svchost.exe lastet meinen Speicher aus

cosinus · 20.02.2011, 18:20

Dann poste bitte nach der Entfernung jetzt frische OTL-Logs:

Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Doppelklick auf die OTL.exe
Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
Unter Extra Registry, wähle bitte Use SafeList
Klicke nun auf Run Scan links oben
Wenn der Scan beendet wurde werden 2 Logfiles erstellt
Poste die Logfiles hier in den Thread.

Timo7760 · 20.02.2011, 19:10

Hi,
Danke nochmal, hab OTL nochmal durchlaufen lassen:

Code:

ATTFilter

OTL Extras logfile created on: 20.02.2011 18:53:02 - Run 2
OTL by OldTimer - Version 3.2.20.6     Folder = C:\Users\Timo\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 60,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 79,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 111,44 Gb Total Space | 75,20 Gb Free Space | 67,48% Space Free | Partition Type: NTFS
Drive D: | 232,88 Gb Total Space | 105,10 Gb Free Space | 45,13% Space Free | Partition Type: NTFS
Drive E: | 107,90 Gb Total Space | 107,81 Gb Free Space | 99,92% Space Free | Partition Type: NTFS
Drive F: | 7,48 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: TIMO-PC | User Name: Timo | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0CC861C4-2DE7-438B-8139-E55D0A9973E6}" = dir=in | app=c:\program files\acer arcade deluxe\homemedia\homemedia.exe | 
"{0F5B51A3-AA75-48DA-97BC-D93221495D1A}" = dir=in | app=c:\program files\acer arcade deluxe\acer arcade deluxe\acer arcade deluxe.exe | 
"{151993F2-D413-4048-96BF-0FB33DB96FC0}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe | 
"{15451ADB-CF75-46DA-AB59-CC7BAB6CC75D}" = dir=in | app=c:\program files\acer\acer vcm\vc.exe | 
"{2BBC3EB7-EE27-4F0E-8566-4A5F16A65A66}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe | 
"{3673E242-38DB-415C-81CD-F767E62534FE}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{5CFB6649-7C2A-4B43-A099-4D04B764E4BE}" = dir=in | app=c:\program files\acer arcade deluxe\playmovie\pmvservice.exe | 
"{7BD65B90-A3F1-4D8C-9E90-4999B8EBA804}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe | 
"{8717AF46-97FC-465B-9558-1FBF757D97AA}" = dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe | 
"{970E2153-184F-482B-9B86-B46EAE130CBB}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe | 
"{9FC17329-1503-4DC0-A571-2D69A8E1D5C5}" = dir=in | app=c:\program files\acer arcade deluxe\playmovie\playmovie.exe | 
"{B3D45A7D-8AD2-4E2C-8D15-B27610520A8F}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\client\agentsvc.exe | 
"{BEEEEE1F-50B1-48DF-B05F-7ACE0E6D17B3}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\client\agentsvc.exe | 
"{D249C927-F055-46B1-8AD0-46F9409A8C91}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{D9277855-0A29-4403-87C3-88B0F208C0D7}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{F379E883-67C7-49F2-8958-99E77B830FD4}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = WIDCOMM Bluetooth Software 6.0.1.6400
"{047F790A-7A2A-4B6A-AD02-38092BA63DAC}" = Acer VCM
"{10F498FF-5392-4DF3-8F73-FE172A9F3800}" = Winbond CIR Device Drivers
"{11316260-6666-467B-AC34-183FCB5D4335}" = Acer Mobility Center Plug-In
"{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now Standard
"{13D85C14-2B85-419F-AC41-C7F21E68B25D}" = Acer eSettings Management
"{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java(TM) 6 Update 24
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works
"{57265292-228A-41FA-9AEC-4620CBCC2739}" = Acer eAudio Management
"{58E5844B-7CE2-413D-83D1-99294BF6C74F}" = Acer ePower Management
"{5B63A470-9334-44D1-AF61-6CE2DB565AE9}" = Orion
"{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}" = Skype™ 3.8
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110111700}" = Zuma Deluxe
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11029123}" = Bricks of Egypt
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110322783}" = Big Kahuna Reef
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110411970}" = Chuzzle
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111118433}" = Mystery Case Files - Huntsville
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111199750}" = Cake Mania
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111252743}" = Mahjong Escape Ancient China
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111324990}" = Kick N Rush
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111543617}" = Backspin Billiards
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111692950}" = Mahjongg Artifacts
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111771833}" = Jewel Quest Solitaire
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111796363}" = Mystery Solitaire - Secret Island
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111872660}" = Diner Dash Flo on the Go
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112531267}" = Chicken Invaders 3
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112615863}" = Agatha Christie Death on the Nile
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}" = Alice Greenfingers
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113009953}" = Turbo Pizza
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113080210}" = Azada
"{8F1B6239-FEA0-450A-A950-B05276CE177C}" = Acer Empowering Technology
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{3EC77D26-799B-4CD8-914F-C1565E796173}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{430971B1-C31E-45DA-81E0-72C095BAB72C}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{58FC5E37-DD28-4D4A-A549-125744C6763C}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{888B9AC7-8F5C-456B-A27A-157A6C310E52}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{BEE75E01-DD3F-4D5F-B96C-609E6538D419}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{A5633652-3795-4829-BB0B-644F0279E279}" = Acer eDataSecurity Management
"{A77255C4-AFCB-44A3-BF0F-2091A71FFD9E}" = Acer Crystal Eye Webcam 2.0.8
"{AC76BA86-7AD7-1031-7B44-AA0000000001}" = Adobe Reader X (10.0.1) - Deutsch
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe  1.4.142.1
"{D36DD326-7280-11D8-97C8-000129760CBE}" = PhotoNow!
"{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{ECCD28B2-8798-4D16-8126-625D728294A1}" = SPBA 5.8
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"Acer Acer Bio Protection 6.0.00.17" = Acer Bio Protection

AAU 6.0.00.17
"Acer GameZone Console_is1" = Acer GameZone Console 2.0.1.1
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"CNXT_MODEM_HDA_HSF" = HDAUDIO Soft Data Fax Modem with SmartCP
"ERUNT_is1" = ERUNT 1.1j
"Google Desktop" = Google Desktop
"GridVista" = Acer GridVista
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now 5
"InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.0.19)" = Mozilla Firefox (3.0.19)
"MSC" = McAfee SecurityCenter
"NVIDIA Drivers" = NVIDIA Drivers
"SynTPDeinstKey" = Synaptics Pointing Device Driver
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"OnlineCodex" = OnlineCodex
"QIP 2005" = QIP 2005 8092
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 13.02.2011 15:11:20 | Computer Name = Timo-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 13.02.2011 15:28:13 | Computer Name = Timo-PC | Source = VSS | ID = 8194
Description = 
 
Error - 13.02.2011 15:34:29 | Computer Name = Timo-PC | Source = VSS | ID = 8194
Description = 
 
Error - 13.02.2011 15:36:07 | Computer Name = Timo-PC | Source = VSS | ID = 8194
Description = 
 
Error - 13.02.2011 15:37:27 | Computer Name = Timo-PC | Source = VSS | ID = 8194
Description = 
 
Error - 13.02.2011 15:49:19 | Computer Name = Timo-PC | Source = VSS | ID = 8194
Description = 
 
[ System Events ]
Error - 13.02.2011 15:14:47 | Computer Name = Timo-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description = 
 
Error - 13.02.2011 15:14:47 | Computer Name = Timo-PC | Source = Microsoft-Windows-Servicing | ID = 4385
Description = 
 
Error - 13.02.2011 15:14:47 | Computer Name = Timo-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description = 
 
Error - 13.02.2011 15:14:47 | Computer Name = Timo-PC | Source = Microsoft-Windows-Servicing | ID = 4385
Description = 
 
Error - 13.02.2011 15:14:47 | Computer Name = Timo-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description = 
 
Error - 13.02.2011 15:14:47 | Computer Name = Timo-PC | Source = Microsoft-Windows-Servicing | ID = 4385
Description = 
 
Error - 13.02.2011 16:04:17 | Computer Name = Timo-PC | Source = Service Control Manager | ID = 7030
Description = 
 
Error - 13.02.2011 16:08:41 | Computer Name = Timo-PC | Source = HTTP | ID = 15016
Description = 
 
Error - 14.02.2011 09:18:13 | Computer Name = Timo-PC | Source = HTTP | ID = 15016
Description = 
 
Error - 14.02.2011 10:56:33 | Computer Name = Timo-PC | Source = HTTP | ID = 15016
Description = 
 
 
< End of report >

Code:

ATTFilter

OTL logfile created on: 20.02.2011 18:53:02 - Run 2
OTL by OldTimer - Version 3.2.20.6     Folder = C:\Users\Timo\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 60,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 79,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 111,44 Gb Total Space | 75,20 Gb Free Space | 67,48% Space Free | Partition Type: NTFS
Drive D: | 232,88 Gb Total Space | 105,10 Gb Free Space | 45,13% Space Free | Partition Type: NTFS
Drive E: | 107,90 Gb Total Space | 107,81 Gb Free Space | 99,92% Space Free | Partition Type: NTFS
Drive F: | 7,48 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: TIMO-PC | User Name: Timo | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Timo\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Users\Timo\AppData\Local\Temp\RtkBtMnt.exe (Realtek Semiconductor Corp.)
PRC - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
PRC - C:\Programme\Acer\Acer Bio Protection\CompPtcVUI.exe (Arachnoid Biometrics Identification Group Corp.)
PRC - C:\Programme\Acer\Acer Bio Protection\BASVC.exe ()
PRC - C:\Programme\Acer\Acer Bio Protection\PdtWzd.exe (Arachnoid Biometrics Identification Group Corp.)
PRC - C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe (Google)
PRC - c:\Programme\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Acer\Empowering Technology\ePower\ePower_DMC.exe (Acer Inc.)
PRC - C:\Programme\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe (CyberLink)
PRC - C:\Programme\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.)
PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Programme\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.)
PRC - C:\Programme\Launch Manager\QtZgAcer.EXE (Dritek System Inc.)
PRC - C:\Programme\Acer\Empowering Technology\Framework.Launcher.exe ()
PRC - C:\Programme\Acer\Empowering Technology\NotificationCenter\Framework.NotificationCenter.exe (acer)
PRC - C:\Programme\Acer\Empowering Technology\Service\ETService.exe ()
PRC - C:\Programme\Acer\Empowering Technology\eAudio\eAudio.exe (Acer Incorporated)
PRC - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe (Egis Incorporated)
PRC - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe (Egis Incorporated)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Programme\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe (NewTech InfoSystems, Inc.)
PRC - C:\Programme\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe ()
PRC - C:\Programme\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe ()
PRC - C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
PRC - C:\Programme\Common Files\SPBA\upeksvr.exe (UPEK Inc.)
PRC - c:\Programme\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
PRC - C:\Programme\Acer\Acer VCM\AcerVCM.exe (Acer Incorporated)
PRC - C:\Programme\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe (NewTech Infosystems, Inc.)
PRC - C:\Programme\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe ()
PRC - C:\Programme\Acer\Acer VCM\RS_Service.exe (Acer Incorporated)
PRC - C:\ACER\Mobility Center\MobilityService.exe ()
PRC - C:\Windows\PLFSetI.exe ()
PRC - C:\Programme\McAfee\MSK\msksrver.exe (McAfee, Inc.)
PRC - c:\Programme\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
PRC - C:\Programme\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
PRC - C:\Programme\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Programme\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
PRC - C:\Programme\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
PRC - C:\Programme\McAfee\MPF\MpfSrv.exe (McAfee, Inc.)
PRC - C:\Programme\Acer\Acer VCM\acp2HID.exe (Acer Inc.)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Timo\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18523_none_5cdd65e20837faf2\comctl32.dll (Microsoft Corporation)
MOD - c:\Programme\McAfee\SiteAdvisor\sahook.dll (McAfee, Inc.)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (IGBASVC) -- C:\Programme\Acer\Acer Bio Protection\BASVC.exe ()
SRV - (GoogleDesktopManager-051210-111108) -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
SRV - (Partner Service) -- C:\ProgramData\Partner\partner.exe (Google Inc.)
SRV - (McAfee SiteAdvisor Service) -- c:\Programme\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
SRV - (IAANTMON) Intel(R) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (ETService) -- C:\Programme\Acer\Empowering Technology\Service\ETService.exe ()
SRV - (eDataSecurity Service) -- C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe (Egis Incorporated)
SRV - (NTIBackupSvc) -- C:\Programme\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe (NewTech InfoSystems, Inc.)
SRV - (NTISchedulerSvc) -- C:\Programme\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe ()
SRV - (McNASvc) -- c:\Programme\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
SRV - (BUNAgentSvc) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe (NewTech Infosystems, Inc.)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (CLHNService) -- C:\Programme\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe ()
SRV - (RS_Service) -- C:\Programme\Acer\Acer VCM\RS_Service.exe (Acer Incorporated)
SRV - (MobilityService) -- C:\Acer\Mobility Center\MobilityService.exe ()
SRV - (MSK80Service) -- C:\Program Files\McAfee\MSK\MskSrver.exe (McAfee, Inc.)
SRV - (McProxy) -- c:\Programme\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
SRV - (mcmscsvc) -- C:\Programme\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
SRV - (McODS) -- C:\Programme\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (McSysmon) -- C:\Programme\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
SRV - (McShield) -- C:\Programme\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
SRV - (MpfService) -- C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (AlfaFF) -- C:\Windows\system32\Drivers\AlfaFF.sys (Alfa Corporation)
DRV - (iaStor) -- C:\Windows\system32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796}) -- C:\Programme\Acer Arcade Deluxe\PlayMovie\000.fcl (Cyberlink Corp.)
DRV - (NVHDA) -- C:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation)
DRV - (L1E) -- C:\Windows\System32\drivers\L1E60x86.sys (Atheros Communications, Inc.)
DRV - (psdvdisk) -- C:\Windows\System32\drivers\PSDVdisk.sys (Egis Incorporated)
DRV - (PSDFilter) -- C:\Windows\system32\DRIVERS\psdfilter.sys (Egis Incorporated)
DRV - (PSDNServ) -- C:\Windows\System32\drivers\PSDNServ.sys (Egis Incorporated)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (NETw5v32) Intel(R) -- C:\Windows\System32\drivers\NETw5v32.sys (Intel Corporation)
DRV - (TcUsb) -- C:\Windows\System32\drivers\tcusb.sys (UPEK Inc.)
DRV - (SynTP) -- C:\Windows\System32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (RTSTOR) -- C:\Windows\System32\drivers\RTSTOR.sys (Realtek Semiconductor Corp.)
DRV - (HSF_DPV) -- C:\Windows\System32\drivers\HSX_DPV.sys (Conexant Systems, Inc.)
DRV - (HSXHWAZL) -- C:\Windows\System32\drivers\HSXHWAZL.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\Windows\System32\drivers\HSX_CNXT.sys (Conexant Systems, Inc.)
DRV - (NTIDrvr) -- C:\Windows\System32\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV - (UBHelper) -- C:\Windows\System32\drivers\UBHelper.sys (NewTech Infosystems Corporation)
DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (HSFHWAZL) -- C:\Windows\System32\drivers\VSTAZL3.SYS (Conexant Systems, Inc.)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (NTIPPKernel) -- C:\Programme\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys (Cyberlink Corp.)
DRV - (XAudio) -- C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - (mferkdk) -- C:\Windows\System32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (mfeavfk) -- C:\Windows\System32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfehidk) -- C:\Windows\System32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfesmfk) -- C:\Windows\System32\drivers\mfesmfk.sys (McAfee, Inc.)
DRV - (mfebopk) -- C:\Windows\System32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (MPFP) -- C:\Windows\System32\drivers\Mpfp.sys (McAfee, Inc.)
DRV - (winbondcir) -- C:\Windows\System32\drivers\winbondcir.sys (Winbond Electronics Corporation)
DRV - (int15) -- C:\Windows\System32\drivers\int15.sys ()
DRV - (DKbFltr) -- C:\Windows\System32\drivers\DKbFltr.sys (Dritek System Inc.)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=0211&m=aspire_6930g
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=0211&m=aspire_6930g
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=0211&m=aspire_6930g
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://global.acer.com [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=0211&m=aspire_6930g
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2011.02.14 20:31:42 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.02.17 19:38:39 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.02.19 21:26:31 | 000,000,000 | ---D | M]
 
[2011.02.13 21:21:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Timo\AppData\Roaming\mozilla\Extensions
[2011.02.20 15:12:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Timo\AppData\Roaming\mozilla\Firefox\Profiles\q7zjq99g.default\extensions
[2011.02.16 14:08:56 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Timo\AppData\Roaming\mozilla\Firefox\Profiles\q7zjq99g.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.02.19 21:26:36 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.02.19 21:26:36 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011.02.19 21:26:36 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011.02.19 21:26:13 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2011.02.17 19:38:35 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2011.02.17 19:38:35 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2011.02.17 19:38:35 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2011.02.17 19:38:35 | 000,000,986 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2011.02.17 19:38:35 | 000,000,801 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (McAfee Phishing Filter) - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\Programme\McAfee\MSK\mcapbho.dll ()
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Programme\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll (Egis)
O2 - BHO: (Partner BHO Class) - {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:\ProgramData\Partner\partner.dll (Google Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Programme\Google\GoogleToolbar1.dll (Google Germany GmbH)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\3.1.415.1646\swg.dll (Google Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Programme\Google\GoogleToolbar1.dll (Google Germany GmbH)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)
O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ArcadeDeluxeAgent] C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [BkupTray] C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe ()
O4 - HKLM..\Run: [CLMLServer] C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [eAudio] C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe (Acer Incorporated)
O4 - HKLM..\Run: [eDataSecurity Loader] C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe (Egis Incorporated)
O4 - HKLM..\Run: [ePower_DMC] C:\Programme\Acer\Empowering Technology\ePower\ePower_DMC.exe (Acer Inc.)
O4 - HKLM..\Run: [eRecoveryService]  File not found
O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
O4 - HKLM..\Run: [IAAnotif] C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [LManager] C:\Programme\Launch Manager\QtZgAcer.EXE (Dritek System Inc.)
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [PlayMovie] C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.)
O4 - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [WarReg_PopUp] C:\Programme\Acer\WR_PopUp\WarReg_PopUp.exe (Acer Incorporated)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [ZPdtWzdVitaKey MC3000] C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe (Arachnoid Biometrics Identification Group Corp.)
O4 - HKCU..\Run: [ICQ] C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Programme\Acer\Acer Bio Protection\PwdBank.exe ()
O9 - Extra 'Tools' menuitem : Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Programme\Acer\Acer Bio Protection\PwdBank.exe ()
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) - C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AWinNotifyVitaKey MC3000: DllName - C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll - C:\Programme\Acer\Acer Bio Protection\WinNotify.dll (Arachnoid Biometrics Identification Group Corp.)
O20 - Winlogon\Notify\spba: DllName - C:\Program Files\Common Files\SPBA\homefus2.dll - C:\Programme\Common Files\SPBA\homefus2.dll (UPEK Inc.)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\Acer01.JPG
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\Acer01.JPG
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2010.10.18 17:00:19 | 000,000,000 | ---D | M] - D:\AutoPlay -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.02.20 18:51:10 | 000,602,624 | ---- | C] (OldTimer Tools) -- C:\Users\Timo\Desktop\OTL.exe
[2011.02.19 21:26:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2011.02.19 21:26:49 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Java
[2011.02.19 21:26:31 | 000,472,808 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll
[2011.02.19 21:26:31 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2011.02.19 21:26:31 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2011.02.19 21:26:31 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2011.02.19 21:26:06 | 000,000,000 | ---D | C] -- C:\Programme\Java
[2011.02.17 17:18:32 | 000,000,000 | ---D | C] -- C:\Users\Timo\Desktop\Neuer Ordner
[2011.02.17 16:35:27 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011.02.17 16:34:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT
[2011.02.17 16:34:44 | 000,000,000 | ---D | C] -- C:\Programme\ERUNT
[2011.02.17 15:17:46 | 000,295,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHost.exe
[2011.02.17 15:17:46 | 000,099,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHostProxy.dll
[2011.02.17 15:17:46 | 000,049,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netfxperf.dll
[2011.02.16 16:06:33 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Adobe
[2011.02.16 16:06:33 | 000,000,000 | ---D | C] -- C:\Programme\Adobe
[2011.02.16 13:59:21 | 000,000,000 | ---D | C] -- C:\Users\Timo\AppData\Roaming\Malwarebytes
[2011.02.16 13:59:11 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.02.16 13:59:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.02.16 13:59:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.02.16 13:59:07 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.02.16 13:59:07 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2011.02.16 13:53:48 | 000,000,000 | ---D | C] -- C:\Users\Timo\Desktop\MFTools
[2011.02.16 13:52:37 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netevent.dll
[2011.02.15 17:27:01 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\browserchoice.exe
[2011.02.15 17:03:42 | 000,097,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\infocardapi.dll
[2011.02.15 17:03:41 | 000,105,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationCFFRasterizerNative_v0300.dll
[2011.02.15 17:03:40 | 000,622,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\icardagt.exe
[2011.02.15 17:03:40 | 000,037,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\infocardcpl.cpl
[2011.02.15 17:03:40 | 000,011,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\icardres.dll
[2011.02.15 17:03:38 | 000,781,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationNative_v0300.dll
[2011.02.15 16:58:55 | 000,158,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mscorier.dll
[2011.02.15 16:58:50 | 000,083,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mscories.dll
[2011.02.15 16:57:23 | 000,024,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\nshhttp.dll
[2011.02.15 16:57:19 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\httpapi.dll
[2011.02.15 16:56:36 | 000,000,000 | ---D | C] -- C:\Programme\MSXML 4.0
[2011.02.14 16:31:32 | 000,000,000 | ---D | C] -- C:\Users\Timo\AppData\Local\Adobe
[2011.02.14 16:17:23 | 000,000,000 | ---D | C] -- C:\Users\Timo\AppData\Roaming\skypePM
[2011.02.14 15:19:20 | 002,452,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat
[2011.02.14 15:19:16 | 000,671,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2011.02.14 15:19:16 | 000,467,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2011.02.14 15:19:14 | 000,380,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2011.02.14 15:19:13 | 000,389,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2011.02.14 15:19:11 | 000,389,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2011.02.14 15:19:11 | 000,230,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll
[2011.02.14 15:19:11 | 000,193,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2011.02.14 15:19:11 | 000,026,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2011.02.14 15:19:10 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieencode.dll
[2011.02.14 15:19:08 | 001,383,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2011.02.14 15:19:08 | 000,028,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2011.02.14 14:48:52 | 000,000,000 | ---D | C] -- C:\Users\Timo\AppData\Roaming\Adobe
[2011.02.14 14:48:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QIP 2005
[2011.02.14 14:48:46 | 000,000,000 | ---D | C] -- C:\Programme\QIP
[2011.02.14 14:46:14 | 012,240,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\NlsLexicons0007.dll
[2011.02.14 14:46:11 | 002,644,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\NlsLexicons0009.dll
[2011.02.14 14:45:58 | 000,801,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\NaturalLanguage6.dll
[2011.02.14 14:45:07 | 000,666,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelinesvc.exe
[2011.02.14 14:45:06 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelineprxy.dll
[2011.02.14 14:45:04 | 000,183,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sdohlp.dll
[2011.02.14 14:45:04 | 000,098,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iasrecst.dll
[2011.02.14 14:45:04 | 000,054,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iasads.dll
[2011.02.14 14:45:04 | 000,044,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iasdatastore.dll
[2011.02.14 14:45:03 | 000,017,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iashost.exe
[2011.02.14 14:43:51 | 000,996,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMNetMgr.dll
[2011.02.14 14:43:50 | 000,094,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\logagent.exe
[2011.02.14 14:43:47 | 000,357,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskschd.dll
[2011.02.14 14:43:46 | 000,345,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmicmiplugin.dll
[2011.02.14 14:43:45 | 000,270,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskcomp.dll
[2011.02.14 14:43:38 | 000,954,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40.dll
[2011.02.14 14:43:37 | 000,954,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40u.dll
[2011.02.14 14:43:22 | 001,256,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\lsasrv.dll
[2011.02.14 14:42:01 | 000,024,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\amxread.dll
[2011.02.14 14:42:01 | 000,013,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\apilogen.dll
[2011.02.14 14:41:47 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wlanmsm.dll
[2011.02.14 14:41:46 | 000,127,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\L2SecHC.dll
[2011.02.14 14:41:45 | 000,302,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wlansec.dll
[2011.02.14 14:41:20 | 000,636,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\localspl.dll
[2011.02.14 14:40:49 | 000,104,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netiohlp.dll
[2011.02.14 14:40:38 | 000,027,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\NETSTAT.EXE
[2011.02.14 14:40:36 | 000,019,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ARP.EXE
[2011.02.14 14:40:31 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\finger.exe
[2011.02.14 14:40:30 | 000,008,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\HOSTNAME.EXE
[2011.02.14 14:40:27 | 000,011,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MRINFO.EXE
[2011.02.14 14:40:24 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ROUTE.EXE
[2011.02.14 14:39:04 | 000,015,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pacerprf.dll
[2011.02.14 14:38:21 | 000,157,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\t2embed.dll
[2011.02.14 14:37:55 | 000,409,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\odbc32.dll
[2011.02.14 14:36:29 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\spwmp.dll
[2011.02.14 14:36:27 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdxm.ocx
[2011.02.14 14:36:27 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxmasf.dll
[2011.02.14 14:36:24 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdxm.tlb
[2011.02.14 14:36:24 | 000,018,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\amcompat.tlb
[2011.02.14 14:36:11 | 008,147,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmploc.DLL
[2011.02.14 14:35:48 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
[2011.02.14 14:34:33 | 003,548,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2011.02.14 14:34:32 | 003,600,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2011.02.14 14:34:30 | 001,314,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll
[2011.02.14 14:34:26 | 000,248,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msshsq.dll
[2011.02.14 14:34:24 | 002,386,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMVCORE.DLL
[2011.02.14 14:34:23 | 002,868,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mf.dll
[2011.02.14 14:34:13 | 002,038,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2011.02.14 14:34:11 | 000,443,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32spl.dll
[2011.02.14 14:34:09 | 000,562,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdtcprx.dll
[2011.02.14 14:34:09 | 000,038,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xolehlp.dll
[2011.02.14 14:34:07 | 000,430,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll
[2011.02.14 14:34:02 | 002,927,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer.exe
[2011.02.14 14:33:55 | 000,512,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll
[2011.02.14 14:33:47 | 001,169,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sdclt.exe
[2011.02.14 14:33:44 | 000,866,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmpmde.dll
[2011.02.14 14:33:41 | 000,351,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WSDApi.dll
[2011.02.14 14:33:36 | 000,135,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wshom.ocx
[2011.02.14 14:33:35 | 000,180,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\scrobj.dll
[2011.02.14 14:33:35 | 000,135,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cscript.exe
[2011.02.14 14:33:33 | 000,317,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MP4SDECD.DLL
[2011.02.14 14:33:27 | 000,303,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmpeffects.dll
[2011.02.14 14:33:25 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\consent.exe
[2011.02.14 14:33:23 | 000,062,464 | ---- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codeca.acm
[2011.02.14 14:33:17 | 000,081,920 | ---- | C] (Radius Inc.) -- C:\Windows\System32\iccvid.dll
[2011.02.14 14:33:15 | 000,036,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rtutils.dll
[2011.02.14 14:33:11 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\asycfilt.dll
[2011.02.14 14:30:39 | 000,000,000 | ---D | C] -- C:\Users\Timo\AppData\Roaming\ICQ
[2011.02.14 14:30:38 | 000,000,000 | ---D | C] -- C:\Users\Timo\AppData\Local\AOL
[2011.02.14 14:30:30 | 000,000,000 | ---D | C] -- C:\Programme\ICQ7.2
[2011.02.14 14:29:52 | 000,000,000 | ---D | C] -- C:\Users\Timo\AppData\Roaming\Skype
[2011.02.14 14:29:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011.02.14 14:29:16 | 000,000,000 | ---D | C] -- C:\Programme\Skype
[2011.02.14 14:29:16 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Skype
[2011.02.14 14:28:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype
[2011.02.14 14:27:23 | 000,292,352 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2011.02.14 14:27:20 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fontsub.dll
[2011.02.14 14:27:20 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2011.02.14 14:27:20 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dciman32.dll
[2011.02.14 14:26:25 | 000,091,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\avifil32.dll
[2011.02.14 14:26:25 | 000,082,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mciavi32.dll
[2011.02.14 14:26:23 | 000,123,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msvfw32.dll
[2011.02.14 14:26:23 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\avicap32.dll
[2011.02.14 14:23:40 | 000,045,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dataclen.dll
[2011.02.14 14:23:39 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdd.dll
[2011.02.14 14:23:12 | 000,604,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMSPDMOD.DLL
[2011.02.14 14:22:39 | 000,244,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rastls.dll
[2011.02.14 14:22:38 | 000,281,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\raschap.dll
[2011.02.13 21:21:07 | 000,000,000 | ---D | C] -- C:\Users\Timo\AppData\Roaming\Mozilla
[2011.02.13 21:21:07 | 000,000,000 | ---D | C] -- C:\Users\Timo\AppData\Local\Mozilla
[2011.02.13 21:21:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox
[2011.02.13 21:20:59 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Firefox
[2011.02.13 21:10:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Desktop
[2011.02.13 21:09:58 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA
[2011.02.13 21:05:09 | 014,033,923 | ---- | C] (Adobe Systems, Inc.) -- C:\Windows\System32\acer.exe
[2011.02.13 21:05:08 | 000,000,000 | ---D | C] -- C:\Users\Timo\AppData\Roaming\Macromedia
[2011.02.13 21:05:06 | 000,000,000 | ---D | C] -- C:\Programme\Acer Incorporated
[2011.02.13 21:05:03 | 000,000,000 | ---D | C] -- C:\Windows\ACER
[2011.02.13 21:04:47 | 000,000,000 | ---D | C] -- C:\Users\Timo\AppData\Roaming\Acer
[2011.02.13 21:04:14 | 000,000,000 | ---D | C] -- C:\Users\Timo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDirector
[2011.02.13 20:54:21 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msxml4a.dll
[2011.02.13 20:51:56 | 000,000,000 | ---D | C] -- C:\Users\Timo\AppData\Local\PowerCinema
[2011.02.13 20:51:55 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer Arcade Deluxe
[2011.02.13 20:49:32 | 000,000,000 | ---D | C] -- C:\Programme\Acer Arcade Deluxe
[2011.02.13 20:49:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Temp
[2011.02.13 20:49:29 | 000,000,000 | ---D | C] -- C:\ProgramData\CyberLink
[2011.02.13 20:48:35 | 000,114,688 | ---- | C] (Arachnoid Biometrics Identification Group Corp.) -- C:\Windows\System32\VCryptAPI.dll
[2011.02.13 20:48:24 | 000,023,040 | ---- | C] (Arachnoid Biometrics Identification Group Corp.) -- C:\Windows\System32\ShlCmd.exe
[2011.02.13 20:48:23 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\biologon.dll
[2011.02.13 20:48:11 | 000,042,608 | ---- | C] (Alfa Corporation) -- C:\Windows\System32\drivers\AlfaFF.sys
[2011.02.13 20:48:11 | 000,024,048 | ---- | C] (Arachnoid Biometrics Identification Group Corp.) -- C:\Windows\System32\AlfaFF.dll
[2011.02.13 20:48:10 | 000,338,416 | ---- | C] (Alfa Corporation) -- C:\Windows\System32\DrvCrypt.dll
[2011.02.13 20:48:06 | 001,468,928 | ---- | C] (UPEK, Inc.) -- C:\Windows\System32\bsapi.dll
[2011.02.13 20:47:49 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\SPBA
[2011.02.13 20:47:45 | 000,000,000 | ---D | C] -- C:\ProgramData\UIB
[2011.02.13 20:47:08 | 000,000,000 | ---D | C] -- C:\CLSetup
[2011.02.13 20:37:55 | 000,061,440 | ---- | C] (Acer Inc.) -- C:\Windows\System32\MCEPlugin.dll
[2011.02.13 20:34:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer GridVista
[2011.02.13 20:33:59 | 000,000,000 | ---D | C] -- C:\Programme\Acer Inc
[2011.02.13 20:32:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Launch Manager
[2011.02.13 20:32:50 | 000,000,000 | ---D | C] -- C:\Programme\Launch Manager
[2011.02.13 20:31:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel® Matrix Storage Manager
[2011.02.13 20:28:27 | 000,262,144 | ---- | C] (SuYin) -- C:\Windows\Acer Crystal Eye webcam.EXE
[2011.02.13 20:28:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer Crystal Eye
[2011.02.13 20:28:11 | 000,000,000 | ---D | C] -- C:\Users\Timo\AppData\Roaming\InstallShield
[2011.02.13 20:26:30 | 000,233,472 | ---- | C] (Broadcom Corporation.) -- C:\Windows\System32\BtwRSupport.dll
[2011.02.13 20:26:23 | 000,000,000 | ---D | C] -- C:\Windows\System32\es-MX
[2011.02.13 20:26:23 | 000,000,000 | ---D | C] -- C:\Windows\System32\es-AR
[2011.02.13 20:26:21 | 000,000,000 | ---D | C] -- C:\Programme\WIDCOMM
[2011.02.13 20:24:20 | 001,079,840 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcpluir.dll
[2011.02.13 20:24:20 | 000,768,544 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcplui.exe
[2011.02.13 20:24:20 | 000,420,384 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcpl.cpl
[2011.02.13 20:24:20 | 000,313,888 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvexpbar.dll
[2011.02.13 20:21:21 | 000,446,464 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\NVUNINST.EXE
[2011.02.13 20:20:55 | 000,000,000 | ---D | C] -- C:\Users\Timo\Documents\Eigene Google Gadgets
[2011.02.13 20:20:54 | 000,000,000 | ---D | C] -- C:\Users\Timo\AppData\Local\Google
[2011.02.13 20:20:44 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011.02.13 20:20:28 | 000,000,000 | R--D | C] -- C:\Users\Timo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2011.02.13 20:20:28 | 000,000,000 | R--D | C] -- C:\Users\Timo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2011.02.13 20:20:27 | 000,000,000 | R--D | C] -- C:\Users\Timo\Searches
[2011.02.13 20:20:20 | 000,000,000 | ---D | C] -- C:\Users\Timo\AppData\Roaming\Identities
[2011.02.13 20:20:18 | 000,000,000 | R--D | C] -- C:\Users\Timo\Contacts
[2011.02.13 20:16:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Google
[2011.02.13 20:16:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Partner
[2011.02.13 20:15:46 | 000,000,000 | ---D | C] -- C:\Programme\Google
[2011.02.13 20:15:14 | 000,000,000 | ---D | C] -- C:\Users\Timo\AppData\Local\VirtualStore
[2011.02.13 20:14:48 | 000,000,000 | -HSD | C] -- C:\Users\Timo\Vorlagen
[2011.02.13 20:14:48 | 000,000,000 | -HSD | C] -- C:\Users\Timo\AppData\Local\Verlauf
[2011.02.13 20:14:48 | 000,000,000 | -HSD | C] -- C:\Users\Timo\AppData\Local\Temporary Internet Files
[2011.02.13 20:14:48 | 000,000,000 | -HSD | C] -- C:\Users\Timo\Startmenü
[2011.02.13 20:14:48 | 000,000,000 | -HSD | C] -- C:\Users\Timo\SendTo
[2011.02.13 20:14:48 | 000,000,000 | -HSD | C] -- C:\Users\Timo\Recent
[2011.02.13 20:14:48 | 000,000,000 | -HSD | C] -- C:\Users\Timo\Netzwerkumgebung
[2011.02.13 20:14:48 | 000,000,000 | -HSD | C] -- C:\Users\Timo\Lokale Einstellungen
[2011.02.13 20:14:48 | 000,000,000 | -HSD | C] -- C:\Users\Timo\Documents\Eigene Videos
[2011.02.13 20:14:48 | 000,000,000 | -HSD | C] -- C:\Users\Timo\Documents\Eigene Musik
[2011.02.13 20:14:48 | 000,000,000 | -HSD | C] -- C:\Users\Timo\Eigene Dateien
[2011.02.13 20:14:48 | 000,000,000 | -HSD | C] -- C:\Users\Timo\Documents\Eigene Bilder
[2011.02.13 20:14:48 | 000,000,000 | -HSD | C] -- C:\Users\Timo\Druckumgebung
[2011.02.13 20:14:48 | 000,000,000 | -HSD | C] -- C:\Users\Timo\Cookies
[2011.02.13 20:14:48 | 000,000,000 | -HSD | C] -- C:\Users\Timo\AppData\Local\Anwendungsdaten
[2011.02.13 20:14:48 | 000,000,000 | -HSD | C] -- C:\Users\Timo\Anwendungsdaten
[2011.02.13 20:14:47 | 000,000,000 | --SD | C] -- C:\Users\Timo\AppData\Roaming\Microsoft
[2011.02.13 20:14:47 | 000,000,000 | R--D | C] -- C:\Users\Timo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2011.02.13 20:14:47 | 000,000,000 | R--D | C] -- C:\Users\Timo\Documents
[2011.02.13 20:14:47 | 000,000,000 | R--D | C] -- C:\Users\Timo\Desktop
[2011.02.13 20:14:47 | 000,000,000 | R--D | C] -- C:\Users\Timo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2011.02.13 20:14:47 | 000,000,000 | -H-D | C] -- C:\Users\Timo\AppData
[2011.02.13 20:14:47 | 000,000,000 | ---D | C] -- C:\Users\Timo\AppData\Local\Temp
[2011.02.13 20:14:47 | 000,000,000 | ---D | C] -- C:\Users\Timo\AppData\Local\Microsoft
[2011.02.13 20:14:47 | 000,000,000 | ---D | C] -- C:\Users\Timo\AppData\Roaming\Media Center Programs
[2011.02.13 20:14:47 | 000,000,000 | ---D | C] -- C:\Users\Timo\AppData\Roaming\Acer GameZone Console
[2011.02.13 20:14:46 | 000,000,000 | R--D | C] -- C:\Users\Timo\Videos
[2011.02.13 20:14:46 | 000,000,000 | R--D | C] -- C:\Users\Timo\Saved Games
[2011.02.13 20:14:46 | 000,000,000 | R--D | C] -- C:\Users\Timo\Pictures
[2011.02.13 20:14:46 | 000,000,000 | R--D | C] -- C:\Users\Timo\Music
[2011.02.13 20:14:46 | 000,000,000 | R--D | C] -- C:\Users\Timo\Links
[2011.02.13 20:14:46 | 000,000,000 | R--D | C] -- C:\Users\Timo\Favorites
[2011.02.13 20:14:46 | 000,000,000 | R--D | C] -- C:\Users\Timo\Downloads
[2011.02.13 20:13:49 | 002,421,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wucltux.dll
[2011.02.13 20:13:49 | 000,044,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups2.dll
[2011.02.13 20:13:36 | 000,575,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapi.dll
[2011.02.13 20:13:36 | 000,087,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wudriver.dll
[2011.02.13 20:13:36 | 000,035,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups.dll
[2011.02.13 20:13:31 | 000,171,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuwebv.dll
[2011.02.13 20:13:31 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapp.exe
[2011.02.13 20:11:58 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen
[2011.02.13 20:11:58 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü
[2011.02.13 20:11:58 | 000,000,000 | -HSD | C] -- C:\Programme
[2011.02.13 20:11:58 | 000,000,000 | -HSD | C] -- C:\Programme\Gemeinsame Dateien
[2011.02.13 20:11:58 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten
[2011.02.13 20:11:58 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos
[2011.02.13 20:11:58 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik
[2011.02.13 20:11:58 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder
[2011.02.13 20:11:58 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen
[2011.02.13 20:11:58 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente
[2011.02.13 20:11:58 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten
[2011.02.13 20:05:26 | 000,324,120 | ---- | C] (Intel Corporation) -- C:\Windows\System32\drivers\iaStor.sys
[2011.02.13 19:04:41 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2008.07.22 09:01:25 | 000,049,152 | ---- | C] ( ) -- C:\Windows\Interop.IWshRuntimeLibrary.dll
 
========== Files - Modified Within 30 Days ==========
 
[2011.02.20 18:51:27 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Timo\Desktop\OTL.exe
[2011.02.20 18:50:18 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.02.20 18:50:18 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.02.20 18:47:20 | 000,012,883 | ---- | M] () -- C:\Windows\System32\Config.MPF
[2011.02.20 14:54:42 | 000,618,430 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.02.20 14:54:42 | 000,587,178 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.02.20 14:54:42 | 000,122,842 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.02.20 14:54:42 | 000,101,250 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.02.20 14:50:41 | 000,000,000 | ---- | M] () -- C:\Windows\System32\LogConfigTemp.xml
[2011.02.20 14:50:17 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.02.20 14:50:03 | 3213,774,848 | -HS- | M] () -- C:\hiberfil.sys
[2011.02.19 21:26:11 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll
[2011.02.19 21:26:11 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2011.02.19 21:26:11 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2011.02.19 21:26:11 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2011.02.19 17:07:58 | 000,512,028 | ---- | M] () -- C:\Users\Timo\Desktop\Minas_Sirion_-_Rulespack_V1.1.3.pdf
[2011.02.17 16:47:03 | 000,000,000 | ---- | M] () -- C:\Users\Timo\defogger_reenable
[2011.02.17 16:36:22 | 000,000,910 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.02.17 16:34:45 | 000,000,737 | ---- | M] () -- C:\Users\Timo\Desktop\NTREGOPT.lnk
[2011.02.17 16:34:45 | 000,000,718 | ---- | M] () -- C:\Users\Timo\Desktop\ERUNT.lnk
[2011.02.16 16:07:05 | 000,001,896 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2011.02.16 13:58:42 | 000,010,837 | ---- | M] () -- C:\Users\Timo\Desktop\Microsoft Office Word-Dokument (neu).docx
[2011.02.16 13:55:49 | 000,029,920 | ---- | M] () -- C:\Users\Timo\Desktop\fehler.jpg
[2011.02.16 13:54:50 | 000,296,448 | ---- | M] () -- C:\Users\Timo\Desktop\g2m3e4r.exe
[2011.02.16 13:54:41 | 000,050,477 | ---- | M] () -- C:\Users\Timo\Desktop\defogger.exe
[2011.02.16 13:51:16 | 000,503,478 | ---- | M] () -- C:\Users\Timo\Desktop\fehler.bmp
[2011.02.15 22:53:08 | 000,008,079 | ---- | M] () -- C:\Users\Timo\Desktop\Microsoft Office Excel-Arbeitsblatt (neu).xlsx
[2011.02.15 19:31:35 | 000,298,112 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.02.14 16:31:05 | 000,003,584 | ---- | M] () -- C:\Users\Timo\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.02.14 16:17:23 | 000,000,056 | -H-- | M] () -- C:\ProgramData\ezsidmv.dat
[2011.02.14 14:48:48 | 000,000,694 | ---- | M] () -- C:\Users\Timo\Desktop\QIP 2005.lnk
[2011.02.14 14:29:19 | 000,001,872 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2011.02.13 21:21:14 | 000,000,000 | ---- | M] () -- C:\Windows\nsreg.dat
[2011.02.13 21:21:04 | 000,001,728 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.02.13 21:19:47 | 000,000,104 | ---- | M] () -- C:\Users\Timo\Desktop\Computer - Verknüpfung.lnk
[2011.02.13 21:04:39 | 000,000,627 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acer VCM.lnk
[2011.02.13 20:53:06 | 000,000,680 | ---- | M] () -- C:\Users\Timo\AppData\Local\d3d9caps.dat
[2011.02.13 20:48:36 | 000,118,784 | ---- | M] () -- C:\Windows\System32\VMC3KAPI.dll
[2011.02.13 20:48:35 | 000,114,688 | ---- | M] (Arachnoid Biometrics Identification Group Corp.) -- C:\Windows\System32\VCryptAPI.dll
[2011.02.13 20:48:24 | 000,023,040 | ---- | M] (Arachnoid Biometrics Identification Group Corp.) -- C:\Windows\System32\ShlCmd.exe
[2011.02.13 20:48:23 | 000,005,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\biologon.dll
[2011.02.13 20:48:11 | 000,042,608 | ---- | M] (Alfa Corporation) -- C:\Windows\System32\drivers\AlfaFF.sys
[2011.02.13 20:48:11 | 000,024,048 | ---- | M] (Arachnoid Biometrics Identification Group Corp.) -- C:\Windows\System32\AlfaFF.dll
[2011.02.13 20:48:10 | 000,338,416 | ---- | M] (Alfa Corporation) -- C:\Windows\System32\DrvCrypt.dll
[2011.02.13 20:48:06 | 001,468,928 | ---- | M] (UPEK, Inc.) -- C:\Windows\System32\bsapi.dll
[2011.02.13 20:47:08 | 000,000,020 | ---- | M] () -- C:\Medion.ini
[2011.02.13 20:34:01 | 000,000,092 | ---- | M] () -- C:\Windows\GridV.UNI
[2011.02.13 20:32:52 | 000,000,083 | ---- | M] () -- C:\Windows\QtZgAcer.UNI
[2011.02.13 20:26:26 | 000,000,807 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\BTTray.lnk
[2011.02.13 20:10:20 | 000,060,826 | ---- | M] () -- C:\Windows\System32\license.rtf
 
========== Files Created - No Company Name ==========
 
[2011.02.19 17:07:49 | 000,512,028 | ---- | C] () -- C:\Users\Timo\Desktop\Minas_Sirion_-_Rulespack_V1.1.3.pdf
[2011.02.17 16:47:03 | 000,000,000 | ---- | C] () -- C:\Users\Timo\defogger_reenable
[2011.02.17 16:34:45 | 000,000,737 | ---- | C] () -- C:\Users\Timo\Desktop\NTREGOPT.lnk
[2011.02.17 16:34:45 | 000,000,718 | ---- | C] () -- C:\Users\Timo\Desktop\ERUNT.lnk
[2011.02.16 16:07:05 | 000,001,896 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2011.02.16 16:07:05 | 000,001,804 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2011.02.16 13:59:11 | 000,000,910 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.02.16 13:58:23 | 000,010,837 | ---- | C] () -- C:\Users\Timo\Desktop\Microsoft Office Word-Dokument (neu).docx
[2011.02.16 13:55:49 | 000,029,920 | ---- | C] () -- C:\Users\Timo\Desktop\fehler.jpg
[2011.02.16 13:54:43 | 000,296,448 | ---- | C] () -- C:\Users\Timo\Desktop\g2m3e4r.exe
[2011.02.16 13:54:40 | 000,050,477 | ---- | C] () -- C:\Users\Timo\Desktop\defogger.exe
[2011.02.16 13:33:26 | 000,503,478 | ---- | C] () -- C:\Users\Timo\Desktop\fehler.bmp
[2011.02.15 22:53:08 | 000,008,079 | ---- | C] () -- C:\Users\Timo\Desktop\Microsoft Office Excel-Arbeitsblatt (neu).xlsx
[2011.02.14 16:31:05 | 000,003,584 | ---- | C] () -- C:\Users\Timo\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.02.14 16:17:23 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011.02.14 14:48:48 | 000,000,694 | ---- | C] () -- C:\Users\Timo\Desktop\QIP 2005.lnk
[2011.02.14 14:41:56 | 002,501,921 | ---- | C] () -- C:\Windows\System32\wlan.tmf
[2011.02.14 14:29:19 | 000,001,872 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
[2011.02.13 21:21:14 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2011.02.13 21:21:04 | 000,001,728 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.02.13 21:19:47 | 000,000,104 | ---- | C] () -- C:\Users\Timo\Desktop\Computer - Verknüpfung.lnk
[2011.02.13 21:05:08 | 036,909,056 | ---- | C] () -- C:\Windows\System32\acer.scr
[2011.02.13 21:04:39 | 000,000,627 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acer VCM.lnk
[2011.02.13 20:49:29 | 000,006,048 | ---- | C] () -- C:\ProgramData\ArcadeDeluxe2.log
[2011.02.13 20:48:36 | 000,118,784 | ---- | C] () -- C:\Windows\System32\VMC3KAPI.dll
[2011.02.13 20:47:08 | 000,000,020 | ---- | C] () -- C:\Medion.ini
[2011.02.13 20:36:24 | 000,000,000 | ---- | C] () -- C:\Windows\System32\LogConfigTemp.xml
[2011.02.13 20:34:01 | 000,000,092 | ---- | C] () -- C:\Windows\GridV.UNI
[2011.02.13 20:32:52 | 000,000,083 | ---- | C] () -- C:\Windows\QtZgAcer.UNI
[2011.02.13 20:28:27 | 000,626,688 | ---- | C] () -- C:\Windows\Image.dll
[2011.02.13 20:28:27 | 000,222,382 | ---- | C] () -- C:\Windows\Acer Crystal Eye webcam.ico
[2011.02.13 20:28:27 | 000,200,704 | ---- | C] () -- C:\Windows\PLFSetI.exe
[2011.02.13 20:28:27 | 000,004,838 | ---- | C] () -- C:\Windows\Suyin.reg
[2011.02.13 20:28:27 | 000,000,036 | ---- | C] () -- C:\Windows\PidList.ini
[2011.02.13 20:26:26 | 000,000,807 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\BTTray.lnk
[2011.02.13 20:20:30 | 000,000,953 | ---- | C] () -- C:\Users\Timo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2011.02.13 20:20:26 | 000,000,948 | ---- | C] () -- C:\Users\Timo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2011.02.13 20:20:18 | 000,000,919 | ---- | C] () -- C:\Users\Timo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk
[2011.02.13 20:14:58 | 000,000,680 | ---- | C] () -- C:\Users\Timo\AppData\Local\d3d9caps.dat
[2011.02.13 20:09:23 | 3213,774,848 | -HS- | C] () -- C:\hiberfil.sys
[2008.07.30 11:19:21 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2008.07.30 03:13:17 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIOFM4.dll
[2008.07.30 03:13:17 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIBUN5.dll
[2008.07.30 02:47:56 | 000,204,800 | ---- | C] () -- C:\Windows\System32\SysHook.dll
[2008.07.30 02:42:04 | 000,487,424 | ---- | C] () -- C:\Windows\System32\INT15.dll
[2008.07.30 02:25:14 | 000,001,694 | ---- | C] () -- C:\Windows\RtDefLvl.ini
[2007.01.26 07:32:18 | 000,069,632 | ---- | C] () -- C:\Windows\System32\drivers\int15.sys
[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2001.12.26 15:12:30 | 000,065,536 | ---- | C] () -- C:\Windows\System32\multiplex_vcd.dll
[2001.11.14 13:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll
[2001.09.03 22:46:38 | 000,110,592 | ---- | C] () -- C:\Windows\System32\Hmpg12.dll
[2001.07.30 15:33:56 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC.dll
[2001.07.23 21:04:36 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC_MMX.dll

< End of report >

cosinus · 20.02.2011, 19:29

Recht unauffällig. Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Timo7760 · 20.02.2011, 23:15

Hi,
Danke nochmal für deine Hilfe. Der CCleaner hat ein bisschen Müll entsorgt, aber sicher nichts wichtiges gefunden, denke mal, das das nur dazu diente, dass Cofi etwas schneller lief.
Hier die Logdatei:

Code:

ATTFilter

ComboFix 11-02-20.01 - Timo 20.02.2011  22:49:11.1.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6001.1.1252.49.1031.18.3066.1522 [GMT 1:00]
ausgeführt von:: c:\users\Timo\Desktop\cofi.exe.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Im Speicher befindliches AV aktiv.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Acer\Acer Bio Protection\PwdFilter.dll

.
(((((((((((((((((((((((   Dateien erstellt von 2011-01-20 bis 2011-02-20  ))))))))))))))))))))))))))))))
.

2011-02-20 21:59 . 2011-02-20 21:59	--------	d-----w-	c:\users\Default\AppData\Local\temp
2011-02-20 21:45 . 2011-02-20 21:45	--------	d-----w-	c:\program files\CCleaner
2011-02-20 21:42 . 2011-02-20 21:47	--------	d-----w-	C:\cofi.exe
2011-02-19 20:26 . 2011-02-19 20:26	--------	d-----w-	c:\program files\Common Files\Java
2011-02-19 20:26 . 2011-02-19 20:26	472808	----a-w-	c:\windows\system32\deployJava1.dll
2011-02-19 20:26 . 2011-02-19 20:26	--------	d-----w-	c:\program files\Java
2011-02-17 15:34 . 2011-02-17 15:34	--------	d-----w-	c:\program files\ERUNT
2011-02-17 14:17 . 2009-11-08 09:55	99176	----a-w-	c:\windows\system32\PresentationHostProxy.dll
2011-02-17 14:17 . 2009-11-08 09:55	49472	----a-w-	c:\windows\system32\netfxperf.dll
2011-02-17 14:17 . 2009-11-08 09:55	297808	----a-w-	c:\windows\system32\mscoree.dll
2011-02-17 14:17 . 2009-11-08 09:55	295264	----a-w-	c:\windows\system32\PresentationHost.exe
2011-02-17 14:17 . 2009-11-08 09:55	1130824	----a-w-	c:\windows\system32\dfshim.dll
2011-02-16 15:06 . 2011-02-16 15:06	--------	d-----w-	c:\program files\Common Files\Adobe
2011-02-16 12:59 . 2010-12-20 17:09	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2011-02-16 12:59 . 2011-02-16 12:59	--------	d-----w-	c:\programdata\Malwarebytes
2011-02-16 12:59 . 2011-02-17 15:36	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2011-02-16 12:59 . 2010-12-20 17:08	20952	----a-w-	c:\windows\system32\drivers\mbam.sys
2011-02-16 12:52 . 2010-09-06 16:24	125952	----a-w-	c:\windows\system32\srvsvc.dll
2011-02-16 12:52 . 2010-09-06 14:13	303616	----a-w-	c:\windows\system32\drivers\srv.sys
2011-02-16 12:52 . 2010-09-06 14:12	145408	----a-w-	c:\windows\system32\drivers\srv2.sys
2011-02-16 12:52 . 2010-09-06 14:12	101888	----a-w-	c:\windows\system32\drivers\srvnet.sys
2011-02-16 12:52 . 2010-09-06 16:23	17920	----a-w-	c:\windows\system32\netevent.dll
2011-02-16 12:52 . 2009-08-24 12:16	378368	----a-w-	c:\windows\system32\winhttp.dll
2011-02-16 12:48 . 2010-05-27 19:16	738816	----a-w-	c:\windows\system32\inetcomm.dll
2011-02-15 17:38 . 2008-04-30 05:36	454656	----a-w-	c:\program files\Common Files\System\msadc\msadce.dll
2011-02-15 16:27 . 2010-02-12 10:48	293376	----a-w-	c:\windows\system32\browserchoice.exe
2011-02-15 16:03 . 2008-06-20 01:14	97800	----a-w-	c:\windows\system32\infocardapi.dll
2011-02-15 16:03 . 2008-06-20 01:14	105016	----a-w-	c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2011-02-15 16:03 . 2008-06-20 01:14	37384	----a-w-	c:\windows\system32\infocardcpl.cpl
2011-02-15 16:03 . 2008-06-20 01:14	11264	----a-w-	c:\windows\system32\icardres.dll
2011-02-15 16:03 . 2008-06-20 01:14	622080	----a-w-	c:\windows\system32\icardagt.exe
2011-02-15 16:03 . 2008-06-20 01:14	781344	----a-w-	c:\windows\system32\PresentationNative_v0300.dll
2011-02-15 15:58 . 2008-07-27 18:03	158720	----a-w-	c:\windows\system32\mscorier.dll
2011-02-15 15:58 . 2008-07-27 18:03	83968	----a-w-	c:\windows\system32\mscories.dll
2011-02-15 15:57 . 2010-02-20 23:39	24064	----a-w-	c:\windows\system32\nshhttp.dll
2011-02-15 15:57 . 2010-02-20 21:18	411136	----a-w-	c:\windows\system32\drivers\http.sys
2011-02-15 15:57 . 2010-02-20 23:37	31232	----a-w-	c:\windows\system32\httpapi.dll
2011-02-15 15:56 . 2011-02-15 15:56	--------	d-----w-	c:\program files\MSXML 4.0
2011-02-14 13:48 . 2011-02-14 13:48	--------	d-----w-	c:\program files\QIP
2011-02-14 13:46 . 2008-06-26 01:45	12240896	----a-w-	c:\windows\system32\NlsLexicons0007.dll
2011-02-14 13:46 . 2008-06-26 01:45	2644480	----a-w-	c:\windows\system32\NlsLexicons0009.dll
2011-02-14 13:43 . 2008-06-23 01:59	996352	----a-w-	c:\windows\system32\WMNetMgr.dll
2011-02-14 13:42 . 2009-08-10 11:01	1399296	----a-w-	c:\windows\system32\msxml6.dll
2011-02-14 13:42 . 2009-09-10 17:30	213504	----a-w-	c:\windows\system32\msv1_0.dll
2011-02-14 13:42 . 2009-03-17 03:38	13824	----a-w-	c:\windows\system32\apilogen.dll
2011-02-14 13:42 . 2009-03-17 03:38	24064	----a-w-	c:\windows\system32\amxread.dll
2011-02-14 13:41 . 2009-07-11 19:32	293376	----a-w-	c:\windows\system32\wlanmsm.dll
2011-02-14 13:41 . 2009-07-11 19:29	127488	----a-w-	c:\windows\system32\L2SecHC.dll
2011-02-14 13:41 . 2009-07-11 19:32	302592	----a-w-	c:\windows\system32\wlansec.dll
2011-02-14 13:41 . 2009-07-11 19:32	513024	----a-w-	c:\windows\system32\wlansvc.dll
2011-02-14 13:41 . 2009-06-04 12:34	2066432	----a-w-	c:\windows\system32\mstscax.dll
2011-02-14 13:41 . 2009-04-23 12:42	636928	----a-w-	c:\windows\system32\localspl.dll
2011-02-14 13:40 . 2009-08-14 16:29	104960	----a-w-	c:\windows\system32\netiohlp.dll
2011-02-14 13:40 . 2009-08-14 14:16	27136	----a-w-	c:\windows\system32\NETSTAT.EXE
2011-02-14 13:40 . 2009-08-14 14:16	19968	----a-w-	c:\windows\system32\ARP.EXE
2011-02-14 13:40 . 2009-08-14 14:16	9728	----a-w-	c:\windows\system32\TCPSVCS.EXE
2011-02-14 13:40 . 2009-08-14 14:16	10240	----a-w-	c:\windows\system32\finger.exe
2011-02-14 13:40 . 2009-08-14 14:16	8704	----a-w-	c:\windows\system32\HOSTNAME.EXE
2011-02-14 13:40 . 2009-08-14 14:16	11264	----a-w-	c:\windows\system32\MRINFO.EXE
2011-02-14 13:40 . 2009-08-14 14:16	17920	----a-w-	c:\windows\system32\ROUTE.EXE
2011-02-14 13:39 . 2008-04-05 01:21	72192	----a-w-	c:\windows\system32\drivers\pacer.sys
2011-02-14 13:39 . 2008-04-05 03:34	15360	----a-w-	c:\windows\system32\pacerprf.dll
2011-02-14 13:38 . 2010-06-28 16:15	1315840	----a-w-	c:\windows\system32\ole32.dll
2011-02-14 13:38 . 2010-06-28 14:31	339968	----a-w-	c:\program files\Windows NT\Accessories\wordpad.exe
2011-02-14 13:38 . 2010-08-26 16:07	157184	----a-w-	c:\windows\system32\t2embed.dll
2011-02-14 13:38 . 2010-01-29 16:22	1616384	----a-w-	c:\program files\Windows Mail\msoe.dll
2011-02-14 13:38 . 2010-10-12 15:48	33280	----a-w-	c:\program files\Windows Mail\wabfind.dll
2011-02-14 13:38 . 2010-10-12 13:52	66048	----a-w-	c:\program files\Windows Mail\wabmig.exe
2011-02-14 13:38 . 2010-10-12 13:52	515584	----a-w-	c:\program files\Windows Mail\wab.exe
2011-02-14 13:37 . 2010-08-10 15:02	274432	----a-w-	c:\windows\system32\schannel.dll
2011-02-14 13:37 . 2010-12-28 14:57	409600	----a-w-	c:\windows\system32\odbc32.dll
2011-02-14 13:37 . 2010-12-28 14:56	708608	----a-w-	c:\program files\Common Files\System\ado\msado15.dll
2011-02-14 13:37 . 2010-12-28 14:56	57344	----a-w-	c:\program files\Common Files\System\msadc\msadcs.dll
2011-02-14 13:37 . 2010-12-28 14:56	253952	----a-w-	c:\program files\Common Files\System\ado\msadox.dll
2011-02-14 13:37 . 2010-12-28 14:56	241664	----a-w-	c:\program files\Common Files\System\ado\msadomd.dll
2011-02-14 13:37 . 2010-12-28 14:56	180224	----a-w-	c:\program files\Common Files\System\msadc\msadco.dll
2011-02-14 13:36 . 2009-07-14 13:00	313344	----a-w-	c:\windows\system32\wmpdxm.dll
2011-02-14 13:36 . 2009-07-14 12:58	7680	----a-w-	c:\windows\system32\spwmp.dll
2011-02-14 13:36 . 2009-07-14 12:59	4096	----a-w-	c:\windows\system32\msdxm.ocx
2011-02-14 13:36 . 2009-07-14 12:59	4096	----a-w-	c:\windows\system32\dxmasf.dll
2011-02-14 13:36 . 2009-07-14 10:59	107520	----a-w-	c:\program files\Windows Media Player\wmpconfig.exe
2011-02-14 13:36 . 2009-07-14 10:58	107520	----a-w-	c:\program files\Windows Media Player\wmpshare.exe
2011-02-14 13:36 . 2009-07-14 08:30	43520	----a-w-	c:\windows\system32\msdxm.tlb
2011-02-14 13:36 . 2009-07-14 08:30	18432	----a-w-	c:\windows\system32\amcompat.tlb
2011-02-14 13:36 . 2010-09-10 16:35	168960	----a-w-	c:\program files\Windows Media Player\wmplayer.exe
2011-02-14 13:36 . 2010-09-10 16:37	8147456	----a-w-	c:\windows\system32\wmploc.DLL
2011-02-14 13:35 . 2009-04-23 12:43	784896	----a-w-	c:\windows\system32\rpcrt4.dll
2011-02-14 13:35 . 2010-10-28 12:56	2048	----a-w-	c:\windows\system32\tzres.dll
2011-02-14 13:33 . 2010-02-23 11:32	212992	----a-w-	c:\windows\system32\drivers\mrxsmb10.sys
2011-02-14 13:30 . 2011-02-14 13:30	--------	d-----w-	c:\program files\ICQ7.2
2011-02-14 13:29 . 2011-02-14 13:29	--------	d-----w-	c:\program files\Skype
2011-02-14 13:29 . 2011-02-14 13:29	--------	d-----w-	c:\program files\Common Files\Skype
2011-02-14 13:28 . 2011-02-14 13:29	--------	d-----w-	c:\programdata\Skype
2011-02-14 13:27 . 2010-08-31 15:40	531968	----a-w-	c:\windows\system32\comctl32.dll
2011-02-14 13:27 . 2011-01-08 05:57	292352	----a-w-	c:\windows\system32\atmfd.dll
2011-02-14 13:27 . 2011-01-08 07:50	34304	----a-w-	c:\windows\system32\atmlib.dll
2011-02-14 13:27 . 2010-06-16 15:12	72704	----a-w-	c:\windows\system32\fontsub.dll
2011-02-14 13:27 . 2009-06-15 15:20	10240	----a-w-	c:\windows\system32\dciman32.dll
2011-02-14 13:26 . 2010-06-16 15:59	898952	----a-w-	c:\windows\system32\drivers\tcpip.sys
2011-02-14 13:26 . 2009-12-28 12:32	31744	----a-w-	c:\windows\system32\msvidc32.dll
2011-02-14 13:26 . 2009-12-28 12:32	22528	----a-w-	c:\windows\system32\msyuv.dll
2011-02-14 13:26 . 2009-12-28 12:32	13312	----a-w-	c:\windows\system32\msrle32.dll
2011-02-14 13:26 . 2009-12-28 12:31	50176	----a-w-	c:\windows\system32\iyuv_32.dll
2011-02-14 13:26 . 2009-12-28 12:35	11776	----a-w-	c:\windows\system32\tsbyuv.dll
2011-02-14 13:26 . 2009-12-28 12:31	82944	----a-w-	c:\windows\system32\mciavi32.dll
2011-02-14 13:26 . 2009-12-28 12:28	91136	----a-w-	c:\windows\system32\avifil32.dll
2011-02-14 13:26 . 2009-12-28 12:32	123904	----a-w-	c:\windows\system32\msvfw32.dll
2011-02-14 13:26 . 2009-12-28 12:28	65024	----a-w-	c:\windows\system32\avicap32.dll
2011-02-14 13:23 . 2008-08-02 01:01	625152	----a-w-	c:\windows\system32\drivers\dxgkrnl.sys
2011-02-14 13:23 . 2008-06-26 03:29	565248	----a-w-	c:\windows\system32\emdmgmt.dll
2011-02-14 13:23 . 2008-06-26 03:29	45056	----a-w-	c:\windows\system32\dataclen.dll
2011-02-14 13:23 . 2008-05-20 02:07	148480	----a-w-	c:\windows\system32\drivers\nwifi.sys
2011-02-14 13:23 . 2008-08-02 03:26	36864	----a-w-	c:\windows\system32\cdd.dll
2011-02-14 13:23 . 2009-04-02 12:37	604672	----a-w-	c:\windows\system32\WMSPDMOD.DLL
2011-02-14 13:22 . 2009-10-07 12:41	244224	----a-w-	c:\windows\system32\rastls.dll
2011-02-14 13:22 . 2009-10-07 12:41	281600	----a-w-	c:\windows\system32\raschap.dll
2011-02-13 20:09 . 2011-02-13 20:10	--------	d-----w-	c:\programdata\NVIDIA
2011-02-13 20:05 . 2008-06-30 15:59	14033923	----a-w-	c:\windows\system32\acer.exe
2011-02-13 20:05 . 2007-04-18 21:02	36909056	----a-w-	c:\windows\system32\acer.scr
2011-02-13 20:05 . 2011-02-13 20:05	--------	d-----w-	c:\windows\ACER
2011-02-13 19:54 . 2008-01-16 17:35	44544	----a-w-	c:\windows\system32\msxml4a.dll
2011-02-13 19:49 . 2011-02-13 19:54	--------	d-----w-	c:\program files\Acer Arcade Deluxe
2011-02-13 19:49 . 2011-02-13 19:51	--------	d-----w-	c:\programdata\CyberLink
2011-02-13 19:48 . 2011-02-13 19:48	118784	----a-w-	c:\windows\system32\VMC3KAPI.dll
2011-02-13 19:48 . 2011-02-13 19:48	114688	----a-w-	c:\windows\system32\VCryptAPI.dll

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}]
2011-02-13 19:16	157168	----a-w-	c:\programdata\Partner\partner.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-05-14 15:05	121392	----a-w-	c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-18 21633320]
"ICQ"="c:\program files\ICQ7.2\ICQ.exe" [2011-02-14 133432]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-07-20 182808]
"RtHDVCpl"="RtHDVCpl.exe" [2008-05-07 6139904]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-25 1049896]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-08-03 582992]
"eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-05-14 526896]
"eAudio"="c:\program files\Acer\Empowering Technology\eAudio\eAudio.exe" [2008-05-30 544768]
"BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-25 28672]
"WarReg_PopUp"="c:\program files\Acer\WR_PopUp\WarReg_PopUp.exe" [2008-01-29 303104]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2011-02-13 30192]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-07-18 13543968]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-07-18 92704]
"PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704]
"LManager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2008-06-04 817672]
"ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-08-01 405504]
"ZPdtWzdVitaKey MC3000"="c:\program files\Acer\Acer Bio Protection\PdtWzd.exe" [2011-02-13 3676160]
"ArcadeDeluxeAgent"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2008-07-24 147456]
"CLMLServer"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2008-07-24 167936]
"PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2008-07-18 167936]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Acer VCM.lnk - c:\program files\Acer\Acer VCM\AcerVCM.exe [2011-2-13 1216512]
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-4-23 727592]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"DisableCAD"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AWinNotifyVitaKey MC3000]
2011-02-13 19:48	3197952	----a-w-	c:\program files\Acer\Acer Bio Protection\WinNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\spba]
2008-03-25 14:24	567560	----a-w-	c:\program files\Common Files\SPBA\homefus2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2011-02-13 30192]
R3 Partner Service;Partner Service;c:\programdata\Partner\partner.exe [2011-02-13 110576]
S0 AlfaFF;AlfaFF File System mini-filter;c:\windows\system32\Drivers\AlfaFF.sys [2011-02-13 42608]
S2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl [2008-07-18 61424]
S2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [2008-03-03 16384]
S2 CLHNService;CLHNService;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [2008-01-16 81504]
S2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [2008-06-02 24576]
S2 IGBASVC;iGroupTec Service;c:\program files\Acer\Acer Bio Protection\BASVC.exe [2011-02-13 3602432]
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\SITEAD~1\mcsacore.exe [2009-12-08 93320]
S2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-04-25 45056]
S2 NTIPPKernel;NTIPPKernel;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys [2008-01-16 122368]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-04-25 131072]
S2 RS_Service;Raw Socket Service;c:\program files\Acer\Acer VCM\RS_Service.exe [2008-01-10 233472]
S3 NETw5v32;Intel(R) Wireless WiFi Link Adaptertreiber für Windows Vista 32-Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2008-05-05 3658752]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2008-06-25 44064]
S3 winbondcir;Winbond IR Transceiver;c:\windows\system32\DRIVERS\winbondcir.sys [2007-03-28 43008]

.
Inhalt des "geplante Tasks" Ordners

2008-07-30 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-07-30 13:10]

2008-07-30 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-07-30 13:10]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=0211&m=aspire_6930g
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=0211&m=aspire_6930g
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
FF - ProfilePath - c:\users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\q7zjq99g.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: McAfee SiteAdvisor: {B7082FAA-CB62-4872-9106-E42DD88EDE45} - c:\program files\McAfee\SiteAdvisor
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

HKLM-Run-eRecoveryService - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-02-20 23:03
Windows 6.0.6001 Service Pack 1 NTFS

Scanne versteckte Prozesse... 

Scanne versteckte Autostarteinträge... 

Scanne versteckte Dateien... 

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'Explorer.exe'(1952)
c:\progra~1\mcafee\SITEAD~1\saHook.dll
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\sysenv.dll
c:\windows\system32\btncopy.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\rundll32.exe
c:\program files\Common Files\SPBA\upeksvr.exe
c:\program files\Acer\Acer Bio Protection\CompPtcVUI.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\progra~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\progra~1\McAfee\VIRUSS~1\mcshield.exe
c:\windows\system32\rundll32.exe
c:\acer\Mobility Center\MobilityService.exe
c:\program files\McAfee\MPF\MPFSrv.exe
c:\program files\McAfee\MSK\MskSrver.exe
c:\program files\Cyberlink\Shared files\RichVideo.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\progra~1\mcafee.com\agent\mcagent.exe
c:\windows\system32\conime.exe
c:\progra~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\progra~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\progra~1\mcafee\msc\mcuimgr.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-02-20  23:06:51 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2011-02-20 22:06

Vor Suchlauf: 9 Verzeichnis(se), 80.410.566.656 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 80.285.765.632 Bytes frei

- - End Of File - - BE8175D737A40EC3BF4C868E252C1F9A

Da werden einige Programme angezeigt, die ich wohl ausschalten werde, z.B. brauche ich weder Bluetooth noch diese bescheuerte Empowering Technology von Acer.

cosinus · 21.02.2011, 11:27

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Das Tool braucht nur wenige Sekunden.
Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

Timo7760 · 21.02.2011, 15:18

Hi,
GMER hat funktioniert.

Code:

ATTFilter

GMER 1.0.15.15530 - hxxp://www.gmer.net
Rootkit quick scan 2011-02-21 14:47:50
Windows 6.0.6001 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.FBEO
Running: ldx1qhgb.exe; Driver: C:\Users\Timo\AppData\Local\Temp\kgtdipog.sys


---- System - GMER 1.0.15 ----

Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)  ZwCreateFile [0x805B998E]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)  ZwCreateProcess [0x805B9928]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)  ZwCreateProcessEx [0x805B993C]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)  ZwMapViewOfSection [0x805B99CC]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)  ZwNotifyChangeKey [0x805B9A0F]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)  ZwOpenProcess [0x805B9900]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)  ZwOpenThread [0x805B9914]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)  ZwProtectVirtualMemory [0x805B99A2]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)  ZwReplaceKey [0x805B9A37]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)  ZwRestoreKey [0x805B9A23]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)  ZwSetContextThread [0x805B997A]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)  ZwSetInformationProcess [0x805B9966]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)  ZwTerminateProcess [0x805B99FB]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)  ZwUnmapViewOfSection [0x805B99E2]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)  ZwYieldExecution [0x805B99B8]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)  ZwCreateUserProcess [0x805B9952]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)  NtCreateFile
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)  NtMapViewOfSection
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)  NtOpenProcess
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)  NtOpenThread
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)  NtSetInformationProcess

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                        mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
AttachedDevice  \Driver\tdx \Device\Ip                                                                        Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice  \Driver\tdx \Device\Tcp                                                                       Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice  \Driver\tdx \Device\Udp                                                                       Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice  \Driver\tdx \Device\RawIp                                                                     Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                       Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                       Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----

Code:

ATTFilter

Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 15:13:10 on 21.02.2011

OS: Windows Vista Home Premium Edition Service Pack 1 (Build 6001), 32-bit
Default Browser: Mozilla Corporation Firefox 3.0.19

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[AppInit DLLs]
-----( HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows )-----
"AppInit_DLLs" - "Google" - C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"AlfaFF File System mini-filter" (AlfaFF) - "Alfa Corporation" - C:\Windows\System32\Drivers\AlfaFF.sys
"catchme" (catchme) - ? - C:\cofi.exe25383c\catchme.sys  (File not found)
"int15" (int15) - ? - C:\Windows\system32\drivers\int15.sys  (File found, but it contains no detailed information)
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"NTIPPKernel" (NTIPPKernel) - "Cyberlink Corp." - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys
"PSDFilter" (PSDFilter) - "Egis Incorporated" - C:\Windows\System32\DRIVERS\psdfilter.sys
"PSDNServ" (PSDNServ) - "Egis Incorporated" - C:\Windows\System32\DRIVERS\PSDNServ.sys
"PSDVdisk" (psdvdisk) - "Egis Incorporated" - C:\Windows\System32\DRIVERS\PSDVdisk.sys
"UBHelper" (UBHelper) - "NewTech Infosystems Corporation" - C:\Windows\system32\drivers\UBHelper.sys
"Upper Class Filter Driver" (NTIDrvr) - "NewTech Infosystems, Inc." - C:\Windows\System32\DRIVERS\NTIDrvr.sys
"{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}" ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796}) - "Cyberlink Corp." - C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)
{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} "DragDropProtect Class" - "Egis Inc." - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
{2b45bd21-71f8-4c8c-a87a-7eeb25a1a3e0} "EPM-PO Shell Extensions" - ? - epm-po.dll  (File not found)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)
{8F9D8FBE-C5C1-4B65-986E-51235C9283E8} "FPLaunchCache" - "Arachnoid Biometrics Identification Group Corp." - C:\Program Files\Acer\Acer Bio Protection\FPLaunchCache.dll
{00020d75-0000-0000-c000-000000000046} "lnkfile" - ? -   (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{7842554E-6BED-11D2-8CDB-B05550C10000} "Monitor Class" - "Broadcom Corporation." - C:\Windows\system32\btncopy.dll
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll

[Internet Explorer]
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_24.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"@btrez.dll,-4015" - ? - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
"Quick-Launching Area" - ? - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "&Google" - "Google Germany GmbH" - c:\program files\google\googletoolbar1.dll
<binary data> "Acer eDataSecurity Management" - "Egis Incorporated." - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Germany GmbH" - c:\program files\google\googletoolbar1.dll
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Program Files\Google\GoogleToolbarNotifier\3.1.415.1646\swg.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} "Partner BHO Class" - "Google Inc." - C:\ProgramData\Partner\partner.dll
{83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} "ShowBarObj Class" - "Egis" - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
{02478D38-C3F9-4efb-9B51-7695ECA05670} "{02478D38-C3F9-4efb-9B51-7695ECA05670}" - ? -   (File not found | COM-object registry key not found)

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Timo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"Acer VCM.lnk" - "Acer Incorporated" - C:\Program Files\Acer\Acer VCM\AcerVCM.exe  (Shortcut exists | File exists)
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"BTTray.lnk" - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe  (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"ICQ" - "ICQ, LLC." - "C:\Program Files\ICQ7.2\ICQ.exe" silent loginmode=4
"Skype" - "Skype Technologies S.A." - "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
"ArcadeDeluxeAgent" - "CyberLink Corp." - "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe"
"BkupTray" - ? - "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe"
"CLMLServer" - "CyberLink" - "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe"
"eAudio" - "Acer Incorporated" - "C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe"
"eDataSecurity Loader" - "Egis Incorporated" - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
"ePower_DMC" - "Acer Inc." - C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
"Google Desktop Search" - "Google" - "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
"IAAnotif" - "Intel Corporation" - C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
"LManager" - "Dritek System Inc." - C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
"PlayMovie" - "Acer Corp." - "C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe"
"PLFSetI" - ? - C:\Windows\PLFSetI.exe
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
"WarReg_PopUp" - "Acer Incorporated" - C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe
"ZPdtWzdVitaKey MC3000" - "Arachnoid Biometrics Identification Group Corp." - "C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe" show

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Bluetooth Service" (btwdins) - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
"CLHNService" (CLHNService) - ? - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files\Cyberlink\Shared files\RichVideo.exe
"eDataSecurity Service" (eDataSecurity Service) - "Egis Incorporated" - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
"Empowering Technology Service" (ETService) - ? - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
"Google Desktop Manager 5.9.1005.12335" (GoogleDesktopManager-051210-111108) - "Google" - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
"Google Updater Service" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
"iGroupTec Service" (IGBASVC) - ? - C:\Program Files\Acer\Acer Bio Protection\BASVC.exe  (File found, but it contains no detailed information)
"Intel(R) Matrix Storage Event Monitor" (IAANTMON) - "Intel Corporation" - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
"LightScribeService Direct Disc Labeling Service" (LightScribeService) - "Hewlett-Packard Company" - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"MobilityService" (MobilityService) - ? - C:\Acer\Mobility Center\MobilityService.exe
"NTI Backup Now 5 Agent Service" (BUNAgentSvc) - "NewTech Infosystems, Inc." - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
"NTI Backup Now 5 Backup Service" (NTIBackupSvc) - "NewTech InfoSystems, Inc." - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
"NTI Backup Now 5 Scheduler Service" (NTISchedulerSvc) - ? - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe  (File found, but it contains no detailed information)
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"Partner Service" (Partner Service) - "Google Inc." - C:\ProgramData\Partner\partner.exe
"Raw Socket Service" (RS_Service) - "Acer Incorporated" - C:\Program Files\Acer\Acer VCM\RS_Service.exe

[Winlogon]
-----( HKCU\Control Panel\Desktop )-----
"SCRNSAVE.EXE" - ? - C:\Windows\System32\acer.scr  (File found, but it contains no detailed information)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"AWinNotifyVitaKey MC3000" - "Arachnoid Biometrics Identification Group Corp." - C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll
"spba" - "UPEK Inc." - C:\Program Files\Common Files\SPBA\homefus2.dll

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Code:

ATTFilter

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:			
Windows Version:		Windows Vista Home Premium Edition
Windows Information:		Service Pack 1 (build 6001), 32-bit
Base Board Manufacturer:	Acer, Inc.
BIOS Manufacturer:		Acer
System Manufacturer:		Acer, inc.
System Product Name:		Aspire 6930G
Logical Drives Mask:		0x0000003c

Kernel Drivers (total 156):
  0x81E11000 \SystemRoot\system32\ntkrnlpa.exe
  0x821CA000 \SystemRoot\system32\hal.dll
  0x8040A000 \SystemRoot\system32\kdcom.dll
  0x80412000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
  0x80472000 \SystemRoot\system32\PSHED.dll
  0x80483000 \SystemRoot\system32\BOOTVID.dll
  0x8048B000 \SystemRoot\system32\CLFS.SYS
  0x804CC000 \SystemRoot\system32\CI.dll
  0x80601000 \SystemRoot\system32\drivers\Wdf01000.sys
  0x8067D000 \SystemRoot\system32\drivers\WDFLDR.SYS
  0x8068A000 \SystemRoot\system32\drivers\acpi.sys
  0x806D0000 \SystemRoot\system32\drivers\WMILIB.SYS
  0x806D9000 \SystemRoot\system32\drivers\msisadrv.sys
  0x806E1000 \SystemRoot\system32\drivers\pci.sys
  0x80708000 \SystemRoot\System32\drivers\partmgr.sys
  0x80717000 \SystemRoot\system32\DRIVERS\compbatt.sys
  0x8071A000 \SystemRoot\system32\DRIVERS\BATTC.SYS
  0x80724000 \SystemRoot\system32\drivers\volmgr.sys
  0x80733000 \SystemRoot\System32\drivers\volmgrx.sys
  0x8077D000 \SystemRoot\System32\drivers\mountmgr.sys
  0x8078D000 \SystemRoot\System32\Drivers\UBHelper.sys
  0x89C03000 \SystemRoot\system32\DRIVERS\iaStor.sys
  0x89CDC000 \SystemRoot\system32\drivers\atapi.sys
  0x89CE4000 \SystemRoot\system32\drivers\ataport.SYS
  0x89D02000 \SystemRoot\system32\drivers\fltmgr.sys
  0x89D34000 \SystemRoot\system32\drivers\fileinfo.sys
  0x89D44000 \SystemRoot\system32\DRIVERS\psdfilter.sys
  0x89D4D000 \SystemRoot\system32\Drivers\AlfaFF.sys
  0x89D56000 \SystemRoot\system32\Drivers\ksecdd.sys
  0x89E0B000 \SystemRoot\system32\drivers\ndis.sys
  0x89F16000 \SystemRoot\system32\drivers\msrpc.sys
  0x89F41000 \SystemRoot\system32\drivers\NETIO.SYS
  0x8A00B000 \SystemRoot\System32\Drivers\Ntfs.sys
  0x8A11A000 \SystemRoot\system32\drivers\volsnap.sys
  0x8A153000 \SystemRoot\System32\Drivers\spldr.sys
  0x8A15B000 \SystemRoot\System32\Drivers\mup.sys
  0x8A16A000 \SystemRoot\System32\drivers\ecache.sys
  0x8A191000 \SystemRoot\system32\drivers\disk.sys
  0x8A1A2000 \SystemRoot\system32\drivers\CLASSPNP.SYS
  0x8A1C3000 \SystemRoot\system32\drivers\crcdisk.sys
  0x8DAE7000 \SystemRoot\system32\DRIVERS\tunnel.sys
  0x8DAF2000 \SystemRoot\system32\DRIVERS\tunmp.sys
  0x8DAFB000 \SystemRoot\system32\DRIVERS\CmBatt.sys
  0x8DAFF000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
  0x8DC03000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
  0x8E336000 \SystemRoot\System32\drivers\dxgkrnl.sys
  0x8E3D5000 \SystemRoot\System32\drivers\watchdog.sys
  0x8E3E2000 \SystemRoot\system32\DRIVERS\usbuhci.sys
  0x8DB08000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0x8E3ED000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0x8DB46000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
  0x8E40F000 \SystemRoot\system32\DRIVERS\NETw5v32.sys
  0x8E796000 \SystemRoot\system32\DRIVERS\L1E60x86.sys
  0x8E7A6000 \SystemRoot\system32\DRIVERS\winbondcir.sys
  0x8E7BB000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0x8E7CE000 \SystemRoot\system32\DRIVERS\DKbFltr.sys
  0x8E7D8000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0x8DB58000 \SystemRoot\system32\DRIVERS\SynTP.sys
  0x8E7E3000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0x8E7E5000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0x8DB88000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0x8E7F0000 \SystemRoot\system32\DRIVERS\NTIDrvr.sys
  0x8E400000 \SystemRoot\system32\DRIVERS\intelppm.sys
  0x8DBA0000 \SystemRoot\system32\DRIVERS\msiscsi.sys
  0x89F7B000 \SystemRoot\system32\DRIVERS\storport.sys
  0x8DBCE000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0x8DBD9000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
  0x8DBF0000 \SystemRoot\system32\DRIVERS\ndistapi.sys
  0x8A1D9000 \SystemRoot\system32\DRIVERS\ndiswan.sys
  0x89FBC000 \SystemRoot\system32\DRIVERS\raspppoe.sys
  0x89FCB000 \SystemRoot\system32\DRIVERS\raspptp.sys
  0x89FDF000 \SystemRoot\system32\DRIVERS\rassstp.sys
  0x89DC7000 \SystemRoot\system32\DRIVERS\termdd.sys
  0x8E7F8000 \SystemRoot\system32\DRIVERS\swenum.sys
  0x80795000 \SystemRoot\system32\DRIVERS\ks.sys
  0x8DA00000 \SystemRoot\system32\DRIVERS\circlass.sys
  0x8A000000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0x89DD7000 \SystemRoot\system32\DRIVERS\umbus.sys
  0x807BF000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0x89DE4000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0x8E80B000 \SystemRoot\system32\drivers\RTKVHDA.sys
  0x8EA13000 \SystemRoot\system32\drivers\portcls.sys
  0x8EA40000 \SystemRoot\system32\drivers\drmk.sys
  0x8EA65000 \SystemRoot\system32\DRIVERS\HSXHWAZL.sys
  0x8EAA2000 \SystemRoot\system32\DRIVERS\HSX_DPV.sys
  0x8EC0F000 \SystemRoot\system32\DRIVERS\HSX_CNXT.sys
  0x8ECC4000 \SystemRoot\system32\drivers\modem.sys
  0x8ECD1000 \SystemRoot\system32\drivers\nvhda32v.sys
  0x8ECDF000 \SystemRoot\system32\DRIVERS\hidir.sys
  0x8ECEA000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
  0x8ECFA000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0x8ED01000 \SystemRoot\system32\DRIVERS\kbdhid.sys
  0x8ED0A000 \SystemRoot\system32\DRIVERS\mouhid.sys
  0x8ED12000 \SystemRoot\system32\drivers\RTSTOR.SYS
  0x8ED25000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0x8ED2E000 \SystemRoot\System32\Drivers\Null.SYS
  0x8ED35000 \SystemRoot\System32\Drivers\Beep.SYS
  0x8ED3C000 \SystemRoot\System32\drivers\vga.sys
  0x8ED48000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
  0x8ED69000 \SystemRoot\system32\DRIVERS\hidusb.sys
  0x8ED72000 \SystemRoot\System32\Drivers\tcusb.sys
  0x8ED7D000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0x8ED85000 \SystemRoot\system32\drivers\rdpencdd.sys
  0x8ED8D000 \SystemRoot\System32\Drivers\Msfs.SYS
  0x8ED98000 \SystemRoot\System32\Drivers\Npfs.SYS
  0x8EDA6000 \SystemRoot\System32\DRIVERS\rasacd.sys
  0x9080C000 \SystemRoot\System32\drivers\tcpip.sys
  0x908F5000 \SystemRoot\System32\drivers\fwpkclnt.sys
  0x90910000 \SystemRoot\system32\DRIVERS\usbccgp.sys
  0x90927000 \SystemRoot\system32\DRIVERS\tdx.sys
  0x9093D000 \SystemRoot\system32\DRIVERS\smb.sys
  0x90951000 \SystemRoot\system32\drivers\afd.sys
  0x90999000 \SystemRoot\System32\Drivers\usbvideo.sys
  0x909BA000 \SystemRoot\System32\DRIVERS\netbt.sys
  0x8EDAF000 \SystemRoot\system32\DRIVERS\pacer.sys
  0x909EC000 \SystemRoot\system32\DRIVERS\netbios.sys
  0x8EDC5000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0x8EBA4000 \SystemRoot\system32\DRIVERS\rdbss.sys
  0x90800000 \SystemRoot\system32\drivers\nsiproxy.sys
  0x8EDD8000 \SystemRoot\System32\Drivers\dfsc.sys
  0x8DA0E000 \SystemRoot\system32\DRIVERS\udfs.sys
  0x8EDEF000 \SystemRoot\System32\Drivers\crashdmp.sys
  0x92400000 \SystemRoot\System32\Drivers\dump_iaStor.sys
  0x95820000 \SystemRoot\System32\win32k.sys
  0x924D9000 \SystemRoot\System32\drivers\Dxapi.sys
  0x924E3000 \SystemRoot\system32\DRIVERS\monitor.sys
  0x95A40000 \SystemRoot\System32\TSDDD.dll
  0x924F2000 \SystemRoot\system32\drivers\luafv.sys
  0x95A60000 \SystemRoot\System32\cdd.dll
  0x9250D000 \SystemRoot\system32\drivers\spsys.sys
  0x925BC000 \SystemRoot\system32\DRIVERS\ipfltdrv.sys
  0x925CE000 \SystemRoot\system32\DRIVERS\lltdio.sys
  0x8DA49000 \SystemRoot\system32\DRIVERS\nwifi.sys
  0x925DE000 \SystemRoot\system32\DRIVERS\ndisuio.sys
  0x925E8000 \SystemRoot\system32\DRIVERS\rspndr.sys
  0x8DA73000 \SystemRoot\system32\drivers\HTTP.sys
  0x8EBE0000 \SystemRoot\System32\DRIVERS\srvnet.sys
  0x805AC000 \SystemRoot\system32\DRIVERS\bowser.sys
  0x805C5000 \SystemRoot\System32\drivers\mpsdrv.sys
  0x805DA000 \SystemRoot\system32\drivers\mrxdav.sys
  0x9DA00000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0x9DA1F000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
  0x9DA58000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
  0x9DA70000 \SystemRoot\System32\DRIVERS\srv2.sys
  0x9DA98000 \SystemRoot\System32\DRIVERS\srv.sys
  0x9DAE6000 \??\C:\Windows\system32\drivers\int15.sys
  0x9DAF7000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
  0x9DAFB000 \??\C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys
  0x9DB19000 \SystemRoot\system32\drivers\peauth.sys
  0x9DBF7000 \SystemRoot\system32\DRIVERS\PSDNServ.sys
  0xA3C03000 \SystemRoot\system32\DRIVERS\PSDVdisk.sys
  0xA3C15000 \SystemRoot\System32\Drivers\secdrv.SYS
  0xA3C1F000 \SystemRoot\System32\drivers\tcpipreg.sys
  0xA3C2B000 \SystemRoot\system32\DRIVERS\xaudio.sys
  0xA3C33000 \??\C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl
  0x77C50000 \Windows\System32\ntdll.dll

Processes (total 85):
       0 System Idle Process
       4 System
     532 C:\Windows\System32\smss.exe
     600 csrss.exe
     652 C:\Windows\System32\wininit.exe
     664 csrss.exe
     696 C:\Windows\System32\services.exe
     708 C:\Windows\System32\lsass.exe
     716 C:\Windows\System32\lsm.exe
     880 C:\Windows\System32\svchost.exe
     928 C:\Windows\System32\nvvsvc.exe
     956 C:\Windows\System32\svchost.exe
     988 C:\Windows\System32\svchost.exe
    1048 C:\Windows\System32\svchost.exe
    1076 C:\Windows\System32\svchost.exe
    1092 C:\Windows\System32\svchost.exe
    1164 C:\Windows\System32\audiodg.exe
    1192 C:\Windows\System32\SLsvc.exe
    1224 C:\Windows\System32\svchost.exe
    1368 C:\Windows\System32\winlogon.exe
    1432 C:\Windows\System32\svchost.exe
    1636 C:\Windows\System32\spoolsv.exe
    1660 C:\Windows\System32\svchost.exe
    1904 C:\Windows\System32\rundll32.exe
    1980 C:\Program Files\Common Files\SPBA\upeksvr.exe
     560 C:\Program Files\Acer\Acer Bio Protection\CompPtcVUI.exe
    2036 C:\Windows\System32\taskeng.exe
     480 C:\Windows\System32\dwm.exe
    2020 C:\Windows\explorer.exe
    2128 C:\Windows\System32\taskeng.exe
    2244 C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    2252 C:\Windows\RtHDVCpl.exe
    2260 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    2292 C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
    2328 C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe
    2372 C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
    2416 C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
    2476 C:\Windows\System32\rundll32.exe
    2484 C:\Windows\PLFSetI.exe
    2632 C:\Users\Timo\AppData\Local\temp\RtkBtMnt.exe
    2832 C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    2844 C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
    2856 C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
    2876 C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
    2892 C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
    3096 C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
    3120 C:\Program Files\Acer\Acer Bio Protection\BASVC.exe
    3204 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    3216 C:\ACER\Mobility Center\MobilityService.exe
    3276 C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
    3348 C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
    3376 C:\Windows\System32\svchost.exe
    3428 C:\Program Files\Cyberlink\Shared files\RichVideo.exe
    3456 C:\Program Files\Acer\Acer VCM\RS_Service.exe
    3504 C:\Windows\System32\svchost.exe
    3552 C:\Windows\System32\svchost.exe
    3580 C:\Windows\System32\SearchIndexer.exe
    3652 C:\Windows\System32\drivers\XAudio.exe
    4028 WmiPrvSE.exe
    1824 C:\Program Files\Launch Manager\QtZgAcer.EXE
    2524 C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
    1480 WmiPrvSE.exe
    2716 C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe
    2780 C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
    2188 C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
    2200 C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
    2672 C:\Program Files\Common Files\Java\Java Update\jusched.exe
    1464 C:\Program Files\Skype\Phone\Skype.exe
    2032 C:\Windows\System32\wbem\unsecapp.exe
    2392 C:\Program Files\ICQ7.2\ICQ.exe
    3568 C:\Program Files\Acer\Acer VCM\AcerVCM.exe
    3688 C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    2696 C:\Program Files\Skype\Plugin Manager\skypePM.exe
    3888 C:\Program Files\Acer\Acer VCM\acp2HID.exe
    4912 C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    5776 C:\Program Files\Mozilla Firefox\firefox.exe
    5796 C:\Program Files\WinRAR\WinRAR.exe
    4436 C:\Windows\servicing\TrustedInstaller.exe
    4884 C:\Windows\System32\wuauclt.exe
    4176 C:\Windows\System32\SearchProtocolHost.exe
    5852 C:\Windows\System32\SearchFilterHost.exe
    3868 dllhost.exe
     888 dllhost.exe
    3988 C:\Users\Timo\Downloads\MBRCheck.exe
    5848 C:\Windows\System32\conime.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000002`80100000  (NTFS)
\\.\D: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00  (NTFS)
\\.\E: --> \\.\PhysicalDrive0 at offset 0x0000001e`5c500000  (NTFS)

PhysicalDrive0 Model Number: HitachiHTS543225L9A300, Rev: FBEOC40C
PhysicalDrive1 Model Number: ST9250827AS, Rev: 3.AAA   

      Size  Device Name          MBR Status
  --------------------------------------------
    232 GB  \\.\PhysicalDrive0   Unknown MBR code
            SHA1: 1BD01CAC429595C1D0CBBF8C10C0B8BA957B5116
    232 GB  \\.\PhysicalDrive1   Unknown MBR code
            SHA1: B8E2175818464D3FFEB1C1B647995AD0F49BFDB5


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

cosinus · 21.02.2011, 15:38

Zitat:

Service Pack 1 (build 6001), 32-bit

Wieso ist eigentlich nur das SP1 drauf? Das SP2 gibt es schon so lange...

Zitat:

232 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: 1BD01CAC429595C1D0CBBF8C10C0B8BA957B5116
232 GB \\.\PhysicalDrive1 Unknown MBR code
SHA1: B8E2175818464D3FFEB1C1B647995AD0F49BFDB5

Wegen der unbekannten MBRs mal bitte dieses Tool von Kaspersky ausführen => http://www.trojaner-board.de/82358-t...entfernen.html

Timo7760 · 21.02.2011, 15:58

Oh, das Service Pack hab ich noch nicht neu draufgeladen... mach ich jetzt aber erstmal.
Hier das vom TDSS, nach Beenden des Scans hat er "no found" angezeigt.

Code:

ATTFilter

2011/02/21 15:48:07.0544 5700	TDSS rootkit removing tool 2.4.18.0 Feb 21 2011 11:08:08
2011/02/21 15:48:08.0049 5700	================================================================================
2011/02/21 15:48:08.0049 5700	SystemInfo:
2011/02/21 15:48:08.0049 5700	
2011/02/21 15:48:08.0049 5700	OS Version: 6.0.6001 ServicePack: 1.0
2011/02/21 15:48:08.0049 5700	Product type: Workstation
2011/02/21 15:48:08.0049 5700	ComputerName: TIMO-PC
2011/02/21 15:48:08.0050 5700	UserName: Timo
2011/02/21 15:48:08.0050 5700	Windows directory: C:\Windows
2011/02/21 15:48:08.0050 5700	System windows directory: C:\Windows
2011/02/21 15:48:08.0050 5700	Processor architecture: Intel x86
2011/02/21 15:48:08.0050 5700	Number of processors: 2
2011/02/21 15:48:08.0050 5700	Page size: 0x1000
2011/02/21 15:48:08.0050 5700	Boot type: Normal boot
2011/02/21 15:48:08.0050 5700	================================================================================
2011/02/21 15:48:08.0676 5700	Initialize success
2011/02/21 15:48:11.0938 5768	================================================================================
2011/02/21 15:48:11.0938 5768	Scan started
2011/02/21 15:48:11.0938 5768	Mode: Manual; 
2011/02/21 15:48:11.0938 5768	================================================================================
2011/02/21 15:48:13.0307 5768	ACPI            (fcb8c7210f0135e24c6580f7f649c73c) C:\Windows\system32\drivers\acpi.sys
2011/02/21 15:48:14.0249 5768	adp94xx         (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys
2011/02/21 15:48:15.0096 5768	adpahci         (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys
2011/02/21 15:48:15.0890 5768	adpu160m        (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys
2011/02/21 15:48:16.0623 5768	adpu320         (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys
2011/02/21 15:48:17.0447 5768	AFD             (763e172a55177e478cb419f88fd0ba03) C:\Windows\system32\drivers\afd.sys
2011/02/21 15:48:18.0126 5768	agp440          (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys
2011/02/21 15:48:18.0898 5768	aic78xx         (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2011/02/21 15:48:19.0522 5768	AlfaFF          (4490b8bdf38750458eb9b24835fda8fe) C:\Windows\system32\Drivers\AlfaFF.sys
2011/02/21 15:48:20.0171 5768	aliide          (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys
2011/02/21 15:48:20.0684 5768	amdagp          (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys
2011/02/21 15:48:21.0294 5768	amdide          (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys
2011/02/21 15:48:21.0717 5768	AmdK7           (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys
2011/02/21 15:48:22.0106 5768	AmdK8           (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys
2011/02/21 15:48:22.0541 5768	arc             (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys
2011/02/21 15:48:22.0975 5768	arcsas          (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys
2011/02/21 15:48:23.0397 5768	AsyncMac        (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/02/21 15:48:23.0809 5768	atapi           (2d9c903dc76a66813d350a562de40ed9) C:\Windows\system32\drivers\atapi.sys
2011/02/21 15:48:24.0277 5768	Beep            (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
2011/02/21 15:48:24.0722 5768	blbdrive        (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys
2011/02/21 15:48:25.0147 5768	bowser          (74b442b2be1260b7588c136177ceac66) C:\Windows\system32\DRIVERS\bowser.sys
2011/02/21 15:48:25.0592 5768	BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2011/02/21 15:48:26.0314 5768	BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2011/02/21 15:48:26.0961 5768	Brserid         (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2011/02/21 15:48:27.0551 5768	BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2011/02/21 15:48:28.0150 5768	BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2011/02/21 15:48:29.0084 5768	BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2011/02/21 15:48:29.0662 5768	BTHMODEM        (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
2011/02/21 15:48:30.0463 5768	cdfs            (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
2011/02/21 15:48:31.0197 5768	cdrom           (1ec25cea0de6ac4718bf89f9e1778b57) C:\Windows\system32\DRIVERS\cdrom.sys
2011/02/21 15:48:31.0831 5768	circlass        (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\DRIVERS\circlass.sys
2011/02/21 15:48:32.0241 5768	CLFS            (465745561c832b29f7c48b488aab3842) C:\Windows\system32\CLFS.sys
2011/02/21 15:48:32.0888 5768	CmBatt          (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/02/21 15:48:33.0328 5768	cmdide          (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys
2011/02/21 15:48:33.0900 5768	Compbatt        (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
2011/02/21 15:48:34.0371 5768	crcdisk         (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys
2011/02/21 15:48:35.0235 5768	Crusoe          (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys
2011/02/21 15:48:36.0006 5768	DfsC            (9e635ae5e8ad93e2b5989e2e23679f97) C:\Windows\system32\Drivers\dfsc.sys
2011/02/21 15:48:36.0896 5768	disk            (64109e623abd6955c8fb110b592e68b7) C:\Windows\system32\drivers\disk.sys
2011/02/21 15:48:37.0677 5768	DKbFltr         (73baf270d24fe726b9cd7f80bb17a23d) C:\Windows\system32\DRIVERS\DKbFltr.sys
2011/02/21 15:48:38.0298 5768	drmkaud         (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
2011/02/21 15:48:39.0075 5768	DXGKrnl         (85f33880b8cfb554bd3d9ccdb486845a) C:\Windows\System32\drivers\dxgkrnl.sys
2011/02/21 15:48:40.0011 5768	E1G60           (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys
2011/02/21 15:48:40.0714 5768	Ecache          (dd2cd259d83d8b72c02c5f2331ff9d68) C:\Windows\system32\drivers\ecache.sys
2011/02/21 15:48:41.0586 5768	elxstor         (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys
2011/02/21 15:48:42.0495 5768	ErrDev          (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys
2011/02/21 15:48:43.0065 5768	exfat           (0d858eb20589a34efb25695acaa6aa2d) C:\Windows\system32\drivers\exfat.sys
2011/02/21 15:48:43.0568 5768	fastfat         (3c489390c2e2064563727752af8eab9e) C:\Windows\system32\drivers\fastfat.sys
2011/02/21 15:48:44.0012 5768	fdc             (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys
2011/02/21 15:48:44.0469 5768	FileInfo        (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
2011/02/21 15:48:45.0002 5768	Filetrace       (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
2011/02/21 15:48:45.0458 5768	flpydisk        (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/02/21 15:48:45.0983 5768	FltMgr          (05ea53afe985443011e36dab07343b46) C:\Windows\system32\drivers\fltmgr.sys
2011/02/21 15:48:46.0516 5768	Fs_Rec          (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
2011/02/21 15:48:47.0140 5768	gagp30kx        (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys
2011/02/21 15:48:48.0028 5768	HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
2011/02/21 15:48:48.0936 5768	HDAudBus        (c87b1ee051c0464491c1a7b03fa0bc99) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/02/21 15:48:49.0617 5768	HidBth          (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
2011/02/21 15:48:50.0565 5768	HidIr           (d8df3722d5e961baa1292aa2f12827e2) C:\Windows\system32\DRIVERS\hidir.sys
2011/02/21 15:48:51.0764 5768	HidUsb          (854ca287ab7faf949617a788306d967e) C:\Windows\system32\DRIVERS\hidusb.sys
2011/02/21 15:48:52.0655 5768	HpCISSs         (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys
2011/02/21 15:48:53.0355 5768	HSFHWAZL        (46d67209550973257601a533e2ac5785) C:\Windows\system32\DRIVERS\VSTAZL3.SYS
2011/02/21 15:48:54.0015 5768	HSF_DPV         (fadd7095163cb3cb4073793ebb50fe75) C:\Windows\system32\DRIVERS\HSX_DPV.sys
2011/02/21 15:48:54.0683 5768	HSXHWAZL        (058783bedd17615d1fece09f77960436) C:\Windows\system32\DRIVERS\HSXHWAZL.sys
2011/02/21 15:48:55.0292 5768	HTTP            (96e241624c71211a79c84f50a8e71cab) C:\Windows\system32\drivers\HTTP.sys
2011/02/21 15:48:56.0126 5768	i2omp           (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys
2011/02/21 15:48:56.0660 5768	i8042prt        (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/02/21 15:48:57.0426 5768	iaStor          (707c1692214b1c290271067197f075f6) C:\Windows\system32\DRIVERS\iaStor.sys
2011/02/21 15:48:58.0225 5768	iaStorV         (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys
2011/02/21 15:48:58.0936 5768	iirsp           (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2011/02/21 15:48:59.0628 5768	int15           (4d8d5b1c895ea0f2a721b98a7ce198f1) C:\Windows\system32\drivers\int15.sys
2011/02/21 15:49:00.0567 5768	IntcAzAudAddService (219ca9a36d6de2ec04f958c907673436) C:\Windows\system32\drivers\RTKVHDA.sys
2011/02/21 15:49:01.0302 5768	intelide        (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
2011/02/21 15:49:01.0981 5768	intelppm        (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
2011/02/21 15:49:02.0616 5768	IpFilterDriver  (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/02/21 15:49:04.0095 5768	IPMIDRV         (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys
2011/02/21 15:49:04.0697 5768	IPNAT           (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
2011/02/21 15:49:05.0309 5768	IRENUM          (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
2011/02/21 15:49:06.0208 5768	isapnp          (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys
2011/02/21 15:49:07.0130 5768	iScsiPrt        (f247eec28317f6c739c16de420097301) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/02/21 15:49:08.0158 5768	iteatapi        (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2011/02/21 15:49:09.0077 5768	iteraid         (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2011/02/21 15:49:10.0012 5768	kbdclass        (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/02/21 15:49:10.0640 5768	kbdhid          (18247836959ba67e3511b62846b9c2e0) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/02/21 15:49:11.0424 5768	KSecDD          (7a0cf7908b6824d6a2a1d313e5ae3dca) C:\Windows\system32\Drivers\ksecdd.sys
2011/02/21 15:49:11.0933 5768	L1E             (86d7f66ac2c0123ed81b2f3e835845c2) C:\Windows\system32\DRIVERS\L1E60x86.sys
2011/02/21 15:49:12.0433 5768	lltdio          (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
2011/02/21 15:49:12.0979 5768	LSI_FC          (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys
2011/02/21 15:49:13.0414 5768	LSI_SAS         (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys
2011/02/21 15:49:13.0971 5768	LSI_SCSI        (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys
2011/02/21 15:49:14.0585 5768	luafv           (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
2011/02/21 15:49:15.0072 5768	mdmxsdk         (0cea2d0d3fa284b85ed5b68365114f76) C:\Windows\system32\DRIVERS\mdmxsdk.sys
2011/02/21 15:49:15.0754 5768	megasas         (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys
2011/02/21 15:49:16.0650 5768	MegaSR          (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys
2011/02/21 15:49:17.0585 5768	Modem           (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
2011/02/21 15:49:18.0319 5768	monitor         (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
2011/02/21 15:49:19.0286 5768	mouclass        (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
2011/02/21 15:49:20.0121 5768	mouhid          (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
2011/02/21 15:49:20.0645 5768	MountMgr        (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
2011/02/21 15:49:21.0448 5768	mpio            (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys
2011/02/21 15:49:22.0060 5768	mpsdrv          (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
2011/02/21 15:49:22.0771 5768	Mraid35x        (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2011/02/21 15:49:23.0485 5768	MRxDAV          (ae3de84536b6799d2267443cec8edbb9) C:\Windows\system32\drivers\mrxdav.sys
2011/02/21 15:49:24.0099 5768	mrxsmb          (7afc42e60432fd1014f5342f2b1b1f74) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/02/21 15:49:25.0179 5768	mrxsmb10        (8a75752ae17924f65452746674b14b78) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/02/21 15:49:26.0042 5768	mrxsmb20        (f4d0f3252e651f02be64984ffa738394) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/02/21 15:49:27.0013 5768	msahci          (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32\drivers\msahci.sys
2011/02/21 15:49:27.0937 5768	msdsm           (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys
2011/02/21 15:49:28.0726 5768	Msfs            (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
2011/02/21 15:49:29.0538 5768	msisadrv        (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
2011/02/21 15:49:30.0351 5768	MSKSSRV         (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
2011/02/21 15:49:31.0040 5768	MSPCLOCK        (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/02/21 15:49:31.0773 5768	MSPQM           (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
2011/02/21 15:49:32.0587 5768	MsRPC           (b5614aecb05a9340aa0fb55bf561cc63) C:\Windows\system32\drivers\MsRPC.sys
2011/02/21 15:49:33.0330 5768	mssmbios        (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/02/21 15:49:34.0231 5768	MSTEE           (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
2011/02/21 15:49:34.0874 5768	Mup             (6dfd1d322de55b0b7db7d21b90bec49c) C:\Windows\system32\Drivers\mup.sys
2011/02/21 15:49:35.0599 5768	NativeWifiP     (3c21ce48ff529bb73dadb98770b54025) C:\Windows\system32\DRIVERS\nwifi.sys
2011/02/21 15:49:36.0255 5768	NDIS            (9bdc71790fa08f0a0b5f10462b1bd0b1) C:\Windows\system32\drivers\ndis.sys
2011/02/21 15:49:37.0052 5768	NdisTapi        (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/02/21 15:49:37.0664 5768	Ndisuio         (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/02/21 15:49:38.0332 5768	NdisWan         (3d14c3b3496f88890d431e8aa022a411) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/02/21 15:49:38.0988 5768	NDProxy         (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
2011/02/21 15:49:39.0678 5768	NetBIOS         (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
2011/02/21 15:49:40.0371 5768	netbt           (7c5fee5b1c5728507cd96fb4a13e7a02) C:\Windows\system32\DRIVERS\netbt.sys
2011/02/21 15:49:41.0305 5768	NETw5v32        (e559ea9138c77b5d1fda8c558764a25f) C:\Windows\system32\DRIVERS\NETw5v32.sys
2011/02/21 15:49:42.0174 5768	nfrd960         (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
2011/02/21 15:49:43.0009 5768	Npfs            (ecb5003f484f9ed6c608d6d6c7886cbb) C:\Windows\system32\drivers\Npfs.sys
2011/02/21 15:49:43.0830 5768	nsiproxy        (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
2011/02/21 15:49:44.0396 5768	Ntfs            (b4effe29eb4f15538fd8a9681108492d) C:\Windows\system32\drivers\Ntfs.sys
2011/02/21 15:49:44.0949 5768	NTIDrvr         (2757d2ba59aee155209e24942ab127c9) C:\Windows\system32\DRIVERS\NTIDrvr.sys
2011/02/21 15:49:45.0263 5768	NTIPPKernel     (547bfa3591c70674b0bfc99354ab78b3) C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys
2011/02/21 15:49:46.0138 5768	ntrigdigi       (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
2011/02/21 15:49:46.0582 5768	Null            (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
2011/02/21 15:49:47.0102 5768	NVHDA           (2c7ac27710e8d41c1eb7d1599187d237) C:\Windows\system32\drivers\nvhda32v.sys
2011/02/21 15:49:47.0740 5768	nvlddmkm        (cb0d6f8f65b8766ff2aaaa78881fd9f8) C:\Windows\system32\DRIVERS\nvlddmkm.sys
2011/02/21 15:49:48.0195 5768	nvraid          (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys
2011/02/21 15:49:48.0641 5768	nvstor          (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys
2011/02/21 15:49:49.0175 5768	nv_agp          (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys
2011/02/21 15:49:50.0578 5768	ohci1394        (be32da025a0be1878f0ee8d6d9386cd5) C:\Windows\system32\drivers\ohci1394.sys
2011/02/21 15:49:51.0325 5768	Parport         (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
2011/02/21 15:49:52.0147 5768	partmgr         (3b38467e7c3daed009dfe359e17f139f) C:\Windows\system32\drivers\partmgr.sys
2011/02/21 15:49:52.0847 5768	Parvdm          (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
2011/02/21 15:49:53.0556 5768	pci             (01b94418deb235dff777cc80076354b4) C:\Windows\system32\drivers\pci.sys
2011/02/21 15:49:54.0241 5768	pciide          (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys
2011/02/21 15:49:55.0044 5768	pcmcia          (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
2011/02/21 15:49:55.0727 5768	PEAUTH          (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2011/02/21 15:49:56.0484 5768	PptpMiniport    (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
2011/02/21 15:49:57.0137 5768	Processor       (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys
2011/02/21 15:49:57.0962 5768	PSched          (bfef604508a0ed1eae2a73e872555ffb) C:\Windows\system32\DRIVERS\pacer.sys
2011/02/21 15:49:58.0461 5768	PSDFilter       (1dcbb35090cc4b2bd3d661e6089523c6) C:\Windows\system32\DRIVERS\psdfilter.sys
2011/02/21 15:49:59.0167 5768	PSDNServ        (e26e46d619469964ac3609620f443867) C:\Windows\system32\DRIVERS\PSDNServ.sys
2011/02/21 15:49:59.0828 5768	psdvdisk        (3e1d134af2806867d06047c4cc33cc65) C:\Windows\system32\DRIVERS\PSDVdisk.sys
2011/02/21 15:50:00.0618 5768	ql2300          (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys
2011/02/21 15:50:01.0436 5768	ql40xx          (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2011/02/21 15:50:02.0170 5768	QWAVEdrv        (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
2011/02/21 15:50:02.0803 5768	RasAcd          (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
2011/02/21 15:50:03.0583 5768	Rasl2tp         (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/02/21 15:50:04.0282 5768	RasPppoe        (3e9d9b048107b40d87b97df2e48e0744) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/02/21 15:50:05.0173 5768	RasSstp         (a7d141684e9500ac928a772ed8e6b671) C:\Windows\system32\DRIVERS\rassstp.sys
2011/02/21 15:50:05.0766 5768	rdbss           (6e1c5d0457622f9ee35f683110e93d14) C:\Windows\system32\DRIVERS\rdbss.sys
2011/02/21 15:50:06.0420 5768	RDPCDD          (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/02/21 15:50:06.0949 5768	rdpdr           (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys
2011/02/21 15:50:07.0748 5768	RDPENCDD        (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
2011/02/21 15:50:08.0374 5768	RDPWD           (e1c18f4097a5abcec941dc4b2f99db7e) C:\Windows\system32\drivers\RDPWD.sys
2011/02/21 15:50:09.0298 5768	rspndr          (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
2011/02/21 15:50:09.0766 5768	RTSTOR          (7a4f79df3793160b280cde152b61fe33) C:\Windows\system32\drivers\RTSTOR.SYS
2011/02/21 15:50:10.0200 5768	sbp2port        (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2011/02/21 15:50:10.0680 5768	secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2011/02/21 15:50:11.0147 5768	Serenum         (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
2011/02/21 15:50:11.0648 5768	Serial          (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
2011/02/21 15:50:12.0092 5768	sermouse        (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
2011/02/21 15:50:12.0648 5768	sffdisk         (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\drivers\sffdisk.sys
2011/02/21 15:50:13.0348 5768	sffp_mmc        (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys
2011/02/21 15:50:14.0071 5768	sffp_sd         (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\drivers\sffp_sd.sys
2011/02/21 15:50:14.0682 5768	sfloppy         (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
2011/02/21 15:50:15.0638 5768	sisagp          (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys
2011/02/21 15:50:16.0217 5768	SiSRaid2        (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys
2011/02/21 15:50:16.0853 5768	SiSRaid4        (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys
2011/02/21 15:50:17.0554 5768	Smb             (031e6bcd53c9b2b9ace111eafec347b6) C:\Windows\system32\DRIVERS\smb.sys
2011/02/21 15:50:18.0262 5768	spldr           (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
2011/02/21 15:50:19.0013 5768	srv             (5754e8bae40943871d0ab9becbf335e8) C:\Windows\system32\DRIVERS\srv.sys
2011/02/21 15:50:19.0667 5768	srv2            (d47b09ff7d28ee44d728f57c2d1fab86) C:\Windows\system32\DRIVERS\srv2.sys
2011/02/21 15:50:20.0574 5768	srvnet          (32d52290341a740881521e118106acd6) C:\Windows\system32\DRIVERS\srvnet.sys
2011/02/21 15:50:21.0197 5768	swenum          (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
2011/02/21 15:50:21.0842 5768	Symc8xx         (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2011/02/21 15:50:22.0520 5768	Sym_hi          (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2011/02/21 15:50:23.0321 5768	Sym_u3          (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2011/02/21 15:50:23.0982 5768	SynTP           (4c9bb4b3b9eac26211484c30b914c6dc) C:\Windows\system32\DRIVERS\SynTP.sys
2011/02/21 15:50:24.0665 5768	Tcpip           (782568ab6a43160a159b6215b70bcce9) C:\Windows\system32\drivers\tcpip.sys
2011/02/21 15:50:25.0565 5768	Tcpip6          (782568ab6a43160a159b6215b70bcce9) C:\Windows\system32\DRIVERS\tcpip.sys
2011/02/21 15:50:26.0406 5768	tcpipreg        (d4a2e4a4b011f3a883af77315a5ae76b) C:\Windows\system32\drivers\tcpipreg.sys
2011/02/21 15:50:27.0216 5768	TcUsb           (72b9e77565da5fa564581976e000d29b) C:\Windows\system32\Drivers\tcusb.sys
2011/02/21 15:50:27.0962 5768	TDPIPE          (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
2011/02/21 15:50:28.0851 5768	TDTCP           (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
2011/02/21 15:50:29.0575 5768	tdx             (d09276b1fab033ce1d40dcbdf303d10f) C:\Windows\system32\DRIVERS\tdx.sys
2011/02/21 15:50:30.0164 5768	TermDD          (a048056f5e1a96a9bf3071b91741a5aa) C:\Windows\system32\DRIVERS\termdd.sys
2011/02/21 15:50:30.0853 5768	tssecsrv        (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/02/21 15:50:31.0498 5768	tunmp           (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
2011/02/21 15:50:32.0309 5768	tunnel          (119b8184e106baedc83fce5ddf3950da) C:\Windows\system32\DRIVERS\tunnel.sys
2011/02/21 15:50:32.0999 5768	uagp35          (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys
2011/02/21 15:50:33.0866 5768	UBHelper        (f763e070843ee2803de1395002b42938) C:\Windows\system32\drivers\UBHelper.sys
2011/02/21 15:50:34.0570 5768	udfs            (8b5088058fa1d1cd897a2113ccff6c58) C:\Windows\system32\DRIVERS\udfs.sys
2011/02/21 15:50:35.0316 5768	uliagpkx        (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys
2011/02/21 15:50:36.0000 5768	uliahci         (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys
2011/02/21 15:50:36.0565 5768	UlSata          (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2011/02/21 15:50:37.0212 5768	ulsata2         (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2011/02/21 15:50:37.0989 5768	umbus           (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
2011/02/21 15:50:38.0508 5768	usbccgp         (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/02/21 15:50:39.0031 5768	usbcir          (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
2011/02/21 15:50:39.0476 5768	usbehci         (cebe90821810e76320155beba722fcf9) C:\Windows\system32\DRIVERS\usbehci.sys
2011/02/21 15:50:40.0046 5768	usbhub          (cc6b28e4ce39951357963119ce47b143) C:\Windows\system32\DRIVERS\usbhub.sys
2011/02/21 15:50:40.0478 5768	usbohci         (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys
2011/02/21 15:50:40.0926 5768	usbprint        (b51e52acf758be00ef3a58ea452fe360) C:\Windows\system32\drivers\usbprint.sys
2011/02/21 15:50:41.0416 5768	USBSTOR         (87ba6b83c5d19b69160968d07d6e2982) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/02/21 15:50:41.0894 5768	usbuhci         (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/02/21 15:50:42.0525 5768	usbvideo        (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys
2011/02/21 15:50:43.0254 5768	vga             (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/02/21 15:50:44.0020 5768	VgaSave         (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
2011/02/21 15:50:44.0588 5768	viaagp          (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys
2011/02/21 15:50:45.0366 5768	ViaC7           (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys
2011/02/21 15:50:46.0089 5768	viaide          (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys
2011/02/21 15:50:47.0069 5768	volmgr          (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
2011/02/21 15:50:47.0729 5768	volmgrx         (98f5ffe6316bd74e9e2c97206c190196) C:\Windows\system32\drivers\volmgrx.sys
2011/02/21 15:50:48.0378 5768	volsnap         (d8b4a53dd2769f226b3eb374374987c9) C:\Windows\system32\drivers\volsnap.sys
2011/02/21 15:50:49.0046 5768	vsmraid         (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys
2011/02/21 15:50:49.0650 5768	WacomPen        (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2011/02/21 15:50:50.0462 5768	Wanarp          (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/02/21 15:50:50.0485 5768	Wanarpv6        (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/02/21 15:50:51.0096 5768	Wd              (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys
2011/02/21 15:50:51.0771 5768	Wdf01000        (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
2011/02/21 15:50:52.0439 5768	winachsf        (bb9cbaf6ac20452b245c324f1f50ee81) C:\Windows\system32\DRIVERS\HSX_CNXT.sys
2011/02/21 15:50:53.0137 5768	winbondcir      (3fa87d56769838aac82fafc3e78fc732) C:\Windows\system32\DRIVERS\winbondcir.sys
2011/02/21 15:50:53.0626 5768	WmiAcpi         (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys
2011/02/21 15:50:54.0337 5768	ws2ifsl         (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
2011/02/21 15:50:55.0053 5768	WUDFRd          (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/02/21 15:50:55.0813 5768	XAudio          (dab33cfa9dd24251aaa389ff36b64d4b) C:\Windows\system32\DRIVERS\xaudio.sys
2011/02/21 15:50:56.0067 5768	{49DE1C67-83F8-4102-99E0-C16DCC7EEC796} (4d840c6af3c020ed3a35efba9025cf4a) C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl
2011/02/21 15:50:56.0373 5768	================================================================================
2011/02/21 15:50:56.0373 5768	Scan finished
2011/02/21 15:50:56.0373 5768	================================================================================
2011/02/21 15:55:25.0913 5124	Deinitialize success

cosinus · 21.02.2011, 16:19

mach das mit dem SP2 bitte später!!

Mach erst zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Timo7760 · 21.02.2011, 22:30

Hi,
SP2 hab ich runtergeladen, aber noch nicht installiert.

Code:

ATTFilter

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 5830

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

21.02.2011 19:42:34
mbam-log-2011-02-21 (19-42-34).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Durchsuchte Objekte: 406520
Laufzeit: 1 Stunde(n), 46 Minute(n), 35 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Das zweite von dir empfohlene Programm hat zuerst nur eine einzelne Bedrohung erkannt, und dann irgendwo auf Partition D 416 auf einmal. Hoffe du kannst mit dem Log mehr anfangen als ich, ich habs aus Gründen der Privatsphäre etwas gekürzt. Sollte es wirklich wichtig sein, hab ich die notfalls auch noch.

Code:

ATTFilter

SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 02/21/2011 at 10:22 PM

Application Version : 4.49.1000

Core Rules Database Version : 6442
Trace Rules Database Version: 4254

Scan type       : Complete Scan
Total Scan Time : 02:28:58

Memory items scanned      : 795
Memory threats detected   : 0
Registry items scanned    : 8736
Registry threats detected : 0
File items scanned        : 269191
File threats detected     : 417

Adware.Tracking Cookie
C:\Users\Timo\AppData\Roaming\Microsoft\Windows\Cookies\timo@atwola[1].txt
	 [ D:\Users\Timo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\LC3F5RBP ]
	ds.serving-sys.com [ D:\Users\Timo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\LC3F5RBP ]
	media.scanscout.com [ D:\Users\Timo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\LC3F5RBP ]
	media01.kyte.tv [ D:\Users\Timo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\LC3F5RBP ]
	media1.break.com [ D:\Users\Timo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\LC3F5RBP ]
	objects.tremormedia.com [ D:\Users\Timo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\LC3F5RBP ]
	static. [ D:\Users\Timo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\LC3F5RBP ]
	track.webgains.com [ D:\Users\Timo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\LC3F5RBP ]
[ D:\Users\Timo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\LC3F5RBP ]
----------------------------------------------
VON MIR EDITIERT
----------------------------------------------
	D:\Users\Timo\AppData\Roaming\Microsoft\Windows\Cookies\timo@zbox.zanox[2].txt
	.apmebf.com [ D:\Users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\zpb2jizb.default\cookies.sqlite ]
	.mediaplex.com [ D:\Users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\zpb2jizb.default\cookies.sqlite ]
	.mediaplex.com [ D:\Users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\zpb2jizb.default\cookies.sqlite ]
	ad.yieldmanager.com [ D:\Users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\zpb2jizb.default\cookies.sqlite ]
	ad.yieldmanager.com [ D:\Users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\zpb2jizb.default\cookies.sqlite ]
	.statcounter.com [ D:\Users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\zpb2jizb.default\cookies.sqlite ]
	.adfarm1.adition.com [ D:\Users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\zpb2jizb.default\cookies.sqlite ]
	.atdmt.com [ D:\Users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\zpb2jizb.default\cookies.sqlite ]
	.atdmt.com [ D:\Users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\zpb2jizb.default\cookies.sqlite ]
	.doubleclick.net [ D:\Users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\zpb2jizb.default\cookies.sqlite ]
	.tradedoubler.com [ D:\Users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\zpb2jizb.default\cookies.sqlite ]
	.tradedoubler.com [ D:\Users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\zpb2jizb.default\cookies.sqlite ]
	.webmasterplan.com [ D:\Users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\zpb2jizb.default\cookies.sqlite ]
	.traffictrack.de [ D:\Users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\zpb2jizb.default\cookies.sqlite ]
	.traffictrack.de [ D:\Users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\zpb2jizb.default\cookies.sqlite ]
	.tto2.traffictrack.de [ D:\Users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\zpb2jizb.default\cookies.sqlite ]
	.zanox-affiliate.de [ D:\Users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\zpb2jizb.default\cookies.sqlite ]
	.tracking.mindshare.de [ D:\Users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\zpb2jizb.default\cookies.sqlite ]
	tracking.mindshare.de [ D:\Users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\zpb2jizb.default\cookies.sqlite ]
	.komtrack.com [ D:\Users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\zpb2jizb.default\cookies.sqlite ]
	.komtrack.com [ D:\Users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\zpb2jizb.default\cookies.sqlite ]
	ipcounter.de [ D:\Users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\zpb2jizb.default\cookies.sqlite ]
	.adfarm1.adition.com [ D:\Users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\zpb2jizb.default\cookies.sqlite ]
	.partypoker.com [ D:\Users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\zpb2jizb.default\cookies.sqlite ]
	.partypoker.com [ D:\Users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\zpb2jizb.default\cookies.sqlite ]
	.atwola.com [ D:\Users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\zpb2jizb.default\cookies.sqlite ]
	.webmasterplan.com [ D:\Users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\zpb2jizb.default\cookies.sqlite ]
	.webmasterplan.com [ D:\Users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\zpb2jizb.default\cookies.sqlite ]
	ad.yieldmanager.com [ D:\Users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\zpb2jizb.default\cookies.sqlite ]
	ad.yieldmanager.com [ D:\Users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\zpb2jizb.default\cookies.sqlite ]
	de.sitestat.com [ D:\Users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\zpb2jizb.default\cookies.sqlite ]

Hab jetzt mit der Funktion des Programms alle Bedrohungen entfernt, ich lasse jetzt erstmal SP2 laufen und dann seh ich weiter.
Danke nochmal,
mfG
Timo

cosinus · 22.02.2011, 08:46

Sieht ok aus, da wurden nur Cookies gefunden.
Noch Probleme oder weitere Funde in der Zwischenzeit?

Timo7760 · 22.02.2011, 17:10

SP2 ist jetzt drauf.
Bis jetzt hab ich nichts besonderes gefunden, allerdings ist mein PC immer noch lahm- mein freier physikalischer Speicher beträgt nur 20 MB.

cosinus · 22.02.2011, 19:25

Vista belegt den Speicher sehr stark, um andere Vorgänge zu beschleunigen. Beachte mal => http://www.trojaner-board.de/71631-p...samer-tun.html

Timo7760 · 23.02.2011, 11:58

Hi,
hab die Liste einmal abgearbeitet, geändert hat sich aber noch nichts.
Ein Schritt hat nämlich nicht funktioniert, das was man direkt nach Auschalten des Windows Defenders unter Dienste machen muss:

Zitat:

* Nachdem der Dienst deaktiviert und gestoppt wurde:

Start -> Ausführen -> gpedit.msc : Verwaltung der Gruppenrichtlinien

* Weiternavigieren wir zu

Administrative Vorlagen / Windows-Komponenten / Windows Defender

und dort im rechten Teilfenster die standardmäßige Vorgabe der Richtlinie von "Windows Defender deaktivieren" von "deaktiviert" auf "Aktiviert" stellen.

Mein PC verkündet mir dann, dass gpedit.msc nicht gefunden werden konnte und ich nachsehen soll, ob das richtig geschrieben wurde. Hab schon gpedit und ähnliche Schreibweisen versucht, klappt aber nicht.

Hier nochmal 3 Bilder aus meinem Taskmanager, markiert sind die Dienste, die zu dem größten svchost Prozess gehören (der mit 100.000k).

cosinus · 23.02.2011, 12:15

Vllt hillft das hier noch => Windows Vista - Optimierung der Speicherverwaltung

Anwendung auf EIGENE GEFAHR!!

21.02.2011, 16:19	#24
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	svchost.exe lastet meinen Speicher aus mach das mit dem SP2 bitte später!! Mach erst zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs. Denk dran beide Tools zu updaten vor dem Scan!! __________________ Logfiles bitte immer in CODE-Tags posten

22.02.2011, 08:46	#26
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	svchost.exe lastet meinen Speicher aus Sieht ok aus, da wurden nur Cookies gefunden. Noch Probleme oder weitere Funde in der Zwischenzeit? __________________ Logfiles bitte immer in CODE-Tags posten

22.02.2011, 19:25	#28
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	svchost.exe lastet meinen Speicher aus Vista belegt den Speicher sehr stark, um andere Vorgänge zu beschleunigen. Beachte mal => http://www.trojaner-board.de/71631-p...samer-tun.html __________________ Logfiles bitte immer in CODE-Tags posten

23.02.2011, 12:15	#30
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	svchost.exe lastet meinen Speicher aus Vllt hillft das hier noch => Windows Vista - Optimierung der Speicherverwaltung Anwendung auf EIGENE GEFAHR!! __________________ Logfiles bitte immer in CODE-Tags posten

svchost.exe lastet meinen Speicher aus

Log-Analyse und Auswertung: svchost.exe lastet meinen Speicher aus