Trojaner-Board - Antivir melde mehrer Trojaner

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Antivir melde mehrer Trojaner (https://www.trojaner-board.de/90176-antivir-melde-mehrer-trojaner.html)

Antivir melde mehrer Trojaner

Hallo,
da ich mit eurer Hilfe schon einmal meinen pc sauber bekommen habe, komme ich auch diesmal wieder auf eure forum.
heute morgen meldete antivir auf einmal einen befall meines pc´s
hier die logdaten:

Code:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org
 

Datenbank Version: 4500
 

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702
 

29.08.2010 14:35:10

mbam-log-2010-08-29 (14-35-10).txt
 

Art des Suchlaufs: Quick-Scan

Durchsuchte Objekte: 142175

Laufzeit: 22 Minute(n), 29 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 3
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

C:\Dokumente und Einstellungen\\Startmenü\Programme\Autostart\sysrda32.exe (Heuristics.Shuriken) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drivers\zyxnv.sys (Rootkit.Bubnix) -> Quarantined and deleted successfully.

C:\Dokumente und Einstellungen\\Anwendungsdaten\avdrn.dat (Malware.Trace) -> Quarantined and deleted successfully.

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 14:39 on 29/08/2010

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...
Unable to read ofbrqmii.sys
SPTD -> Already disabled

-=E.O.F=-

GMER Logfile:

Code:

GMER 1.0.15.15281 - hxxp://www.gmer.net

Rootkit scan 2010-08-29 14:54:17

Windows 5.1.2600 Service Pack 3

Running: gmer.exe; Driver: C:\DOKUME~1\\LOKALE~1\Temp\kxldypow.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT            F72CBD9E                                                                                              ZwCreateKey

SSDT            F72CBD94                                                                                              ZwCreateThread

SSDT            F72CBDA3                                                                                              ZwDeleteKey

SSDT            F72CBDAD                                                                                              ZwDeleteValueKey

SSDT            F72CBDB2                                                                                              ZwLoadKey

SSDT            F72CBD80                                                                                              ZwOpenProcess

SSDT            F72CBD85                                                                                              ZwOpenThread

SSDT            F72CBDBC                                                                                              ZwReplaceKey

SSDT            F72CBDB7                                                                                              ZwRestoreKey

SSDT            F72CBDA8                                                                                              ZwSetValueKey

SSDT            F72CBD8F                                                                                              ZwTerminateProcess
 

---- Kernel code sections - GMER 1.0.15 ----
 

?               yjeqitpi.sys                                                                                          Das System kann die angegebene Datei nicht finden. !

?               ofbrqmii.sys                                                                                          Ein an das System angeschlossenes Gerät funktioniert nicht. !

PAGE            Fastfat.sys                                                                                           F73BAD56 4 Bytes  CALL 867CF429 

.text           C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                                              section is writeable [0xF6E93360, 0x240F7E, 0xE8000020]
 

---- Devices - GMER 1.0.15 ----
 

Device          \FileSystem\Fastfat \FatCdrom                                                                         867CBE20

Device          \Driver\Tcpip \Device\Ip                                                                              861EE3E0

Device          \Driver\Tcpip \Device\Tcp                                                                             861EE3E0

Device          \Driver\Tcpip \Device\Udp                                                                             861EE3E0

Device          \Driver\Tcpip \Device\RawIp                                                                           861EE3E0

Device          \Driver\Tcpip \Device\IPMULTICAST                                                                     861EE3E0

Device          \FileSystem\Fastfat \Fat                                                                              867CBE20
 

AttachedDevice  \FileSystem\Fastfat \Fat                                                                              fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
 

---- Services - GMER 1.0.15 ----
 

Service          (*** hidden *** )                                                                                    [BOOT] ofbrqmii                                                          <-- ROOTKIT !!!
 

---- Registry - GMER 1.0.15 ----
 

Reg             HKLM\SYSTEM\CurrentControlSet\Services\ofbrqmii@Type                                                  1

Reg             HKLM\SYSTEM\CurrentControlSet\Services\ofbrqmii@Start                                                 0

Reg             HKLM\SYSTEM\CurrentControlSet\Services\ofbrqmii@ErrorControl                                          0

Reg             HKLM\SYSTEM\CurrentControlSet\Services\ofbrqmii@Group                                                 Boot Bus Extender

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04                      

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0                   1

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew                0x2E 0xCF 0x04 0x0E ...

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4                      

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                   0

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                0xE8 0xD9 0x31 0x06 ...

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)  

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0                       1

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew                    0x2E 0xCF 0x04 0x0E ...

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)  

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                       0

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                    0xE8 0xD9 0x31 0x06 ...

Reg             HKLM\SYSTEM\ControlSet003\Services\ofbrqmii@Type                                                      1

Reg             HKLM\SYSTEM\ControlSet003\Services\ofbrqmii@Start                                                     0

Reg             HKLM\SYSTEM\ControlSet003\Services\ofbrqmii@ErrorControl                                              0

Reg             HKLM\SYSTEM\ControlSet003\Services\ofbrqmii@Group                                                     Boot Bus Extender

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)  

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0                       1

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew                    0x2E 0xCF 0x04 0x0E ...

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)  

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                       0

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                    0xE8 0xD9 0x31 0x06 ...
 

---- EOF - GMER 1.0.15 ----OTL Logfile:

--- --- ---

Code:

OTL logfile created on: 29.08.2010 14:59:05 - Run 3

OTL by OldTimer - Version 3.2.6.0     Folder = C:\Dokumente und Einstellungen\

\Desktop

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

1.022,00 Mb Total Physical Memory | 691,00 Mb Available Physical Memory | 68,00% Memory free

2,00 Gb Paging File | 2,00 Gb Available in Paging File | 88,00% Paging File free

Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 192,00 Gb Total Space | 34,41 Gb Free Space | 17,92% Space Free | Partition Type: FAT32

D: Drive not present or media not loaded

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: 

Current User Name: 

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: On

Skip Microsoft Files: On

File Age = 90 Days

Output = Minimal

Quick Scan

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Dokumente und Einstellungen\\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

PRC - C:\WINDOWS\soundman.exe (Realtek Semiconductor Corp.)

PRC - C:\Programme\RALINK\Common\RaUI.exe (Ralink Technology, Corp.)

 

 
 ========== Modules (SafeList) ==========

 

MOD - C:\Dokumente und Einstellungen\\Desktop\OTL.exe (OldTimer Tools)

MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - (NMIndexingService) --  File not found

SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)

DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)

DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)

DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)

DRV - (sptd) -- C:\WINDOWS\system32\drivers\sptd.sys (Duplex Secure Ltd.)

DRV - (Changer) -- C:\WINDOWS\system32\drivers\Changer.sys (Microsoft Corporation)

DRV - (PDNMp50) -- C:\WINDOWS\system32\drivers\PDNMp50.sys (Printing Communications Assoc., Inc. (PCAUSA))

DRV - (PDNSp50) -- C:\WINDOWS\system32\drivers\PDNSp50.sys (Printing Communications Assoc., Inc. (PCAUSA))

DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) -- C:\WINDOWS\system32\drivers\alcxwdm.sys (Realtek Semiconductor Corp.)

DRV - (RT73) -- C:\WINDOWS\system32\drivers\rt73.sys (Ralink Technology, Corp.)

DRV - (nv) -- C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)

DRV - (RTL8023xp) -- C:\WINDOWS\system32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation                           )

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

 

 

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Programme\Mozilla Firefox\components [2007.04.11 00:15:26 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2007.04.11 00:15:26 | 000,000,000 | ---D | M]

 

[2008.12.05 16:58:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\\Anwendungsdaten\Mozilla\Extensions

[2007.04.11 00:16:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\\Anwendungsdaten\Mozilla\Firefox\Profiles\0ydk7qlp.default\extensions

[2010.08.25 00:10:30 | 000,000,000 | ---D | M] (Flashblock) -- C:\Dokumente und Einstellungen\\Anwendungsdaten\Mozilla\Firefox\Profiles\0ydk7qlp.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}

[2007.04.11 00:15:26 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions

[2010.07.29 08:21:54 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml

[2010.07.29 08:21:54 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml

[2010.07.29 08:21:54 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml

[2010.07.29 08:21:54 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml

[2010.07.29 08:21:54 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2010.06.17 14:35:44 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\nvmctray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()

O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\soundman.exe (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [SW20] C:\WINDOWS\system32\sw20.exe ()

O4 - HKLM..\Run: [SW24] C:\WINDOWS\system32\sw24.exe ()

O4 - HKCU..\Run: [Steam] c:\programme\steam\steam.exe (Valve Corporation)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Ralink Wireless Utility.lnk = C:\Programme\RALINK\Common\RaUI.exe (Ralink Technology, Corp.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre6\bin\npjpi160_15.dll (Sun Microsystems, Inc.)

O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe File not found

O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe File not found

O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)

O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)

O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)

O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)

O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Oberon Flash Game Host)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home

O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2004.04.30 08:44:26 | 000,000,398 | ---- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ]

O33 - MountPoints2\{91c34cca-26f0-11df-b6f1-003005e385e3}\Shell - "" = AutoRun

O33 - MountPoints2\{91c34cca-26f0-11df-b6f1-003005e385e3}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{91c34cca-26f0-11df-b6f1-003005e385e3}\Shell\AutoRun\command - "" = I:\LaunchU3.exe -- File not found

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: 6to4 -  File not found

NetSvcs: Ias - C:\WINDOWS\system32\ias [2007.04.10 17:54:42 | 000,000,000 | ---D | M]

NetSvcs: Iprip -  File not found

NetSvcs: Irmon -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: Wmi - C:\WINDOWS\system32\wmi.dll (Microsoft Corporation)

NetSvcs: WmdmPmSp -  File not found

 

 

Drivers32: midi - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)

Drivers32: midimapper - C:\WINDOWS\System32\midimap.dll (Microsoft Corporation)

Drivers32: mixer - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)

Drivers32: msacm.imaadpcm - C:\WINDOWS\System32\imaadp32.acm (Microsoft Corporation)

Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.lhacm - C:\WINDOWS\System32\lhacm.acm (Microsoft Corporation)

Drivers32: msacm.msadpcm - C:\WINDOWS\System32\msadp32.acm (Microsoft Corporation)

Drivers32: msacm.msaudio1 - C:\WINDOWS\System32\msaud32.acm (Microsoft Corporation)

Drivers32: msacm.msg711 - C:\WINDOWS\System32\msg711.acm (Microsoft Corporation)

Drivers32: msacm.msg723 - C:\WINDOWS\System32\msg723.acm (Microsoft Corporation)

Drivers32: msacm.msgsm610 - C:\WINDOWS\System32\msgsm32.acm (Microsoft Corporation)

Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)

Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)

Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)

Drivers32: vidc.I420 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)

Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)

Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

Drivers32: vidc.iyuv - C:\WINDOWS\System32\iyuv_32.dll (Microsoft Corporation)

Drivers32: vidc.M261 - C:\WINDOWS\System32\msh261.drv (Microsoft Corporation)

Drivers32: vidc.M263 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)

Drivers32: vidc.mrle - C:\WINDOWS\System32\msrle32.dll (Microsoft Corporation)

Drivers32: vidc.msvc - C:\WINDOWS\System32\msvidc32.dll (Microsoft Corporation)

Drivers32: vidc.uyvy - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)

Drivers32: vidc.yuy2 - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)

Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)

Drivers32: vidc.yvu9 - C:\WINDOWS\System32\tsbyuv.dll (Microsoft Corporation)

Drivers32: vidc.yvyu - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)

Drivers32: wave - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)

Drivers32: wavemapper - C:\WINDOWS\System32\msacm32.drv (Microsoft Corporation)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point (17465059307421696)

 
 ========== Files/Folders - Created Within 90 Days ==========

 

[2010.08.29 13:48:13 | 000,000,000 | ---D | C] -- C:\Programme\ERUNT

[2010.08.29 13:37:13 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\\Desktop\MFTools

[2010.08.12 11:42:11 | 000,000,000 | ---D | C] -- C:\Programme\CIB software GmbH

[2010.08.12 11:40:50 | 000,000,000 | ---D | C] -- C:\WINDOWS\Downloaded Installations

[2010.07.31 10:51:13 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\\.thumbnails

[2010.07.30 19:07:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\\.gimp-2.6

[2010.07.30 19:07:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\\Eigene Dateien\gegl-0.0

[2010.07.30 19:06:03 | 000,000,000 | ---D | C] -- C:\Programme\GIMP-2.0

[2010.07.29 19:19:39 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Skype

[2010.07.13 10:58:48 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\\Desktop\usbstick

[2010.07.05 17:02:46 | 000,000,000 | -HSD | C] -- C:\FOUND.010

[2010.06.24 18:12:38 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\\Desktop\cc

[2010.06.21 10:58:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\\Eigene Dateien\Job

[2010.06.21 01:27:15 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\\Anwendungsdaten\SUPERAntiSpyware.com

[2010.06.17 15:37:53 | 000,000,000 | -HSD | C] -- C:\Recycled

[2010.06.17 14:14:39 | 000,000,000 | RHSD | C] -- C:\cmdcons

[2010.06.17 14:11:01 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe

[2010.06.17 14:11:01 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe

[2010.06.17 14:11:01 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe

[2010.06.17 14:11:01 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe

[2010.06.17 14:10:43 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT

[2010.06.17 14:08:08 | 000,000,000 | ---D | C] -- C:\cofi

[2010.06.17 14:06:50 | 000,000,000 | ---D | C] -- C:\Qoobox

[2010.06.17 14:02:26 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\\Recent

[2010.06.17 13:48:12 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner

[2010.06.17 12:08:12 | 000,000,000 | ---D | C] -- C:\_OTL

[2010.06.15 22:34:24 | 000,000,000 | ---D | C] -- C:\FOUND.009

[2010.06.14 18:34:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\\Anwendungsdaten\Malwarebytes

[2010.06.14 18:34:22 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys

[2010.06.14 18:34:20 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2010.06.14 18:34:20 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware

[2010.06.14 18:34:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes

[2010.06.14 18:31:59 | 000,572,416 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\\Desktop\OTL.exe

[2010.06.13 19:47:05 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Macromedia

[2010.06.13 19:38:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\\Eigene Dateien\Virenproblem

[2010.06.13 19:18:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Macromedia

[2010.06.13 18:08:14 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\\Eigene Dateien\Users

[2010.06.13 18:08:14 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\\Eigene Dateien\Startup

[2010.06.13 18:08:14 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\\Eigene Dateien\Data

[2010.06.13 17:42:16 | 000,000,000 | ---D | C] -- C:\Programme\IsoBuster

 
 ========== Files - Modified Within 90 Days ==========

 

[2010.08.29 15:00:02 | 000,585,504 | ---- | M] () -- C:\WINDOWS\System32\drivers\ofbrqmii.sys

[2010.08.29 14:59:46 | 010,485,760 | -H-- | M] () -- C:\Dokumente und Einstellungen\\NTUSER.DAT

[2010.08.29 14:39:12 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\\defogger_reenable

[2010.08.29 14:37:14 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2010.08.29 14:37:04 | 000,000,053 | ---- | M] () -- C:\biosinfo

[2010.08.29 14:36:46 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT

[2010.08.29 14:36:44 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2010.08.29 14:35:46 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\\ntuser.ini

[2010.08.29 14:18:30 | 000,002,243 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Skype.lnk

[2010.08.29 13:48:16 | 000,000,506 | ---- | M] () -- C:\Dokumente und Einstellungen\\Desktop\NTREGOPT.lnk

[2010.08.29 13:48:16 | 000,000,487 | ---- | M] () -- C:\Dokumente und Einstellungen\\Desktop\ERUNT.lnk

[2010.08.29 13:37:20 | 000,284,915 | ---- | M] () -- C:\Dokumente und Einstellungen\\Desktop\Gmer.zip

[2010.08.29 13:37:20 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\\Desktop\defogger.exe

[2010.08.29 13:19:52 | 000,388,197 | ---- | M] () -- C:\Dokumente und Einstellungen\\Desktop\Load.exe

[2010.08.24 15:54:32 | 000,029,184 | ---- | M] () -- C:\Dokumente und Einstellungen\\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010.08.23 14:31:18 | 000,000,487 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Opera.lnk

[2010.08.23 03:49:54 | 001,227,704 | ---- | M] () -- C:\Dokumente und Einstellungen\\Desktop\P1000961.JPG

[2010.08.12 12:23:52 | 000,249,496 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2010.08.12 11:44:20 | 000,094,542 | ---- | M] () -- C:\Dokumente und Einstellungen\\Desktop\hausarbeit.pdf

[2010.08.12 11:43:54 | 000,004,617 | ---- | M] () -- C:\Dokumente und Einstellungen\\Desktop\Deckblatt.pdf

[2010.08.12 10:58:20 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK

[2010.07.31 10:52:54 | 000,001,435 | ---- | M] () -- C:\Dokumente und Einstellungen\\.recently-used.xbel

[2010.07.30 19:06:38 | 000,000,695 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\GIMP 2.lnk

[2010.07.05 08:51:58 | 000,024,576 | ---- | M] () -- C:\Dokumente und Einstellungen\\Desktop\Evaluation.doc

[2010.06.30 16:21:48 | 000,000,155 | ---- | M] () -- C:\Dokumente und Einstellungen\\Desktop\noautoplay.reg

[2010.06.25 15:43:54 | 000,207,973 | ---- | M] () -- C:\Dokumente und Einstellungen\\Desktop\cc.zip

[2010.06.21 10:54:24 | 000,065,672 | ---- | M] () -- C:\Dokumente und Einstellungen\\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT

[2010.06.19 10:51:24 | 000,293,376 | ---- | M] () -- C:\Dokumente und Einstellungen\\Desktop\xfsi2p7j.exe

[2010.06.17 14:36:04 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini

[2010.06.17 14:14:44 | 000,000,336 | RHS- | M] () -- C:\boot.ini

[2010.06.17 13:48:16 | 000,001,427 | ---- | M] () -- C:\Dokumente und Einstellungen\\Desktop\CCleaner.lnk

[2010.06.17 13:46:36 | 003,713,649 | R--- | M] () -- C:\Dokumente und Einstellungen\\Desktop\cofi.exe

[2010.06.14 18:34:26 | 000,000,591 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2010.06.14 18:32:06 | 000,572,416 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\\Desktop\OTL.exe

[2010.06.13 18:16:58 | 000,001,330 | ---- | M] () -- C:\Dokumente und Einstellungen\\Desktop\Age of Empires III.lnk

[2010.06.09 10:45:48 | 000,019,456 | ---- | M] () -- C:\Dokumente und Einstellungen\\Eigene Dateien\Sachen die mir gehören.doc

[2010.06.08 16:53:24 | 000,098,629 | ---- | M] () -- C:\Dokumente und Einstellungen\\Eigene Dateien\Europas Dilemma.pdf

[2010.06.08 16:51:18 | 000,563,114 | ---- | M] () -- C:\Dokumente und Einstellungen\\Eigene Dateien\10_Jahre_WWU_Wifo_MB_1_2009.pdf

 
 ========== Files Created - No Company Name ==========

 

[2010.08.29 14:40:46 | 000,293,376 | ---- | C] () -- C:\Dokumente und Einstellungen\\Desktop\gmer.exe

[2010.08.29 14:39:11 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\\defogger_reenable

[2010.08.29 13:48:14 | 000,000,506 | ---- | C] () -- C:\Dokumente und Einstellungen\\Desktop\NTREGOPT.lnk

[2010.08.29 13:48:14 | 000,000,487 | ---- | C] () -- C:\Dokumente und Einstellungen\\Desktop\ERUNT.lnk

[2010.08.29 13:37:19 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\\Desktop\defogger.exe

[2010.08.29 13:37:18 | 000,284,915 | ---- | C] () -- C:\Dokumente und Einstellungen\\Desktop\Gmer.zip

[2010.08.29 13:19:50 | 000,388,197 | ---- | C] () -- C:\Dokumente und Einstellungen\\Desktop\Load.exe

[2010.08.29 13:05:25 | 000,585,504 | ---- | C] () -- C:\WINDOWS\System32\drivers\ofbrqmii.sys

[2010.08.29 13:04:53 | 000,000,016 | ---- | C] () -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\hngmfc.dat

[2010.08.23 14:31:16 | 000,000,487 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Opera.lnk

[2010.08.23 03:48:49 | 001,227,704 | ---- | C] () -- C:\Dokumente und Einstellungen\\Desktop\P1000961.JPG

[2010.08.12 11:44:18 | 000,094,542 | ---- | C] () -- C:\Dokumente und Einstellungen\\Desktop\hausarbeit.pdf

[2010.08.12 11:43:52 | 000,004,617 | ---- | C] () -- C:\Dokumente und Einstellungen\\Desktop\Deckblatt.pdf

[2010.07.31 10:52:52 | 000,001,435 | ---- | C] () -- C:\Dokumente und Einstellungen\\.recently-used.xbel

[2010.07.30 19:06:35 | 000,000,695 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\GIMP 2.lnk

[2010.07.15 00:00:12 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK

[2010.07.05 08:48:23 | 000,024,576 | ---- | C] () -- C:\Dokumente und Einstellungen\\Desktop\Evaluation.doc

[2010.06.30 16:21:52 | 000,000,155 | ---- | C] () -- C:\Dokumente und Einstellungen\\Desktop\noautoplay.reg

[2010.06.25 15:43:53 | 000,207,973 | ---- | C] () -- C:\Dokumente und Einstellungen\\Desktop\cc.zip

[2010.06.19 10:51:22 | 000,293,376 | ---- | C] () -- C:\Dokumente und Einstellungen\\Desktop\xfsi2p7j.exe

[2010.06.17 14:14:42 | 000,000,266 | ---- | C] () -- C:\Boot.bak

[2010.06.17 14:14:40 | 000,262,448 | ---- | C] () -- C:\cmldr

[2010.06.17 14:11:01 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe

[2010.06.17 14:11:01 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe

[2010.06.17 14:11:01 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe

[2010.06.17 14:11:01 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe

[2010.06.17 14:11:01 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe

[2010.06.17 13:48:15 | 000,001,427 | ---- | C] () -- C:\Dokumente und Einstellungen\\Desktop\CCleaner.lnk

[2010.06.17 13:46:34 | 003,713,649 | R--- | C] () -- C:\Dokumente und Einstellungen\\Desktop\cofi.exe

[2010.06.14 18:34:24 | 000,000,591 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2010.06.13 18:16:57 | 000,001,330 | ---- | C] () -- C:\Dokumente und Einstellungen\\Desktop\Age of Empires III.lnk

[2010.06.13 18:02:46 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll

[2010.06.13 18:02:46 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\dllcache\psisdecd.dll

[2010.06.13 18:02:46 | 000,052,224 | ---- | C] () -- C:\WINDOWS\System32\msdvbnp.ax

[2010.06.13 18:02:46 | 000,052,224 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msdvbnp.ax

[2010.06.13 18:02:46 | 000,030,208 | ---- | C] () -- C:\WINDOWS\System32\psisrndr.ax

[2010.06.13 18:02:46 | 000,030,208 | ---- | C] () -- C:\WINDOWS\System32\dllcache\psisrndr.ax

[2010.06.13 18:02:45 | 000,733,184 | ---- | C] () -- C:\WINDOWS\System32\dllcache\qedwipes.dll

[2010.06.13 18:02:45 | 000,136,192 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mpg2splt.ax

[2010.06.13 18:02:45 | 000,064,512 | ---- | C] () -- C:\WINDOWS\System32\dllcache\amstream.dll

[2010.06.13 18:02:45 | 000,034,304 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mciqtz32.dll

[2010.06.13 18:02:45 | 000,013,312 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msdmo.dll

[2010.06.09 10:45:09 | 000,019,456 | ---- | C] () -- C:\Dokumente und Einstellungen\\Eigene Dateien\Sachen die mir gehören.doc

[2010.06.08 16:53:22 | 000,098,629 | ---- | C] () -- C:\Dokumente und Einstellungen\\Eigene Dateien\Europas Dilemma.pdf

[2010.06.08 16:51:17 | 000,563,114 | ---- | C] () -- C:\Dokumente und Einstellungen\\Eigene Dateien\10_Jahre_WWU_Wifo_MB_1_2009.pdf

[2007.11.20 19:21:15 | 000,295,018 | ---- | C] () -- C:\WINDOWS\System32\Install7x.dll

[2007.10.14 22:43:24 | 000,000,403 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2007.07.03 22:38:10 | 000,143,360 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll

[2007.06.09 17:13:11 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI

[2007.04.11 20:39:07 | 000,000,000 | ---- | C] () -- C:\WINDOWS\msicpl.ini

[2007.04.11 20:36:37 | 000,009,728 | R--- | C] () -- C:\WINDOWS\System32\sysinfoX64.sys

[2007.04.11 20:36:37 | 000,008,192 | R--- | C] () -- C:\WINDOWS\System32\sysinfo.sys

[2006.06.01 11:22:00 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll

[2006.06.01 11:22:00 | 001,466,368 | ---- | C] () -- C:\WINDOWS\System32\nview.dll

[2006.06.01 11:22:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll

[2006.06.01 11:22:00 | 000,581,632 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll

[2006.06.01 11:22:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll

[2006.06.01 11:22:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll

[2006.06.01 11:22:00 | 000,196,608 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll

[1999.01.22 20:46:58 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL

 
 ========== LOP Check ==========

 

[2007.10.14 22:41:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SBT

[2007.04.11 00:11:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\\Anwendungsdaten\ICQLite

[2007.07.08 16:15:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\\Anwendungsdaten\Template

[2008.01.07 10:25:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\\Anwendungsdaten\Opera

[2008.03.01 19:02:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\\Anwendungsdaten\Firaxis Games

[2008.03.01 19:05:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\\Anwendungsdaten\My Games

[2008.04.09 11:32:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\\Anwendungsdaten\ICQ

[2008.11.21 13:33:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\\Anwendungsdaten\DAEMON Tools

[2009.01.15 10:04:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\\Anwendungsdaten\uTorrent

[2009.03.02 08:43:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\\Anwendungsdaten\Inkscape

[2009.03.04 20:18:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\\Anwendungsdaten\gtk-2.0

[2008.12.26 12:12:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\\Anwendungsdaten\Hepi

[2007.07.18 21:57:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\\Anwendungsdaten\Arka

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %SYSTEMDRIVE%\*.* >

[2004.04.30 08:44:24 | 000,093,963 | -HS- | M] () -- C:\COMMAND.COM

[2004.04.17 21:19:14 | 000,045,815 | ---- | M] () -- C:\KERNEL.SYS

[2004.04.30 08:44:26 | 000,000,398 | ---- | M] () -- C:\AUTOEXEC.BAT

[2004.04.30 08:44:26 | 000,000,801 | ---- | M] () -- C:\CONFIG.SYS

[2006.02.28 12:00:00 | 000,004,952 | RHS- | M] () -- C:\bootfont.bin

[2009.12.16 12:48:32 | 000,251,712 | RHS- | M] () -- C:\ntldr

[2006.02.28 12:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM

[2007.04.10 17:59:28 | 000,000,512 | -HS- | M] () -- C:\bootsect.dos

[2010.06.17 14:14:44 | 000,000,336 | RHS- | M] () -- C:\boot.ini

[2007.04.10 19:09:48 | 000,000,000 | RHS- | M] () -- C:\IO.SYS

[2007.04.10 19:09:48 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS

[2010.08.29 14:36:40 | 1610,612,736 | -HS- | M] () -- C:\pagefile.sys

[2010.08.29 14:37:04 | 000,000,053 | ---- | M] () -- C:\biosinfo

[2009.06.22 19:04:10 | 000,595,442 | ---- | M] () -- C:\pastedpic_06222009_190407.png

[2009.06.22 19:09:26 | 000,145,745 | ---- | M] () -- C:\pastedpic_06222009_190924.png

[2009.06.24 12:40:56 | 000,104,230 | ---- | M] () -- C:\pastedpic_06242009_124054.png

[2004.08.03 23:00:10 | 000,262,448 | ---- | M] () -- C:\cmldr

[2007.04.10 19:05:38 | 000,000,266 | ---- | M] () -- C:\Boot.bak

[2010.06.17 14:38:06 | 000,011,822 | ---- | M] () -- C:\ComboFix.txt

[2010.07.06 20:28:56 | 000,004,320 | ---- | M] () -- C:\feed.txt

 
 < %systemroot%\system32\*.wt >

 
 < %systemroot%\system32\*.ruy >

 
 < %systemroot%\Fonts\*.com >

 
 < %systemroot%\Fonts\*.dll >

 
 < %systemroot%\Fonts\*.ini >

[2007.04.10 19:09:26 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

 
 < %systemroot%\Fonts\*.ini2 >

 
 < %systemroot%\system32\spool\prtprocs\w32x86\*.* >

[2010.05.21 11:57:40 | 000,466,784 | ---- | M] (CIB software GmbH, München) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\CIBpdfPP.dll

 
 < %systemroot%\REPAIR\*.bak1 >

 
 < %systemroot%\REPAIR\*.ini >

 
 < %systemroot%\system32\*.jpg >

 
 < %systemroot%\*.scr >

 
 < %systemroot%\*._sy >

 
 < %APPDATA%\Adobe\Update\*.* >

 
 < %ALLUSERSPROFILE%\Favorites\*.* >

 
 < %APPDATA%\Microsoft\*.* >

[2010.05.02 22:17:12 | 000,001,730 | -H-- | M] () -- C:\Dokumente und Einstellungen\\Anwendungsdaten\Microsoft\LastFlashConfig.WFC

 
 < %PROGRAMFILES%\*.* >

 
 < %APPDATA%\Update\*.* >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

 
 < %systemroot%\Tasks\*.job /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

[2007.04.10 17:59:28 | 000,430,080 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

[2007.04.10 17:59:28 | 000,638,976 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav

[2007.04.10 17:59:28 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav

 
 < %systemroot%\system32\user32.dll /md5 >

[2008.04.14 04:22:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=1AB997E656C3360BE5EAD080FA3384D4 -- C:\WINDOWS\system32\user32.dll

 
 < %systemroot%\system32\ws2_32.dll /md5 >

[2008.04.14 04:22:32 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=6A35E2D6F5F052C84EC2CEB296389439 -- C:\WINDOWS\system32\ws2_32.dll

 
 < %systemroot%\system32\ws2help.dll /md5 >

[2008.04.14 04:22:32 | 000,019,968 | ---- | M] (Microsoft Corporation) MD5=A932898EC4A9CA38948B53E4AC723C83 -- C:\WINDOWS\system32\ws2help.dll

 
 < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

 
 < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-08-12 08:58:51

< End of report >

--- --- ---
OTL hat entgegen der Anleitung allerdings nur den OTL log ausgeworfen, eine Extras Datei konnte ich nicht finden.

Vielen dank schon mal für die Hilfe
mfg fezi

Hallo,

poste bitte auch das Log von AntiVir.

Zitat:

Partition Type: FAT32

Wer hat Dir den Rechner installiert? FAT32 ist schon lange nicht mehr zeitgemäß, Du hast auf aktuelleren Windows-Versionen damit zu viele nachteile, v.a. weil auch problemlos das weitaus bessere NTFS genutzt werden kann.

Versuchen wirt schonmal das Rootkit zu killen. Bitte mal den Avenger anwenden:

1.) Lade Dir von hier Avenger:
Swandog46's Public Anti-Malware Tools (Download, linksseitig)

2.) Entpack das zip-Archiv, führe die Datei "avenger.exe" aus (unter Vista per Rechtsklick => als Administrator ausführen). Die Haken unten wie abgebildet setzen:

http://mitglied.lycos.de/efunction/tb123/avenger.png

3.) Kopiere Dir exakt die Zeilen aus dem folgenden Code-Feld:

Code:

files to delete:

C:\WINDOWS\System32\drivers\ofbrqmii.sys

C:\WINDOWS\System32\yjeqitpi.sys

C:\WINDOWS\system32\drivers\zyxnv.sys
 

Drivers to delete:

ofbrqmii

4.) Geh in "The Avenger" nun oben auf "Load Script", dort auf "Paste from Clipboard".

5.) Der Code-Text hier aus meinem Beitrag müsste nun unter "Input Script here" in "The Avenger" zu sehen sein.

6.) Falls dem so ist, klick unten rechts auf "Execute". Bestätige die nächste Abfrage mit "Ja", die Frage zu "Reboot now" (Neustart des Systems) ebenso.

7.) Nach dem Neustart erhältst Du ein LogFile von Avenger eingeblendet. Kopiere dessen Inhalt und poste ihn hier.

8.) Die Datei c:\avenger\backup.zip bei File-Upload.net hochladen und hier verlinken

Erstmal die Berichte von Antivir:

Code:

In der Datei 'C:\Dokumente und Einstellungen\\Lokale Einstellungen\Temporary Internet Files\Content.IE5\0B9GDFWC\mstsc[1].104&exn=CVE-2009-4324_2'

wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan] gefunden.

Ausgeführte Aktion: Zugriff verweigern

Code:

In der Datei 'C:\Dokumente und Einstellungen\\Lokale Einstellungen\Temporary Internet Files\Content.IE5\0B9GDFWC\mstsc[1].104&exn=CVE-2009-4324_2'

wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan] gefunden.

Ausgeführte Aktion: Zugriff verweigern

Code:

In der Datei 'C:\WINDOWS\system32\fjhdyfhsn.bat'

wurde ein Virus oder unerwünschtes Programm 'BAT/Delfiles.116' [virus] gefunden.

Ausgeführte Aktion: Zugriff verweigern

Code:

In der Datei 'C:\WINDOWS\system32\fjhdyfhsn.bat'

wurde ein Virus oder unerwünschtes Programm 'BAT/Delfiles.116' [virus] gefunden.

Ausgeführte Aktion: Zugriff verweigern

Code:

In der Datei 'C:\Dokumente und Einstellungen\\Lokale Einstellungen\Temporary Internet Files\Content.IE5\0B9GDFWC\mstsc[1].104&exn=CVE-2009-4324_2'

wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan] gefunden.

Ausgeführte Aktion: Zugriff verweigern

Code:

In der Datei 'C:\WINDOWS\system32\drivers\aec.sys'

wurde ein Virus oder unerwünschtes Programm 'RKIT/Agent.biiu' [trojan] gefunden.

Ausgeführte Aktion: Zugriff verweigern

------------

hier der avengerlog:

Code:

Logfile of The Avenger Version 2.0, (c) by Swandog46

hxxp://swandog46.geekstogo.com
 

Platform:  Windows XP
 

*******************
 

Script file opened successfully.

Script file read successfully.
 

Backups directory opened successfully at C:\Avenger
 

*******************
 

Beginning to process script file:
 

Rootkit scan active.

No rootkits found!
 

File "C:\WINDOWS\System32\drivers\ofbrqmii.sys" deleted successfully.
 

Error:  file "C:\WINDOWS\System32\yjeqitpi.sys" not found!

Deletion of file "C:\WINDOWS\System32\yjeqitpi.sys" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

  --> the object does not exist
 
 

Error:  file "C:\WINDOWS\system32\drivers\zyxnv.sys" not found!

Deletion of file "C:\WINDOWS\system32\drivers\zyxnv.sys" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

  --> the object does not exist
 

Driver "ofbrqmii" deleted successfully.
 

Completed script processing.
 

*******************
 

Finished!  Terminate.

hier der link zur avenger datei: hxxp://www.file-upload.net/download-2785454/backup.zip.html

--------------------
Nach dem Neustart durch Avenger kam eine Fehlermeldung, ich habe einen screenshot davon gemacht und hier hochgeladen:
http://www5.pic-upload.de/30.08.10/skl1xlh2cwh5.jpg
Ich hab dann auf abbrechen geklickt, danach kam das Fenster wieder. Nach dem dritten mal auf Abbrechen kam es nicht wieder.
--------------------
FAT32 ist glaube ich schon seit dem Kauf vor ca 3-4 Jahren auf dem Pc ich habe da nichts geändert, aber auch noch nie Probleme damit gehabt. Sollte ich das ändern?

Zitat:

FAT32 ist glaube ich schon seit dem Kauf vor ca 3-4 Jahren auf dem Pc ich habe da nichts geändert, aber auch noch nie Probleme damit gehabt. Sollte ich das ändern?

ja, das ändern wir aber später. Wir müssen erstmal die Infektion beseitigen:

Bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

http://saved.im/mtm0nzyzmzd5/cofi.jpg

Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Code:

ComboFix 10-08-28.02 - ***30.08.2010  13:01:57.2.1 - FAT32x86

Microsoft Windows XP Home Edition  5.1.2600.3.1252.49.1031.18.1022.721 [GMT 2:00]

ausgeführt von:: c:\dokumente und einstellungen\\Desktop\cofi.exe.exe

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

.
 

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.
 

C:\feed.txt
 

.

(((((((((((((((((((((((   Dateien erstellt von 2010-07-28 bis 2010-08-30  ))))))))))))))))))))))))))))))

.
 

2010-08-30 10:54 . 2010-08-30 10:54        --------        d-----w-        c:\programme\CCleaner

2010-08-29 11:48 . 2010-08-29 11:48        --------        d-----w-        c:\programme\ERUNT

2010-08-12 09:42 . 2010-08-12 09:42        --------        d-----w-        c:\programme\CIB software GmbH

2010-08-12 09:40 . 2010-08-12 09:40        --------        d-----w-        c:\windows\Downloaded Installations
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-08-29 11:04 . 2010-08-29 11:04        16        ----a-w-        c:\dokumente und einstellungen\NetworkService\Anwendungsdaten\hngmfc.dat

2010-07-30 17:06 . 2010-07-30 17:06        --------        d-----w-        c:\programme\GIMP-2.0

2010-07-29 17:19 . 2010-07-29 17:19        --------        d-----w-        c:\programme\Gemeinsame Dateien\Skype

2010-07-04 20:20 . 2007-11-21 19:31        1        ----a-w-        c:\dokumente und einstellungen\\Anwendungsdaten\OpenOffice.org2\user\uno_packages\cache\stamp.sys

2010-06-30 12:28 . 2006-02-28 10:00        149504        ----a-w-        c:\windows\system32\schannel.dll

2010-06-24 19:46 . 2010-06-20 23:28        63488        ----a-w-        c:\dokumente und einstellungen\\Anwendungsdaten\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll

2010-06-24 19:46 . 2010-06-20 23:28        117760        ----a-w-        c:\dokumente und einstellungen\\Anwendungsdaten\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL

2010-06-24 12:22 . 2006-02-28 10:00        916480        ----a-w-        c:\windows\system32\wininet.dll

2010-06-24 09:02 . 2006-02-28 10:00        1852032        ----a-w-        c:\windows\system32\win32k.sys

2010-06-21 15:27 . 2006-02-28 10:00        354304        ----a-w-        c:\windows\system32\drivers\srv.sys

2010-06-21 08:54 . 2007-04-10 17:15        65672        ----a-w-        c:\dokumente und einstellungen\\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT

2010-06-20 23:28 . 2010-06-20 23:28        52224        ----a-w-        c:\dokumente und einstellungen\\Anwendungsdaten\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll

2010-06-17 14:03 . 2006-02-28 10:00        80384        ----a-w-        c:\windows\system32\iccvid.dll

2010-06-14 14:31 . 2007-04-10 17:08        744448        ----a-w-        c:\windows\pchealth\helpctr\binaries\HelpSvc.exe

2010-06-14 07:41 . 2006-02-28 10:00        1172480        ----a-w-        c:\windows\system32\msxml3.dll

2009-07-14 00:16 . 2009-07-14 00:16        1044480        ----a-w-        c:\programme\mozilla firefox\plugins\libdivx.dll

2009-07-14 00:16 . 2009-07-14 00:16        200704        ----a-w-        c:\programme\mozilla firefox\plugins\ssldivx.dll

2009-07-14 00:16 . 2009-07-14 00:16        1044480        ----a-w-        c:\programme\opera\program\plugins\libdivx.dll

2009-07-14 00:16 . 2009-07-14 00:16        200704        ----a-w-        c:\programme\opera\program\plugins\ssldivx.dll

.
 

------- Sigcheck -------
 

[-] 2008-04-14 . 1AB997E656C3360BE5EAD080FA3384D4 . 580096 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll

[7] 2008-04-14 . B0050CC5340E3A0760DD8B417FF7AEBD . 580096 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\user32.dll

[-] 2007-03-08 . 78785EFF8CB90CEC1862A4CCFD9A3C3A . 579584 . . [5.1.2600.3099] . . c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll

[-] 2007-03-08 . 492E166CFD26A50FB9160DB536FF7D2B . 579072 . . [5.1.2600.3099] . . c:\windows\$NtServicePackUninstall$\user32.dll

[7] 2006-02-28 . 56785FD5236D7B22CF471A6DA9DB46D8 . 578560 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB890859$\user32.dll

[-] 2005-03-02 . 4C90159A69A5FD3EB39C71411F28FCFF . 578560 . . [5.1.2600.2622] . . c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll

[-] 2005-03-02 . 3751D7CF0E0A113D84414992146BCE6A . 578560 . . [5.1.2600.2622] . . c:\windows\$NtUninstallKB925902$\user32.dll
 

[-] 2008-04-14 . A932898EC4A9CA38948B53E4AC723C83 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\ws2help.dll

[7] 2008-04-14 . C7D8A0517CBF16B84F657DE87EBE9D4B . 19968 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ws2help.dll

[7] 2006-02-28 . B3ADA72D1E3E10A8F6430669DFC38ED0 . 19968 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ws2help.dll

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Steam"="c:\programme\steam\steam.exe" [2010-08-25 1242448]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-06-01 7618560]

"nwiz"="nwiz.exe" [2006-06-01 1519616]

"SW20"="c:\windows\system32\sw20.exe" [2006-05-18 208896]

"SW24"="c:\windows\system32\sw24.exe" [2006-05-17 69632]

"NvMediaCenter"="NvMCTray.dll" [2006-06-01 86016]

"SoundMan"="SOUNDMAN.EXE" [2006-08-03 577536]

"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]

"SunJavaUpdateSched"="c:\programme\Java\jre6\bin\jusched.exe" [2009-10-04 149280]

"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
 

c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\

Microsoft Office.lnk - c:\programme\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

Ralink Wireless Utility.lnk - c:\programme\RALINK\Common\RaUI.exe [2007-11-20 618496]
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Programme\\Opera\\Opera.exe"=

"c:\\Programme\\Skype\\Plugin Manager\\skypePM.exe"=

"c:\\Programme\\ICQ6.5\\ICQ.exe"=

"c:\\Programme\\Skype\\Phone\\Skype.exe"=
 

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [13.01.2010 14:37 108289]

S0 zyxnv;zyxnv; [x]

S3 PDNMp50;PDNMp50 NDIS Protocol Driver;c:\windows\system32\drivers\PDNMp50.sys [28.11.2006 22:46 28224]

S3 PDNSp50;PDNSp50 NDIS Protocol Driver;c:\windows\system32\drivers\PDNSp50.sys [28.11.2006 22:46 27072]

S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [21.11.2008 13:33 717296]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

TCP: {D8E8C55E-910B-4818-9D18-0C8D0817B098} = 192.168.223.23

FF - ProfilePath - c:\dokumente und einstellungen\\Anwendungsdaten\Mozilla\Firefox\Profiles\0ydk7qlp.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/

FF - plugin: c:\programme\Opera\program\plugins\npdivx32.dll

FF - plugin: c:\programme\Opera\program\plugins\npdivx32.dll
 

---- FIREFOX Richtlinien ----

FF - user.js: network.cookie.cookieBehavior - 0

FF - user.js: privacy.clearOnShutdown.cookies - false

FF - user.js: security.warn_viewing_mixed - false

FF - user.js: security.warn_viewing_mixed.show_once - false

FF - user.js: security.warn_submit_insecure - false

FF - user.js: security.warn_submit_insecure.show_once - false

c:\programme\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);

c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);

c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);

c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); 

c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); 

c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);

c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);

c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);

c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type",                  5);

c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);

c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size",  4096);

c:\programme\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);

c:\programme\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\programme\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);

c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);

c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);

c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);

c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);

c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);

c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);

c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);

.
 

**************************************************************************
 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2010-08-30 13:04

Windows 5.1.2600 Service Pack 3 FAT NTAPI
 

Scanne versteckte Prozesse... 
 

Scanne versteckte Autostarteinträge... 
 

Scanne versteckte Dateien... 
 

Scan erfolgreich abgeschlossen

versteckte Dateien: 0
 

**************************************************************************

.

Zeit der Fertigstellung: 2010-08-30  13:06:01

ComboFix-quarantined-files.txt  2010-08-30 11:06

ComboFix2.txt  2010-06-17 12:38
 

Vor Suchlauf: 24 Verzeichnis(se), 36.798.431.232 Bytes frei

Nach Suchlauf: 26 Verzeichnis(se), 36.772.839.424 Bytes frei
 

- - End Of File - - FBD344EE210DC80AE52E15556872FB72

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus

Anschließend den bootkit_remover herunterladen. Entpacke das Tool in einen eigenen Ordner auf dem Desktop und führe in diesem Ordner die Datei remove.exe aus.

Wenn Du Windows Vista oder Windows 7 verwendest, musst Du die remover.exe über ein Rechtsklick => als Administrator ausführen

Ein schwarzes Fenster wird sich öffnen und automatisch nach bösartigen Veränderungen im MBR suchen.
Poste dann bitte, ob es Veränderungen gibt und wenn ja in welchem device. Am besten alles posten was die remover.exe ausgibt.

Code:

GMER 1.0.15.15281 - hxxp://www.gmer.net

Rootkit scan 2010-08-31 01:56:24

Windows 5.1.2600 Service Pack 3

Running: gmer.exe; Driver: C:\DOKUME~1\\LOKALE~1\Temp\kxldypow.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT            F7306446                                                                                              ZwCreateKey

SSDT            F730643C                                                                                              ZwCreateThread

SSDT            F730644B                                                                                              ZwDeleteKey

SSDT            F7306455                                                                                              ZwDeleteValueKey

SSDT            F730645A                                                                                              ZwLoadKey

SSDT            F7306428                                                                                              ZwOpenProcess

SSDT            F730642D                                                                                              ZwOpenThread

SSDT            F7306464                                                                                              ZwReplaceKey

SSDT            F730645F                                                                                              ZwRestoreKey

SSDT            F7306450                                                                                              ZwSetValueKey

SSDT            F7306437                                                                                              ZwTerminateProcess
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text           C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                                              section is writeable [0xF6EDC360, 0x240F7E, 0xE8000020]
 

---- Devices - GMER 1.0.15 ----
 

AttachedDevice  \FileSystem\Fastfat \Fat                                                                              fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
 

---- Registry - GMER 1.0.15 ----
 

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04                      

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0                   1

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew                0x2E 0xCF 0x04 0x0E ...

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4                      

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                   0

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                0xE8 0xD9 0x31 0x06 ...

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)  

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0                       1

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew                    0x2E 0xCF 0x04 0x0E ...

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)  

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                       0

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                    0xE8 0xD9 0x31 0x06 ...

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)  

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0                       1

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew                    0x2E 0xCF 0x04 0x0E ...

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)  

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                       0

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                    0xE8 0xD9 0x31 0x06 ...
 

---- EOF - GMER 1.0.15 ----

OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 02:06:14 on 31.08.2010
 

OS: Windows XP Home Edition Service Pack 3 (Build 2600)

Default Browser: Microsoft Corporation Internet Explorer 8.00.6001.18702
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"ALSNDMGR.CPL" - ? - C:\WINDOWS\system32\ALSNDMGR.CPL  (File signed by Microsoft | File found, but it contains no detailed information)

"JAVACPL.CPL" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\JAVACPL.CPL

"NVCPL.CPL" - "NVIDIA Corporation" - C:\WINDOWS\system32\NVCPL.CPL

"NVTUICPL.CPL" - "NVIDIA Corporation" - C:\WINDOWS\system32\NVTUICPL.CPL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"Avira AntiVir Personal - Free Antivirus " - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"AEGIS Protocol (IEEE 802.1x) v3.4.10.0" (AegisP) - "Meetinghouse Data Communications" - C:\WINDOWS\System32\DRIVERS\AegisP.sys

"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys

"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys

"catchme" (catchme) - ? - C:\DOKUME~1\\LOKALE~1\Temp\catchme.sys  (File not found)

"GMSIPCI" (GMSIPCI) - ? - H:\INSTALL\GMSIPCI.SYS  (File not found)

"kxldypow" (kxldypow) - ? - C:\DOKUME~1\\LOKALE~1\Temp\kxldypow.sys  (Hidden registry entry, rootkit activity | File not found)

"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)

"nv" (nv) - "NVIDIA Corporation" - C:\WINDOWS\System32\DRIVERS\nv4_mini.sys

"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)

"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)

"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)

"PDNMp50 NDIS Protocol Driver" (PDNMp50) - "Printing Communications Assoc., Inc. (PCAUSA)" - C:\WINDOWS\system32\drivers\PDNMp50.sys

"PDNSp50 NDIS Protocol Driver" (PDNSp50) - "Printing Communications Assoc., Inc. (PCAUSA)" - C:\WINDOWS\system32\drivers\PDNSp50.sys

"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)

"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)

"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys

"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)

"zyxnv" (zyxnv) - ? - C:\WINDOWS\system32\drivers\zyxnv.sys  (File not found)
 

[Explorer]

-----( HKCU\Software\Classes\Folder\shellex\ColumnHandlers )-----

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? -   (File not found | COM-object registry key not found)

-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{BDEADF00-C265-11d0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Handler )-----

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL

{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)

{1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.dll

{73B24247-042E-4EF5-ADC2-42F62E6FD654} "ICQ Lite Shell Extension" - ? -   (File not found | COM-object registry key not found)

{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)

{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -   (File not found | COM-object registry key not found)

{FFB699E0-306A-11d3-8BD1-00104B6F7516} "NVIDIA CPL Extension" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.dll

{1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? -   (File not found | COM-object registry key not found)

{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? -   (File not found | COM-object registry key not found)

{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? -   (File not found | COM-object registry key not found)

{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? -   (File not found | COM-object registry key not found)

{0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office\OLKFSTUB.DLL

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - ? -   (File not found | COM-object registry key not found)

{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -   (File not found | COM-object registry key not found)

{e57ce731-33e8-4c51-8354-bb4de9d215d1} "Universelle Plug & Play-Geräte" - ? -   (File not found | COM-object registry key not found)

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Programme\WinRAR\rarext.dll  (File found, but it contains no detailed information)
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} "Java Plug-in 1.6.0_02" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.6.0_02\bin\npjpi160_02.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab

{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} "Java Plug-in 1.6.0_03" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.6.0_03\bin\npjpi160_03.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_15.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_15.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_15.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

{D0C0F75C-683A-4390-A791-1ACFD5599AB8} "Oberon Flash Game Host" - "Oberon Media, Inc." - C:\WINDOWS\Downloaded Program Files\OberonGameHost.dll / hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab

{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx / hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC} "ClsidExtension" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_15.dll

"ICQ Lite" - ? - C:\Programme\ICQLite\ICQLite.exe  (File not found)

"ICQ6" - "ICQ, LLC." - C:\Programme\ICQ6.5\ICQ.exe

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
 

[Known DLLs]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs )-----

"user32" - "Microsoft Corporation" - C:\WINDOWS\system32\user32.dll
 

[Logon]

-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----

"DESKTOP.INI" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\DESKTOP.INI

"Microsoft Office.lnk" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office\OSA9.EXE  (Shortcut exists | File exists)

"Ralink Wireless Utility.lnk" - "Ralink Technology, Corp." - C:\Programme\RALINK\Common\RaUI.exe  (Shortcut exists | File exists)

-----( %UserProfile%\Startmenü\Programme\Autostart )-----

"DESKTOP.INI" - ? - C:\Dokumente und Einstellungen\\Startmenü\Programme\Autostart\DESKTOP.INI

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"Steam" - "Valve Corporation" - "c:\programme\steam\steam.exe" -silent

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"

"avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min

"NvCplDaemon" - "NVIDIA Corporation" - RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

"NvMediaCenter" - "NVIDIA Corporation" - RunDLL32.exe NvMCTray.dll,NvTaskbarInit

"nwiz" - "NVIDIA Corporation" - nwiz.exe /install

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Java\jre6\bin\jusched.exe"

"SW20" - ? - C:\WINDOWS\system32\sw20.exe

"SW24" - ? - C:\WINDOWS\system32\sw24.exe  (File found, but it contains no detailed information)
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"Anwendungsverwaltung" (AppMgmt) - ? - C:\WINDOWS\System32\appmgmts.dll  (File not found)

"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe

"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe

"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe

"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe

"NMIndexingService" (NMIndexingService) - ? - "C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe"  (File not found)

"NVIDIA Display Driver Service" (NVSvc) - "NVIDIA Corporation" - C:\WINDOWS\system32\nvsvc32.exe
 

[Winlogon]

-----( HKCU\Control Panel\IOProcs )-----

"MVB" - ? - mvfs32.dll  (File not found)

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions )-----

{c6dc5466-785a-11d2-84d0-00c04fb169f7} "Softwareinstallation" - ? - appmgmts.dll  (File not found)

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----

"WgaLogon" - "Microsoft Corporation" - C:\WINDOWS\system32\WgaLogon.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---
If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Code:

.\debug.cpp(238) : Debug log started at 31.08.2010 - 00:11:23

.\boot_cleaner.cpp(675) : Bootkit Remover

.\boot_cleaner.cpp(676) : (c) 2009 eSage Lab

.\boot_cleaner.cpp(677) : www.esagelab.com

.\boot_cleaner.cpp(681) : Program version: 1.1.0.0

.\boot_cleaner.cpp(688) : OS Version: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)

.\debug.cpp(248) : **********************************************

.\debug.cpp(249) : *** [ LOADED MODULES INFORMATION ] ***********

.\debug.cpp(250) : **********************************************

.\debug.cpp(256) : 0x804d7000 0x001f9280 "\WINDOWS\system32\ntkrnlpa.exe"

.\debug.cpp(256) : 0x806d1000 0x00020300 "\WINDOWS\system32\hal.dll"

.\debug.cpp(256) : 0xf7b10000 0x00002000 "\WINDOWS\system32\KDCOM.DLL"

.\debug.cpp(256) : 0xf7a20000 0x00003000 "\WINDOWS\system32\BOOTVID.dll"

.\debug.cpp(256) : 0xf74e0000 0x0002f000 "ACPI.sys"

.\debug.cpp(256) : 0xf7b12000 0x00002000 "\WINDOWS\system32\DRIVERS\WMILIB.SYS"

.\debug.cpp(256) : 0xf74cf000 0x00011000 "pci.sys"

.\debug.cpp(256) : 0xf7610000 0x0000a000 "isapnp.sys"

.\debug.cpp(256) : 0xf7bd8000 0x00001000 "pciide.sys"

.\debug.cpp(256) : 0xf7890000 0x00007000 "\WINDOWS\system32\DRIVERS\PCIIDEX.SYS"

.\debug.cpp(256) : 0xf7620000 0x0000b000 "MountMgr.sys"

.\debug.cpp(256) : 0xf74b0000 0x0001f000 "ftdisk.sys"

.\debug.cpp(256) : 0xf7898000 0x00005000 "PartMgr.sys"

.\debug.cpp(256) : 0xf7630000 0x0000e000 "VolSnap.sys"

.\debug.cpp(256) : 0xf7498000 0x00018000 "atapi.sys"

.\debug.cpp(256) : 0xf7640000 0x00009000 "disk.sys"

.\debug.cpp(256) : 0xf7650000 0x0000d000 "\WINDOWS\system32\DRIVERS\CLASSPNP.SYS"

.\debug.cpp(256) : 0xf7478000 0x00020000 "fltmgr.sys"

.\debug.cpp(256) : 0xf7466000 0x00012000 "sr.sys"

.\debug.cpp(256) : 0xf7660000 0x00009000 "PxHelp20.sys"

.\debug.cpp(256) : 0xf7442000 0x00024000 "Fastfat.sys"

.\debug.cpp(256) : 0xf742b000 0x00017000 "KSecDD.sys"

.\debug.cpp(256) : 0xf73fe000 0x0002d000 "NDIS.sys"

.\debug.cpp(256) : 0xf73e4000 0x0001a000 "Mup.sys"

.\debug.cpp(256) : 0xf7680000 0x0000a000 "\SystemRoot\system32\DRIVERS\processr.sys"

.\debug.cpp(256) : 0xf6edc000 0x003bf000 "\SystemRoot\system32\DRIVERS\nv4_mini.sys"

.\debug.cpp(256) : 0xf6ec8000 0x00014000 "\SystemRoot\system32\DRIVERS\VIDEOPRT.SYS"

.\debug.cpp(256) : 0xf7690000 0x0000d000 "\SystemRoot\system32\DRIVERS\i8042prt.sys"

.\debug.cpp(256) : 0xf78c0000 0x00007000 "\SystemRoot\system32\DRIVERS\kbdclass.sys"

.\debug.cpp(256) : 0xf78c8000 0x00006000 "\SystemRoot\system32\DRIVERS\mouclass.sys"

.\debug.cpp(256) : 0xf6eb4000 0x00014000 "\SystemRoot\system32\DRIVERS\parport.sys"

.\debug.cpp(256) : 0xf76a0000 0x00010000 "\SystemRoot\system32\DRIVERS\serial.sys"

.\debug.cpp(256) : 0xf7a9c000 0x00004000 "\SystemRoot\system32\DRIVERS\serenum.sys"

.\debug.cpp(256) : 0xf76b0000 0x0000b000 "\SystemRoot\system32\DRIVERS\imapi.sys"

.\debug.cpp(256) : 0xf76c0000 0x00010000 "\SystemRoot\system32\DRIVERS\cdrom.sys"

.\debug.cpp(256) : 0xf76d0000 0x0000f000 "\SystemRoot\system32\DRIVERS\redbook.sys"

.\debug.cpp(256) : 0xf6e91000 0x00023000 "\SystemRoot\system32\DRIVERS\ks.sys"

.\debug.cpp(256) : 0xf6aba000 0x003d7000 "\SystemRoot\system32\drivers\ALCXWDM.SYS"

.\debug.cpp(256) : 0xf6a96000 0x00024000 "\SystemRoot\system32\drivers\portcls.sys"

.\debug.cpp(256) : 0xf76e0000 0x0000f000 "\SystemRoot\system32\drivers\drmk.sys"

.\debug.cpp(256) : 0xf78d0000 0x00005000 "\SystemRoot\system32\DRIVERS\usbohci.sys"

.\debug.cpp(256) : 0xf6a72000 0x00024000 "\SystemRoot\system32\DRIVERS\USBPORT.SYS"

.\debug.cpp(256) : 0xf78d8000 0x00008000 "\SystemRoot\system32\DRIVERS\usbehci.sys"

.\debug.cpp(256) : 0xf6a5e000 0x00014000 "\SystemRoot\system32\DRIVERS\Rtnicxp.sys"

.\debug.cpp(256) : 0xf72f9000 0x00001000 "\SystemRoot\system32\DRIVERS\audstub.sys"

.\debug.cpp(256) : 0xf76f0000 0x0000d000 "\SystemRoot\system32\DRIVERS\rasl2tp.sys"

.\debug.cpp(256) : 0xf7aa4000 0x00003000 "\SystemRoot\system32\DRIVERS\ndistapi.sys"

.\debug.cpp(256) : 0xf6a47000 0x00017000 "\SystemRoot\system32\DRIVERS\ndiswan.sys"

.\debug.cpp(256) : 0xf7700000 0x0000b000 "\SystemRoot\system32\DRIVERS\raspppoe.sys"

.\debug.cpp(256) : 0xf7710000 0x0000c000 "\SystemRoot\system32\DRIVERS\raspptp.sys"

.\debug.cpp(256) : 0xf78e0000 0x00005000 "\SystemRoot\system32\DRIVERS\TDI.SYS"

.\debug.cpp(256) : 0xf6a36000 0x00011000 "\SystemRoot\system32\DRIVERS\psched.sys"

.\debug.cpp(256) : 0xf7720000 0x00009000 "\SystemRoot\system32\DRIVERS\msgpc.sys"

.\debug.cpp(256) : 0xf78e8000 0x00005000 "\SystemRoot\system32\DRIVERS\ptilink.sys"

.\debug.cpp(256) : 0xf78f0000 0x00005000 "\SystemRoot\system32\DRIVERS\raspti.sys"

.\debug.cpp(256) : 0xf7730000 0x0000a000 "\SystemRoot\system32\DRIVERS\termdd.sys"

.\debug.cpp(256) : 0xf7b14000 0x00002000 "\SystemRoot\system32\DRIVERS\swenum.sys"

.\debug.cpp(256) : 0xf69d8000 0x0005e000 "\SystemRoot\system32\DRIVERS\update.sys"

.\debug.cpp(256) : 0xf7ab4000 0x00004000 "\SystemRoot\system32\DRIVERS\mssmbios.sys"

.\debug.cpp(256) : 0xf7740000 0x0000a000 "\SystemRoot\System32\Drivers\NDProxy.SYS"

.\debug.cpp(256) : 0xf7750000 0x0000f000 "\SystemRoot\system32\DRIVERS\usbhub.sys"

.\debug.cpp(256) : 0xf7b16000 0x00002000 "\SystemRoot\system32\DRIVERS\USBD.SYS"

.\debug.cpp(256) : 0xf7ae4000 0x00003000 "\SystemRoot\System32\Drivers\i2omgmt.SYS"

.\debug.cpp(256) : 0xf7b1a000 0x00002000 "\SystemRoot\System32\Drivers\Fs_Rec.SYS"

.\debug.cpp(256) : 0xf7312000 0x00001000 "\SystemRoot\System32\Drivers\Null.SYS"

.\debug.cpp(256) : 0xf7b1c000 0x00002000 "\SystemRoot\System32\Drivers\Beep.SYS"

.\debug.cpp(256) : 0xf7918000 0x00006000 "\SystemRoot\System32\drivers\vga.sys"

.\debug.cpp(256) : 0xf7b1e000 0x00002000 "\SystemRoot\System32\Drivers\mnmdd.SYS"

.\debug.cpp(256) : 0xf7b20000 0x00002000 "\SystemRoot\System32\DRIVERS\RDPCDD.sys"

.\debug.cpp(256) : 0xf7920000 0x00005000 "\SystemRoot\System32\Drivers\Msfs.SYS"

.\debug.cpp(256) : 0xf7928000 0x00008000 "\SystemRoot\System32\Drivers\Npfs.SYS"

.\debug.cpp(256) : 0xf7ae8000 0x00003000 "\SystemRoot\system32\DRIVERS\rasacd.sys"

.\debug.cpp(256) : 0xf433d000 0x00013000 "\SystemRoot\system32\DRIVERS\ipsec.sys"

.\debug.cpp(256) : 0xf42e4000 0x00059000 "\SystemRoot\system32\DRIVERS\tcpip.sys"

.\debug.cpp(256) : 0xf42bc000 0x00028000 "\SystemRoot\system32\DRIVERS\netbt.sys"

.\debug.cpp(256) : 0xf429a000 0x00022000 "\SystemRoot\System32\drivers\afd.sys"

.\debug.cpp(256) : 0xf7760000 0x00009000 "\SystemRoot\system32\DRIVERS\netbios.sys"

.\debug.cpp(256) : 0xf7930000 0x00006000 "\SystemRoot\system32\DRIVERS\ssmdrv.sys"

.\debug.cpp(256) : 0xf426f000 0x0002b000 "\SystemRoot\system32\DRIVERS\rdbss.sys"

.\debug.cpp(256) : 0xf41d7000 0x00070000 "\SystemRoot\system32\DRIVERS\mrxsmb.sys"

.\debug.cpp(256) : 0xf7770000 0x0000b000 "\SystemRoot\System32\Drivers\Fips.SYS"

.\debug.cpp(256) : 0xf41b1000 0x00026000 "\SystemRoot\system32\DRIVERS\ipnat.sys"

.\debug.cpp(256) : 0xf7780000 0x00009000 "\SystemRoot\system32\DRIVERS\wanarp.sys"

.\debug.cpp(256) : 0xf4195000 0x0001c000 "\SystemRoot\system32\DRIVERS\avipbb.sys"

.\debug.cpp(256) : 0xf7b26000 0x00002000 "\??\C:\Programme\Avira\AntiVir Desktop\avgio.sys"

.\debug.cpp(256) : 0xf77a0000 0x00010000 "\SystemRoot\System32\Drivers\Cdfs.SYS"

.\debug.cpp(256) : 0xf7938000 0x00007000 "\SystemRoot\system32\DRIVERS\USBSTOR.SYS"

.\debug.cpp(256) : 0xf4101000 0x00018000 "\SystemRoot\System32\Drivers\dump_atapi.sys"

.\debug.cpp(256) : 0xf7b28000 0x00002000 "\SystemRoot\System32\Drivers\dump_WMILIB.SYS"

.\debug.cpp(256) : 0xbf800000 0x001c5000 "\SystemRoot\System32\win32k.sys"

.\debug.cpp(256) : 0xf7393000 0x00003000 "\SystemRoot\System32\drivers\Dxapi.sys"

.\debug.cpp(256) : 0xf7940000 0x00005000 "\SystemRoot\System32\watchdog.sys"

.\debug.cpp(256) : 0xbf000000 0x00012000 "\SystemRoot\System32\drivers\dxg.sys"

.\debug.cpp(256) : 0xf7c18000 0x00001000 "\SystemRoot\System32\drivers\dxgthk.sys"

.\debug.cpp(256) : 0xbf012000 0x00452000 "\SystemRoot\System32\nv4_disp.dll"

.\debug.cpp(256) : 0xba4ac000 0x00014000 "\SystemRoot\system32\DRIVERS\avgntflt.sys"

.\debug.cpp(256) : 0xf7948000 0x00005000 "\SystemRoot\system32\DRIVERS\AegisP.sys"

.\debug.cpp(256) : 0xba4f4000 0x00004000 "\SystemRoot\system32\DRIVERS\ndisuio.sys"

.\debug.cpp(256) : 0xb9a77000 0x0002d000 "\SystemRoot\system32\DRIVERS\mrxdav.sys"

.\debug.cpp(256) : 0xf7b42000 0x00002000 "\SystemRoot\System32\Drivers\ParVdm.SYS"

.\debug.cpp(256) : 0xba394000 0x0000a000 "\SystemRoot\system32\DRIVERS\secdrv.sys"

.\debug.cpp(256) : 0xb98e0000 0x00057000 "\SystemRoot\system32\DRIVERS\srv.sys"

.\debug.cpp(256) : 0xb8e4b000 0x00015000 "\SystemRoot\system32\drivers\wdmaud.sys"

.\debug.cpp(256) : 0xb97f0000 0x0000f000 "\SystemRoot\system32\drivers\sysaudio.sys"

.\debug.cpp(256) : 0xb8b3a000 0x00041000 "\SystemRoot\System32\Drivers\HTTP.sys"

.\debug.cpp(256) : 0xb77de000 0x00017000 "\??\C:\DOKUME~1\\LOKALE~1\Temp\kxldypow.sys"

.\debug.cpp(256) : 0xb7737000 0x0002b000 "\SystemRoot\system32\drivers\kmixer.sys"

.\debug.cpp(256) : 0x7c910000 0x000b9000 "\WINDOWS\System32\ntdll.dll"

.\debug.cpp(263) : **********************************************

.\debug.cpp(307) : *** [ DEVICE OBJECTS INFORMATION ] ***********

.\debug.cpp(308) : **********************************************

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDIS"

.\debug.cpp(400) :              Destination="\Device\Ndis"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\D:"

.\debug.cpp(400) :              Destination="\Device\Harddisk1\DP(1)0-0+6"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi3:"

.\debug.cpp(400) :              Destination="\Device\Ide\IdePort1"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY1"

.\debug.cpp(400) :              Destination="\Device\Video0"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ffbb6e3f-ccfe-4d84-90d9-421418b03a8e}"

.\debug.cpp(400) :              Destination="\Device\00000038"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY2"

.\debug.cpp(400) :              Destination="\Device\Video1"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPPOEMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

.\debug.cpp(400) :              Destination="\Device\0000002f"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0C0C#2&daba3ff&0#{4afa3d53-74a7-11d0-be5e-00a0c9062857}"

.\debug.cpp(400) :              Destination="\Device\0000003e"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{c9ca9e73-e78b-11db-a8fd-806d6172696f}"

.\debug.cpp(400) :              Destination="\Device\Harddisk1\DP(1)0-0+6"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Ip"

.\debug.cpp(400) :              Destination="\Device\Ip"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USBSTOR#Disk&Ven_Generic&Prod_USB_SM_Reader&Rev_1.02#058F312D81B&2#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"

.\debug.cpp(400) :              Destination="\Device\00000067"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY3"

.\debug.cpp(400) :              Destination="\Device\Video2"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_1039&DEV_7001&SUBSYS_10951734&REV_0F#3&61aaa01&0&1A#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}"

.\debug.cpp(400) :              Destination="\Device\NTPNP_PCI0007"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IPSECDev"

.\debug.cpp(400) :              Destination="\Device\IPSEC"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\E:"

.\debug.cpp(400) :              Destination="\Device\Harddisk2\DP(1)0-0+7"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\avgio"

.\debug.cpp(400) :              Destination="\Device\avgio"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY4"

.\debug.cpp(400) :              Destination="\Device\Video3"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANIP#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

.\debug.cpp(400) :              Destination="\Device\0000002e"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDPROXY"

.\debug.cpp(400) :              Destination="\Device\NDProxy"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\CDR4_XP"

.\debug.cpp(400) :              Destination="\Device\PxHelperDevice0"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{c9ca9e76-e78b-11db-a8fd-806d6172696f}"

.\debug.cpp(400) :              Destination="\Device\Harddisk4\DP(1)0-0+9"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{c9ca9e75-e78b-11db-a8fd-806d6172696f}"

.\debug.cpp(400) :              Destination="\Device\Harddisk3\DP(1)0-0+8"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\$VDMLPT1"

.\debug.cpp(400) :              Destination="\Device\ParallelVdm0"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{3c0d501a-140b-11d1-b40f-00a0c9223196}"

.\debug.cpp(400) :              Destination="\Device\00000038"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USBSTOR#Disk&Ven_Generic&Prod_USB_CF_Reader&Rev_1.01#058F312D81B&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"

.\debug.cpp(400) :              Destination="\Device\00000066"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{0C6580E1-5410-4E6D-9BFD-06163562A5FF}"

.\debug.cpp(400) :              Destination="\Device\{0C6580E1-5410-4E6D-9BFD-06163562A5FF}"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\WMIDataDevice"

.\debug.cpp(400) :              Destination="\Device\WMIDataDevice"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#RemovableMedia#7&2c889678&0&RM#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"

.\debug.cpp(400) :              Destination="\Device\Harddisk2\DP(1)0-0+7"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\F:"

.\debug.cpp(400) :              Destination="\Device\Harddisk3\DP(1)0-0+8"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\COM1"

.\debug.cpp(400) :              Destination="\Device\Serial0"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{c9ca9e74-e78b-11db-a8fd-806d6172696f}"

.\debug.cpp(400) :              Destination="\Device\Harddisk2\DP(1)0-0+7"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{dff220f3-f70f-11d0-b917-00a0c9223196}"

.\debug.cpp(400) :              Destination="\Device\00000038"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\avgntflt"

.\debug.cpp(400) :              Destination="\FileSystem\Filters\avgntflt"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PIPE"

.\debug.cpp(400) :              Destination="\Device\NamedPipe"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_1039&DEV_7012&SUBSYS_109F1734&REV_A0#3&61aaa01&0&17#{6994ad04-93ef-11d0-a3cc-00a0c9223196}"

.\debug.cpp(400) :              Destination="\Device\NTPNP_PCI0004"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{d6c5066e-72c1-11d2-9755-0000f8004788}"

.\debug.cpp(400) :              Destination="\Device\KSENUM#00000002"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{2eb07ea0-7e70-11d0-a5d6-28db04c10000}"

.\debug.cpp(400) :              Destination="\Device\00000038"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#RemovableMedia#7&2c40c824&0&RM#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"

.\debug.cpp(400) :              Destination="\Device\Harddisk3\DP(1)0-0+8"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#CdRomTSSTcorp_CD#DVDW_SH-S182M_______________SB02____#5&1129c222&0&0.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"

.\debug.cpp(400) :              Destination="\Device\Ide\IdeDeviceP0T0L0-3"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\G:"

.\debug.cpp(400) :              Destination="\Device\Harddisk4\DP(1)0-0+9"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PSched"

.\debug.cpp(400) :              Destination="\Device\PSched"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USBSTOR#Disk&Ven_Generic&Prod_USB_MS_Reader&Rev_1.03#058F312D81B&3#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"

.\debug.cpp(400) :              Destination="\Device\00000068"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\UNC"

.\debug.cpp(400) :              Destination="\Device\Mup"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IPNAT"

.\debug.cpp(400) :              Destination="\Device\IPNAT"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\LPTENUM#MicrosoftRawPort#6&3a23b298&0&LPT1#{811fc6a5-f728-11d0-a537-0000f8753ed1}"

.\debug.cpp(400) :              Destination="\Device\Parallel0"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{6994ad04-93ef-11d0-a3cc-00a0c9223196}"

.\debug.cpp(400) :              Destination="\Device\00000038"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD0"

.\debug.cpp(400) :              Destination="\Device\USBFDO-0"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\FltMgrMsg"

.\debug.cpp(400) :              Destination="\FileSystem\Filters\FltMgrMsg"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Tcp"

.\debug.cpp(400) :              Destination="\Device\Tcp"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\I2OExec"

.\debug.cpp(400) :              Destination="\Device\I2OExec"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_01DF&SUBSYS_03451462&REV_A1#4&3678acaf&0&0008#{5b45201d-f2f2-4f3b-85bb-30ff1f953599}"

.\debug.cpp(400) :              Destination="\Device\NTPNP_PCI0016"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\LCD"

.\debug.cpp(400) :              Destination="\Device\VideoPdo0"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD1"

.\debug.cpp(400) :              Destination="\Device\USBFDO-1"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PTIMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

.\debug.cpp(400) :              Destination="\Device\00000035"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{c9ca9e77-e78b-11db-a8fd-806d6172696f}"

.\debug.cpp(400) :              Destination="\Device\HarddiskVolume1"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\AegisP_{65770660-5973-4D3C-944A-82B959657F1B}"

.\debug.cpp(400) :              Destination="\Device\AegisP_{65770660-5973-4D3C-944A-82B959657F1B}"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive0"

.\debug.cpp(400) :              Destination="\Device\Harddisk0\DR0"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PRN"

.\debug.cpp(400) :              Destination="\DosDevices\LPT1"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD2"

.\debug.cpp(400) :              Destination="\Device\USBFDO-2"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_1039&DEV_7002&SUBSYS_10951734&REV_00#3&61aaa01&0&1B#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}"

.\debug.cpp(400) :              Destination="\Device\NTPNP_PCI0008"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{53172480-4791-11d0-a5d6-28db04c10000}"

.\debug.cpp(400) :              Destination="\Device\00000038"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\H:"

.\debug.cpp(400) :              Destination="\Device\CdRom0"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive1"

.\debug.cpp(400) :              Destination="\Device\Harddisk1\DR2"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\sysaudio"

.\debug.cpp(400) :              Destination="\Device\sysaudio"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#CdRomTSSTcorp_CD#DVDW_SH-S182M_______________SB02____#5&1129c222&0&0.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}"

.\debug.cpp(400) :              Destination="\Device\Ide\IdeDeviceP0T0L0-3"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\fsWrap"

.\debug.cpp(400) :              Destination="\Device\FsWrap"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD3"

.\debug.cpp(400) :              Destination="\Device\USBFDO-3"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{97ebaacb-95bd-11d0-a3ea-00a0c9223196}"

.\debug.cpp(400) :              Destination="\Device\00000038"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PSCHEDMP#0002#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

.\debug.cpp(400) :              Destination="\Device\00000033"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PSCHEDMP#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

.\debug.cpp(400) :              Destination="\Device\00000031"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\CdRom0"

.\debug.cpp(400) :              Destination="\Device\CdRom0"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\kxldypow"

.\debug.cpp(400) :              Destination="\Device\kxldypow"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive2"

.\debug.cpp(400) :              Destination="\Device\Harddisk2\DR3"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#RemovableMedia#7&2c889678&0&RM#{53f5630a-b6bf-11d0-94f2-00a0c91efb8b}"

.\debug.cpp(400) :              Destination="\Device\Harddisk2\DP(1)0-0+7"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10EC&DEV_8169&SUBSYS_10911734&REV_10#3&61aaa01&0&48#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

.\debug.cpp(400) :              Destination="\Device\NTPNP_PCI0011"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Global"

.\debug.cpp(400) :              Destination="\GLOBAL??"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive3"

.\debug.cpp(400) :              Destination="\Device\Harddisk3\DR4"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#FixedButton#2&daba3ff&0#{4afa3d53-74a7-11d0-be5e-00a0c9062857}"

.\debug.cpp(400) :              Destination="\Device\00000040"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive4"

.\debug.cpp(400) :              Destination="\Device\Harddisk4\DR5"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_1039&DEV_7012&SUBSYS_109F1734&REV_A0#3&61aaa01&0&17#{dda54a40-1e4c-11d1-a050-405705c10000}"

.\debug.cpp(400) :              Destination="\Device\NTPNP_PCI0004"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0501#1#{86e0d1e0-8089-11d0-9ce4-08003e301f73}"

.\debug.cpp(400) :              Destination="\Device\00000057"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0400#5&2eb4d01f&0#{97f76ef0-f883-11d0-af1f-0000f800845c}"

.\debug.cpp(400) :              Destination="\Device\00000056"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PxHelperDevice0"

.\debug.cpp(400) :              Destination="\Device\PxHelperDevice0"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{d6c50671-72c1-11d2-9755-0000f8004788}"

.\debug.cpp(400) :              Destination="\Device\KSENUM#00000002"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Secdrv"

.\debug.cpp(400) :              Destination="\Device\Secdrv"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#RemovableMedia#7&33317da3&0&RM#{53f5630a-b6bf-11d0-94f2-00a0c91efb8b}"

.\debug.cpp(400) :              Destination="\Device\Harddisk1\DP(1)0-0+6"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{3e227e76-690d-11d2-8161-0000f8775bf1}"

.\debug.cpp(400) :              Destination="\Device\00000038"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ad809c00-7b88-11d0-a5d6-28db04c10000}"

.\debug.cpp(400) :              Destination="\Device\00000038"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{9ea331fa-b91b-45f8-9285-bd2bc77afcde}"

.\debug.cpp(400) :              Destination="\Device\00000038"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{0D375D45-66E7-4A0E-B094-F3F0959C1DC0}"

.\debug.cpp(400) :              Destination="\Device\{0D375D45-66E7-4A0E-B094-F3F0959C1DC0}"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0501#1#{4d36e978-e325-11ce-bfc1-08002be10318}"

.\debug.cpp(400) :              Destination="\Device\00000057"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB#4&2b10988e&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}"

.\debug.cpp(400) :              Destination="\Device\USBPDO-0"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#RemovableMedia#7&26ebca8a&0&RM#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"

.\debug.cpp(400) :              Destination="\Device\Harddisk4\DP(1)0-0+9"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#Vid_058f&Pid_6362#058F312D81B#{a5dcbf10-6530-11d2-901f-00c04fb951ed}"

.\debug.cpp(400) :              Destination="\Device\USBPDO-5"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\MountPointManager"

.\debug.cpp(400) :              Destination="\Device\MountPointManager"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{d6c50674-72c1-11d2-9755-0000f8004788}"

.\debug.cpp(400) :              Destination="\Device\KSENUM#00000002"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ssmctl"

.\debug.cpp(400) :              Destination="\Device\ssmctl"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_L2TPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

.\debug.cpp(400) :              Destination="\Device\0000002d"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{48BC4B68-42E1-45C7-9ED4-A0C52C0396DE}"

.\debug.cpp(400) :              Destination="\Device\{48BC4B68-42E1-45C7-9ED4-A0C52C0396DE}"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\MbDlDp32"

.\debug.cpp(400) :              Destination="\Device\PxHelperDevice0"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\WanArp"

.\debug.cpp(400) :              Destination="\Device\WANARP"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{C36A7EE1-9BE6-4B0E-B4CD-D62346C2D3B0}"

.\debug.cpp(400) :              Destination="\Device\{C36A7EE1-9BE6-4B0E-B4CD-D62346C2D3B0}"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#ftdisk#0000#{53f5630e-b6bf-11d0-94f2-00a0c91efb8b}"

.\debug.cpp(400) :              Destination="\Device\00000002"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB20#4&37800789&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}"

.\debug.cpp(400) :              Destination="\Device\USBPDO-1"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_1039&DEV_7001&SUBSYS_10951734&REV_0F#3&61aaa01&0&19#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}"

.\debug.cpp(400) :              Destination="\Device\NTPNP_PCI0006"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{775C9B65-D10D-417E-9461-55C766CA277D}"

.\debug.cpp(400) :              Destination="\Device\{775C9B65-D10D-417E-9461-55C766CA277D}"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#RemovableMedia#7&26ebca8a&0&RM#{53f5630a-b6bf-11d0-94f2-00a0c91efb8b}"

.\debug.cpp(400) :              Destination="\Device\Harddisk4\DP(1)0-0+9"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

.\debug.cpp(400) :              Destination="\Device\00000038"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDISWANIP"

.\debug.cpp(400) :              Destination="\Device\NdisWanIp"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{65770660-5973-4D3C-944A-82B959657F1B}"

.\debug.cpp(400) :              Destination="\Device\{65770660-5973-4D3C-944A-82B959657F1B}"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\AegisP"

.\debug.cpp(400) :              Destination="\Device\AegisP"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{fbf6f530-07b9-11d2-a71e-0000f8004788}"

.\debug.cpp(400) :              Destination="\Device\KSENUM#00000002"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{bf963d80-c559-11d0-8a2b-00a0c9255ac1}"

.\debug.cpp(400) :              Destination="\Device\00000038"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0F13#5&2eb4d01f&0#{378de44c-56ef-11d1-bc8c-00a0c91405dd}"

.\debug.cpp(400) :              Destination="\Device\00000055"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#RemovableMedia#7&2c40c824&0&RM#{53f5630a-b6bf-11d0-94f2-00a0c91efb8b}"

.\debug.cpp(400) :              Destination="\Device\Harddisk3\DP(1)0-0+8"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi0:"

.\debug.cpp(400) :              Destination="\Device\Ide\IdePort0"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB#4&2c6831a5&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}"

.\debug.cpp(400) :              Destination="\Device\USBPDO-3"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_1039&DEV_7012&SUBSYS_109F1734&REV_A0#3&61aaa01&0&17#{65e8773e-8f56-11d0-a3b9-00a0c9223196}"

.\debug.cpp(400) :              Destination="\Device\NTPNP_PCI0004"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_1039&DEV_7001&SUBSYS_10951734&REV_0F#3&61aaa01&0&18#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}"

.\debug.cpp(400) :              Destination="\Device\NTPNP_PCI0005"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{4747b320-62ce-11cf-a5d6-28db04c10000}"

.\debug.cpp(400) :              Destination="\Device\00000038"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPTPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

.\debug.cpp(400) :              Destination="\Device\00000030"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PTILINK1"

.\debug.cpp(400) :              Destination="\Device\ParTechInc0"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{a7c7a5b1-5af3-11d1-9ced-00a024bf0407}"

.\debug.cpp(400) :              Destination="\Device\00000038"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{c9ca9e72-e78b-11db-a8fd-806d6172696f}"

.\debug.cpp(400) :              Destination="\Device\CdRom0"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDISTAPI"

.\debug.cpp(400) :              Destination="\Device\NdisTapi"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NdisWan"

.\debug.cpp(400) :              Destination="\Device\NdisWan"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\AscKmd"

.\debug.cpp(400) :              Destination="\Device\AscKmd"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0303#5&2eb4d01f&0#{884b96c3-56ef-11d1-bc8c-00a0c91405dd}"

.\debug.cpp(400) :              Destination="\Device\00000054"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi1:"

.\debug.cpp(400) :              Destination="\Device\Ide\IdePort2"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IPMULTICAST"

.\debug.cpp(400) :              Destination="\Device\IPMULTICAST"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\LPT1"

.\debug.cpp(400) :              Destination="\Device\Parallel0"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PTILINK2"

.\debug.cpp(400) :              Destination="\Device\ParTechInc1"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#RemovableMedia#7&33317da3&0&RM#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"

.\debug.cpp(400) :              Destination="\Device\Harddisk1\DP(1)0-0+6"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Shadow"

.\debug.cpp(400) :              Destination="\Device\LanmanRedirector"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_1039&DEV_7012&SUBSYS_109F1734&REV_A0#3&61aaa01&0&17#{65e8773d-8f56-11d0-a3b9-00a0c9223196}"

.\debug.cpp(400) :              Destination="\Device\NTPNP_PCI0004"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USBSTOR#Disk&Ven_Generic&Prod_USB_SD_Reader&Rev_1.00#058F312D81B&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"

.\debug.cpp(400) :              Destination="\Device\00000065"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#AuthenticAMD_-_x86_Family_15_Model_47#_0#{97fadb10-4e33-40ae-359c-8bef029dbdd0}"

.\debug.cpp(400) :              Destination="\Device\0000003d"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PTILINK3"

.\debug.cpp(400) :              Destination="\Device\ParTechInc2"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#1&30a96598&0&SignatureFA41FA41Offset7E00Length3002F05E00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"

.\debug.cpp(400) :              Destination="\Device\HarddiskVolume1"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\FltMgr"

.\debug.cpp(400) :              Destination="\FileSystem\Filters\FltMgr"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\FtControl"

.\debug.cpp(400) :              Destination="\Device\FtControl"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\C:"

.\debug.cpp(400) :              Destination="\Device\HarddiskVolume1"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\MAILSLOT"

.\debug.cpp(400) :              Destination="\Device\MailSlot"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#CdRomTSSTcorp_CD#DVDW_SH-S182M_______________SB02____#5&1129c222&0&0.0.0#{1186654d-47b8-48b9-beb9-7df113ae3c67}"

.\debug.cpp(400) :              Destination="\Device\Ide\IdeDeviceP0T0L0-3"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\AUX"

.\debug.cpp(400) :              Destination="\DosDevices\COM1"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NUL"

.\debug.cpp(400) :              Destination="\Device\Null"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\GLOBALROOT"

.\debug.cpp(400) :              Destination=""
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Ndisuio"

.\debug.cpp(400) :              Destination="\Device\Ndisuio"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#RDP_MOU#0000#{378de44c-56ef-11d1-bc8c-00a0c91405dd}"

.\debug.cpp(400) :              Destination="\Device\00000037"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi2:"

.\debug.cpp(400) :              Destination="\Device\Ide\IdePort3"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB#4&22f7f2c&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}"

.\debug.cpp(400) :              Destination="\Device\USBPDO-2"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{10AF95A3-2AEF-4D76-975E-83539F6E5FC0}"

.\debug.cpp(400) :              Destination="\Device\{10AF95A3-2AEF-4D76-975E-83539F6E5FC0}"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#DiskSAMSUNG_SP2504C_________________________VT100-41#30535139314a4c47303938393233202020202020#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"

.\debug.cpp(400) :              Destination="\Device\Ide\IdeDeviceP2T0L0-e"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#RDP_KBD#0000#{884b96c3-56ef-11d1-bc8c-00a0c91405dd}"

.\debug.cpp(400) :              Destination="\Device\00000036"
 

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\avipbb"

.\debug.cpp(400) :              Destination="\Device\avipbb"
 

.\debug.cpp(451) : **********************************************

.\boot_cleaner.cpp(1077) : System volume is \\.\C:

.\boot_cleaner.cpp(1113) : \\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`00007e00

.\boot_cleaner.cpp(424) : Boot sector MD5 is: 5ddc20efcc4d1dab37c348c7db7289cf

.\boot_cleaner.cpp(1151) : 

.\boot_cleaner.cpp(1152) :      Size  Device Name          MBR Status

.\boot_cleaner.cpp(1153) :  --------------------------------------------

.\boot_cleaner.cpp(1197) :    232 GB  \\.\PhysicalDrive0   Unknown boot code

.\boot_cleaner.cpp(1203) : 

.\boot_cleaner.cpp(1209) : Unknown boot code has been found on some of your physical disks.

.\boot_cleaner.cpp(1211) : To inspect the boot code manually, dump the master boot sector:

.\boot_cleaner.cpp(1212) : remover.exe dump <device_name> [output_file]

.\boot_cleaner.cpp(1216) : To disinfect the master boot sector, use the following command:

.\boot_cleaner.cpp(1217) : remover.exe fix <device_name>

.\boot_cleaner.cpp(1220) : 

.\boot_cleaner.cpp(1242) : Done;

Zitat:

"zyxnv" (zyxnv) - ? - C:\WINDOWS\system32\drivers\zyxnv.sys (File not found)

Bitte mit osam deaktivieren und löschen. Nur diesen einen Eintrag!

nachdem deaktivieren:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 13:05:03 on 31.08.2010
 

OS: Windows XP Home Edition Service Pack 3 (Build 2600)

Default Browser: Microsoft Corporation Internet Explorer 8.00.6001.18702
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"ALSNDMGR.CPL" - ? - C:\WINDOWS\system32\ALSNDMGR.CPL  (File signed by Microsoft | File found, but it contains no detailed information)

"JAVACPL.CPL" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\JAVACPL.CPL

"NVCPL.CPL" - "NVIDIA Corporation" - C:\WINDOWS\system32\NVCPL.CPL

"NVTUICPL.CPL" - "NVIDIA Corporation" - C:\WINDOWS\system32\NVTUICPL.CPL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"Avira AntiVir Personal - Free Antivirus " - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"AEGIS Protocol (IEEE 802.1x) v3.4.10.0" (AegisP) - "Meetinghouse Data Communications" - C:\WINDOWS\System32\DRIVERS\AegisP.sys

"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys

"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys

"catchme" (catchme) - ? - C:\DOKUME~1\\LOKALE~1\Temp\catchme.sys  (File not found)

"GMSIPCI" (GMSIPCI) - ? - H:\INSTALL\GMSIPCI.SYS  (File not found)

"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)

"nv" (nv) - "NVIDIA Corporation" - C:\WINDOWS\System32\DRIVERS\nv4_mini.sys

"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)

"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)

"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)

"PDNMp50 NDIS Protocol Driver" (PDNMp50) - "Printing Communications Assoc., Inc. (PCAUSA)" - C:\WINDOWS\system32\drivers\PDNMp50.sys

"PDNSp50 NDIS Protocol Driver" (PDNSp50) - "Printing Communications Assoc., Inc. (PCAUSA)" - C:\WINDOWS\system32\drivers\PDNSp50.sys

"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)

"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)

"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys

"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)

(Disabled) "zyxnv" (zyxnv) - ? - C:\WINDOWS\system32\drivers\zyxnv.sys  (File not found)
 

[Explorer]

-----( HKCU\Software\Classes\Folder\shellex\ColumnHandlers )-----

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? -   (File not found | COM-object registry key not found)

-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{BDEADF00-C265-11d0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Handler )-----

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL

{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)

{1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.dll

{73B24247-042E-4EF5-ADC2-42F62E6FD654} "ICQ Lite Shell Extension" - ? -   (File not found | COM-object registry key not found)

{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)

{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -   (File not found | COM-object registry key not found)

{FFB699E0-306A-11d3-8BD1-00104B6F7516} "NVIDIA CPL Extension" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.dll

{1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? -   (File not found | COM-object registry key not found)

{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? -   (File not found | COM-object registry key not found)

{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? -   (File not found | COM-object registry key not found)

{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? -   (File not found | COM-object registry key not found)

{0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office\OLKFSTUB.DLL

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - ? -   (File not found | COM-object registry key not found)

{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -   (File not found | COM-object registry key not found)

{e57ce731-33e8-4c51-8354-bb4de9d215d1} "Universelle Plug & Play-Geräte" - ? -   (File not found | COM-object registry key not found)

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Programme\WinRAR\rarext.dll  (File found, but it contains no detailed information)
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} "Java Plug-in 1.6.0_02" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.6.0_02\bin\npjpi160_02.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab

{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} "Java Plug-in 1.6.0_03" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.6.0_03\bin\npjpi160_03.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_15.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_15.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_15.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

{D0C0F75C-683A-4390-A791-1ACFD5599AB8} "Oberon Flash Game Host" - "Oberon Media, Inc." - C:\WINDOWS\Downloaded Program Files\OberonGameHost.dll / hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab

{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx / hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC} "ClsidExtension" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_15.dll

"ICQ Lite" - ? - C:\Programme\ICQLite\ICQLite.exe  (File not found)

"ICQ6" - "ICQ, LLC." - C:\Programme\ICQ6.5\ICQ.exe

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
 

[Known DLLs]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs )-----

"user32" - "Microsoft Corporation" - C:\WINDOWS\system32\user32.dll
 

[Logon]

-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----

"DESKTOP.INI" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\DESKTOP.INI

"Microsoft Office.lnk" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office\OSA9.EXE  (Shortcut exists | File exists)

"Ralink Wireless Utility.lnk" - "Ralink Technology, Corp." - C:\Programme\RALINK\Common\RaUI.exe  (Shortcut exists | File exists)

-----( %UserProfile%\Startmenü\Programme\Autostart )-----

"DESKTOP.INI" - ? - C:\Dokumente und Einstellungen\\Startmenü\Programme\Autostart\DESKTOP.INI

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"Steam" - "Valve Corporation" - "c:\programme\steam\steam.exe" -silent

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"

"avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min

"NvCplDaemon" - "NVIDIA Corporation" - RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

"NvMediaCenter" - "NVIDIA Corporation" - RunDLL32.exe NvMCTray.dll,NvTaskbarInit

"nwiz" - "NVIDIA Corporation" - nwiz.exe /install

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Java\jre6\bin\jusched.exe"

"SW20" - ? - C:\WINDOWS\system32\sw20.exe

"SW24" - ? - C:\WINDOWS\system32\sw24.exe  (File found, but it contains no detailed information)
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"Anwendungsverwaltung" (AppMgmt) - ? - C:\WINDOWS\System32\appmgmts.dll  (File not found)

"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe

"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe

"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe

"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe

"NMIndexingService" (NMIndexingService) - ? - "C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe"  (File not found)

"NVIDIA Display Driver Service" (NVSvc) - "NVIDIA Corporation" - C:\WINDOWS\system32\nvsvc32.exe
 

[Winlogon]

-----( HKCU\Control Panel\IOProcs )-----

"MVB" - ? - mvfs32.dll  (File not found)

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions )-----

{c6dc5466-785a-11d2-84d0-00c04fb169f7} "Softwareinstallation" - ? - appmgmts.dll  (File not found)

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----

"WgaLogon" - "Microsoft Corporation" - C:\WINDOWS\system32\WgaLogon.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===
 

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

nach dem löschen:
OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 13:15:28 on 31.08.2010
 

OS: Windows XP Home Edition Service Pack 3 (Build 2600)

Default Browser: Microsoft Corporation Internet Explorer 8.00.6001.18702
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"ALSNDMGR.CPL" - ? - C:\WINDOWS\system32\ALSNDMGR.CPL  (File signed by Microsoft | File found, but it contains no detailed information)

"JAVACPL.CPL" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\JAVACPL.CPL

"NVCPL.CPL" - "NVIDIA Corporation" - C:\WINDOWS\system32\NVCPL.CPL

"NVTUICPL.CPL" - "NVIDIA Corporation" - C:\WINDOWS\system32\NVTUICPL.CPL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"Avira AntiVir Personal - Free Antivirus " - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"AEGIS Protocol (IEEE 802.1x) v3.4.10.0" (AegisP) - "Meetinghouse Data Communications" - C:\WINDOWS\System32\DRIVERS\AegisP.sys

"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys

"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys

"catchme" (catchme) - ? - C:\DOKUME~1\\LOKALE~1\Temp\catchme.sys  (File not found)

"GMSIPCI" (GMSIPCI) - ? - H:\INSTALL\GMSIPCI.SYS  (File not found)

"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)

"nv" (nv) - "NVIDIA Corporation" - C:\WINDOWS\System32\DRIVERS\nv4_mini.sys

"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)

"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)

"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)

"PDNMp50 NDIS Protocol Driver" (PDNMp50) - "Printing Communications Assoc., Inc. (PCAUSA)" - C:\WINDOWS\system32\drivers\PDNMp50.sys

"PDNSp50 NDIS Protocol Driver" (PDNSp50) - "Printing Communications Assoc., Inc. (PCAUSA)" - C:\WINDOWS\system32\drivers\PDNSp50.sys

"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)

"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)

"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys

"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)
 

[Explorer]

-----( HKCU\Software\Classes\Folder\shellex\ColumnHandlers )-----

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? -   (File not found | COM-object registry key not found)

-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{BDEADF00-C265-11d0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Handler )-----

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL

{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)

{1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.dll

{73B24247-042E-4EF5-ADC2-42F62E6FD654} "ICQ Lite Shell Extension" - ? -   (File not found | COM-object registry key not found)

{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)

{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -   (File not found | COM-object registry key not found)

{FFB699E0-306A-11d3-8BD1-00104B6F7516} "NVIDIA CPL Extension" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.dll

{1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? -   (File not found | COM-object registry key not found)

{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? -   (File not found | COM-object registry key not found)

{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? -   (File not found | COM-object registry key not found)

{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? -   (File not found | COM-object registry key not found)

{0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office\OLKFSTUB.DLL

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - ? -   (File not found | COM-object registry key not found)

{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -   (File not found | COM-object registry key not found)

{e57ce731-33e8-4c51-8354-bb4de9d215d1} "Universelle Plug & Play-Geräte" - ? -   (File not found | COM-object registry key not found)

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Programme\WinRAR\rarext.dll  (File found, but it contains no detailed information)
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} "Java Plug-in 1.6.0_02" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.6.0_02\bin\npjpi160_02.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab

{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} "Java Plug-in 1.6.0_03" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.6.0_03\bin\npjpi160_03.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_15.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_15.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_15.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

{D0C0F75C-683A-4390-A791-1ACFD5599AB8} "Oberon Flash Game Host" - "Oberon Media, Inc." - C:\WINDOWS\Downloaded Program Files\OberonGameHost.dll / hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab

{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx / hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC} "ClsidExtension" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_15.dll

"ICQ Lite" - ? - C:\Programme\ICQLite\ICQLite.exe  (File not found)

"ICQ6" - "ICQ, LLC." - C:\Programme\ICQ6.5\ICQ.exe

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
 

[Known DLLs]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs )-----

"user32" - "Microsoft Corporation" - C:\WINDOWS\system32\user32.dll
 

[Logon]

-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----

"DESKTOP.INI" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\DESKTOP.INI

"Microsoft Office.lnk" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office\OSA9.EXE  (Shortcut exists | File exists)

"Ralink Wireless Utility.lnk" - "Ralink Technology, Corp." - C:\Programme\RALINK\Common\RaUI.exe  (Shortcut exists | File exists)

-----( %UserProfile%\Startmenü\Programme\Autostart )-----

"DESKTOP.INI" - ? - C:\Dokumente und Einstellungen\\Startmenü\Programme\Autostart\DESKTOP.INI

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"Steam" - "Valve Corporation" - "c:\programme\steam\steam.exe" -silent

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"

"avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min

"NvCplDaemon" - "NVIDIA Corporation" - RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

"NvMediaCenter" - "NVIDIA Corporation" - RunDLL32.exe NvMCTray.dll,NvTaskbarInit

"nwiz" - "NVIDIA Corporation" - nwiz.exe /install

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Java\jre6\bin\jusched.exe"

"SW20" - ? - C:\WINDOWS\system32\sw20.exe

"SW24" - ? - C:\WINDOWS\system32\sw24.exe  (File found, but it contains no detailed information)
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"Anwendungsverwaltung" (AppMgmt) - ? - C:\WINDOWS\System32\appmgmts.dll  (File not found)

"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe

"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe

"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe

"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe

"NMIndexingService" (NMIndexingService) - ? - "C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe"  (File not found)

"NVIDIA Display Driver Service" (NVSvc) - "NVIDIA Corporation" - C:\WINDOWS\system32\nvsvc32.exe
 

[Winlogon]

-----( HKCU\Control Panel\IOProcs )-----

"MVB" - ? - mvfs32.dll  (File not found)

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions )-----

{c6dc5466-785a-11d2-84d0-00c04fb169f7} "Softwareinstallation" - ? - appmgmts.dll  (File not found)

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----

"WgaLogon" - "Microsoft Corporation" - C:\WINDOWS\system32\WgaLogon.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Ok. Downloade Dir bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Das Tool braucht nur eine Sekunde.
Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

Code:

MBRCheck, version 1.2.3

(c) 2010, AD
 

Command-line:                        

Windows Version:                Windows XP Home Edition

Windows Information:                Service Pack 3 (build 2600)

Logical Drives Mask:                0x000000fc
 

Kernel Drivers (total 107):

  0x804D7000 \WINDOWS\system32\ntkrnlpa.exe

  0x806D1000 \WINDOWS\system32\hal.dll

  0xF7B10000 \WINDOWS\system32\KDCOM.DLL

  0xF7A20000 \WINDOWS\system32\BOOTVID.dll

  0xF74E0000 ACPI.sys

  0xF7B12000 \WINDOWS\system32\DRIVERS\WMILIB.SYS

  0xF74CF000 pci.sys

  0xF7610000 isapnp.sys

  0xF7BD8000 pciide.sys

  0xF7890000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS

  0xF7620000 MountMgr.sys

  0xF74B0000 ftdisk.sys

  0xF7898000 PartMgr.sys

  0xF7630000 VolSnap.sys

  0xF7498000 atapi.sys

  0xF7640000 disk.sys

  0xF7650000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS

  0xF7478000 fltmgr.sys

  0xF7466000 sr.sys

  0xF7660000 PxHelp20.sys

  0xF7442000 Fastfat.sys

  0xF742B000 KSecDD.sys

  0xF73FE000 NDIS.sys

  0xF73E4000 Mup.sys

  0xF7680000 \SystemRoot\system32\DRIVERS\processr.sys

  0xF6EFA000 \SystemRoot\system32\DRIVERS\nv4_mini.sys

  0xF6EE6000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS

  0xF7690000 \SystemRoot\system32\DRIVERS\i8042prt.sys

  0xF78C0000 \SystemRoot\system32\DRIVERS\kbdclass.sys

  0xF78C8000 \SystemRoot\system32\DRIVERS\mouclass.sys

  0xF6ED2000 \SystemRoot\system32\DRIVERS\parport.sys

  0xF76A0000 \SystemRoot\system32\DRIVERS\serial.sys

  0xF7A9C000 \SystemRoot\system32\DRIVERS\serenum.sys

  0xF76B0000 \SystemRoot\system32\DRIVERS\imapi.sys

  0xF76C0000 \SystemRoot\system32\DRIVERS\cdrom.sys

  0xF76D0000 \SystemRoot\system32\DRIVERS\redbook.sys

  0xF6EAF000 \SystemRoot\system32\DRIVERS\ks.sys

  0xF6AD8000 \SystemRoot\system32\drivers\ALCXWDM.SYS

  0xF6AB4000 \SystemRoot\system32\drivers\portcls.sys

  0xF76E0000 \SystemRoot\system32\drivers\drmk.sys

  0xF78D0000 \SystemRoot\system32\DRIVERS\usbohci.sys

  0xF6A90000 \SystemRoot\system32\DRIVERS\USBPORT.SYS

  0xF78D8000 \SystemRoot\system32\DRIVERS\usbehci.sys

  0xF6A7C000 \SystemRoot\system32\DRIVERS\Rtnicxp.sys

  0xF7315000 \SystemRoot\system32\DRIVERS\audstub.sys

  0xF76F0000 \SystemRoot\system32\DRIVERS\rasl2tp.sys

  0xF7AA4000 \SystemRoot\system32\DRIVERS\ndistapi.sys

  0xF6A65000 \SystemRoot\system32\DRIVERS\ndiswan.sys

  0xF7700000 \SystemRoot\system32\DRIVERS\raspppoe.sys

  0xF7710000 \SystemRoot\system32\DRIVERS\raspptp.sys

  0xF78E0000 \SystemRoot\system32\DRIVERS\TDI.SYS

  0xF6A54000 \SystemRoot\system32\DRIVERS\psched.sys

  0xF7720000 \SystemRoot\system32\DRIVERS\msgpc.sys

  0xF78E8000 \SystemRoot\system32\DRIVERS\ptilink.sys

  0xF78F0000 \SystemRoot\system32\DRIVERS\raspti.sys

  0xF7730000 \SystemRoot\system32\DRIVERS\termdd.sys

  0xF7B14000 \SystemRoot\system32\DRIVERS\swenum.sys

  0xF69F6000 \SystemRoot\system32\DRIVERS\update.sys

  0xF7AB4000 \SystemRoot\system32\DRIVERS\mssmbios.sys

  0xF7740000 \SystemRoot\System32\Drivers\NDProxy.SYS

  0xF7750000 \SystemRoot\system32\DRIVERS\usbhub.sys

  0xF7B16000 \SystemRoot\system32\DRIVERS\USBD.SYS

  0xF7AE4000 \SystemRoot\System32\Drivers\i2omgmt.SYS

  0xF7B1A000 \SystemRoot\System32\Drivers\Fs_Rec.SYS

  0xF7C02000 \SystemRoot\System32\Drivers\Null.SYS

  0xF7B1C000 \SystemRoot\System32\Drivers\Beep.SYS

  0xF7918000 \SystemRoot\System32\drivers\vga.sys

  0xF7B1E000 \SystemRoot\System32\Drivers\mnmdd.SYS

  0xF7B20000 \SystemRoot\System32\DRIVERS\RDPCDD.sys

  0xF7920000 \SystemRoot\System32\Drivers\Msfs.SYS

  0xF7928000 \SystemRoot\System32\Drivers\Npfs.SYS

  0xF7AE8000 \SystemRoot\system32\DRIVERS\rasacd.sys

  0xF435B000 \SystemRoot\system32\DRIVERS\ipsec.sys

  0xF4302000 \SystemRoot\system32\DRIVERS\tcpip.sys

  0xF42DA000 \SystemRoot\system32\DRIVERS\netbt.sys

  0xF42B8000 \SystemRoot\System32\drivers\afd.sys

  0xF7760000 \SystemRoot\system32\DRIVERS\netbios.sys

  0xF7930000 \SystemRoot\system32\DRIVERS\ssmdrv.sys

  0xF428D000 \SystemRoot\system32\DRIVERS\rdbss.sys

  0xF41F5000 \SystemRoot\system32\DRIVERS\mrxsmb.sys

  0xF7770000 \SystemRoot\System32\Drivers\Fips.SYS

  0xF41CF000 \SystemRoot\system32\DRIVERS\ipnat.sys

  0xF7780000 \SystemRoot\system32\DRIVERS\wanarp.sys

  0xF41B3000 \SystemRoot\system32\DRIVERS\avipbb.sys

  0xF7B26000 \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys

  0xF77A0000 \SystemRoot\System32\Drivers\Cdfs.SYS

  0xF415F000 \SystemRoot\system32\DRIVERS\rt73.sys

  0xF7938000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS

  0xF411F000 \SystemRoot\System32\Drivers\dump_atapi.sys

  0xF7B28000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS

  0xBF800000 \SystemRoot\System32\win32k.sys

  0xF7393000 \SystemRoot\System32\drivers\Dxapi.sys

  0xF7940000 \SystemRoot\System32\watchdog.sys

  0xBF000000 \SystemRoot\System32\drivers\dxg.sys

  0xF7D62000 \SystemRoot\System32\drivers\dxgthk.sys

  0xBF012000 \SystemRoot\System32\nv4_disp.dll

  0xBA4AC000 \SystemRoot\system32\DRIVERS\avgntflt.sys

  0xF7948000 \SystemRoot\system32\DRIVERS\AegisP.sys

  0xBA4F4000 \SystemRoot\system32\DRIVERS\ndisuio.sys

  0xB9A77000 \SystemRoot\system32\DRIVERS\mrxdav.sys

  0xF7B44000 \SystemRoot\System32\Drivers\ParVdm.SYS

  0xBA394000 \SystemRoot\system32\DRIVERS\secdrv.sys

  0xB98E0000 \SystemRoot\system32\DRIVERS\srv.sys

  0xB8E4B000 \SystemRoot\system32\drivers\wdmaud.sys

  0xB99BF000 \SystemRoot\system32\drivers\sysaudio.sys

  0xB89E8000 \SystemRoot\System32\Drivers\HTTP.sys

  0x7C910000 \WINDOWS\System32\ntdll.dll
 

Processes (total 31):

       0 System Idle Process

       4 System

     516 C:\WINDOWS\System32\SMSS.EXE

     748 CSRSS.EXE

     788 C:\WINDOWS\System32\WINLOGON.EXE

     832 C:\WINDOWS\System32\SERVICES.EXE

     844 C:\WINDOWS\System32\LSASS.EXE

    1008 C:\WINDOWS\System32\SVCHOST.EXE

    1064 SVCHOST.EXE

    1104 C:\WINDOWS\System32\SVCHOST.EXE

    1200 SVCHOST.EXE

    1344 SVCHOST.EXE

    1404 C:\WINDOWS\System32\SPOOLSV.EXE

    1440 C:\Programme\Avira\AntiVir Desktop\SCHED.EXE

    1488 SVCHOST.EXE

    1548 C:\Programme\Avira\AntiVir Desktop\AVGUARD.EXE

    1580 C:\Programme\Java\JRE6\BIN\JQS.EXE

    1604 C:\WINDOWS\System32\NVSVC32.EXE

    1256 ALG.EXE

    1432 C:\WINDOWS\EXPLORER.EXE

     612 C:\WINDOWS\System32\RUNDLL32.EXE

    1304 C:\WINDOWS\SOUNDMAN.EXE

    1560 C:\Programme\Java\JRE6\BIN\JUSCHED.EXE

    1572 C:\Programme\Avira\AntiVir Desktop\AVGNT.EXE

    2104 C:\Programme\RALINK\Common\RaUI.exe

    2348 WMIPRVSE.EXE

    1888 C:\Programme\ICQ6.5\ICQ.exe

    2328 C:\Programme\Mozilla Firefox\FIREFOX.EXE

    1180 C:\Programme\Mozilla Firefox\plugin-container.exe

    2428 C:\WINDOWS\System32\SVCHOST.EXE

    1232 C:\Dokumente und Einstellungen\\Desktop\MBRCheck.exe
 

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00  (FAT32)
 

PhysicalDrive0 Model Number: SAMSUNGSP2504C, Rev: VT100-41
 

      Size  Device Name          MBR Status

  --------------------------------------------

    232 GB  \\.\PhysicalDrive0   Windows XP MBR code detected

            SHA1: ADFE55CD0C6ED2E00B22375835E4C2736CE9AD11
 
 

Done!

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Code:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org
 

Datenbank Version: 4513
 

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702
 

31.08.2010 15:58:59

mbam-log-2010-08-31 (15-58-59).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|)

Durchsuchte Objekte: 211534

Laufzeit: 16 Minute(n), 35 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 5
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

C:\System Volume Information\_restore{0369CE46-8DE8-4715-9840-D2F2D2BAD92D}\RP31\A0013317.sys (Rootkit.Bubnix) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{0369CE46-8DE8-4715-9840-D2F2D2BAD92D}\RP31\A0013318.sys (Rootkit.Bubnix) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{0369CE46-8DE8-4715-9840-D2F2D2BAD92D}\RP31\A0013489.sys (Rootkit.Bubnix) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{0369CE46-8DE8-4715-9840-D2F2D2BAD92D}\RP32\A0013561.sys (Rootkit.Bubnix) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{0369CE46-8DE8-4715-9840-D2F2D2BAD92D}\RP32\A0013564.exe (Trojan.Zapchast) -> Quarantined and deleted successfully.