Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Befall mit TR/Crypt.XPACK.Gen und TR/Crypt.XPACK.Gen3 (https://www.trojaner-board.de/90949-befall-tr-crypt-xpack-gen-tr-crypt-xpack-gen3.html)

Fnyrri 20.09.2010 08:10
Befall mit TR/Crypt.XPACK.Gen und TR/Crypt.XPACK.Gen3
 
Hi,

als Schock zum Montagmorgen präsentierte AntiVir mir direkt nach dem Hochfahren (sechzehnmal gleichzeitig) die Meldung, dass
C:\Windows\System32\lnksmsdt.dll
das Trojanische Pferd TR/Crypt.XPACK.Gen sei:

hxxp://250kb.de/JxcMbbI

Update: Während des Scans durch 'Malwarebytes Anti-Malware' reichte AntiVir noch die Information nach, dass
C:\Users\Acer\AppData\local\osmskbdi.dll und
C:\Users\AppData\Local\Temp\mdQX.exe
das Trojanische Pferd TR/Crypt.XPACK.Gen3 (ja, jetzt mit 3) sind:

hxxp://250kb.de/FZNdTK8

Jetzt bin ich ein wenig verzweifelt :/
Hier die Ergebnisse der in den FAQ empfohlenen Suchläufe:

MAM:

Code:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4655

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

20.09.2010 08:51:11
mbam-log-2010-09-20 (08-51-11).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 141729
Laufzeit: 12 Minute(n), 25 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 2
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 2

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dcuvuxe (Trojan.Hiloti) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yhuyi (Trojan.Agent.U) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Users\ACER\AppData\Local\osmskbdi.dll (Trojan.Hiloti) -> Quarantined and deleted successfully.
C:\Users\ACER\AppData\Local\Temp\mdQX.exe (Trojan.Hiloti) -> Quarantined and deleted successfully.
OTL.Txt:
Code:
OTL logfile created on: 20.09.2010 08:59:07 - Run 1
OTL by OldTimer - Version 3.2.14.0    Folder = C:\Users\ACER\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 54,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 76,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 144,04 Gb Total Space | 63,58 Gb Free Space | 44,14% Space Free | Partition Type: NTFS
Drive D: | 144,04 Gb Total Space | 143,95 Gb Free Space | 99,93% Space Free | Partition Type: NTFS
Drive E: | 988,78 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive F: | 465,65 Gb Total Space | 403,60 Gb Free Space | 86,68% Space Free | Partition Type: FAT32
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: ACER-PC
Current User Name: ACER
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\ACER\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Programme\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
PRC - C:\Programme\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
PRC - C:\Programme\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
PRC - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Samsung\Samsung New PC Studio\NPSAgent.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Windows\System32\FsUsbExService.Exe (Teruten)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Users\ACER\AppData\Local\Temp\RtkBtMnt.exe (Realtek Semiconductor Corp.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Programme\Launch Manager\QtZgAcer.EXE (Dritek System Inc.)
PRC - C:\Programme\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe (CyberLink)
PRC - C:\Programme\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.)
PRC - C:\Programme\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Programme\Acer\Empowering Technology\ePower\ePower_DMC.exe (Acer Inc.)
PRC - C:\Programme\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe ()
PRC - C:\Programme\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe (NewTech InfoSystems, Inc.)
PRC - C:\Programme\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe ()
PRC - C:\Programme\Pinnacle\Shared Files\Programs\StrmServer\StrmServer.exe (Avid Development GmbH)
PRC - C:\Programme\Acer\Empowering Technology\Service\ETService.exe ()
PRC - C:\Windows\System32\agrsmsvc.exe (Agere Systems)
PRC - C:\Programme\Acer\Empowering Technology\eAudio\eAudio.exe (Acer Incorporated)
PRC - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe (Egis Incorporated)
PRC - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe (Egis Incorporated)
PRC - C:\Programme\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe (NewTech Infosystems, Inc.)
PRC - c:\Programme\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
PRC - C:\Programme\Common Files\microsoft shared\ink\InputPersonalization.exe (Microsoft Corporation)
PRC - C:\Programme\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe ()
PRC - C:\Programme\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
PRC - C:\ACER\Mobility Center\MobilityService.exe ()
PRC - C:\Programme\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
PRC - C:\Programme\McAfee\MSK\msksrver.exe (McAfee, Inc.)
PRC - c:\Programme\McAfee\MSC\mcuimgr.exe (McAfee, Inc.)
PRC - C:\Windows\PLFSetI.exe ()
PRC - c:\Programme\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
PRC - C:\Programme\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Programme\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
PRC - C:\Programme\McAfee\MPF\MpfSrv.exe (McAfee, Inc.)
PRC - C:\Programme\Lexmark 2300 Series\ezprint.exe (Lexmark International Inc.)
PRC - C:\Programme\Lexmark 2300 Series\lxcgmon.exe (Lexmark International, Inc.)
PRC - C:\Windows\System32\lxcgcoms.exe ( )
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\ACER\Desktop\OTL.exe (OldTimer Tools)
MOD - c:\Programme\McAfee\SiteAdvisor\sahook.dll (McAfee, Inc.)
MOD - C:\Windows\System32\SysHook.dll ()
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (McAfee SiteAdvisor Service) -- C:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
SRV - (Hamachi2Svc) -- C:\Program Files\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (FsUsbExService) -- C:\Windows\System32\FsUsbExService.Exe (Teruten)
SRV - (IAANTMON) Intel(R) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (ServiceLayer) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (NTIBackupSvc) -- C:\Programme\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe (NewTech InfoSystems, Inc.)
SRV - (NTISchedulerSvc) -- C:\Programme\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe ()
SRV - (ETService) -- C:\Programme\Acer\Empowering Technology\Service\ETService.exe ()
SRV - (AgereModemAudio) -- C:\Windows\System32\agrsmsvc.exe (Agere Systems)
SRV - (eDataSecurity Service) -- C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe (Egis Incorporated)
SRV - (BUNAgentSvc) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe (NewTech Infosystems, Inc.)
SRV - (McNASvc) -- c:\Programme\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (CLHNService) -- C:\Programme\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe ()
SRV - (mcmscsvc) -- C:\Programme\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
SRV - (MobilityService) -- C:\Acer\Mobility Center\MobilityService.exe ()
SRV - (McSysmon) -- C:\Programme\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
SRV - (MSK80Service) -- C:\Program Files\McAfee\MSK\MskSrver.exe (McAfee, Inc.)
SRV - (McODS) -- C:\Programme\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (McProxy) -- c:\Programme\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
SRV - (McShield) -- C:\Programme\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
SRV - (MpfService) -- C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.)
SRV - (lxcg_device) -- C:\Windows\System32\lxcgcoms.exe ( )
 
 
========== Driver Services (SafeList) ==========
 
DRV - (NwlnkFwd) -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (hamachi) -- C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (FsUsbExDisk) -- C:\Windows\System32\FsUsbExDisk.Sys ()
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (ss_bmdm) -- C:\Windows\System32\drivers\ss_bmdm.sys (MCCI Corporation)
DRV - (ss_bbus) SAMSUNG USB Mobile Device (WDM) -- C:\Windows\System32\drivers\ss_bbus.sys (MCCI)
DRV - (ss_bmdfl) SAMSUNG USB Mobile Modem (Filter) -- C:\Windows\System32\drivers\ss_bmdfl.sys (MCCI Corporation)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (NVHDA) -- C:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation)
DRV - (iaStor) -- C:\Windows\system32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (DKbFltr) -- C:\Windows\System32\drivers\DKbFltr.sys (Dritek System Inc.)
DRV - (mod7700) -- C:\Windows\System32\drivers\dvb7700all.sys (DiBcom)
DRV - ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796}) -- C:\Programme\Acer Arcade Deluxe\PlayMovie\000.fcl (Cyberlink Corp.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (NETw5v32) Intel(R) -- C:\Windows\System32\drivers\NETw5v32.sys (Intel Corporation)
DRV - (JMCR) -- C:\Windows\System32\drivers\jmcr.sys (JMicron Technology Corp.)
DRV - (A310) -- C:\Windows\System32\drivers\AVerA310USB.sys (AVerMedia TECHNOLOGIES, Inc.)
DRV - (BDASwCap) -- C:\Windows\System32\drivers\AVerA310Cap.sys (AVerMedia TECHNOLOGIES, Inc.)
DRV - (b57nd60x) -- C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)
DRV - (int15) -- C:\Windows\System32\drivers\int15.sys (Acer, Inc.)
DRV - (psdvdisk) -- C:\Windows\System32\drivers\PSDVdisk.sys (Egis Incorporated)
DRV - (PSDNServ) -- C:\Windows\System32\drivers\PSDNServ.sys (Egis Incorporated)
DRV - (PSDFilter) -- C:\Windows\system32\DRIVERS\psdfilter.sys (Egis Incorporated)
DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (NTIDrvr) -- C:\Windows\System32\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV - (UBHelper) -- C:\Windows\System32\drivers\UBHelper.sys (NewTech Infosystems Corporation)
DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (SynTP) -- C:\Windows\System32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (NTIPPKernel) -- C:\Programme\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys (Cyberlink Corp.)
DRV - (mfesmfk) -- C:\Windows\System32\drivers\mfesmfk.sys (McAfee, Inc.)
DRV - (mfehidk) -- C:\Windows\System32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfeavfk) -- C:\Windows\System32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfebopk) -- C:\Windows\System32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (mferkdk) -- C:\Windows\System32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (pccsmcfd) -- C:\Windows\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (MPFP) -- C:\Windows\System32\drivers\Mpfp.sys (McAfee, Inc.)
DRV - (winbondcir) -- C:\Windows\System32\drivers\winbondcir.sys (Winbond Electronics Corporation)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=1108&m=aspire_7730g
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=1108&m=aspire_7730g
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=1108&m=aspire_7730g
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://global.acer.com [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.2
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:1.1.10
FF - prefs.js..extensions.enabledItems: {35106bca-6c78-48c7-ac28-56df30b51d2a}:1.3.8
FF - prefs.js..extensions.enabledItems: {D3C23E26-C072-418C-8C69-320979274A33}:1.9.1
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q="
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010.07.22 23:29:03 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2009.07.27 15:04:28 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{D3C23E26-C072-418C-8C69-320979274A33}: C:\Users\ACER\AppData\Local\{D3C23E26-C072-418C-8C69-320979274A33} [2010.09.13 17:03:37 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.09.17 04:21:04 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.09.17 04:21:04 | 000,000,000 | ---D | M]
 
[2009.01.02 21:32:25 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\mozilla\Extensions
[2010.09.19 19:30:05 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\mozilla\Firefox\Profiles\wzcb5rou.default\extensions
[2010.02.21 18:31:25 | 000,000,000 | ---D | M] (Linkification) -- C:\Users\ACER\AppData\Roaming\mozilla\Firefox\Profiles\wzcb5rou.default\extensions\{35106bca-6c78-48c7-ac28-56df30b51d2a}
[2010.06.30 15:04:37 | 000,000,000 | ---D | M] (Fast Video Download (with SearchMenu)) -- C:\Users\ACER\AppData\Roaming\mozilla\Firefox\Profiles\wzcb5rou.default\extensions\{c50ca3c4-5656-43c2-a061-13e717f73fc8}
[2010.08.18 21:50:51 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\ACER\AppData\Roaming\mozilla\Firefox\Profiles\wzcb5rou.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.05.31 11:22:12 | 000,000,000 | ---D | M] (DownThemAll!) -- C:\Users\ACER\AppData\Roaming\mozilla\Firefox\Profiles\wzcb5rou.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
[2010.09.19 18:22:36 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2009.03.24 11:10:44 | 000,114,688 | ---- | M] (Zylom) -- C:\Programme\Mozilla Firefox\plugins\npzylomgamesplayer.dll
[2010.06.24 12:41:39 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.06.24 12:41:39 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.06.24 12:41:39 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.06.24 12:41:39 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.06.24 12:41:39 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (McAfee Phishing Filter) - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\Programme\McAfee\MSK\mcapbho.dll ()
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Programme\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll (Egis)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Programme\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)
O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)
O4 - HKLM..\Run: [ArcadeDeluxeAgent] C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BkupTray] C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe ()
O4 - HKLM..\Run: [CLMLServer] C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [eAudio] C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe (Acer Incorporated)
O4 - HKLM..\Run: [eDataSecurity Loader] C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe (Egis Incorporated)
O4 - HKLM..\Run: [ePower_DMC] C:\Programme\Acer\Empowering Technology\ePower\ePower_DMC.exe (Acer Inc.)
O4 - HKLM..\Run: [eRecoveryService]  File not found
O4 - HKLM..\Run: [EzPrint] C:\Program Files\Lexmark 2300 Series\ezprint.exe (Lexmark International Inc.)
O4 - HKLM..\Run: [IAAnotif] C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [LManager] C:\Programme\Launch Manager\QtZgAcer.EXE (Dritek System Inc.)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [lxcgmon.exe] C:\Program Files\Lexmark 2300 Series\lxcgmon.exe (Lexmark International, Inc.)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [NPSStartup]  File not found
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [PlayMovie] C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.)
O4 - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()
O4 - HKLM..\Run: [ProductReg] C:\Program Files\Acer\WR_PopUp\ProductReg.exe (Acer)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [AutoStartNPSAgent] C:\Programme\Samsung\Samsung New PC Studio\NPSAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKCU..\Run: [ICQ] C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O4 - HKCU..\Run: [PMCLoader] C:\Program Files\Pinnacle\TVCenter Pro\PMCLoader.exe (Pinnacle Systems GmbH)
O4 - HKCU..\Run: [PMCRemote]  File not found
O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: HP Intelligente Auswahl - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Programme\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Oberon Flash Game Host)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 83.169.186.33 83.169.186.97 213.73.91.35
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\ACER\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\ACER\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2002.05.07 21:22:24 | 000,000,212 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{8df28cc3-ab2d-11dd-9d9a-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{8df28cc3-ab2d-11dd-9d9a-806e6f6e6963}\Shell\AutoRun\command - "" = E:\_autorun\Autorun.exe -- [2000.02.07 23:20:10 | 000,036,864 | R--- | M] (New World Computing)
O33 - MountPoints2\{8df28cc3-ab2d-11dd-9d9a-806e6f6e6963}\Shell\instDX\command - "" = E:\DirectX\dxsetup.exe -- [2000.10.21 14:39:38 | 000,147,456 | R--- | M] (Microsoft Corporation)
O33 - MountPoints2\{8df28cc3-ab2d-11dd-9d9a-806e6f6e6963}\Shell\readme\command - "" = notepad readme.txt
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O36 - AppCertDlls: disketup - (C:\Windows\system32\lnksmsdt.dll) - C:\Windows\System32\lnksmsdt.dll ()
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.09.20 08:58:36 | 000,576,000 | ---- | C] (OldTimer Tools) -- C:\Users\ACER\Desktop\OTL.exe
[2010.09.20 08:37:10 | 000,000,000 | ---D | C] -- C:\Users\ACER\AppData\Roaming\Malwarebytes
[2010.09.20 08:36:57 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.09.20 08:36:55 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.09.20 08:36:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.09.20 08:36:54 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.09.13 17:03:37 | 000,000,000 | ---D | C] -- C:\Users\ACER\AppData\Local\{D3C23E26-C072-418C-8C69-320979274A33}
[2010.09.11 23:55:16 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\3DO Shared
[2010.09.11 23:49:24 | 000,000,000 | ---D | C] -- C:\Windows\System\KEEPER
[2009.05.29 10:57:40 | 000,413,696 | ---- | C] ( ) -- C:\Windows\System32\lxcginpa.dll
[2009.05.29 10:57:40 | 000,397,312 | ---- | C] ( ) -- C:\Windows\System32\lxcgiesc.dll
[2009.05.29 10:57:40 | 000,323,584 | ---- | C] ( ) -- C:\Windows\System32\lxcghcp.dll
[2009.05.29 10:57:39 | 001,224,704 | ---- | C] ( ) -- C:\Windows\System32\lxcgserv.dll
[2009.05.29 10:57:39 | 000,995,328 | ---- | C] ( ) -- C:\Windows\System32\lxcgusb1.dll
[2009.05.29 10:57:39 | 000,696,320 | ---- | C] ( ) -- C:\Windows\System32\lxcghbn3.dll
[2009.05.29 10:57:39 | 000,684,032 | ---- | C] ( ) -- C:\Windows\System32\lxcgcomc.dll
[2009.05.29 10:57:39 | 000,643,072 | ---- | C] ( ) -- C:\Windows\System32\lxcgpmui.dll
[2009.05.29 10:57:39 | 000,585,728 | ---- | C] ( ) -- C:\Windows\System32\lxcglmpm.dll
[2009.05.29 10:57:39 | 000,421,888 | ---- | C] ( ) -- C:\Windows\System32\lxcgcomm.dll
[2009.05.29 10:57:39 | 000,163,840 | ---- | C] ( ) -- C:\Windows\System32\lxcgprox.dll
[2009.05.29 10:57:39 | 000,094,208 | ---- | C] ( ) -- C:\Windows\System32\lxcgpplc.dll
[2008.07.22 10:01:25 | 000,049,152 | ---- | C] ( ) -- C:\Windows\Interop.IWshRuntimeLibrary.dll
 
========== Files - Modified Within 30 Days ==========
 
[2010.09.20 08:59:04 | 002,883,584 | -HS- | M] () -- C:\Users\ACER\NTUSER.DAT
[2010.09.20 08:51:26 | 000,054,016 | ---- | M] () -- C:\Windows\System32\drivers\repc.sys
[2010.09.20 08:40:20 | 000,033,638 | ---- | M] () -- C:\Users\ACER\Desktop\Antivir-Meldung2.jpg
[2010.09.20 08:36:59 | 000,000,822 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.09.20 08:16:31 | 000,033,324 | ---- | M] () -- C:\Users\ACER\Desktop\Antivir-Meldung.jpg
[2010.09.20 08:14:44 | 000,026,029 | ---- | M] () -- C:\Windows\System32\Config.MPF
[2010.09.20 08:12:45 | 000,000,349 | ---- | M] () -- C:\Users\Public\Documents\PCLECHAL.INI
[2010.09.20 08:12:39 | 000,000,000 | ---- | M] () -- C:\Windows\System32\LogConfigTemp.xml
[2010.09.20 08:12:02 | 000,027,744 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2010.09.20 08:12:01 | 000,027,744 | ---- | M] () -- C:\ProgramData\nvModes.001
[2010.09.20 08:10:25 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.09.20 08:10:24 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.09.20 08:10:24 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.09.20 08:10:17 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.09.20 08:10:00 | 3215,847,424 | -HS- | M] () -- C:\hiberfil.sys
[2010.09.19 19:27:10 | 000,524,288 | -HS- | M] () -- C:\Users\ACER\NTUSER.DAT{579a4397-f07c-11de-b4fe-00238b004985}.TMContainer00000000000000000001.regtrans-ms
[2010.09.19 19:27:10 | 000,065,536 | -HS- | M] () -- C:\Users\ACER\NTUSER.DAT{579a4397-f07c-11de-b4fe-00238b004985}.TM.blf
[2010.09.19 19:26:37 | 002,963,412 | -H-- | M] () -- C:\Users\ACER\AppData\Local\IconCache.db
[2010.09.19 17:03:42 | 000,052,348 | ---- | M] () -- C:\Users\ACER\Desktop\Komplett.docx
[2010.09.19 16:47:08 | 000,576,000 | ---- | M] (OldTimer Tools) -- C:\Users\ACER\Desktop\OTL.exe
[2010.09.17 05:50:33 | 000,037,155 | ---- | M] () -- C:\Users\ACER\Desktop\Wohnkosten.pdf
[2010.09.16 16:56:39 | 000,001,891 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2010.09.16 13:24:27 | 000,027,136 | ---- | M] () -- C:\Users\ACER\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.09.16 13:24:18 | 000,000,120 | ---- | M] () -- C:\Users\ACER\AppData\Local\Wmoyusura.dat
[2010.09.16 13:24:18 | 000,000,000 | ---- | M] () -- C:\Users\ACER\AppData\Local\Pqobunepoza.bin
[2010.09.15 01:00:00 | 000,000,372 | ---- | M] () -- C:\Windows\tasks\McDefragTask.job
[2010.09.13 17:01:48 | 000,047,616 | ---- | M] () -- C:\Windows\System32\lnksmsdt.dll
[2010.09.12 21:37:08 | 002,025,721 | ---- | M] () -- C:\Users\ACER\Desktop\Osteo Vortrag.pdf
[2010.09.11 23:56:54 | 000,001,784 | ---- | M] () -- C:\Users\Public\Desktop\Heroes of Might and Magic III Complete.lnk
[2010.09.10 18:11:28 | 000,001,397 | ---- | M] () -- C:\Users\ACER\Desktop\DivX Movies.lnk
[2010.09.10 18:11:10 | 000,000,921 | ---- | M] () -- C:\Users\Public\Desktop\DivX Plus Player.lnk
[2010.08.26 14:51:37 | 001,893,001 | ---- | M] () -- C:\Users\ACER\Desktop\LSV-GreaterBas-ChromatoneRMX.mp3
[2010.08.21 14:45:58 | 001,418,806 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010.08.21 14:45:58 | 000,618,442 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.08.21 14:45:58 | 000,587,178 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.08.21 14:45:58 | 000,122,842 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.08.21 14:45:58 | 000,101,250 | ---- | M] () -- C:\Windows\System32\perfc009.dat
 
========== Files Created - No Company Name ==========
 
[2010.09.20 08:51:26 | 000,054,016 | ---- | C] () -- C:\Windows\System32\drivers\repc.sys
[2010.09.20 08:40:20 | 000,033,638 | ---- | C] () -- C:\Users\ACER\Desktop\Antivir-Meldung2.jpg
[2010.09.20 08:36:59 | 000,000,822 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.09.20 08:16:30 | 000,033,324 | ---- | C] () -- C:\Users\ACER\Desktop\Antivir-Meldung.jpg
[2010.09.19 11:44:54 | 000,052,348 | ---- | C] () -- C:\Users\ACER\Desktop\Komplett.docx
[2010.09.17 05:50:31 | 000,037,155 | ---- | C] () -- C:\Users\ACER\Desktop\Wohnkosten.pdf
[2010.09.13 17:03:38 | 000,000,120 | ---- | C] () -- C:\Users\ACER\AppData\Local\Wmoyusura.dat
[2010.09.13 17:03:38 | 000,000,000 | ---- | C] () -- C:\Users\ACER\AppData\Local\Pqobunepoza.bin
[2010.09.13 17:01:48 | 000,047,616 | ---- | C] () -- C:\Windows\System32\lnksmsdt.dll
[2010.09.12 21:37:04 | 002,025,721 | ---- | C] () -- C:\Users\ACER\Desktop\Osteo Vortrag.pdf
[2010.09.11 23:56:54 | 000,001,784 | ---- | C] () -- C:\Users\Public\Desktop\Heroes of Might and Magic III Complete.lnk
[2010.09.10 18:11:28 | 000,001,397 | ---- | C] () -- C:\Users\ACER\Desktop\DivX Movies.lnk
[2010.09.10 18:11:10 | 000,000,921 | ---- | C] () -- C:\Users\Public\Desktop\DivX Plus Player.lnk
[2010.08.26 14:51:37 | 001,893,001 | ---- | C] () -- C:\Users\ACER\Desktop\LSV-GreaterBas-ChromatoneRMX.mp3
[2010.08.15 14:38:18 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2010.01.16 19:01:13 | 000,201,488 | ---- | C] () -- C:\Windows\System32\MACD32.DLL
[2010.01.16 19:01:13 | 000,144,144 | ---- | C] () -- C:\Windows\System32\MASE32.DLL
[2010.01.16 19:01:13 | 000,141,584 | ---- | C] () -- C:\Windows\System32\MAMC32.DLL
[2010.01.16 19:01:13 | 000,063,248 | ---- | C] () -- C:\Windows\System32\MASD32.DLL
[2010.01.16 19:01:13 | 000,033,040 | ---- | C] () -- C:\Windows\System32\MA32.DLL
[2010.01.08 13:02:42 | 000,110,592 | ---- | C] () -- C:\Windows\System32\FsUsbExDevice.Dll
[2010.01.08 13:02:42 | 000,036,608 | ---- | C] () -- C:\Windows\System32\FsUsbExDisk.Sys
[2009.12.13 23:30:51 | 000,000,272 | ---- | C] () -- C:\Windows\SIERRA.INI
[2009.07.27 14:58:28 | 000,000,788 | ---- | C] () -- C:\ProgramData\hpzinstall.log
[2009.07.22 12:49:48 | 000,040,960 | R--- | C] () -- C:\Windows\System32\psfind.dll
[2009.07.16 02:03:43 | 000,007,592 | ---- | C] () -- C:\Users\ACER\AppData\Local\d3d9caps.dat
[2009.06.30 15:33:29 | 000,027,136 | ---- | C] () -- C:\Users\ACER\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.05.29 10:57:40 | 000,274,432 | ---- | C] () -- C:\Windows\System32\lxcginst.dll
[2009.02.07 17:32:13 | 000,000,000 | ---- | C] () -- C:\Windows\PROTOCOL.INI
[2009.01.04 13:13:39 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2009.01.03 00:21:45 | 000,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll
[2009.01.03 00:21:45 | 000,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll
[2009.01.03 00:21:45 | 000,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll
[2009.01.02 21:49:13 | 000,027,744 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009.01.02 14:53:36 | 000,027,744 | ---- | C] () -- C:\ProgramData\nvModes.001
[2008.11.05 12:53:48 | 000,626,688 | ---- | C] () -- C:\Windows\Image.dll
[2008.11.05 12:53:48 | 000,000,036 | ---- | C] () -- C:\Windows\PidList.ini
[2008.04.18 20:25:22 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2008.04.18 11:49:14 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIOFM4.dll
[2008.04.18 11:49:14 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIBUN5.dll
[2008.04.18 10:56:05 | 000,204,800 | ---- | C] () -- C:\Windows\System32\SysHook.dll
[2008.04.18 10:52:45 | 000,487,424 | ---- | C] () -- C:\Windows\System32\INT15.dll
[2008.04.18 10:42:52 | 000,001,694 | ---- | C] () -- C:\Windows\RtDefLvl.ini
[2008.01.21 04:24:21 | 000,197,120 | ---- | C] () -- C:\Users\ACER\AppData\Local\abodiqad.VIR
[2007.10.25 18:26:10 | 000,005,632 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys
[2007.02.22 18:32:00 | 000,344,064 | ---- | C] () -- C:\Windows\System32\lxcgcoin.dll
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:25:25 | 000,557,568 | ---- | C] () -- C:\Windows\System32\hpotscld.dll
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2005.08.18 06:26:46 | 000,040,960 | ---- | C] () -- C:\Windows\System32\lxcgvs.dll
[2005.03.13 14:32:14 | 000,061,440 | ---- | C] () -- C:\Windows\System32\lxcgcnv4.dll
[2001.12.26 16:12:30 | 000,065,536 | ---- | C] () -- C:\Windows\System32\multiplex_vcd.dll
[2001.09.03 23:46:38 | 000,110,592 | ---- | C] () -- C:\Windows\System32\Hmpg12.dll
[2001.07.30 16:33:56 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC.dll
[2001.07.23 22:04:36 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC_MMX.dll
[1997.06.14 11:56:08 | 000,056,832 | ---- | C] () -- C:\Windows\System32\iyvu9_32.dll
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 64 bytes -> C:\Users\ACER\Desktop\Jacques Offenbach Orphe aux Enfers GALOP INFERNAL Can can (480 x 360).mp4:TOC.WMV
< End of report >
OTL Extras.Txt:

Code:
OTL Extras logfile created on: 20.09.2010 08:59:07 - Run 1
OTL by OldTimer - Version 3.2.14.0    Folder = C:\Users\ACER\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 54,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 76,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 144,04 Gb Total Space | 63,58 Gb Free Space | 44,14% Space Free | Partition Type: NTFS
Drive D: | 144,04 Gb Total Space | 143,95 Gb Free Space | 99,93% Space Free | Partition Type: NTFS
Drive E: | 988,78 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive F: | 465,65 Gb Total Space | 403,60 Gb Free Space | 86,68% Space Free | Partition Type: FAT32
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: ACER-PC
Current User Name: ACER
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-7420075-3053948626-936591600-1000]
"EnableNotifications" = 1
"EnableNotificationsRef" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04BF22A4-C6A1-40BB-85B6-416822DA9EA0}" = rport=137 | protocol=17 | dir=out | app=system |
"{09192CF9-479E-40DD-BCD3-7613CF252C2C}" = rport=445 | protocol=6 | dir=out | app=system |
"{14CF7768-2A52-4F24-BFA4-4890A8F83B24}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{1AC07984-3473-4C65-9FF8-91BEFC04A95B}" = lport=139 | protocol=6 | dir=in | app=system |
"{38A77539-D477-4814-AC56-7BC8282268DF}" = rport=139 | protocol=6 | dir=out | app=system |
"{4A2AC76F-BA67-4793-B913-63E35E3E7B9C}" = lport=137 | protocol=17 | dir=in | app=system |
"{57716658-BCC7-4E11-85BA-0E5A7B37890F}" = rport=138 | protocol=17 | dir=out | app=system |
"{945ACD29-530E-438F-9715-1A4BAE5242D7}" = lport=138 | protocol=17 | dir=in | app=system |
"{CE2E0AAC-D7ED-4FD3-A649-4EC5FFC361C3}" = rport=427 | protocol=17 | dir=in | svc=hpslpsvc | app=c:\windows\system32\svchost.exe |
"{CEAB9719-E068-406D-B0FA-B5B6103796DC}" = lport=445 | protocol=6 | dir=in | app=system |
"{D232AC0D-CF44-486B-9EB9-61FE6AF19923}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{F96B6E93-2B90-4F55-B32A-01681675BBEC}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03EDA29E-15F3-43EC-9D1F-F2DF94F8F422}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpiscnapp.exe |
"{06164584-5B03-4113-93FA-5AE316CAFAF3}" = protocol=6 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsasvr.exe |
"{08A79550-56F9-42EC-81A3-06F5D87F821C}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{0ADFB58F-C2E1-4A28-82AE-7B3BCEA3830C}" = protocol=17 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsvsvr.exe |
"{10FB71B5-4E15-4BCF-919A-4B7715848ACE}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{12184E5A-9CE2-4B47-95F3-2A883A973399}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe |
"{1883A6FD-A874-473C-93F6-9E575BF74D2D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{1962C344-A6F4-4422-B337-4C7B41D75A63}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{24EDBCEC-A7BC-4BA9-9A5D-33110194461F}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{30725DB0-FE78-43B2-8FD1-45C1599AB623}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe |
"{33E3E77B-EC79-43F4-AD9A-6B724767AC94}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposid01.exe |
"{36984233-0142-4CBB-8698-04C3C2D0523C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{379EC35C-E9AE-4E04-9C29-8B26F5F447C0}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{3A1AD0A6-53E9-480F-A143-07271A4A88C8}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{3AE8F041-56AE-4075-A345-EE77E43F4E4B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{3CA22460-B68D-426D-847F-525E82A6B401}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqpse.exe |
"{3CFBCC3A-EB66-48C9-A1D6-78C3E95A3C6B}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqkygrp.exe |
"{3DE70723-8D4C-451B-8B4F-6CD1A54A2A64}" = protocol=17 | dir=in | app=c:\program files\pinnacle\shared files\programs\strmserver\strmserver.exe |
"{4195D402-85DE-4689-9BD7-E94AD8665D4E}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqste08.exe |
"{42547E42-C6DB-4836-948F-1910840A7401}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{42A3AD09-15DC-46C4-A2FD-08A2933C83FB}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{449624C0-B221-4970-955C-3D36E9B3DF7E}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{44E86C24-8A31-4FA5-9FA5-A2EBBE8AE7C9}" = dir=in | app=c:\program files\acer arcade deluxe\homemedia\homemedia.exe |
"{455A26F0-C6B0-46EF-82ED-33468C2FB9C7}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe |
"{48AE5B90-5774-4043-984C-C985460226C0}" = dir=in | app=c:\program files\acer arcade deluxe\playmovie\playmovie.exe |
"{4E03EC53-8F38-4450-ACD3-A186E0F89E4F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{57364AF3-2209-4A6F-BD9A-C7E77B2DBEDE}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxcgpswx.exe |
"{57FFEA3B-1258-46D5-A824-FBB000A488F1}" = dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe |
"{5817F6AE-D602-4074-8604-DA44100785F1}" = protocol=17 | dir=in | app=c:\windows\system32\lxcgcoms.exe |
"{5FD3D973-521D-4A30-B996-8B7E63F35A38}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgplgtupl.exe |
"{607C6FAC-0624-4D8B-B5C3-5DAF98C0ACD3}" = dir=in | app=c:\program files\acer arcade deluxe\playmovie\pmvservice.exe |
"{642003C1-A9F1-4167-8EA6-28C50D615383}" = dir=in | app=c:\program files\acer arcade deluxe\acer arcade deluxe\acer arcade deluxe.exe |
"{7546C3DD-D0EE-41BF-AD6D-738D34B51539}" = protocol=17 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{75D3D0FD-0355-4728-8ABF-ADF498B928EF}" = protocol=6 | dir=in | app=c:\program files\pinnacle\shared files\programs\strmserver\strmserver.exe |
"{77327392-9C9F-4138-99A8-B4067CE7E745}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{86D42E26-1064-4D2B-9F62-27FFF6ADA515}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqsudi.exe |
"{86E10664-E6EA-495B-987E-11008B34294E}" = dir=in | app=c:\program files\common files\hp\digital imaging\bin\hpqphotocrm.exe |
"{8737DBFA-FFA7-4D38-9D17-1590EC698208}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe |
"{8B67F724-9D13-4C6E-997C-CFAF9506F9BF}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpoews01.exe |
"{94918DAD-5603-44A9-84B4-C855556A0569}" = protocol=6 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsvsvr.exe |
"{9565A9BC-7126-42A4-A176-303884131A47}" = protocol=17 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsasvr.exe |
"{95764E7D-0ACA-4F12-9C76-0D6FF381A20A}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{9C9B655E-CC7A-4BBD-AACB-F1378296CC58}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxcgpswx.exe |
"{9FBBDF7F-D7C9-4732-A203-8714A5887650}" = protocol=6 | dir=in | app=c:\windows\system32\lxcgcoms.exe |
"{A0C311F6-01FE-46EE-BBBB-A31546E2C522}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\client\agentsvc.exe |
"{A31B2470-ADCD-4445-AB02-426E296D01CE}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B1C3A12F-60AC-46D6-99DB-1042BA1EFD04}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B3949B97-1E3A-4108-88BA-1EC635F1187E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B58FD039-889A-4000-9A55-45C758B69FCD}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{BAD98A9C-44D3-46DB-A8F9-6251E613D9F9}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqpsapp.exe |
"{BC3D4632-0058-4489-A7E2-05D654ED0601}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe |
"{CA04CE74-B25B-4924-9C05-A4001889C66D}" = protocol=6 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{D19013EB-25C4-407B-A663-29CD759FBD90}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D4942B81-0E9C-4C55-9203-5EA2D89EE249}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D7DDF90D-8E93-4952-AE73-D47531F262B6}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgpc01.exe |
"{DBC71D6E-5325-45CF-8F72-EA52CE052DCC}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\client\agentsvc.exe |
"{E269DBC0-160B-48A8-98BD-141531794A39}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E5E3C61E-8932-4164-9572-31E9315D8643}" = dir=in | app=e:\setup\hpznui01.exe |
"{E7F26E0B-B124-49FD-AEA9-7E5B2C7DE683}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E997DD8F-6A7E-4EB8-BD4B-5823A7FAC112}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{EEF37707-4E68-44BB-AD46-2EC12D65BFE9}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqtra08.exe |
"{F2EEBE6A-8499-49D0-A216-85A700995754}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{F88E3B51-3F02-4177-8337-3F2251A5233B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{0289B35E-DC07-4c7a-9710-BBD686EA4B7D}" = Status
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{09633A5E-3089-41A8-9FF1-382171423C5D}" = PSSWCORE
"{0AD84416-63A4-4CF3-BDDF-8FA866711FB0}" = Civilization III
"{10F498FF-5392-4DF3-8F73-FE172A9F3800}" = Winbond CIR Device Drivers
"{11316260-6666-467B-AC34-183FCB5D4335}" = Acer Mobility Center Plug-In
"{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now Standard
"{13D85C14-2B85-419F-AC41-C7F21E68B25D}" = Acer eSettings Management
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{15B8AFD9-92E9-4E86-96D9-83FAC510B82E}" = HPPhotoSmartPhotobookWebPack1
"{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime
"{22F761D1-8063-4170-ADF7-2D2F47834CA9}" = VideoToolkit01
"{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"{26604C7E-A313-4D12-867F-7C6E7820BE4C}" = JMicron JMB38X Flash Media Controller
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 17
"{27197499-7680-4208-8FD8-5439CDB0FDC1}" = HPProductAssistant
"{2AFEAA03-2DFE-4519-A629-EDAB6541ABE9}" = HPSSupply
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{412B69AF-C352-4F6F-A318-B92B3CB9ACC6}" = Titan Quest
"{43C0C354-A185-4D2D-A057-67C9160460E1}" = PS_AIO_04_C4580_Software_Min
"{4A3D0CF8-60FF-4CEF-91A4-A1F001424602}" = DocProc
"{4E7C28C7-D5DA-4E9F-A1CA-60490B54AE35}" = UnloadSupport
"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works
"{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features
"{57265292-228A-41FA-9AEC-4620CBCC2739}" = Acer eAudio Management
"{58E5844B-7CE2-413D-83D1-99294BF6C74F}" = Acer ePower Management
"{593A6CAF-E114-4e31-884F-74FF349E8E36}" = SolutionCenter
"{5B09F344-4406-11D5-96E8-0050BA84F5F7}" = Baldurs Gate(TM) II - Thron des Bhaal (TM)
"{5B63A470-9334-44D1-AF61-6CE2DB565AE9}" = Orion
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{70E1E357-E57C-4284-B04E-58196DC27BC1}" = PanoStandAlone
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7641710F-A4AD-4EAE-889C-4958BE3F169C}" = C4580
"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver
"{7B63B2922B174135AFC0E1377DD81EC2}" =
"{7C7AC2D4-1077-45C8-826A-16445B5E0DB7}" = Pinnacle DistanTV Server
"{7E84FAC8-C518-40F9-9807-7455301D6D25}" = SamsungConnectivityCableDriver
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110111700}" = Zuma Deluxe
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11029123}" = Bricks of Egypt
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110322783}" = Big Kahuna Reef
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110411970}" = Chuzzle
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111118433}" = Mystery Case Files - Huntsville
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111199750}" = Cake Mania
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111252743}" = Mahjong Escape Ancient China
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111324990}" = Kick N Rush
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111543617}" = Backspin Billiards
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111692950}" = Mahjongg Artifacts
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111771833}" = Jewel Quest Solitaire
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111796363}" = Mystery Solitaire - Secret Island
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111872660}" = Diner Dash Flo on the Go
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112531267}" = Chicken Invaders 3
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112615863}" = Agatha Christie Death on the Nile
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}" = Alice Greenfingers
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113009953}" = Turbo Pizza
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113080210}" = Azada
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{8A74DEFD-A224-49CC-AB80-4E88BC730125}" = LogMeIn Hamachi
"{8F1B6239-FEA0-450A-A950-B05276CE177C}" = Acer Empowering Technology
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{3EC77D26-799B-4CD8-914F-C1565E796173}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{430971B1-C31E-45DA-81E0-72C095BAB72C}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{58FC5E37-DD28-4D4A-A549-125744C6763C}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{888B9AC7-8F5C-456B-A27A-157A6C310E52}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{BEE75E01-DD3F-4D5F-B96C-609E6538D419}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{99E862CC-6F69-4D39-99AA-DBF71BF3B585}" = OpenOffice.org 3.1
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C2D4047-0E40-499a-AC7A-C4B9BB12FE03}" = TrayApp
"{9F4EE72A-C5C9-42ad-ABEF-427690843577}" = MarketResearch
"{A5633652-3795-4829-BB0B-644F0279E279}" = Acer eDataSecurity Management
"{A64A5576-D862-44F8-89DC-2B17FCC9B86E}" = Broadcom Gigabit Integrated Controller
"{A6A195F5-BCAB-4F38-8459-DF693303CD8D}" = PS_AIO_04_C4580_ProductContext
"{A77255C4-AFCB-44A3-BF0F-2091A71FFD9E}" = Acer Crystal Eye Webcam 2.0.8
"{A82E3AFE-0BD9-4A17-9A58-9112B5C679C5}" = MyScript Notes Lite
"{AA2E8A46-B45E-4aea-8A23-88AB57D04523}" = WebReg
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC599724-5755-48C1-ABE7-ABB857652930}" = PC Connectivity Solution
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.4 - Deutsch
"{AF7E85DC-317C-47F5-810E-B82EE093A612}" = Samsung New PC Studio USB Driver Installer
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B5C5C17E-FEF6-4062-8151-A427AE8AF9D7}" = Titan Quest Immortal Throne
"{BED1705F-7558-40f7-9F52-6C6FBD58EA2E}" = HP Photosmart C4500 All-In-One Driver Software 11.0 Rel .4
"{BF08AB1C-3357-4f20-A200-8EBB8EF27C59}" = BufferChm
"{C89B5E3A-690F-4CEE-909A-BF869E198B0A}" = Scan
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CC0E1AE3-091D-4969-B151-7AC142062C28}" = SmartWebPrinting
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe  1.4.142.1
"{D063F201-FAC4-4D5C-B10B-615058ADE5A7}" = HP Update
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D16B4BE6-8B10-422f-8034-96D1CA9483B5}" = GPBaseService
"{D23E2520-0EAA-4AC3-A47E-A551C70D4FED}" = C4580_Help
"{D36DD326-7280-11D8-97C8-000129760CBE}" = PhotoNow!
"{D4278897-1541-493E-9D39-59CC6AB0FC09}" = PS_AIO_04_C4580_Software
"{D74CFE48-087F-46E1-80E6-E2950E1A8DCE}" = HP Photosmart Essential 2.5
"{DB833EF9-A198-49BE-970A-BD46F30BFBB4}" = ANNO 1503 GOLD
"{E535C94A-B87F-4182-BEA8-1E9322078D3E}" = Cards_Calendar_OrderGift_DoMorePlugout
"{E96B0085-6659-486b-A221-5042A042728D}" = Toolbox
"{EF1ADA5A-0B1A-4662-8C55-7475A61D8B65}" = DeviceDiscovery
"{EF9E56EE-0243-4BAD-88F4-5E7508AA7D96}" = Destination Component
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"{F38ADCA4-AF7C-4C73-9021-6F1EA15D15EA}" = Pinnacle TVCenter Pro
"{F7B0E599-C114-4493-BC4D-D8FC7CBBABBB}" = 32 Bit HP CIO Components Installer
"{F95F178B-56AD-4fab-87F8-FA81E66C7D68}" = Network
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"3A5DEFA413DDE699DBA6EBE0A63534ACA524D30F" = Windows-Treiberpaket - Nokia pccsmcfd  (10/12/2007 6.85.4.0)
"Acer GameZone Console_is1" = Acer GameZone Console 2.0.1.1
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Age of Empires 2.0" = Microsoft Age of Empires II
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"AVerMedia A310 (MiniCard, DVB-T)" = AVerMedia A310 (MiniCard, DVB-T) 1.1.0.27
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Battle.net" = Battle.net
"Beyond Divinity_is1" = Beyond Divinity 1.47
"Diablo" = Diablo
"Diablo II" = Diablo II
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX-Setup
"Dungeon Keeper 2" = Dungeon Keeper 2
"EAX(tm) Unified (SHELL)" = EAX(tm) Unified (SHELL)
"FINAL FANTASY VIII" = FINAL FANTASY VIII
"GridVista" = Acer GridVista
"Heroes of Might and Magic II" = Heroes of Might and Magic II
"Heroes of Might and Magic® III" = Heroes of Might and Magic® III Complete
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"HP Imaging Device Functions" = HP Imaging Device Functions 11.0
"HP Photosmart Essential" = HP Photosmart Essential 3.0
"HP Smart Web Printing" = HP Smart Web Printing
"HP Solution Center & Imaging Support Tools" = HP Solution Center 11.0
"HPExtendedCapabilities" = HP Customer Participation Program 11.0
"HPOCR" = OCR Software by I.R.I.S. 11.0
"ImgBurn" = ImgBurn
"InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now 5
"InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"InstallShield_{AF7E85DC-317C-47F5-810E-B82EE093A612}" = Samsung New PC Studio USB Driver Installer
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"Keeper" = Dungeon Keeper
"Lexmark 2300 Series" = Lexmark 2300 Series
"LManager" = Launch Manager
"LogMeIn Hamachi" = LogMeIn Hamachi
"Magic Set Editor 2_is1" = Magic Set Editor 2 - 0.3.8 beta
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"mIRC" = mIRC
"Mozilla Firefox (3.6.10)" = Mozilla Firefox (3.6.10)
"MSC" = McAfee SecurityCenter
"NVIDIA Drivers" = NVIDIA Drivers
"RealPlayer 6.0" = RealPlayer
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile Modem Device" = Samsung Mobile Modem Device Software
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"SAMSUNG USB Mobile Device" = SAMSUNG USB Mobile Device Software
"Shockwave" = Shockwave
"Shop for HP Supplies" = Shop for HP Supplies
"Sierra Uninstall" = Sierra On-Line Games (Remove only)
"SUPER ©" = SUPER © Version 2008.bld.33 (Sep 2, 2008)
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Tiberian Sun" = Command & Conquer Teil 3: Operation Tiberian Sun
"Warcraft III" = Warcraft III
"Warkeys" = Warkeys 1.13.1.0b
"Winamp" = Winamp
"WinRAR archiver" = WinRAR
"WOLAPI" = Gemeinsam genutzte Internet-Komponenten von Westwood
"Zylom Games Player Plugin" = Zylom Games Player Plugin
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"NoNameScript" = NNScript
"Warcraft III" = Warcraft III: All Products
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 07.09.2010 18:55:44 | Computer Name = ACER-PC | Source = System Restore | ID = 8193
Description =
 
Error - 07.09.2010 18:55:44 | Computer Name = ACER-PC | Source = System Restore | ID = 8210
Description =
 
Error - 10.09.2010 12:08:22 | Computer Name = ACER-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 10.09.2010 12:09:29 | Computer Name = ACER-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung HpqSRmon.exe, Version 11.0.0.142, Zeitstempel
 0x47d78822, fehlerhaftes Modul HpqSRmon.exe, Version 11.0.0.142, Zeitstempel 0x47d78822,
 Ausnahmecode 0xc0000005, Fehleroffset 0x000033c5,  Prozess-ID 0xa48, Anwendungsstartzeit
 01cb510241059144.
 
Error - 10.09.2010 12:09:43 | Computer Name = ACER-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
 
Error - 13.09.2010 09:38:58 | Computer Name = ACER-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung HEROES3.EXE, Version 4.0.0.0, Zeitstempel 0x39b83835,
 fehlerhaftes Modul MP3DEC.ASI, Version 3.0.0.0, Zeitstempel 0x36910efa, Ausnahmecode
 0xc0000005, Fehleroffset 0x000076f1,  Prozess-ID 0x1770, Anwendungsstartzeit 01cb531e2b306fb0.
 
Error - 14.09.2010 03:34:24 | Computer Name = ACER-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 14.09.2010 03:35:35 | Computer Name = ACER-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
 
Error - 14.09.2010 12:00:43 | Computer Name = ACER-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung HEROES3.EXE, Version 4.0.0.0, Zeitstempel 0x39b83835,
 fehlerhaftes Modul MP3DEC.ASI, Version 3.0.0.0, Zeitstempel 0x36910efa, Ausnahmecode
 0xc0000005, Fehleroffset 0x000076f1,  Prozess-ID 0x1564, Anwendungsstartzeit 01cb540c198c7554.
 
Error - 14.09.2010 15:57:52 | Computer Name = ACER-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung HEROES3.EXE, Version 4.0.0.0, Zeitstempel 0x39b83835,
 fehlerhaftes Modul MP3DEC.ASI, Version 3.0.0.0, Zeitstempel 0x36910efa, Ausnahmecode
 0xc0000005, Fehleroffset 0x000076f1,  Prozess-ID 0x3e8, Anwendungsstartzeit 01cb542915ed9d84.
 
[ OSession Events ]
Error - 24.05.2009 13:58:52 | Computer Name = ACER-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6211.1000, Microsoft Office Version: 12.0.6215.1000. This session lasted 1610
 seconds with 1440 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 18.09.2010 08:03:06 | Computer Name = ACER-PC | Source = Service Control Manager | ID = 7031
Description =
 
Error - 18.09.2010 08:06:17 | Computer Name = ACER-PC | Source = Service Control Manager | ID = 7031
Description =
 
Error - 18.09.2010 08:10:47 | Computer Name = ACER-PC | Source = Service Control Manager | ID = 7034
Description =
 
Error - 19.09.2010 05:20:47 | Computer Name = ACER-PC | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.2.3 für die Netzwerkkarte mit der Netzwerkadresse
 00238B004985 wurde durch den DHCP-Server 0.0.0.0 abgelehnt (der DHCP-Server hat
 eine DHCPNACK-Meldung gesendet).
 
Error - 19.09.2010 05:20:56 | Computer Name = ACER-PC | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.2.2 für die Netzwerkkarte mit der Netzwerkadresse
 00215D5DED84 wurde durch den DHCP-Server 0.0.0.0 abgelehnt (der DHCP-Server hat
 eine DHCPNACK-Meldung gesendet).
 
Error - 19.09.2010 13:28:43 | Computer Name = ACER-PC | Source = HTTP | ID = 15016
Description =
 
Error - 19.09.2010 13:30:45 | Computer Name = ACER-PC | Source = Service Control Manager | ID = 7022
Description =
 
Error - 20.09.2010 02:10:19 | Computer Name = ACER-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 20.09.2010 um 02:44:08 unerwartet heruntergefahren.
 
Error - 20.09.2010 02:10:25 | Computer Name = ACER-PC | Source = HTTP | ID = 15016
Description =
 
Error - 20.09.2010 02:12:35 | Computer Name = ACER-PC | Source = Service Control Manager | ID = 7022
Description =
 
 
< End of report >
Ich verstehe rein gar nichts von Viren und Co., bedanke mich schon im Voraus bei jedem, der mir zu helfen bereit ist und hoffe, dass mir noch zu helfen ist und dass ich den Laptop nicht zur Sicherheit in einem Eimer Flusssäure auflösen sollte.

cosinus 20.09.2010 10:03
Hallo und :hallo:

Bitte routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Fnyrri 20.09.2010 11:59
Hey,

danke für den Rat. Der Vollscan läuft jetzt schon seit zwei Stunden, ist das im Bereich des Normalen?
Ich poste das Log hier, sobald er fertig ist.

Edit:

Unspektakulärer MAM-Vollscan.Log:
Code:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4655

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

20.09.2010 13:09:03
mbam-log-2010-09-20 (13-09-03).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|F:\|)
Durchsuchte Objekte: 322203
Laufzeit: 1 Stunde(n), 53 Minute(n), 35 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

cosinus 20.09.2010 13:27
Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
O32 - AutoRun File - [2002.05.07 21:22:24 | 000,000,212 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{8df28cc3-ab2d-11dd-9d9a-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{8df28cc3-ab2d-11dd-9d9a-806e6f6e6963}\Shell\AutoRun\command - "" = E:\_autorun\Autorun.exe -- [2000.02.07 23:20:10 | 000,036,864 | R--- | M] (New World Computing)
O33 - MountPoints2\{8df28cc3-ab2d-11dd-9d9a-806e6f6e6963}\Shell\instDX\command - "" = E:\DirectX\dxsetup.exe -- [2000.10.21 14:39:38 | 000,147,456 | R--- | M] (Microsoft Corporation)
O33 - MountPoints2\{8df28cc3-ab2d-11dd-9d9a-806e6f6e6963}\Shell\readme\command - "" = notepad readme.txt
O36 - AppCertDlls: disketup - (C:\Windows\system32\lnksmsdt.dll) - C:\Windows\System32\lnksmsdt.dll ()
[2010.09.13 17:03:37 | 000,000,000 | ---D | C] -- C:\Users\ACER\AppData\Local\{D3C23E26-C072-418C-8C69-320979274A33}
[2010.09.11 23:49:24 | 000,000,000 | ---D | C] -- C:\Windows\System\KEEPER
[2010.09.20 08:51:26 | 000,054,016 | ---- | M] () -- C:\Windows\System32\drivers\repc.sys
[2010.09.13 17:03:38 | 000,000,120 | ---- | C] () -- C:\Users\ACER\AppData\Local\Wmoyusura.dat
[2010.09.13 17:03:38 | 000,000,000 | ---- | C] () -- C:\Users\ACER\AppData\Local\Pqobunepoza.bin
[2010.09.13 17:01:48 | 000,047,616 | ---- | C] () -- C:\Windows\System32\lnksmsdt.dll
[2008.01.21 04:24:21 | 000,197,120 | ---- | C] () -- C:\Users\ACER\AppData\Local\abodiqad.VIR
:Commands
[purity]
[resethosts]
[emptytemp]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Fnyrri 20.09.2010 13:57
Ich habe das wie beschrieben durchgeführt.

OTL hat sich nach ca. einer Minute (während 'emptying temp folders' in der Statuszeile stand) aufgehängt (zuerst kam eine Windows-Fehlermeldung, die grob lautete "OTL funktioniert nicht mehr, bitte warten..." und dann nach einigen Sekunden "Das Programm musste wegen eines Fehlers beendet werden." oder so ähnlich.
Weil anschließend nichts mehr ging, habe ich den Laptop neu gestartet; als er fertig gebootet war, war eine Editor-Datei folgenden Inhalts geöffnet:

Code:
Files\Folders moved on Reboot...
File move failed. E:\AUTORUN.INF scheduled to be moved on reboot.
File move failed. E:\_autorun\Autorun.exe scheduled to be moved on reboot.
File move failed. E:\DirectX\dxsetup.exe scheduled to be moved on reboot.
File\Folder C:\Windows\temp\mcafee_P9CynZ7oTh1ueiZ not found!

Registry entries deleted on Reboot...
Was nun? Noch einen Fix-Versuch mit OTL starten?

cosinus 20.09.2010 15:03
mach es nochmal mit diesem neuen Text:

Code:
:OTL
O32 - AutoRun File - [2002.05.07 21:22:24 | 000,000,212 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{8df28cc3-ab2d-11dd-9d9a-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{8df28cc3-ab2d-11dd-9d9a-806e6f6e6963}\Shell\AutoRun\command - "" = E:\_autorun\Autorun.exe -- [2000.02.07 23:20:10 | 000,036,864 | R--- | M] (New World Computing)
O33 - MountPoints2\{8df28cc3-ab2d-11dd-9d9a-806e6f6e6963}\Shell\instDX\command - "" = E:\DirectX\dxsetup.exe -- [2000.10.21 14:39:38 | 000,147,456 | R--- | M] (Microsoft Corporation)
O33 - MountPoints2\{8df28cc3-ab2d-11dd-9d9a-806e6f6e6963}\Shell\readme\command - "" = notepad readme.txt
O36 - AppCertDlls: disketup - (C:\Windows\system32\lnksmsdt.dll) - C:\Windows\System32\lnksmsdt.dll ()
[2010.09.13 17:03:37 | 000,000,000 | ---D | C] -- C:\Users\ACER\AppData\Local\{D3C23E26-C072-418C-8C69-320979274A33}
[2010.09.11 23:49:24 | 000,000,000 | ---D | C] -- C:\Windows\System\KEEPER
[2010.09.20 08:51:26 | 000,054,016 | ---- | M] () -- C:\Windows\System32\drivers\repc.sys
[2010.09.13 17:03:38 | 000,000,120 | ---- | C] () -- C:\Users\ACER\AppData\Local\Wmoyusura.dat
[2010.09.13 17:03:38 | 000,000,000 | ---- | C] () -- C:\Users\ACER\AppData\Local\Pqobunepoza.bin
[2010.09.13 17:01:48 | 000,047,616 | ---- | C] () -- C:\Windows\System32\lnksmsdt.dll
[2008.01.21 04:24:21 | 000,197,120 | ---- | C] () -- C:\Users\ACER\AppData\Local\abodiqad.VIR

Fnyrri 20.09.2010 15:17
Hab ich gemacht - diesmal lief es anscheinend durch, am Ende meinte OTL, dass der Computer neu gestartet werden muss, um die Dateien endgültig zu löschen.

Hier der Text, der mich nach dem Reboot erwartete:

Code:
========== OTL ==========
File move failed. E:\AUTORUN.INF scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8df28cc3-ab2d-11dd-9d9a-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8df28cc3-ab2d-11dd-9d9a-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8df28cc3-ab2d-11dd-9d9a-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8df28cc3-ab2d-11dd-9d9a-806e6f6e6963}\ not found.
File move failed. E:\_autorun\Autorun.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8df28cc3-ab2d-11dd-9d9a-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8df28cc3-ab2d-11dd-9d9a-806e6f6e6963}\ not found.
File move failed. E:\DirectX\dxsetup.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8df28cc3-ab2d-11dd-9d9a-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8df28cc3-ab2d-11dd-9d9a-806e6f6e6963}\ not found.
File notepad readme.txt not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\\disketup:C:\Windows\system32\lnksmsdt.dll deleted successfully.
File C:\Windows\System32\lnksmsdt.dll not found.
Folder C:\Users\ACER\AppData\Local\{D3C23E26-C072-418C-8C69-320979274A33}\ not found.
Folder C:\Windows\System\KEEPER\ not found.
File C:\Windows\System32\drivers\repc.sys not found.
File C:\Users\ACER\AppData\Local\Wmoyusura.dat not found.
File C:\Users\ACER\AppData\Local\Pqobunepoza.bin not found.
File C:\Windows\System32\lnksmsdt.dll not found.
File C:\Users\ACER\AppData\Local\abodiqad.VIR not found.
 
OTL by OldTimer - Version 3.2.14.0 log created on 09202010_161059

Files\Folders moved on Reboot...
File move failed. E:\AUTORUN.INF scheduled to be moved on reboot.
File move failed. E:\_autorun\Autorun.exe scheduled to be moved on reboot.
File move failed. E:\DirectX\dxsetup.exe scheduled to be moved on reboot.

Registry entries deleted on Reboot...

cosinus 20.09.2010 15:18
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.
http://saved.im/mtm0nzyzmzd5/cofi.jpg
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Fnyrri 20.09.2010 16:17
Ich hoffe, ich hab alles richtig gemacht... hier das Log von ComboFix:


Combofix Logfile:
Code:
ComboFix 10-09-19.04 - ACER 20.09.2010  17:01:59.1.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6001.1.1252.49.1031.18.3066.1906 [GMT 2:00]
ausgeführt von:: c:\users\ACER\Desktop\cofi.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
 * Im Speicher befindliches AV aktiv.

.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\ACER\AppData\Roaming\.#
D:\install.exe

.
(((((((((((((((((((((((  Dateien erstellt von 2010-08-20 bis 2010-09-20  ))))))))))))))))))))))))))))))
.

2010-09-20 15:10 . 2010-09-20 15:10        --------        d-----w-        c:\users\Default\AppData\Local\temp
2010-09-20 14:52 . 2010-09-20 14:52        --------        d-----w-        c:\program files\CCleaner
2010-09-20 12:45 . 2010-09-20 12:45        --------        d-----w-        C:\_OTL
2010-09-20 06:37 . 2010-09-20 06:37        --------        d-----w-        c:\users\ACER\AppData\Roaming\Malwarebytes
2010-09-20 06:36 . 2010-04-29 10:19        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-20 06:36 . 2010-09-20 06:36        --------        d-----w-        c:\programdata\Malwarebytes
2010-09-20 06:36 . 2010-04-29 10:19        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2010-09-20 06:36 . 2010-09-20 06:37        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2010-09-11 21:55 . 2010-09-11 21:55        --------        d-----w-        c:\program files\Common Files\3DO Shared
2010-09-10 16:11 . 2010-09-10 16:10        185640        ----a-w-        c:\programdata\DivX\Setup\finishPlugin.dll
2010-09-10 16:11 . 2010-09-10 16:11        56997        ----a-w-        c:\programdata\DivX\WebPlayer\Uninstaller.exe
2010-09-10 16:11 . 2010-09-10 16:11        56765        ----a-w-        c:\programdata\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-09-10 16:11 . 2010-09-10 16:11        53600        ----a-w-        c:\programdata\DivX\Update\Uninstaller.exe
2010-09-10 16:11 . 2010-09-10 16:11        57691        ----a-w-        c:\programdata\DivX\Player\Uninstaller.exe
2010-09-10 16:11 . 2010-09-10 16:11        54153        ----a-w-        c:\programdata\DivX\DFXPlugin\Uninstaller.exe
2010-09-10 16:10 . 2010-09-10 16:10        144696        ----a-w-        c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.exe

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-20 14:44 . 2009-01-02 19:49        27744        ----a-w-        c:\programdata\nvModes.dat
2010-09-20 14:14 . 2009-01-02 19:43        --------        d-----w-        c:\users\ACER\AppData\Roaming\ICQ
2010-09-19 22:09 . 2009-06-20 15:52        --------        d-----w-        c:\program files\Warcraft III
2010-09-19 17:30 . 2009-01-02 13:31        --------        d-----w-        c:\program files\mIRC
2010-09-19 17:26 . 2009-08-02 00:26        --------        d-----w-        c:\users\ACER\AppData\Roaming\Skype
2010-09-19 14:06 . 2009-08-02 00:35        --------        d-----w-        c:\users\ACER\AppData\Roaming\skypePM
2010-09-11 21:55 . 2010-07-24 08:44        --------        d-----w-        c:\program files\3DO
2010-09-11 21:49 . 2009-09-29 10:43        --------        d-----w-        c:\program files\Bullfrog
2010-09-10 16:13 . 2010-05-22 09:56        57344        ----a-w-        c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-09-10 16:11 . 2010-05-22 09:54        --------        d-----w-        c:\programdata\DivX
2010-09-10 16:11 . 2009-07-02 12:19        --------        d-----w-        c:\program files\DivX
2010-09-10 16:10 . 2010-05-22 09:56        850200        ----a-w-        c:\programdata\DivX\Setup\DivXSetup.exe
2010-09-10 16:10 . 2010-05-22 09:56        1062184        ----a-w-        c:\programdata\DivX\Setup\Resource.dll
2010-09-06 18:48 . 2009-03-17 09:57        1        ----a-w-        c:\users\ACER\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-08-21 12:45 . 2008-01-21 07:15        618442        ----a-w-        c:\windows\system32\perfh007.dat
2010-08-21 12:45 . 2008-01-21 07:15        122842        ----a-w-        c:\windows\system32\perfc007.dat
2010-08-18 21:12 . 2009-01-02 21:58        --------        d-----w-        c:\program files\Diablo II
2010-08-16 07:43 . 2008-11-05 10:51        --------        d-----w-        c:\program files\Launch Manager
2010-08-15 12:51 . 2010-08-15 12:38        --------        d-----w-        c:\program files\PDFCreator
2010-08-11 18:35 . 2009-07-16 00:03        7592        ----a-w-        c:\users\ACER\AppData\Local\d3d9caps.dat
2010-08-05 08:06 . 2009-01-02 19:43        --------        d-----w-        c:\program files\ICQ6.5
2010-07-22 21:29 . 2008-04-18 08:53        --------        d-----w-        c:\program files\McAfee
2010-07-21 19:40 . 2009-01-02 22:10        36999        ----a-w-        c:\windows\DIIUnin.dat
2006-05-03 09:06 . 2009-01-04 10:38        163328        --sh--r-        c:\windows\System32\flvDX.dll
2007-02-21 10:47 . 2009-01-04 10:38        31232        --sh--r-        c:\windows\System32\msfDX.dll
2008-03-16 12:30 . 2009-01-04 10:38        216064        --sh--r-        c:\windows\System32\nbDX.dll
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-03-04 21:38        121392        ----a-w-        c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2010-03-09 26100520]
"AutoStartNPSAgent"="c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe" [2009-04-02 102400]
"ICQ"="c:\program files\ICQ6.5\ICQ.exe" [2009-11-16 172792]
"PMCLoader"="c:\program files\Pinnacle\TVCenter Pro\PMCLoader.exe" [2008-06-23 644368]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"RtHDVCpl"="RtHDVCpl.exe" [2008-04-28 6111232]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-18 1033512]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-08-03 582992]
"ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-04-23 397312]
"eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-03-04 526896]
"eAudio"="c:\program files\Acer\Empowering Technology\eAudio\eAudio.exe" [2008-03-07 544768]
"BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-06 34040]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-07-20 182808]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-08-07 13543968]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-08-07 92704]
"LManager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2008-07-02 821768]
"PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704]
"ArcadeDeluxeAgent"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2008-05-12 147456]
"CLMLServer"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2008-05-12 167936]
"PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2008-05-12 167936]
"ProductReg"="c:\program files\Acer\WR_PopUp\ProductReg.exe" [2008-09-23 6144]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"lxcgmon.exe"="c:\program files\Lexmark 2300 Series\lxcgmon.exe" [2007-04-29 205744]
"EzPrint"="c:\program files\Lexmark 2300 Series\ezprint.exe" [2007-04-29 103344]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-03-25 49152]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-03-13 81920]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"LogMeIn Hamachi Ui"="c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe" [2010-03-30 1820040]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-01 1164584]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Pinnacle Streaming Server.lnk - c:\program files\Pinnacle\Shared Files\Programs\StrmServer\StrmServer.exe [2008-3-25 603408]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-7420075-3053948626-936591600-1000]
"EnableNotifications"=dword:00000001
"EnableNotificationsRef"=dword:00000001

R0 impxti;impxti;c:\windows\System32\drivers\repc.sys [x]
R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-04-04 131072]
R3 A310;AVerMedia A310 DVB-T;c:\windows\system32\DRIVERS\AVerA310USB.sys [2008-04-15 25856]
R3 BDASwCap;AVerMedia A310 BDA DVBT Capture Device;c:\windows\system32\drivers\AVerA310Cap.sys [2008-04-15 42880]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys [2009-03-20 90112]
R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys [2009-03-20 14976]
R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys [2009-03-20 121856]
S2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl [2008-05-09 61424]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
S2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [2008-03-03 16384]
S2 CLHNService;CLHNService;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [2008-01-16 81504]
S2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [2008-03-21 24576]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2009-03-31 233472]
S2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [2010-03-30 1107336]
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2010-04-16 93320]
S2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-04-06 50424]
S2 NTIPPKernel;NTIPPKernel;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys [2008-01-16 122368]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2008-03-28 210432]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2009-03-31 36608]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [2008-04-21 81296]
S3 NETw5v32;Intel(R) Wireless WiFi Link Adaptertreiber für Windows Vista 32-Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2008-04-27 3658752]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2008-08-07 44064]
S3 winbondcir;Winbond IR Transceiver;c:\windows\system32\DRIVERS\winbondcir.sys [2007-03-28 43008]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12        REG_MULTI_SZ          Pml Driver HPZ12 Net Driver HPZ12
HPService        REG_MULTI_SZ          HPSLPSVC
hpdevmgmt        REG_MULTI_SZ          hpqcxs08 hpqddsvc
.
Inhalt des "geplante Tasks" Ordners

2010-09-14 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-01-03 12:32]

2010-07-31 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-01-03 12:32]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://start.icq.com/
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=1108&m=aspire_7730g
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\ACER\AppData\Roaming\Mozilla\Firefox\Profiles\wzcb5rou.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\programdata\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX Richtlinien ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

HKCU-Run-PMCRemote - (no file)
HKLM-Run-eRecoveryService - (no file)
HKLM-Run-NPSStartup - (no file)
AddRemove-AVerMedia A310 (MiniCard, DVB-T) - c:\program files\AVerMedia\AVerMedia A310 (MiniCard
AddRemove-{F38ADCA4-AF7C-4C73-9021-6F1EA15D15EA} - c:\program files\InstallShield Installation Information\{F38ADCA4-AF7C-4C73-9021-6F1EA15D15EA}\Setup.exeUNINSTALL



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-09-20 17:10
Windows 6.0.6001 Service Pack 1 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2010-09-20  17:14:49
ComboFix-quarantined-files.txt  2010-09-20 15:14

Vor Suchlauf: 16 Verzeichnis(se), 72.556.130.304 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 74.461.630.464 Bytes frei

- - End Of File - - 56576726D63E0A3652B3074B698201FF
--- --- ---

cosinus 20.09.2010 17:38
Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:
File::
c:\windows\System32\drivers\repc.sys

Driver::
impxti
3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Fnyrri 20.09.2010 18:39
Alles ausgeführt wie beschrieben.

Nach dem ersten, Combofix-eigenen Neustart konnte ich keine .exe-Dateien mehr öffnen, es kam immer die Fehlermeldung, sie seien mit einem ungültigen, zur Löschung vorgesehenen Registrierungsschlüssel verknüpft. Ich hab nochmal manuell neu gestartet, jetzt geht alles wieder.

Hier die log-Datei:

Combofix Logfile:
Code:
ComboFix 10-09-20.01 - ACER 20.09.2010  19:13:49.2.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6001.1.1252.49.1031.18.3066.1756 [GMT 2:00]
ausgeführt von:: c:\users\ACER\Desktop\cofi.exe
Benutzte Befehlsschalter :: c:\users\ACER\Desktop\CFScript.txt
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

FILE ::
"c:\windows\System32\drivers\repc.sys"
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

.
(((((((((((((((((((((((((((((((((((((((  Treiber/Dienste  )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_impxti


(((((((((((((((((((((((  Dateien erstellt von 2010-08-20 bis 2010-09-20  ))))))))))))))))))))))))))))))
.

2010-09-20 17:18 . 2010-09-20 17:18        --------        d-----w-        c:\users\Public\AppData\Local\temp
2010-09-20 17:18 . 2010-09-20 17:18        --------        d-----w-        c:\users\Default\AppData\Local\temp
2010-09-20 17:12 . 2010-09-20 17:12        --------        d-----w-        C:\32788R22FWJFW
2010-09-20 14:59 . 2010-09-20 15:15        --------        d-----w-        C:\cofi
2010-09-20 14:52 . 2010-09-20 14:52        --------        d-----w-        c:\program files\CCleaner
2010-09-20 12:45 . 2010-09-20 12:45        --------        d-----w-        C:\_OTL
2010-09-20 06:37 . 2010-09-20 06:37        --------        d-----w-        c:\users\ACER\AppData\Roaming\Malwarebytes
2010-09-20 06:36 . 2010-04-29 10:19        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-20 06:36 . 2010-09-20 06:36        --------        d-----w-        c:\programdata\Malwarebytes
2010-09-20 06:36 . 2010-04-29 10:19        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2010-09-20 06:36 . 2010-09-20 06:37        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2010-09-11 21:55 . 2010-09-11 21:55        --------        d-----w-        c:\program files\Common Files\3DO Shared

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-20 17:21 . 2009-01-02 19:49        27744        ----a-w-        c:\programdata\nvModes.dat
2010-09-20 17:05 . 2009-01-02 13:31        --------        d-----w-        c:\program files\mIRC
2010-09-20 14:14 . 2009-01-02 19:43        --------        d-----w-        c:\users\ACER\AppData\Roaming\ICQ
2010-09-19 22:09 . 2009-06-20 15:52        --------        d-----w-        c:\program files\Warcraft III
2010-09-19 17:26 . 2009-08-02 00:26        --------        d-----w-        c:\users\ACER\AppData\Roaming\Skype
2010-09-19 14:06 . 2009-08-02 00:35        --------        d-----w-        c:\users\ACER\AppData\Roaming\skypePM
2010-09-11 21:55 . 2010-07-24 08:44        --------        d-----w-        c:\program files\3DO
2010-09-11 21:49 . 2009-09-29 10:43        --------        d-----w-        c:\program files\Bullfrog
2010-09-10 16:13 . 2010-05-22 09:56        57344        ----a-w-        c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-09-10 16:11 . 2010-09-10 16:11        56997        ----a-w-        c:\programdata\DivX\WebPlayer\Uninstaller.exe
2010-09-10 16:11 . 2010-09-10 16:11        56765        ----a-w-        c:\programdata\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-09-10 16:11 . 2010-05-22 09:54        --------        d-----w-        c:\programdata\DivX
2010-09-10 16:11 . 2009-07-02 12:19        --------        d-----w-        c:\program files\DivX
2010-09-10 16:11 . 2010-09-10 16:11        53600        ----a-w-        c:\programdata\DivX\Update\Uninstaller.exe
2010-09-10 16:11 . 2010-09-10 16:11        57691        ----a-w-        c:\programdata\DivX\Player\Uninstaller.exe
2010-09-10 16:11 . 2010-09-10 16:11        54153        ----a-w-        c:\programdata\DivX\DFXPlugin\Uninstaller.exe
2010-09-10 16:10 . 2010-09-10 16:11        185640        ----a-w-        c:\programdata\DivX\Setup\finishPlugin.dll
2010-09-10 16:10 . 2010-09-10 16:10        144696        ----a-w-        c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.exe
2010-09-10 16:10 . 2010-05-22 09:56        850200        ----a-w-        c:\programdata\DivX\Setup\DivXSetup.exe
2010-09-10 16:10 . 2010-05-22 09:56        1062184        ----a-w-        c:\programdata\DivX\Setup\Resource.dll
2010-09-06 18:48 . 2009-03-17 09:57        1        ----a-w-        c:\users\ACER\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-08-21 12:45 . 2008-01-21 07:15        618442        ----a-w-        c:\windows\system32\perfh007.dat
2010-08-21 12:45 . 2008-01-21 07:15        122842        ----a-w-        c:\windows\system32\perfc007.dat
2010-08-18 21:12 . 2009-01-02 21:58        --------        d-----w-        c:\program files\Diablo II
2010-08-16 07:43 . 2008-11-05 10:51        --------        d-----w-        c:\program files\Launch Manager
2010-08-15 12:51 . 2010-08-15 12:38        --------        d-----w-        c:\program files\PDFCreator
2010-08-11 18:35 . 2009-07-16 00:03        7592        ----a-w-        c:\users\ACER\AppData\Local\d3d9caps.dat
2010-08-05 08:06 . 2009-01-02 19:43        --------        d-----w-        c:\program files\ICQ6.5
2010-07-22 21:29 . 2008-04-18 08:53        --------        d-----w-        c:\program files\McAfee
2010-07-21 19:40 . 2009-01-02 22:10        36999        ----a-w-        c:\windows\DIIUnin.dat
2006-05-03 09:06 . 2009-01-04 10:38        163328        --sh--r-        c:\windows\System32\flvDX.dll
2007-02-21 10:47 . 2009-01-04 10:38        31232        --sh--r-        c:\windows\System32\msfDX.dll
2008-03-16 12:30 . 2009-01-04 10:38        216064        --sh--r-        c:\windows\System32\nbDX.dll
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-03-04 21:38        121392        ----a-w-        c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2010-03-09 26100520]
"AutoStartNPSAgent"="c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe" [2009-04-02 102400]
"ICQ"="c:\program files\ICQ6.5\ICQ.exe" [2009-11-16 172792]
"PMCLoader"="c:\program files\Pinnacle\TVCenter Pro\PMCLoader.exe" [2008-06-23 644368]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"RtHDVCpl"="RtHDVCpl.exe" [2008-04-28 6111232]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-18 1033512]
"ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-04-23 397312]
"eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-03-04 526896]
"eAudio"="c:\program files\Acer\Empowering Technology\eAudio\eAudio.exe" [2008-03-07 544768]
"BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-06 34040]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-07-20 182808]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-08-07 13543968]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-08-07 92704]
"LManager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2008-07-02 821768]
"PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704]
"ArcadeDeluxeAgent"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2008-05-12 147456]
"CLMLServer"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2008-05-12 167936]
"PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2008-05-12 167936]
"ProductReg"="c:\program files\Acer\WR_PopUp\ProductReg.exe" [2008-09-23 6144]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"lxcgmon.exe"="c:\program files\Lexmark 2300 Series\lxcgmon.exe" [2007-04-29 205744]
"EzPrint"="c:\program files\Lexmark 2300 Series\ezprint.exe" [2007-04-29 103344]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-03-25 49152]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-03-13 81920]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"LogMeIn Hamachi Ui"="c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe" [2010-03-30 1820040]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-01 1164584]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Pinnacle Streaming Server.lnk - c:\program files\Pinnacle\Shared Files\Programs\StrmServer\StrmServer.exe [2008-3-25 603408]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-7420075-3053948626-936591600-1000]
"EnableNotifications"=dword:00000001
"EnableNotificationsRef"=dword:00000001

R2 0313791284999801mcinstcleanup;McAfee Application Installer Cleanup (0313791284999801);c:\users\ACER\AppData\Local\Temp\031379~1.EXE [x]
R3 A310;AVerMedia A310 DVB-T;c:\windows\system32\DRIVERS\AVerA310USB.sys [2008-04-15 25856]
R3 BDASwCap;AVerMedia A310 BDA DVBT Capture Device;c:\windows\system32\drivers\AVerA310Cap.sys [2008-04-15 42880]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys [2009-03-20 90112]
R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys [2009-03-20 14976]
R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys [2009-03-20 121856]
S2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl [2008-05-09 61424]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
S2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [2008-03-03 16384]
S2 CLHNService;CLHNService;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [2008-01-16 81504]
S2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [2008-03-21 24576]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2009-03-31 233472]
S2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [2010-03-30 1107336]
S2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-04-06 50424]
S2 NTIPPKernel;NTIPPKernel;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys [2008-01-16 122368]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-04-04 131072]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2008-03-28 210432]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2009-03-31 36608]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [2008-04-21 81296]
S3 NETw5v32;Intel(R) Wireless WiFi Link Adaptertreiber für Windows Vista 32-Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2008-04-27 3658752]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2008-08-07 44064]
S3 winbondcir;Winbond IR Transceiver;c:\windows\system32\DRIVERS\winbondcir.sys [2007-03-28 43008]


--- Andere Dienste/Treiber im Speicher ---

*NewlyCreated* - FSUSBEXDISK

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12        REG_MULTI_SZ          Pml Driver HPZ12 Net Driver HPZ12
HPService        REG_MULTI_SZ          HPSLPSVC
hpdevmgmt        REG_MULTI_SZ          hpqcxs08 hpqddsvc
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://start.icq.com/
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=1108&m=aspire_7730g
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\ACER\AppData\Roaming\Mozilla\Firefox\Profiles\wzcb5rou.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\programdata\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX Richtlinien ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-09-20 19:24
Windows 6.0.6001 Service Pack 1 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'Explorer.exe'(6068)
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\sysenv.dll
c:\windows\System32\SysHook.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\conime.exe
c:\windows\RtHDVCpl.exe
c:\windows\System32\rundll32.exe
c:\program files\Launch Manager\QtZgAcer.EXE
c:\windows\system32\agrsmsvc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\lxcgcoms.exe
c:\acer\Mobility Center\MobilityService.exe
c:\program files\Cyberlink\Shared files\RichVideo.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\wbem\unsecapp.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-09-20  19:30:09 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2010-09-20 17:30
ComboFix2.txt  2010-09-20 15:14

Vor Suchlauf: 21 Verzeichnis(se), 74.540.662.784 Bytes frei
Nach Suchlauf: 23 Verzeichnis(se), 74.212.032.512 Bytes frei

- - End Of File - - A8D5282D0E78703615910CA9C5B9A7CD
--- --- ---

cosinus 20.09.2010 18:51
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus

Anschließend den bootkit_remover herunterladen. Entpacke das Tool in einen eigenen Ordner auf dem Desktop und führe in diesem Ordner die Datei remove.exe aus.

Wenn Du Windows Vista oder Windows 7 verwendest, musst Du die remover.exe über ein Rechtsklick => als Administrator ausführen

Ein schwarzes Fenster wird sich öffnen und automatisch nach bösartigen Veränderungen im MBR suchen.
Poste dann bitte, ob es Veränderungen gibt und wenn ja in welchem device. Am besten alles posten was die remover.exe ausgibt.

Fnyrri 20.09.2010 19:44
GMER hab ich beim besten Willen nicht zum absturzfreien Laufen bekommen.

Hier das OSAM-Log:

OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 20:42:26 on 20.09.2010

OS: Windows Vista Home Premium Edition Service Pack 1 (Build 6001), 32-bit
Default Browser: Mozilla Corporation Firefox 3.6.10

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgio" (avgio) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"catchme" (catchme) - ? - C:\cofi12561c\catchme.sys  (File not found)
"FsUsbExDisk" (FsUsbExDisk) - ? - C:\Windows\system32\FsUsbExDisk.SYS  (File found, but it contains no detailed information)
"Hamachi Network Interface" (hamachi) - "LogMeIn, Inc." - C:\Windows\System32\DRIVERS\hamachi.sys
"int15" (int15) - "Acer, Inc." - C:\Windows\system32\drivers\int15.sys
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"NTIPPKernel" (NTIPPKernel) - "Cyberlink Corp." - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys
"PSDFilter" (PSDFilter) - "Egis Incorporated" - C:\Windows\System32\DRIVERS\psdfilter.sys
"PSDNServ" (PSDNServ) - "Egis Incorporated" - C:\Windows\System32\DRIVERS\PSDNServ.sys
"PSDVdisk" (psdvdisk) - "Egis Incorporated" - C:\Windows\System32\DRIVERS\PSDVdisk.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys
"UBHelper" (UBHelper) - "NewTech Infosystems Corporation" - C:\Windows\system32\drivers\UBHelper.sys
"Upper Class Filter Driver" (NTIDrvr) - "NewTech Infosystems, Inc." - C:\Windows\System32\DRIVERS\NTIDrvr.sys
"{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}" ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796}) - "Cyberlink Corp." - C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -  (File not found | COM-object registry key not found)
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -  (File not found | COM-object registry key not found)
{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} "DragDropProtect Class" - "Egis Incorporated" - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
{2b45bd21-71f8-4c8c-a87a-7eeb25a1a3e0} "EPM-PO Shell Extensions" - ? - epm-po.dll  (File not found)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -  (File not found | COM-object registry key not found)
{00020d75-0000-0000-c000-000000000046} "lnkfile" - ? -  (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - C:\Program Files\Real\RealPlayer\rpshell.dll
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -  (File not found | COM-object registry key not found)

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_17" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} "Java Plug-in 1.6.0_17" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_17" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_17.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
{D0C0F75C-683A-4390-A791-1ACFD5599AB8} "Oberon Flash Game Host" - "Oberon Media, Inc." - C:\Windows\Downloaded Program Files\OberonGameHost.dll / hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
{DDE87865-83C5-48c4-8357-2F5B1AA84522} "HP Intelligente Auswahl" - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
"ICQ6" - "ICQ, LLC." - C:\Program Files\ICQ6.5\ICQ.exe
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "Acer eDataSecurity Management" - "Egis Incorporated." - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} "HP Smart BHO Class" - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} "ShowBarObj Class" - "Egis" - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
{02478D38-C3F9-4efb-9B51-7695ECA05670} "{02478D38-C3F9-4efb-9B51-7695ECA05670}" - ? -  (File not found | COM-object registry key not found)

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\ACER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"Pinnacle Streaming Server.lnk" - "Avid Development GmbH" - C:\Program Files\Pinnacle\Shared Files\Programs\StrmServer\StrmServer.exe  (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"AutoStartNPSAgent" - "Samsung Electronics Co., Ltd." - C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
"PMCLoader" - "Pinnacle Systems GmbH" - C:\Program Files\Pinnacle\TVCenter Pro\PMCLoader.exe -checktasks
"Skype" - "Skype Technologies S.A." - "C:\Program Files\Skype\\Phone\Skype.exe" /nosplash /minimized
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"ArcadeDeluxeAgent" - "CyberLink Corp." - "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe"
"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"BkupTray" - ? - "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe"
"CLMLServer" - "CyberLink" - "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe"
"DivXUpdate" - ? - "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
"eAudio" - "Acer Incorporated" - "C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe"
"eDataSecurity Loader" - "Egis Incorporated" - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
"ePower_DMC" - "Acer Inc." - C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
"EzPrint" - "Lexmark International Inc." - "C:\Program Files\Lexmark 2300 Series\ezprint.exe"
"HP Software Update" - "Hewlett-Packard" - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
"hpqSRMon" - "Hewlett-Packard" - C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
"IAAnotif" - "Intel Corporation" - C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
"LManager" - "Dritek System Inc." - C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
"LogMeIn Hamachi Ui" - "LogMeIn Inc." - "C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
"lxcgmon.exe" - "Lexmark International, Inc." - "C:\Program Files\Lexmark 2300 Series\lxcgmon.exe"
"PlayMovie" - "Acer Corp." - "C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe"
"PLFSetI" - ? - C:\Windows\PLFSetI.exe
"ProductReg" - "Acer" - "C:\Program Files\Acer\WR_PopUp\ProductReg.exe"
"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Java\jre6\bin\jusched.exe"

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"PCL Language Monitor" - "Hewlett-Packard Company" - C:\Windows\system32\hpz3l692.dll
"PDFCreator" - ? - C:\Windows\system32\pdfcmnnt.dll  (File found, but it contains no detailed information)
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"CLHNService" (CLHNService) - ? - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files\Cyberlink\Shared files\RichVideo.exe
"eDataSecurity Service" (eDataSecurity Service) - "Egis Incorporated" - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
"Empowering Technology Service" (ETService) - ? - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
"FsUsbExService" (FsUsbExService) - "Teruten" - C:\Windows\system32\FsUsbExService.Exe
"HP CUE DeviceDiscovery Service" (hpqddsvc) - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll
"HP Network Devices Support" (HPSLPSVC) - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\HPSLPSVC32.DLL
"hpqcxs08" (hpqcxs08) - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll
"Intel(R) Matrix Storage Event Monitor" (IAANTMON) - "Intel Corporation" - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
"LightScribeService Direct Disc Labeling Service" (LightScribeService) - "Hewlett-Packard Company" - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
"LogMeIn Hamachi 2.0 Tunneling Engine" (Hamachi2Svc) - "LogMeIn Inc." - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
"McAfee Application Installer Cleanup (0313791284999801)" (0313791284999801mcinstcleanup) - ? - C:\Users\ACER\AppData\Local\Temp\031379~1.EXE C:\PROGRA~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service  (File not found)
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"MobilityService" (MobilityService) - ? - C:\Acer\Mobility Center\MobilityService.exe
"Net Driver HPZ12" (Net Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZinw12.dll
"NTI Backup Now 5 Agent Service" (BUNAgentSvc) - "NewTech Infosystems, Inc." - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
"NTI Backup Now 5 Backup Service" (NTIBackupSvc) - "NewTech InfoSystems, Inc." - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
"NTI Backup Now 5 Scheduler Service" (NTISchedulerSvc) - ? - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe  (File found, but it contains no detailed information)
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"Pml Driver HPZ12" (Pml Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZipm12.dll
"ServiceLayer" (ServiceLayer) - "Nokia." - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

[Winlogon]
-----( HKCU\Control Panel\Desktop )-----
"SCRNSAVE.EXE" - ? - C:\Windows\system32\acer.scr  (File found, but it contains no detailed information)

===[ Logfile end ]=========================================[ Logfile end ]===

Fnyrri 20.09.2010 19:48
Und hier noch das Ergebnis vom Bootkit Remover:

hxxp://250kb.de/wrQZX4I

cosinus 20.09.2010 21:09
Downloade Dir bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
  • Doppelklick auf die MBRCheck.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Das Tool braucht nur eine Sekunde.
  • Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.
Poste mir bitte den Inhalt des .txt Dokumentes

Fnyrri 20.09.2010 21:31
Here we go:

Code:
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:                       
Windows Version:                Windows Vista Home Premium Edition
Windows Information:                Service Pack 1 (build 6001), 32-bit
Base Board Manufacturer:        Acer, Inc.
BIOS Manufacturer:                Acer
System Manufacturer:                Acer, inc.
System Product Name:                Aspire 7730G
Logical Drives Mask:                0x0000003c

Kernel Drivers (total 163):
  0x82052000 \SystemRoot\system32\ntkrnlpa.exe
  0x8201F000 \SystemRoot\system32\hal.dll
  0x80401000 \SystemRoot\system32\kdcom.dll
  0x80409000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
  0x80469000 \SystemRoot\system32\PSHED.dll
  0x8047A000 \SystemRoot\system32\BOOTVID.dll
  0x80482000 \SystemRoot\system32\CLFS.SYS
  0x804C3000 \SystemRoot\system32\CI.dll
  0x80606000 \SystemRoot\system32\drivers\Wdf01000.sys
  0x80682000 \SystemRoot\system32\drivers\WDFLDR.SYS
  0x8068F000 \SystemRoot\system32\drivers\acpi.sys
  0x806D5000 \SystemRoot\system32\drivers\WMILIB.SYS
  0x806DE000 \SystemRoot\system32\drivers\msisadrv.sys
  0x806E6000 \SystemRoot\system32\drivers\pci.sys
  0x8070D000 \SystemRoot\System32\drivers\partmgr.sys
  0x8071C000 \SystemRoot\system32\DRIVERS\compbatt.sys
  0x8071F000 \SystemRoot\system32\DRIVERS\BATTC.SYS
  0x80729000 \SystemRoot\system32\drivers\volmgr.sys
  0x80738000 \SystemRoot\System32\drivers\volmgrx.sys
  0x80782000 \SystemRoot\System32\drivers\mountmgr.sys
  0x80792000 \SystemRoot\System32\Drivers\UBHelper.sys
  0x8260E000 \SystemRoot\system32\DRIVERS\iaStor.sys
  0x826E7000 \SystemRoot\system32\drivers\atapi.sys
  0x826EF000 \SystemRoot\system32\drivers\ataport.SYS
  0x8270D000 \SystemRoot\system32\drivers\msahci.sys
  0x82717000 \SystemRoot\system32\drivers\PCIIDEX.SYS
  0x82725000 \SystemRoot\system32\drivers\fltmgr.sys
  0x82757000 \SystemRoot\system32\drivers\fileinfo.sys
  0x82767000 \SystemRoot\system32\DRIVERS\psdfilter.sys
  0x82770000 \SystemRoot\System32\Drivers\ksecdd.sys
  0x8A00C000 \SystemRoot\system32\drivers\ndis.sys
  0x8A117000 \SystemRoot\system32\drivers\msrpc.sys
  0x8A142000 \SystemRoot\system32\drivers\NETIO.SYS
  0x8A203000 \SystemRoot\System32\Drivers\Ntfs.sys
  0x8A312000 \SystemRoot\system32\drivers\volsnap.sys
  0x8A34B000 \SystemRoot\System32\Drivers\spldr.sys
  0x8A353000 \SystemRoot\System32\Drivers\mup.sys
  0x8A362000 \SystemRoot\System32\drivers\ecache.sys
  0x8A389000 \SystemRoot\system32\drivers\disk.sys
  0x8A39A000 \SystemRoot\system32\drivers\CLASSPNP.SYS
  0x8A3BB000 \SystemRoot\system32\drivers\crcdisk.sys
  0x8DAE0000 \SystemRoot\system32\DRIVERS\tunnel.sys
  0x8DAEB000 \SystemRoot\system32\DRIVERS\tunmp.sys
  0x8DAF4000 \SystemRoot\system32\DRIVERS\CmBatt.sys
  0x8DAF8000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
  0x8DE05000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
  0x8E538000 \SystemRoot\System32\drivers\dxgkrnl.sys
  0x8E5D7000 \SystemRoot\System32\drivers\watchdog.sys
  0x8E5E4000 \SystemRoot\system32\DRIVERS\usbuhci.sys
  0x8DB01000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0x8E5EF000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0x8DB3F000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
  0x8DB51000 \SystemRoot\system32\DRIVERS\jmcr.sys
  0x8DB65000 \SystemRoot\system32\DRIVERS\SCSIPORT.SYS
  0x8E800000 \SystemRoot\system32\DRIVERS\NETw5v32.sys
  0x8EB87000 \SystemRoot\system32\DRIVERS\b57nd60x.sys
  0x8EBBE000 \SystemRoot\system32\DRIVERS\winbondcir.sys
  0x8EBD3000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0x8EBE6000 \SystemRoot\system32\DRIVERS\DKbFltr.sys
  0x8EBF0000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0x8DB8B000 \SystemRoot\system32\DRIVERS\SynTP.sys
  0x8EBFB000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0x8DBBA000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0x8DBC5000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0x8DBDD000 \SystemRoot\system32\DRIVERS\NTIDrvr.sys
  0x8DBE5000 \SystemRoot\system32\DRIVERS\intelppm.sys
  0x8A3D1000 \SystemRoot\system32\DRIVERS\msiscsi.sys
  0x8A17C000 \SystemRoot\system32\DRIVERS\storport.sys
  0x8DBF4000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0x8A1BD000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
  0x8A1D4000 \SystemRoot\system32\DRIVERS\ndistapi.sys
  0x8079A000 \SystemRoot\system32\DRIVERS\ndiswan.sys
  0x8A1DF000 \SystemRoot\system32\DRIVERS\raspppoe.sys
  0x827E1000 \SystemRoot\system32\DRIVERS\raspptp.sys
  0x807BD000 \SystemRoot\system32\DRIVERS\rassstp.sys
  0x8DE00000 \SystemRoot\system32\DRIVERS\hamachi.sys
  0x8A1EE000 \SystemRoot\system32\DRIVERS\termdd.sys
  0x8EBFD000 \SystemRoot\system32\DRIVERS\swenum.sys
  0x807D2000 \SystemRoot\system32\DRIVERS\ks.sys
  0x82600000 \SystemRoot\system32\DRIVERS\circlass.sys
  0x8A000000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0x805A3000 \SystemRoot\system32\DRIVERS\umbus.sys
  0x805B0000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0x805E4000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0x8EC04000 \SystemRoot\system32\drivers\RTKVHDA.sys
  0x8EE0B000 \SystemRoot\system32\drivers\portcls.sys
  0x8EE38000 \SystemRoot\system32\drivers\drmk.sys
  0x8EE5D000 \SystemRoot\system32\DRIVERS\AGRSM.sys
  0x8EF83000 \SystemRoot\system32\drivers\modem.sys
  0x8EF90000 \SystemRoot\system32\drivers\nvhda32v.sys
  0x8F40F000 \SystemRoot\System32\Drivers\dvb7700all.sys
  0x8F47C000 \SystemRoot\System32\Drivers\BdaSup.SYS
  0x8F47F000 \SystemRoot\system32\DRIVERS\hidir.sys
  0x8F48A000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
  0x8F49A000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0x8F4A1000 \SystemRoot\system32\DRIVERS\kbdhid.sys
  0x8F4AA000 \SystemRoot\system32\DRIVERS\mouhid.sys
  0x8F4B2000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0x8F4BB000 \SystemRoot\System32\Drivers\Null.SYS
  0x8F4C2000 \SystemRoot\System32\Drivers\Beep.SYS
  0x8F4C9000 \SystemRoot\System32\drivers\vga.sys
  0x8F4D5000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
  0x8F4F6000 \SystemRoot\system32\DRIVERS\usbccgp.sys
  0x8F50D000 \SystemRoot\System32\Drivers\usbvideo.sys
  0x8F52E000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0x8F536000 \SystemRoot\system32\drivers\rdpencdd.sys
  0x8F53E000 \SystemRoot\System32\Drivers\Msfs.SYS
  0x8F549000 \SystemRoot\System32\Drivers\Npfs.SYS
  0x8F557000 \SystemRoot\System32\DRIVERS\rasacd.sys
  0x8FA0C000 \SystemRoot\System32\drivers\tcpip.sys
  0x8FAF5000 \SystemRoot\System32\drivers\fwpkclnt.sys
  0x8FB10000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
  0x8FB22000 \SystemRoot\system32\DRIVERS\tdx.sys
  0x8FB38000 \SystemRoot\system32\DRIVERS\smb.sys
  0x8FB4C000 \SystemRoot\system32\drivers\afd.sys
  0x8FB94000 \SystemRoot\System32\DRIVERS\netbt.sys
  0x8FBC6000 \SystemRoot\system32\DRIVERS\pacer.sys
  0x8FBDC000 \SystemRoot\system32\DRIVERS\netbios.sys
  0x8FBEA000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0x8FA00000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
  0x8F560000 \SystemRoot\system32\DRIVERS\rdbss.sys
  0x8F59C000 \SystemRoot\system32\drivers\nsiproxy.sys
  0x8F5A6000 \SystemRoot\System32\Drivers\dfsc.sys
  0x8F5BD000 \SystemRoot\system32\DRIVERS\avipbb.sys
  0x8FA06000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys
  0x8F5D9000 \SystemRoot\system32\DRIVERS\hidusb.sys
  0x8EF9E000 \SystemRoot\System32\Drivers\fastfat.SYS
  0x8F5E2000 \SystemRoot\system32\DRIVERS\cdfs.sys
  0x8F400000 \SystemRoot\System32\Drivers\crashdmp.sys
  0x8DA00000 \SystemRoot\System32\Drivers\dump_iaStor.sys
  0x96E80000 \SystemRoot\System32\win32k.sys
  0x8EFC6000 \SystemRoot\System32\drivers\Dxapi.sys
  0x8EFD0000 \SystemRoot\system32\DRIVERS\monitor.sys
  0x970A0000 \SystemRoot\System32\TSDDD.dll
  0x8EFDF000 \SystemRoot\system32\drivers\luafv.sys
  0x9B602000 \SystemRoot\system32\DRIVERS\avgntflt.sys
  0x970C0000 \SystemRoot\System32\cdd.dll
  0x9B616000 \SystemRoot\system32\drivers\spsys.sys
  0x9B6C5000 \SystemRoot\system32\DRIVERS\ipfltdrv.sys
  0x9B6D7000 \SystemRoot\system32\DRIVERS\lltdio.sys
  0x9B6E7000 \SystemRoot\system32\DRIVERS\nwifi.sys
  0x9B711000 \SystemRoot\system32\DRIVERS\ndisuio.sys
  0x9B71B000 \SystemRoot\system32\DRIVERS\rspndr.sys
  0x9B72E000 \SystemRoot\system32\drivers\HTTP.sys
  0x9B799000 \SystemRoot\System32\DRIVERS\srvnet.sys
  0x9B7B6000 \SystemRoot\system32\DRIVERS\bowser.sys
  0x9B7CF000 \SystemRoot\System32\drivers\mpsdrv.sys
  0x9DE08000 \SystemRoot\system32\drivers\mrxdav.sys
  0x9DE28000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0x9DE47000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
  0x9DE80000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
  0x9DE98000 \SystemRoot\System32\DRIVERS\srv2.sys
  0x9DEBF000 \SystemRoot\System32\DRIVERS\srv.sys
  0x9DF0B000 \??\C:\Windows\system32\drivers\int15.sys
  0x9DF12000 \??\C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys
  0xAAE05000 \SystemRoot\system32\drivers\peauth.sys
  0xAAEE3000 \SystemRoot\system32\DRIVERS\PSDNServ.sys
  0xAAEEC000 \SystemRoot\system32\DRIVERS\PSDVdisk.sys
  0xAAEFE000 \SystemRoot\System32\Drivers\secdrv.SYS
  0xAAF08000 \SystemRoot\System32\drivers\tcpipreg.sys
  0xAAF14000 \??\C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl
  0xAAF35000 \??\C:\Windows\system32\FsUsbExDisk.SYS
  0x77300000 \Windows\System32\ntdll.dll

Processes (total 93):
      0 System Idle Process
      4 SYSTEM
    492 C:\Windows\System32\smss.exe
    624 csrss.exe
    676 C:\Windows\System32\wininit.exe
    688 csrss.exe
    720 C:\Windows\System32\services.exe
    732 C:\Windows\System32\lsass.exe
    744 C:\Windows\System32\lsm.exe
    880 C:\Windows\System32\svchost.exe
    944 C:\Windows\System32\nvvsvc.exe
    972 C:\Windows\System32\svchost.exe
    1008 C:\Windows\System32\svchost.exe
    1060 C:\Windows\System32\svchost.exe
    1100 C:\Windows\System32\svchost.exe
    1132 C:\Windows\System32\svchost.exe
    1192 C:\Windows\System32\audiodg.exe
    1252 C:\Windows\System32\SLsvc.exe
    1296 C:\Windows\System32\svchost.exe
    1384 C:\Windows\System32\winlogon.exe
    1452 C:\Windows\System32\svchost.exe
    1668 C:\Windows\System32\spoolsv.exe
    1692 C:\Program Files\Avira\AntiVir Desktop\sched.exe
    1704 C:\Windows\System32\svchost.exe
    1952 C:\Windows\System32\rundll32.exe
    956 C:\Windows\System32\taskeng.exe
    1128 C:\Windows\System32\dwm.exe
    1460 C:\Windows\explorer.exe
    2080 C:\Windows\System32\taskeng.exe
    2204 C:\Program Files\Windows Defender\MSASCui.exe
    2224 C:\Windows\RtHDVCpl.exe
    2248 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    2272 C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
    2300 C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
    2340 C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe
    2360 C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
    2368 C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    2384 C:\Windows\System32\rundll32.exe
    2392 C:\Program Files\Launch Manager\QtZgAcer.EXE
    2408 C:\Windows\PLFSetI.exe
    2416 C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
    2424 C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
    2436 C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
    2476 C:\Program Files\Lexmark 2300 Series\lxcgmon.exe
    2484 C:\Program Files\Lexmark 2300 Series\ezprint.exe
    2512 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    2528 C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe
    2544 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    2600 C:\Program Files\Java\jre6\bin\jusched.exe
    2664 C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe
    2672 C:\Program Files\DivX\DivX Update\DivXUpdate.exe
    2716 C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
    2740 C:\Program Files\Pinnacle\TVCenter Pro\PMCLoader.exe
    2752 C:\Program Files\Windows Media Player\wmpnscfg.exe
    2792 C:\Program Files\Pinnacle\Shared Files\Programs\StrmServer\StrmServer.exe
    3356 C:\Users\ACER\AppData\Local\Temp\RtkBtMnt.exe
    3440 C:\Windows\System32\agrsmsvc.exe
    3456 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    3468 C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
    3480 C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
    3504 C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
    3528 C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
    3668 C:\Windows\System32\FsUsbExService.Exe
    3688 C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
    3720 C:\Windows\System32\svchost.exe
    3748 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    3764 C:\Windows\System32\lxcgcoms.exe
    3788 C:\ACER\Mobility Center\MobilityService.exe
    3868 C:\Windows\System32\svchost.exe
    3908 C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
    3952 C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
    3992 C:\Windows\System32\svchost.exe
    4008 C:\Windows\System32\svchost.exe
    4052 C:\Program Files\Cyberlink\Shared files\RichVideo.exe
    2060 C:\Windows\System32\svchost.exe
    2280 C:\Windows\System32\svchost.exe
    1924 C:\Windows\System32\SearchIndexer.exe
    968 C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
    3324 C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    2040 C:\Program Files\Windows Media Player\wmpnetwk.exe
    3796 C:\Windows\System32\svchost.exe
    4240 WmiPrvSE.exe
    4248 unsecapp.exe
    4272 C:\Windows\System32\wbem\unsecapp.exe
    5632 C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe
    5716 C:\Windows\System32\wuauclt.exe
    5476 C:\Windows\System32\conime.exe
    5792 C:\Program Files\Mozilla Firefox\firefox.exe
    6104 C:\Program Files\mIRC\mirc.exe
    952 C:\Program Files\3DO\Heroes 3 Complete\HEROES3.EXE
    5844 C:\Windows\System32\SearchProtocolHost.exe
    5452 C:\Windows\System32\SearchFilterHost.exe
    1536 C:\Users\ACER\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000002`80100000  (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000026`82e00000  (NTFS)
\\.\F: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00  (FAT32)

PhysicalDrive0 Model Number: WDCWD3200BEVT-22ZCT0, Rev: 11.01A11
PhysicalDrive1 Model Number: ST3500830AS, Rev:

      Size  Device Name          MBR Status
  --------------------------------------------
    298 GB  \\.\PhysicalDrive0  Acer MBR code detected
            SHA1: 32C70BE973F8E85AEDC1594C905FB8D402DF20D6
    465 GB  \\.\PhysicalDrive1  RE: Windows XP MBR code detected
            SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Done!

cosinus 21.09.2010 10:28
Zitat:
Size Device Name MBR Status
--------------------------------------------
298 GB \\.\PhysicalDrive0 Acer MBR code detected
SHA1: 32C70BE973F8E85AEDC1594C905FB8D402DF20D6
465 GB \\.\PhysicalDrive1 RE: Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Fnyrri 21.09.2010 12:11
Hi,

Malwarebytes-Vollscan ist fertig, den anderen mache ich direkt im Anschluss.
Eine Frage: Der Antivir-Guard meckert sporadisch über Dateien im C\OTL\MovedFiles...(genauer weiß ich's nicht mehr, ich hab es versäumt, einen Screenshot von der Warnung zu machen)
Muss ich mir darüber Gedanken machen, oder sind diese Dateien schon "in guten Händen", da sich OTL ja schon darum "gekümmert" hat?

Code:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4662

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

21.09.2010 13:11:39
mbam-log-2010-09-21 (13-11-39).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|F:\|)
Durchsuchte Objekte: 319988
Laufzeit: 1 Stunde(n), 19 Minute(n), 7 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

cosinus 21.09.2010 14:20
Zitat:
oder sind diese Dateien schon "in guten Händen", da sich OTL ja schon darum "gekümmert" hat?
So ist es :)

Wir haben mit OTL die schädlichen Dateien gefixt. OTL löscht diese nicht, sondern verschiebt diese nach C:\_OTL falls man diese doch nocht braucht (weil versehentlich was Gutes gefixt) oder noch auswerten möchte ;)

Fnyrri 21.09.2010 14:36
Dann bin ich beruhigt :)

Hier noch das andere Log:

Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 09/21/2010 at 03:30 PM

Application Version : 4.43.1000

Core Rules Database Version : 5548
Trace Rules Database Version: 3360

Scan type      : Complete Scan
Total Scan Time : 02:11:38

Memory items scanned      : 831
Memory threats detected  : 0
Registry items scanned    : 9666
Registry threats detected : 0
File items scanned        : 184739
File threats detected    : 7

Adware.Tracking Cookie
        C:\Users\ACER\AppData\Roaming\Microsoft\Windows\Cookies\acer@tradedoubler[1].txt
        C:\Users\ACER\AppData\Roaming\Microsoft\Windows\Cookies\acer@ad.yieldmanager[2].txt
        C:\Users\ACER\AppData\Roaming\Microsoft\Windows\Cookies\acer@doubleclick[1].txt
        C:\Users\ACER\AppData\Roaming\Microsoft\Windows\Cookies\acer@atwola[1].txt
        C:\Users\ACER\AppData\Roaming\Microsoft\Windows\Cookies\acer@atdmt[2].txt
        C:\Users\ACER\AppData\Roaming\Microsoft\Windows\Cookies\acer@content.yieldmanager[3].txt
        C:\Users\ACER\AppData\Roaming\Microsoft\Windows\Cookies\acer@content.yieldmanager[2].txt

cosinus 21.09.2010 17:58
Sieht ok aus, da wurden nur Cookies gefunden.
Noch Probleme oder weitere Funde in der Zwischenzeit?

Fnyrri 21.09.2010 18:19
Nein, keine weiteren Funde oder sonstigen Probleme.
Heißt das, ich bin mit großer Wahrscheinlichkeit wieder clean?

cosinus 21.09.2010 18:27
Dann wären wir durch! :abklatsch:

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update



PDF-Reader aktualisieren
Dein Adobe Reader ist nicht aktuell, was ein großes Sicherheitsrisiko darstellt. Du solltest daher besser die alte Version über Systemsteuerung => Software deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst.

Ich empfehle einen alternativen PDF-Reader wie SumatraPDF oder Foxit PDF Reader, beide sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers, hier der direkte Downloadlink => http://filepony.de/?q=Flash+Player


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

Fnyrri 21.09.2010 18:37
Lieber cosinus/Arne,

vielen, vielen Dank für deine rasche, kompetente und zielführende Hilfe! Als jemand, der von PCs nur unwesentlich mehr versteht als "man kann damit spielen und arbeiten", wäre ich völlig aufgeschmissen gewesen ohne deinen Rat :) Ich kann mich nicht genug dafür bedanken, dass du mir uneigennützig und hilfsbereit deine Zeit geopfert hast.

Ich werde mich noch heute darum kümmern, dass alle nötigen Updates auf dem Rechner landen, damit ich nicht so bald wieder Gast hier im Forum sein muss ;) Und sobald mein Hungerlohn für diesen Monat eingetroffen ist, werde ich eine kleine Spende ans Forum leisten.

Vielen Dank nochmal,
Fnyrri


Alle Zeitangaben in WEZ +1. Es ist jetzt 15:51 Uhr.

Copyright ©2000-2024, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130