Entwickelt sich ja anscheinend zu einer Never ending story ... ich weiß gar nicht, für wen es mir mehr leid tut: für euch, weil ihr so viel Zeit reinsteckt oder für mich, weil ich so viel Zeit reinstecke.
Hier also die Logs - wobei ich nicht sicher bin, ob das MBR Log vollständig ist - da hat sich mein Rechner dann nämlich aufgehangen.
GMER Code:
GMER 1.0.15.15530 - hxxp://www.gmer.net
Rootkit scan 2010-11-30 23:01:32
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\0000006b MAXTOR_STM3250820AS rev.3.AAE
Running: gmer.exe; Driver: C:\DOKUME~1\cp\LOKALE~1\Temp\kftyqpod.sys
---- System - GMER 1.0.15 ----
SSDT BA6E2706 ZwCreateKey
SSDT BA6E26FC ZwCreateThread
SSDT BA6E270B ZwDeleteKey
SSDT BA6E2715 ZwDeleteValueKey
SSDT BA6E2733 ZwLoadDriver
SSDT BA6E271A ZwLoadKey
SSDT BA6E26E8 ZwOpenProcess
SSDT BA6E26ED ZwOpenThread
SSDT BA6E2724 ZwReplaceKey
SSDT BA6E271F ZwRestoreKey
SSDT BA6E2738 ZwSetSystemInformation
SSDT BA6E2710 ZwSetValueKey
SSDT BA6E26F7 ZwTerminateProcess
SSDT BA6E26F2 ZwWriteVirtualMemory
---- Kernel code sections - GMER 1.0.15 ----
.text ntkrnlpa.exe!ZwCallbackReturn + 2DCC 80504668 4 Bytes CALL B70AB493
.text udekydv.sys B9EA9000 62 Bytes JMP B9EEF29A udekydv.sys
.text udekydv.sys B9EA903F 12 Bytes [00, 89, 4C, 24, 28, 9C, 9C, ...]
.text udekydv.sys B9EA904C 111 Bytes [1A, 00, 00, 89, 74, 24, 54, ...]
.text udekydv.sys B9EA90BC 27 Bytes [66, 3D, D2, 65, 83, C5, 08, ...]
.text udekydv.sys B9EA90D8 8 Bytes [00, 9C, 00, 45, 04, E8, 2D, ...]
.text ...
? C:\WINDOWS\system32\drivers\udekydv.sys Ein an das System angeschlossenes Gerät funktioniert nicht.
PAGE Ntfs.sys B9D6DE55 4 Bytes CALL 89D84181
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB8DDB360, 0x2456AE, 0xE8000020]
---- User code sections - GMER 1.0.15 ----
? C:\WINDOWS\System32\svchost.exe[2880] image checksum mismatch; number of sections mismatch; time/date stamp mismatch;
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\WINDOWS\Explorer.EXE[1848] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [034A2F30] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\Explorer.EXE[1848] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [034A2CA0] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\Explorer.EXE[1848] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [034A2D00] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\Explorer.EXE[1848] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [034A2CD0] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2708] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [003E2F30] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2708] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [003E2CA0] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2708] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [003E2D00] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2708] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [003E2CD0] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegQueryValueExW] 51EC8B55
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorDacl] 1845DB51
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetEntriesInAclW] F855DD56
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorGroup] E8084DDC
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorOwner] 000004D2
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!InitializeSecurityDescriptor] FF184589
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!GetTokenInformation] 40515C15
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!OpenProcessToken] F845DD00
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!OpenThreadToken] 8B104DDC
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetServiceStatus] 1865DAF0
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegisterServiceCtrlHandlerW] 0004B9E8
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegCloseKey] 8BC88B00
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegOpenKeyExW] F74199C6
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!StartServiceCtrlDispatcherW] C28B5EF9
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!WideCharToMultiByte] 2B08244C
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrlenW] 9904244C
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LocalFree] 8BF9F741
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentProcess] 244403C2
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentThread] FF56C304
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetProcAddress] 40515C15
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LoadLibraryExW] 244C8B00
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LCMapStringW] 244403C1
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!FreeLibrary] 15FFC308
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcpyW] [0040515C] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!ExpandEnvironmentStringsW] 04244C8B
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcmpiW] F9F74199
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!ExitProcess] FFC3C28B
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCommandLineW] 40515C15
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!InitializeCriticalSection] 646A9900
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetProcessHeap] 33F9F759
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!SetErrorMode] 24543BC0
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!SetUnhandledExceptionFilter] C09C0F04
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!RegisterWaitForSingleObject] EC8B55C3
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!InterlockedCompareExchange] 0204EC81
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LoadLibraryA] 68560000
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!QueryPerformanceCounter] 00000100
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetTickCount] 515415FF
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentThreadId] 8B590040
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentProcessId] 00FFB8F0
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetSystemTimeAsFileTime] 8D500000
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!TerminateProcess] FFFEFC8D
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!UnhandledExceptionFilter] C93351FF
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LocalAlloc] 558D5151
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcmpW] 8D5052FC
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!DelayLoadFailureHook] FFFDFC85
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtQuerySecurityObject] 40504415
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlFreeHeap] 56216A00
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtOpenKey] FFFC75FF
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcscat] 40515815
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcscpy] 0CC48300
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlAllocateHeap] C01BD8F7
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlCompareUnicodeString] C95EC623
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlInitUnicodeString] EC8B55C3
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlInitializeSid] 458B5151
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlLengthRequiredSid] 33565308
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlSubAuthoritySid] 57C88BF6
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtClose] 33FC7589
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlSubAuthorityCountSid] 01518DFF
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlGetDaclSecurityDescriptor] 8441198A
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlQueryInformationAcl] 2BF975DB
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlGetAce] 802974CA
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlImageNtHeader] 7420063C
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcslen] 75FF850A
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlUnhandledExceptionFilter] 45FF470C
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlCopySid] 8506EBFC
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIfEx] 46C88BFF
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtWaitServerListen] 8A01518D
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtSetServerStackSize] DB844119
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIf] CA2BF975
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerListen] D772F13B
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUseProtseqEpW] 5FFC458B
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerRegisterIf] C3C95B5E
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!I_RpcMapWin32Status] 83EC8B55
IAT C:\WINDOWS\System32\svchost.exe[2880] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtStopServerListening] 56530CEC
IAT C:\WINDOWS\system32\wscntfy.exe[3688] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00802F30] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\wscntfy.exe[3688] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00802CA0] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\wscntfy.exe[3688] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00802D00] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\wscntfy.exe[3688] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00802CD0] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Dokumente und Einstellungen\cp\Desktop\gmer.exe[3936] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [003B2F30] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Dokumente und Einstellungen\cp\Desktop\gmer.exe[3936] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [003B2CA0] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Dokumente und Einstellungen\cp\Desktop\gmer.exe[3936] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [003B2D00] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Dokumente und Einstellungen\cp\Desktop\gmer.exe[3936] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [003B2CD0] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
---- Devices - GMER 1.0.15 ----
Device \FileSystem\Ntfs \Ntfs 89CAE330
Device \Driver\Tcpip \Device\Ip 890C5720
Device \Driver\Tcpip \Device\Tcp 890C5720
Device \Driver\Tcpip \Device\Udp 890C5720
Device \Driver\Tcpip \Device\RawIp 890C5720
Device \Driver\Tcpip \Device\IPMULTICAST 890C5720
---- Services - GMER 1.0.15 ----
Service (*** hidden *** ) [BOOT] udekydv <-- ROOTKIT !!!
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\udekydv@onfnglqvk 818678999
Reg HKLM\SYSTEM\CurrentControlSet\Services\udekydv@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\udekydv@Start 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\udekydv@ErrorControl 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\udekydv@Group Boot Bus Extender
Reg HKLM\SYSTEM\ControlSet002\Services\udekydv@onfnglqvk 818678999
Reg HKLM\SYSTEM\ControlSet002\Services\udekydv@Type 1
Reg HKLM\SYSTEM\ControlSet002\Services\udekydv@Start 0
Reg HKLM\SYSTEM\ControlSet002\Services\udekydv@ErrorControl 0
Reg HKLM\SYSTEM\ControlSet002\Services\udekydv@Group Boot Bus Extender
Reg HKLM\SYSTEM\ControlSet003\Services\udekydv@onfnglqvk 818678999
Reg HKLM\SYSTEM\ControlSet003\Services\udekydv@Type 1
Reg HKLM\SYSTEM\ControlSet003\Services\udekydv@Start 0
Reg HKLM\SYSTEM\ControlSet003\Services\udekydv@ErrorControl 0
Reg HKLM\SYSTEM\ControlSet003\Services\udekydv@Group Boot Bus Extender
Reg HKLM\SYSTEM\ControlSet004\Services\udekydv@onfnglqvk 818678999
Reg HKLM\SYSTEM\ControlSet004\Services\udekydv@Type 1
Reg HKLM\SYSTEM\ControlSet004\Services\udekydv@Start 0
Reg HKLM\SYSTEM\ControlSet004\Services\udekydv@ErrorControl 0
Reg HKLM\SYSTEM\ControlSet004\Services\udekydv@Group Boot Bus Extender
Reg HKLM\SYSTEM\ControlSet005\Services\udekydv@onfnglqvk 818678999
Reg HKLM\SYSTEM\ControlSet005\Services\udekydv@Type 1
Reg HKLM\SYSTEM\ControlSet005\Services\udekydv@Start 0
Reg HKLM\SYSTEM\ControlSet005\Services\udekydv@ErrorControl 0
Reg HKLM\SYSTEM\ControlSet005\Services\udekydv@Group Boot Bus Extender
---- EOF - GMER 1.0.15 ----
Osam Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 23:08:07 on 30.11.2010
OS: Windows XP Professional Service Pack 3 (Build 2600)
Default Browser: Microsoft Corporation Internet Explorer 8.00.6001.18702
Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures
Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries
[Common]
-----( %SystemRoot%\Tasks )-----
"1-Klick-Wartung.job" - "TuneUp Software GmbH" - G:\TuneUp\SystemOptimizer.exe
[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"AudioHQU.cpl" - "Creative Technology Ltd." - C:\WINDOWS\system32\AudioHQU.cpl
"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl
"nvcpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.cpl
"nvtuicpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvtuicpl.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Adobe Gamma" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma.cpl
"Avira AntiVir Premium" - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys
"catchme" (catchme) - ? - C:\DOKUME~1\cp\LOKALE~1\Temp\catchme.sys (File not found)
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys (File not found)
"Creative AC3 Software Decoder" (ctac32k) - "Creative Technology Ltd" - C:\WINDOWS\System32\drivers\ctac32k.sys
"Creative DVD-Audio Device Driver" (ctdvda2k) - ? - C:\WINDOWS\System32\drivers\ctdvda2k.sys (File not found)
"Creative P16V HAL Driver" (hap16v2k) - "Creative Technology Ltd" - C:\WINDOWS\System32\drivers\hap16v2k.sys
"Creative Proxy Driver" (ctprxy2k) - "Creative Technology Ltd" - C:\WINDOWS\System32\drivers\ctprxy2k.sys
"Creative SoundFont Management Device Driver" (ctsfm2k) - "Creative Technology Ltd" - C:\WINDOWS\System32\drivers\ctsfm2k.sys
"E-mu Plug-in Architecture Driver" (emupia) - "Creative Technology Ltd" - C:\WINDOWS\System32\drivers\emupia2k.sys
"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys (File not found)
"kftyqpod" (kftyqpod) - ? - C:\DOKUME~1\cp\LOKALE~1\Temp\kftyqpod.sys (Hidden registry entry, rootkit activity | File not found)
"Lavasoft helper driver" (Lavasoft Kernexplorer) - ? - C:\Programme\Lavasoft\Ad-Aware\KernExplorer.sys (File not found)
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys (File not found)
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys (File not found)
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys
"StarOpen" (StarOpen) - ? - C:\WINDOWS\system32\drivers\StarOpen.sys (File found, but it contains no detailed information)
"udekydv" (udekydv) - "Windows (R) Codename Longhorn DDK provider" - C:\WINDOWS\system32\drivers\udekydv.sys (Hidden file | Hidden registry entry, rootkit activity)
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys (File not found)
[Explorer]
-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{BDEADF00-C265-11d0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Programme\Windows Live\Mail\mailcomm.dll
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll (File not found)
{1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? - (File not found | COM-object registry key not found)
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? - (File not found | COM-object registry key not found)
{32683183-48a0-441b-a342-7c2a440a9478} "Media Band" - ? - (File not found | COM-object registry key not found)
{59850401-6664-101B-B21C-00AA004BA90B} "Microsoft Office Binder Unbind" - "Microsoft Corporation" - E:\PROGRA~1\OFFICE~1\Office\1031\UNBIND.DLL
{1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - E:\PROGRA~1\OFFICE~1\Office\OLKFSTUB.DLL
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? - (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{B8323370-FF27-11D2-97B6-204C4F4F5020} "SmartFTP Shell Extension DLL" - "SmartFTP" - G:\FTP\smarthook.dll
{4858E7D9-8E12-45a3-B6A3-1CD128C9D403} "TuneUp Shredder Shell Extension" - "TuneUp Software GmbH" - G:\TuneUp\SDShelEx-win32.dll
{44440D00-FF19-4AFC-B765-9A0970567D97} "TuneUp Theme Extension" - "TuneUp Software GmbH" - C:\WINDOWS\system32\uxtuneup.dll
{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\PhotoViewerShim.dll
{45670FA8-ED97-4F44-BC93-305082590BFB} "Windows XPS Document Metadata Handler" - "Microsoft Corporation" - C:\WINDOWS\System32\XPSSHHDR.DLL
{44121072-A222-48f2-A58A-6D9AD51EBBE9} "Windows XPS Document Thumbnail Handler" - "Microsoft Corporation" - C:\WINDOWS\System32\XPSSHHDR.DLL
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Programme\WinRAR\rarext.dll (File found, but it contains no detailed information)
{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe
[Internet Explorer]
-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )-----
{32683183-48a0-441b-a342-7c2a440a9478} "{32683183-48a0-441b-a342-7c2a440a9478}" - ? - (File not found | COM-object registry key not found)
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? - (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found)
<binary data> "ITBarLayout" - ? - (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{E55FD215-A32E-43FE-A777-A7E8F165F560} "Flatcast Viewer 5.2" - "1 mal 1 Software GmbH" - C:\WINDOWS\DOWNLO~1\CONFLICT.2\NpFv522.dll / hxxp://92.51.137.94/objects/NpFv522.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - D:\SPYBOT~1\SDHelper.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - D:\SPYBOT~1\SDHelper.dll
[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\cp\Startmenü\Programme\Autostart\desktop.ini
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
"Adobe LM Service" (Adobe LM Service) - "Adobe Systems" - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir MailGuard" (AntiVirMailService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avmailc.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe
"Avira AntiVir WebGuard" (AntiVirWebService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE
"Client Service for NetWare" (NWCWorkstation) - ? - C:\WINDOWS\system32\nwcwks.dll (File not found)
"Creative Service for CDROM Access" (Creative Service for CDROM Access) - "Creative Technology Ltd" - C:\WINDOWS\system32\CTsvcCDA.exe
"FLEXnet Licensing Service" (FLEXnet Licensing Service) - "Acresso Software Inc." - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
"LVCOMSer" (LVCOMSer) - "Logitech Inc." - C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe
"LVSrvLauncher" (LVSrvLauncher) - "Logitech Inc." - C:\Programme\Gemeinsame Dateien\LogiShrd\SrvLnch\SrvLnch.exe
"NMSAccess" (NMSAccess) - ? - G:\CDBurnerXP\NMSAccessU.exe (File found, but it contains no detailed information)
"Process Monitor" (LVPrcSrv) - "Logitech Inc." - C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe
"TuneUp Designerweiterung" (UxTuneUp) - "TuneUp Software GmbH" - C:\WINDOWS\System32\uxtuneup.dll
"Windows CardSpace" (idsvc) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll (File not found)
[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )-----
"AVSDA" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avsda.dll
===[ Logfile end ]=========================================[ Logfile end ]===
If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
MBR Code:
MBRCheck, version 1.2.3
(c) 2010, AD
Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000007d
Kernel Drivers (total 130):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806E5000 \WINDOWS\system32\hal.dll
0xBA5A8000 \WINDOWS\system32\KDCOM.DLL
0xBA4B8000 \WINDOWS\system32\BOOTVID.dll
0xB9F78000 ACPI.sys
0xBA5AA000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xB9F67000 pci.sys
0xBA0A8000 isapnp.sys
0xB9EA8000 udekydv.sys
0xBA670000 pciide.sys
0xBA328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xBA0B8000 MountMgr.sys
0xB9E89000 ftdisk.sys
0xBA5AC000 dmload.sys
0xB9E63000 dmio.sys
0xBA330000 PartMgr.sys
0xBA0C8000 VolSnap.sys
0xB9E4B000 atapi.sys
0xB9E31000 nvata.sys
0xBA0D8000 disk.sys
0xBA0E8000 \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
0xB9E11000 fltMgr.sys
0xB9DFF000 sr.sys
0xB9DE8000 KSecDD.sys
0xB9DD5000 WudfPf.sys
0xB9D48000 Ntfs.sys
0xB9D1B000 NDIS.sys
0xB9D01000 Mup.sys
0xBA268000 \SystemRoot\System32\DRIVERS\processr.sys
0xBA448000 \SystemRoot\system32\DRIVERS\fdc.sys
0xBA278000 \SystemRoot\system32\DRIVERS\serial.sys
0xBA568000 \SystemRoot\system32\DRIVERS\serenum.sys
0xB93D2000 \SystemRoot\System32\DRIVERS\parport.sys
0xBA288000 \SystemRoot\System32\DRIVERS\i8042prt.sys
0xBA450000 \SystemRoot\System32\DRIVERS\mouclass.sys
0xBA458000 \SystemRoot\System32\DRIVERS\kbdclass.sys
0xBA460000 \SystemRoot\system32\DRIVERS\usbohci.sys
0xB93AE000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xBA468000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xB933F000 \SystemRoot\system32\drivers\ctaud2k.sys
0xB931B000 \SystemRoot\system32\drivers\portcls.sys
0xBA2A8000 \SystemRoot\system32\drivers\drmk.sys
0xB92F8000 \SystemRoot\system32\drivers\ks.sys
0xB92DF000 \SystemRoot\system32\drivers\ctoss2k.sys
0xBA5BE000 \SystemRoot\System32\drivers\ctprxy2k.sys
0xBA56C000 \SystemRoot\System32\DRIVERS\gameenum.sys
0xBA2C8000 \SystemRoot\system32\DRIVERS\imapi.sys
0xBA2D8000 \SystemRoot\System32\DRIVERS\cdrom.sys
0xBA2E8000 \SystemRoot\System32\DRIVERS\redbook.sys
0xBA2F8000 \SystemRoot\system32\DRIVERS\nvnetbus.sys
0xB91A2000 \SystemRoot\system32\DRIVERS\NVNRM.SYS
0xB8DDB000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xB8DC7000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xBA753000 \SystemRoot\System32\DRIVERS\audstub.sys
0xBA148000 \SystemRoot\System32\DRIVERS\rasl2tp.sys
0xBA574000 \SystemRoot\System32\DRIVERS\ndistapi.sys
0xB8D80000 \SystemRoot\System32\DRIVERS\ndiswan.sys
0xBA158000 \SystemRoot\System32\DRIVERS\raspppoe.sys
0xBA168000 \SystemRoot\System32\DRIVERS\raspptp.sys
0xBA470000 \SystemRoot\System32\DRIVERS\TDI.SYS
0xB8D6F000 \SystemRoot\System32\DRIVERS\psched.sys
0xBA178000 \SystemRoot\System32\DRIVERS\msgpc.sys
0xBA478000 \SystemRoot\System32\DRIVERS\ptilink.sys
0xBA480000 \SystemRoot\System32\DRIVERS\raspti.sys
0xB8D3F000 \SystemRoot\System32\DRIVERS\rdpdr.sys
0xBA188000 \SystemRoot\System32\DRIVERS\termdd.sys
0xBA5D8000 \SystemRoot\System32\DRIVERS\swenum.sys
0xB8CE1000 \SystemRoot\System32\DRIVERS\update.sys
0xBA58C000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xBA198000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xBA490000 \SystemRoot\System32\DRIVERS\flpydisk.sys
0xBA1B8000 \SystemRoot\system32\DRIVERS\NVENETFD.sys
0xBA1C8000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xBA5DE000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xB619E000 \SystemRoot\system32\drivers\ha10kx2k.sys
0xB617D000 \SystemRoot\System32\drivers\ctac32k.sys
0xB615B000 \SystemRoot\System32\drivers\emupia2k.sys
0xB613C000 \SystemRoot\System32\drivers\ctsfm2k.sys
0xBA5E0000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xBA789000 \SystemRoot\System32\Drivers\Null.SYS
0xBA5E2000 \SystemRoot\System32\Drivers\Beep.SYS
0xBA4A0000 \SystemRoot\System32\drivers\vga.sys
0xBA5E4000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xBA5E6000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xBA4A8000 \SystemRoot\System32\Drivers\Msfs.SYS
0xBA4B0000 \SystemRoot\System32\Drivers\Npfs.SYS
0xB9CC1000 \SystemRoot\System32\DRIVERS\rasacd.sys
0xB6089000 \SystemRoot\System32\DRIVERS\ipsec.sys
0xB6030000 \SystemRoot\System32\DRIVERS\tcpip.sys
0xB5FE0000 \SystemRoot\System32\DRIVERS\netbt.sys
0xB5FBA000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xB9406000 \SystemRoot\System32\drivers\ws2ifsl.sys
0xBA208000 \SystemRoot\System32\DRIVERS\wanarp.sys
0xB5F98000 \SystemRoot\System32\drivers\afd.sys
0xBA218000 \SystemRoot\System32\DRIVERS\netbios.sys
0xBA340000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0xB5F6D000 \SystemRoot\System32\DRIVERS\rdbss.sys
0xB5EFD000 \SystemRoot\System32\DRIVERS\mrxsmb.sys
0xBA228000 \SystemRoot\System32\Drivers\Fips.SYS
0xB93FA000 \SystemRoot\system32\DRIVERS\lvuvcflt.sys
0xBA360000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xB5CF3000 \SystemRoot\system32\DRIVERS\LVMVDrv.sys
0xBA238000 \SystemRoot\system32\drivers\LVUSBSta.sys
0xB58EA000 \SystemRoot\system32\DRIVERS\lvuvc.sys
0xB5716000 \SystemRoot\system32\DRIVERS\lvpopflt.sys
0xBA248000 \SystemRoot\system32\drivers\usbaudio.sys
0xB5515000 \SystemRoot\system32\DRIVERS\LVcKap.sys
0xB54CA000 \SystemRoot\system32\DRIVERS\avipbb.sys
0xBA5EA000 \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys
0xBA308000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xB5465000 \SystemRoot\System32\Drivers\dump_nvata.sys
0xBA600000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xB9CCD000 \SystemRoot\System32\drivers\Dxapi.sys
0xBA370000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xBA719000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\nv4_disp.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xB4A4C000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0xB4A38000 \SystemRoot\System32\DRIVERS\ndisuio.sys
0xB3EFF000 \SystemRoot\System32\DRIVERS\mrxdav.sys
0xB3E9A000 \SystemRoot\system32\drivers\wdmaud.sys
0xB406C000 \SystemRoot\system32\drivers\sysaudio.sys
0xBA64A000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xB3463000 \SystemRoot\System32\DRIVERS\srv.sys
0xBA3F8000 \SystemRoot\system32\DRIVERS\LVPr2Mon.sys
0xB2ED2000 \SystemRoot\System32\Drivers\HTTP.sys
0xB191C000 \??\C:\DOKUME~1\cp\LOKALE~1\Temp\kftyqpod.sys
0x7C910000 \WINDOWS\system32\ntdll.dll
Processes (total 37):
0 System Idle Process
4 System
620 C:\WINDOWS\system32\smss.exe
676 csrss.exe
704 C:\WINDOWS\system32\winlogon.exe
748 C:\WINDOWS\system32\services.exe
760 C:\WINDOWS\system32\lsass.exe
956 C:\WINDOWS\system32\svchost.exe
1004 svchost.exe
1100 C:\WINDOWS\system32\svchost.exe
1140 C:\WINDOWS\system32\svchost.exe
1220 svchost.exe
1296 svchost.exe
1540 C:\WINDOWS\system32\spoolsv.exe
1584 C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe
1600 C:\Programme\Avira\AntiVir Desktop\sched.exe
1664 svchost.exe
1848 C:\WINDOWS\explorer.exe
1952 C:\Programme\Avira\AntiVir Desktop\avgnt.exe
1968 C:\WINDOWS\system32\ctfmon.exe
2016 C:\Programme\Avira\AntiVir Desktop\avguard.exe
2036 C:\WINDOWS\system32\CTSVCCDA.EXE
208 C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe
340 G:\CDBurnerXP\NMSAccessU.exe
108 C:\Programme\Avira\AntiVir Desktop\avshadow.exe
636 C:\WINDOWS\system32\nvsvc32.exe
888 C:\WINDOWS\system32\svchost.exe
496 C:\Programme\Avira\AntiVir Desktop\avmailc.exe
672 C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe
2708 C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe
2904 alg.exe
2880 C:\WINDOWS\system32\svchost.exe
3688 C:\WINDOWS\system32\wscntfy.exe
3784 C:\Programme\Internet Explorer\IEXPLORE.EXE
1592 C:\Programme\Internet Explorer\IEXPLORE.EXE
3440 C:\Programme\Internet Explorer\IEXPLORE.EXE
132 C:\Dokumente und Einstellungen\cp\Desktop\MBRCheck.exe
\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000004`e22d6a00 (NTFS)
\\.\E: --> \\.\PhysicalDrive0 at offset 0x00000015`f94d2200 (NTFS)
\\.\G: --> \\.\PhysicalDrive0 at offset 0x00000027`106cda00 (NTFS)
PhysicalDrive0 Model Number: MAXTORSTM3250820AS, Rev: 3.AAE
Size Device Name MBR Status
--------------------------------------------
232 GB \\.\PhysicalDrive0
Mir mal den nächsten Packen Unterlagen schnapp und weiter sortiere nebenbei. Das ist das einzige Gute an der Sache - ich komm mal wieder dazu, die Ablage zu machen :pfeiff:
Gruß :-) |
