\iaStor.sys
0x88AE4000 \SystemRoot\system32\DRIVERS\amdxata.sys
0x88AED000 \SystemRoot\system32\drivers\fltmgr.sys
0x88B21000 \SystemRoot\system32\drivers\fileinfo.sys
0x88C1E000 \SystemRoot\System32\Drivers\Ntfs.sys
0x88D4D000 \SystemRoot\System32\Drivers\msrpc.sys
0x88D78000 \SystemRoot\System32\Drivers\ksecdd.sys
0x88D8B000 \SystemRoot\System32\Drivers\cng.sys
0x88DE8000 \SystemRoot\System32\drivers\pcw.sys
0x88DF6000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x88B32000 \SystemRoot\system32\drivers\ndis.sys
0x889C2000 \SystemRoot\system32\drivers\NETIO.SYS
0x83397000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x833BC000 \SystemRoot\system32\DRIVERS\volsnap.sys
0x88C00000 \SystemRoot\System32\Drivers\spldr.sys
0x88E32000 \SystemRoot\System32\drivers\rdyboost.sys
0x88E5F000 \SystemRoot\System32\Drivers\mup.sys
0x88E6F000 \SystemRoot\System32\drivers\hwpolicy.sys
0x88E77000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x88EA9000 \SystemRoot\system32\DRIVERS\disk.sys
0x88EBA000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x88FD7000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x88FF6000 \SystemRoot\System32\Drivers\Null.SYS
0x88E00000 \SystemRoot\System32\Drivers\Beep.SYS
0x88E07000 \SystemRoot\System32\drivers\vga.sys
0x8E025000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8E046000 \SystemRoot\System32\drivers\watchdog.sys
0x8E053000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8E05B000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8E063000 \SystemRoot\system32\drivers\rdprefmp.sys
0x8E06B000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8E076000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8E084000 \SystemRoot\System32\drivers\tcpip.sys
0x8E1CD000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8E000000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8E017000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8D42C000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8D45E000 \SystemRoot\system32\drivers\afd.sys
0x8D4B8000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x8D4BF000 \SystemRoot\system32\DRIVERS\pacer.sys
0x8D4DE000 \SystemRoot\system32\DRIVERS\vwififlt.sys
0x8D4EF000 \SystemRoot\system32\DRIVERS\netbios.sys
0x8D4FD000 \SystemRoot\System32\Drivers\funfrm.SYS
0x8D50E000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8D521000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8D531000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0x8D537000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8D578000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8D582000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8D58C000 \SystemRoot\System32\drivers\discache.sys
0x8D598000 \SystemRoot\System32\Drivers\dfsc.sys
0x8D5B0000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x8D5BE000 \SystemRoot\system32\DRIVERS\avipbb.sys
0x8D400000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x8EE1B000 \SystemRoot\system32\DRIVERS\igdkmd32.sys
0x8F43D000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8F4F4000 \SystemRoot\System32\drivers\dxgmms1.sys
0x8F52D000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x8F538000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8F583000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8F592000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8F629000 \SystemRoot\system32\DRIVERS\bcmwl6.sys
0x8F890000 \SystemRoot\system32\DRIVERS\vwifibus.sys
0x8F89A000 \SystemRoot\system32\DRIVERS\b57nd60x.sys
0x8F8DB000 \SystemRoot\system32\DRIVERS\AcpiVpc.sys
0x8F8EB000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x8F8EF000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x8F907000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x8F914000 \SystemRoot\system32\DRIVERS\Apfiltr.sys
0x8F94D000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x8F95A000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x8F960000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x8F972000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
0x8F97F000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x8F991000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8F9A9000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x8F9B4000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x8F9D6000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x8F600000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x8F5B1000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x8F617000 \SystemRoot\system32\DRIVERS\WDMirror.sys
0x8F61E000 \SystemRoot\system32\DRIVERS\swenum.sys
0x8F5C8000 \SystemRoot\system32\DRIVERS\ks.sys
0x8F9EE000 \SystemRoot\system32\DRIVERS\umbus.sys
0x8E434000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x8E478000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x8E489000 \SystemRoot\system32\drivers\CHDRT32.sys
0x8E501000 \SystemRoot\system32\drivers\portcls.sys
0x8E530000 \SystemRoot\system32\drivers\drmk.sys
0x8E549000 \SystemRoot\System32\Drivers\crashdmp.sys
0x88EDF000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x8E556000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x8E567000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x8E57E000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x95890000 \SystemRoot\System32\win32k.sys
0x8E580000 \SystemRoot\System32\drivers\Dxapi.sys
0x8E58A000 \SystemRoot\system32\DRIVERS\SMIksdrv.sys
0x96E33000 \SystemRoot\system32\DRIVERS\SMIEXP.SYS
0x970A2000 \SystemRoot\system32\DRIVERS\monitor.sys
0x970CB000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x95AF0000 \SystemRoot\System32\TSDDD.dll
0x95B20000 \SystemRoot\System32\cdd.dll
0x970DD000 \SystemRoot\system32\drivers\luafv.sys
0x970F8000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0x9710D000 \SystemRoot\system32\drivers\WudfPf.sys
0x97127000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x97137000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x9717D000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x9718D000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x9242B000 \SystemRoot\system32\drivers\HTTP.sys
0x924B0000 \SystemRoot\system32\DRIVERS\bowser.sys
0x924C9000 \SystemRoot\System32\drivers\mpsdrv.sys
0x924DB000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x924FE000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x92539000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x92554000 \SystemRoot\system32\drivers\peauth.sys
0x925EB000 \SystemRoot\System32\Drivers\secdrv.SYS
0x92400000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x971A0000 \SystemRoot\System32\drivers\tcpipreg.sys
0x971AD000 \SystemRoot\System32\DRIVERS\srv2.sys
0x98A21000 \SystemRoot\System32\DRIVERS\srv.sys
0x98B5D000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x98B68000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x98B7B000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x98B86000 \??\C:\Users\Caroline\AppData\Local\Temp\pxdcrkog.sys
0x77350000 \Windows\System32\ntdll.dll
0x47CE0000 \Windows\System32\smss.exe
0x77590000 \Windows\System32\apisetschema.dll
0x00690000 \Windows\System32\autochk.exe
0x774B0000 \Windows\System32\msctf.dll
0x77300000 \Windows\System32\gdi32.dll
0x77260000 \Windows\System32\usp10.dll
0x77210000 \Windows\System32\Wldap32.dll
0x774A0000 \Windows\System32\lpk.dll
0x771F0000 \Windows\System32\imm32.dll
0x77160000 \Windows\System32\clbcatq.dll
0x76FC0000 \Windows\System32\setupapi.dll
0x76F60000 \Windows\System32\shlwapi.dll
0x76ED0000 \Windows\System32\oleaut32.dll
0x76EA0000 \Windows\System32\imagehlp.dll
0x76E60000 \Windows\System32\ws2_32.dll
0x76DB0000 \Windows\System32\rpcrt4.dll
0x76D30000 \Windows\System32\comdlg32.dll
0x76C80000 \Windows\System32\msvcrt.dll
0x76A80000 \Windows\System32\iertutil.dll
0x77490000 \Windows\System32\psapi.dll
0x76A20000 \Windows\System32\difxapi.dll
0x76940000 \Windows\System32\kernel32.dll
0x76840000 \Windows\System32\wininet.dll
0x766E0000 \Windows\System32\ole32.dll
0x76610000 \Windows\System32\user32.dll
0x765F0000 \Windows\System32\sechost.dll
0x765E0000 \Windows\System32\nsi.dll
0x764A0000 \Windows\System32\urlmon.dll
0x76490000 \Windows\System32\normaliz.dll
0x75840000 \Windows\System32\shell32.dll
0x757A0000 \Windows\System32\advapi32.dll
0x75680000 \Windows\System32\crypt32.dll

Processes (total 69):
0 System Idle Process
4 System
292 C:\Windows\System32\smss.exe
412 csrss.exe
464 C:\Windows\System32\wininit.exe
472 csrss.exe
520 C:\Windows\System32\services.exe
536 C:\Windows\System32\lsass.exe
544 C:\Windows\System32\lsm.exe
644 C:\Windows\System32\svchost.exe
728 C:\Windows\System32\svchost.exe
784 C:\Windows\System32\svchost.exe
832 C:\Windows\System32\svchost.exe
872 C:\Windows\System32\svchost.exe
980 C:\Windows\System32\svchost.exe
1068 C:\Windows\System32\svchost.exe
1144 C:\Windows\System32\winlogon.exe
1228 C:\Windows\System32\wlanext.exe
1240 C:\Windows\System32\conhost.exe
1376 C:\Windows\System32\spoolsv.exe
1408 C:\Program Files\Avira\AntiVir Desktop\sched.exe
1452 C:\Windows\System32\svchost.exe
1608 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
1636 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1672 C:\Program Files\Bonjour\mDNSResponder.exe
1728 C:\Program Files\Lenovo\ReadyComm\common\IGRS.exe
1768 C:\Program Files\Common Files\microsoft shared\VS7DEBUG\MDM.EXE
1820 C:\Windows\System32\IgrsSvcs.exe
1908 C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
2004 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
2012 C:\Windows\System32\conhost.exe
2036 C:\Windows\System32\svchost.exe
880 C:\Windows\System32\taskhost.exe
956 C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
1576 C:\Windows\explorer.exe
2136 WmiPrvSE.exe
2196 C:\Windows\System32\dwm.exe
2308 C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
2316 C:\Windows\System32\igfxtray.exe
2324 C:\Windows\System32\hkcmd.exe
2332 C:\Windows\System32\igfxpers.exe
2404 C:\Program Files\CONEXANT\SAII\SmartAudio.exe
2424 C:\Windows\System32\igfxsrvc.exe
2432 C:\Program Files\Lenovo\Energy Management\utility.exe
2468 C:\Program Files\Lenovo\Energy Management\Energy Management.exe
2532 C:\Program Files\Wi-Fi Sync\wifisync.exe
2572 C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
2772 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
2852 C:\Program Files\Windows Sidebar\sidebar.exe
2864 C:\Program Files\Windows Live\Messenger\msnmsgr.exe
2892 C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
3292 WmiPrvSE.exe
3352 C:\Program Files\iTunes\iTunesHelper.exe
2248 C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
2100 C:\Program Files\iPod\bin\iPodService.exe
3600 C:\Windows\System32\svchost.exe
1616 C:\Program Files\Windows Media Player\wmpnetwk.exe
1372 C:\Windows\System32\svchost.exe
5336 C:\Program Files\Nero\Update\NASvc.exe
5452 C:\Windows\System32\svchost.exe
5200 C:\Program Files\Common Files\Java\Java Update\jusched.exe
5980 C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
3248 C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
1320 C:\Program Files\Mozilla Firefox\firefox.exe
4960 C:\Windows\System32\audiodg.exe
5500 dllhost.exe
3884 dllhost.exe
4428 C:\Users\Caroline\Desktop\MBRCheck.exe
2948 C:\Windows\System32\conhost.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`0c900000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000034`c1e00000 (NTFS)
\\.\E: --> \\.\PhysicalDrive0 at offset 0x00000053`74900000 (NTFS)

PhysicalDrive0 Model Number: WDCWD5000BEVT-24A0RT0, Rev: 01.01A02

Size Device Name MBR Status
--------------------------------------------
465 GB \\.\PhysicalDrive0 Windows 7 MBR code detected
SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79

Done!