Trojaner-Board - Rechner langsam nach Trojaner-Entfernung

Hallo,
habe die Programme ausgeführt wie beschrieben.
Hier der Inhalt von combofix.txt

Combofix Logfile:

Code:

ComboFix 11-04-10.04 - Christian 11.04.2011  20:07:02.1.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.2046.1176 [GMT 2:00]

ausgeführt von:: c:\users\Christian\Desktop\cofi.exe

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files\Setup.exe

c:\users\Christian\AppData\Roaming\MSA

c:\users\Christian\EmsisoftAntiMalwareSetup.exe

c:\users\Christian\NAVIGON_Fresh_setup.exe

c:\users\Christian\wrar371d.exe

c:\windows\hide.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-03-11 bis 2011-04-11  ))))))))))))))))))))))))))))))

.

.

2011-04-11 18:15 . 2011-04-11 18:15        --------        d-----w-        c:\users\Christian\AppData\Local\temp

2011-04-11 18:15 . 2011-04-11 18:15        --------        d-----w-        c:\users\Default\AppData\Local\temp

2011-04-04 18:59 . 2011-04-04 18:59        --------        d-----w-        c:\program files\ERUNT

2011-03-27 19:11 . 2011-04-09 18:41        --------        d-----w-        c:\users\Christian\AppData\Roaming\Newkb

2011-03-23 17:38 . 2011-02-22 14:13        288768        ----a-w-        c:\windows\system32\XpsGdiConverter.dll

2011-03-23 17:38 . 2011-02-22 13:33        1068544        ----a-w-        c:\windows\system32\DWrite.dll

2011-03-23 17:38 . 2011-02-22 13:33        797696        ----a-w-        c:\windows\system32\FntCache.dll

2011-03-16 14:44 . 2011-03-16 14:44        --------        d-----w-        c:\program files\iPod

2011-03-16 14:44 . 2011-03-16 14:44        --------        d-----w-        c:\program files\iTunes

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-02-02 20:40 . 2010-05-15 14:14        472808        ----a-w-        c:\windows\system32\deployJava1.dll

2011-02-02 17:11 . 2009-10-02 16:10        222080        ------w-        c:\windows\system32\MpSigStub.exe

2011-01-20 16:37 . 2011-02-09 19:17        638336        ----a-w-        c:\windows\system32\drivers\dxgkrnl.sys

2011-01-20 16:08 . 2011-02-09 19:17        478720        ----a-w-        c:\windows\system32\dxgi.dll

2011-01-20 16:08 . 2011-02-09 19:17        219648        ----a-w-        c:\windows\system32\d3d10_1core.dll

2011-01-20 16:08 . 2011-02-09 19:17        189952        ----a-w-        c:\windows\system32\d3d10core.dll

2011-01-20 16:08 . 2011-02-09 19:17        160768        ----a-w-        c:\windows\system32\d3d10_1.dll

2011-01-20 16:08 . 2011-02-09 19:17        1029120        ----a-w-        c:\windows\system32\d3d10.dll

2011-01-20 16:07 . 2011-02-09 19:17        37376        ----a-w-        c:\windows\system32\cdd.dll

2011-01-20 16:07 . 2011-02-09 19:17        258048        ----a-w-        c:\windows\system32\winspool.drv

2011-01-20 16:07 . 2011-02-09 19:17        586240        ----a-w-        c:\windows\system32\stobject.dll

2011-01-20 16:06 . 2011-02-09 19:17        2873344        ----a-w-        c:\windows\system32\mf.dll

2011-01-20 16:06 . 2011-02-09 19:17        26112        ----a-w-        c:\windows\system32\printfilterpipelineprxy.dll

2011-01-20 16:04 . 2011-02-09 19:17        209920        ----a-w-        c:\windows\system32\mfplat.dll

2011-01-20 16:04 . 2011-02-09 19:17        98816        ----a-w-        c:\windows\system32\mfps.dll

2011-01-20 14:28 . 2011-02-09 19:17        1554432        ----a-w-        c:\windows\system32\xpsservices.dll

2011-01-20 14:27 . 2011-02-09 19:17        876032        ----a-w-        c:\windows\system32\XpsPrint.dll

2011-01-20 14:26 . 2011-02-09 19:17        667648        ----a-w-        c:\windows\system32\printfilterpipelinesvc.exe

2011-01-20 14:25 . 2011-02-09 19:17        847360        ----a-w-        c:\windows\system32\OpcServices.dll

2011-01-20 14:24 . 2011-02-09 19:17        135680        ----a-w-        c:\windows\system32\XpsRasterService.dll

2011-01-20 14:15 . 2011-02-09 19:17        979456        ----a-w-        c:\windows\system32\MFH264Dec.dll

2011-01-20 14:14 . 2011-02-09 19:17        357376        ----a-w-        c:\windows\system32\MFHEAACdec.dll

2011-01-20 14:14 . 2011-02-09 19:17        302592        ----a-w-        c:\windows\system32\mfmp4src.dll

2011-01-20 14:14 . 2011-02-09 19:17        261632        ----a-w-        c:\windows\system32\mfreadwrite.dll

2011-01-20 14:12 . 2011-02-09 19:17        1172480        ----a-w-        c:\windows\system32\d3d10warp.dll

2011-01-20 14:11 . 2011-02-09 19:17        486400        ----a-w-        c:\windows\system32\d3d10level9.dll

2011-01-20 13:47 . 2011-02-09 19:17        683008        ----a-w-        c:\windows\system32\d2d1.dll

2007-05-08 12:49 . 2008-03-09 14:57        143360        ----a-w-        c:\program files\SavResIt.dll

2007-05-02 12:00 . 2008-03-09 14:57        249856        ----a-w-        c:\program files\SavResChs.dll

2007-05-02 12:00 . 2008-03-09 14:57        155648        ----a-w-        c:\program files\SavResEng.dll

2007-05-02 12:00 . 2008-03-09 14:57        327680        ----a-w-        c:\program files\SavResCht.dll

2007-05-02 12:00 . 2008-03-09 14:57        204800        ----a-w-        c:\program files\SavResDeu.dll

2007-05-02 12:00 . 2008-03-09 14:57        188416        ----a-w-        c:\program files\SavResFra.dll

2007-05-02 12:00 . 2008-03-09 14:57        155648        ----a-w-        c:\program files\SavResEsp.dll

2007-05-02 12:00 . 2008-03-09 14:57        339968        ----a-w-        c:\program files\SavResJap.dll

2004-05-07 10:25 . 2008-03-09 14:57        1822520        ----a-w-        c:\program files\instmsiW.exe

2004-05-07 10:25 . 2008-03-09 14:57        1708856        ----a-w-        c:\program files\instmsiA.exe

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-05-09 865840]

"eAudio"="c:\acer\Empowering Technology\eAudio\eAudio.exe" [2007-06-11 1286144]

"RtHDVCpl"="RtHDVCpl.exe" [2007-09-04 4702208]

"LManager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2007-07-31 707080]

"PlayMovie"="c:\program files\Acer Arcade Deluxe\Play Movie\PMVService.exe" [2007-05-24 206952]

"WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]

"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-02-12 174872]

"Skytel"="Skytel.exe" [2007-09-04 1826816]

"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-06-26 86016]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-26 8433664]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-06-26 81920]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]

"TMController"="c:\windows\system32\TMController.exe" [2006-08-24 184396]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-03-07 421160]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

TwonkyMedia.lnk - c:\program files\TwonkyMedia\twonkymediaserverconfig.exe [2008-10-1 225280]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"mixer1"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Tour Reminder]

2007-08-01 16:30        151552        ----a-w-        c:\acer\AcerTour\Reminder.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]

2004-12-14 01:12        483328        ----a-w-        c:\program files\Adobe\Acrobat 7.0\Distillr\acrotray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Version Cue CS2]

2005-04-04 17:58        856064        ----a-w-        c:\program files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PLFSet]

2007-04-25 12:47        45056        ----a-w-        c:\windows\PLFSet.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 TwonkyMedia;TwonkyMedia;c:\program files\TwonkyMedia\twonkymediaserverwatchdog.exe [2008-10-01 237568]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

S2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\Acer Arcade Deluxe\Play Movie\000.fcl [2006-11-02 13560]

S2 ALaunchService;ALaunch Service;c:\acer\ALaunch\ALaunchSvc.exe [2007-01-26 50688]

S2 TGCM_ImportWiFiSvc;TGCM_ImportWiFiSvc;c:\program files\o2\Mobile Connection Manager\ImpWiFiSvc.exe [2010-09-29 200624]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2007-02-08 179712]

S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\DRIVERS\seehcri.sys [2008-01-09 27632]

S3 winbondcir;Winbond IR Transceiver;c:\windows\system32\DRIVERS\winbondcir.sys [2007-04-19 43008]

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12        REG_MULTI_SZ           Pml Driver HPZ12 Net Driver HPZ12

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B2C3BB6B-E005-4246-B8E5-DF0A4D073CDC}]

2008-06-18 14:04        8192        ----a-w-        c:\program files\PixiePack Codec Pack\InstallerHelper.exe

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = about:blank

uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7

mStart Page = hxxp://de.intl.acer.yahoo.com

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://de.rd.yahoo.com/customize/ycomp/defaults/su/*hxxp://de.yahoo.com

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} - hxxps://photoservice.fujicolor.de/ips-opdata/objects/jordan-canvasx.cab

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

HKLM-Run-ALaunch - c:\acer\ALaunch\AlaunchClient.exe

HKLM-Run-Acer Tour - (no file)

HKLM-Run-eRecoveryService - (no file)

HKLM-Run-SetPanel - c:\acer\APanel\APanel.cmd

MSConfigStartUp-Bedx - c:\users\Christian\AppData\Roaming\Adobe\Update\for32.dat

MSConfigStartUp-Sony Ericsson PC Suite - c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2011-04-11 20:15

Windows 6.0.6002 Service Pack 2 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]

"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\Play Movie\000.fcl"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

Zeit der Fertigstellung: 2011-04-11  20:18:56

ComboFix-quarantined-files.txt  2011-04-11 18:18

.

Vor Suchlauf: 14 Verzeichnis(se), 18.275.065.856 Bytes frei

Nach Suchlauf: 19 Verzeichnis(se), 18.186.268.672 Bytes frei

.

- - End Of File - - C53AFFC9ED7868F7066024F75506B027

--- --- ---

Einmal das log von gmer:

GMER Logfile:

Code:

GMER 1.0.15.15570 - hxxp://www.gmer.net

Rootkit scan 2011-04-12 20:52:36

Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 WDC_WD25 rev.01.0

Running: nk5w91ke.exe; Driver: C:\Users\CHRIST~1\AppData\Local\Temp\fxlyiuod.sys
 
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text           C:\Windows\system32\DRIVERS\nvlddmkm.sys                                                             section is writeable [0x8CC0B340, 0x345207, 0xE8000020]
 

---- User IAT/EAT - GMER 1.0.15 ----
 

IAT             C:\Windows\Explorer.EXE[1620] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown]                [73BD7817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1620] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage]                 [73C2A86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1620] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI]             [73BDBB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1620] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode]       [73BCF695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1620] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup]                 [73BD75E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1620] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC]              [73BCE7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1620] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM]  [73C08395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1620] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream]     [73BDDA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1620] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight]             [73BCFFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1620] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth]              [73BCFF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1620] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage]               [73BC71CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1620] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM]       [73C5CAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1620] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile]          [73BFC8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1620] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics]             [73BCD968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1620] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree]                       [73BC6853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1620] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc]                      [73BC687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1620] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode]         [73BD2AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
 

---- Devices - GMER 1.0.15 ----
 

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                              Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                              Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
 

---- EOF - GMER 1.0.15 ----

--- --- ---

dann das log von OSAM:

OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 21:04:59 on 12.04.2011
 

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit

Default Browser: Microsoft Corporation Internet Explorer 7.00.6000.16386
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Control Panel Objects]

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"Adobe Gamma" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma.cpl

"Adobe Version Cue CS2" - "Adobe Systems Incorporated" - C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2.cpl

"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"Apple Mobile USB Driver" (USBAAPL) - "Apple, Inc." - C:\Windows\System32\Drivers\usbaapl.sys

"catchme" (catchme) - ? - C:\Users\CHRIST~1\AppData\Local\Temp\catchme.sys  (File not found)

"Cisco Systems Inc. IPSec Driver" (CVPNDRVA) - "Cisco Systems, Inc." - C:\Windows\system32\Drivers\CVPNDRVA.sys

"fxlyiuod" (fxlyiuod) - ? - C:\Users\CHRIST~1\AppData\Local\Temp\fxlyiuod.sys  (Hidden registry entry, rootkit activity | File not found)

"int15" (int15) - ? - C:\Acer\Empowering Technology\eRecovery\int15.sys  (File found, but it contains no detailed information)

"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)

"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)

"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)

"PCASp50 NDIS Protocol Driver" (PCASp50) - ? - C:\Windows\System32\Drivers\PCASp50.sys  (File not found)

"PPdus ASPI Shell" (Afc) - "Arcsoft, Inc." - C:\Windows\System32\drivers\Afc.sys

"Upper Class Filter Driver" (NTIDrvr) - "NewTech Infosystems, Inc." - C:\Windows\System32\DRIVERS\NTIDrvr.sys

"{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}" ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796}) - "Cyberlink Corp." - C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl
 

[Explorer]

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{B2C3BB6B-E005-4246-B8E5-DF0A4D073CDC} "PixiePack Codec Pack 1.0.100.0" - ? - C:\Program Files\PixiePack Codec Pack\InstallerHelper.exe

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Handler )-----

{3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----

{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)

{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)

{2b45bd21-71f8-4c8c-a87a-7eeb25a1a3e0} "EPM-PO Shell Extensions" - ? - epm-po.dll  (File not found)

{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)

{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office10\msohev.dll

{92A94EB1-16E9-44D8-A98A-9C3CCE9B25E8} "PPTminimizer Shell Extension" - ? - C:\Program Files\PPTminimizer\PPTMShell.dll  (File found, but it contains no detailed information)

{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL

{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll  (File found, but it contains no detailed information)
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "Adobe PDF" - "Adobe Systems Incorporated" - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

-----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )-----

{EF99BD32-C1FB-11D2-892F-0090271D4F88} "Yahoo! Toolbar mit Pop-Up-Blocker" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} "Emsisoft Web Malware Scan" - "Emsi Software GmbH" - C:\Windows\DOWNLO~1\EMSISO~1.OCX / hxxp://ax.emsisoft.com/emsisoft_webscan.cab

{CE8267C2-D41A-4A50-A69D-F32B5C289F14} "FoInstaller Class" - "FileOpen Systems, Inc." - C:\Windows\Downloaded Program Files\FileOpenInstall.dll / hxxp://plugin.fileopen.com/current/FileOpen.CAB

{CAC677B6-4963-4305-9066-0BD135CD9233} "IPSUploader4 Control" - "IP Labs GmbH - Germany" - C:\Windows\Downloaded Program Files\IPSUploader4.ocx / https://as.photoprintit.de/ips-opdata/layout/default_cms01/activex/IPSUploader4.cab

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_24.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

{34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} "JordanUploader Class" - "IPLabs GmbH" - C:\Windows\Downloaded Program Files\JordanApplet.dll / https://photoservice.fujicolor.de/ips-opdata/objects/jordan-canvasx.cab

{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\Windows\system32\Macromed\Flash\Flash10i.ocx / hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

{3D3B42C2-11BF-4732-A304-A01384B70D68} "UploadListView Class" - "Google, Inc." - C:\Windows\Downloaded Program Files\UploaderX.dll / hxxp://picasaweb.google.com/s/v/56.11/uploader2.cab

{8FFBE65D-2C9C-4669-84BD-5829DC0B603C} "{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}" - ? -   (File not found | COM-object registry key not found) / hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

{E2883E8F-472F-4FB0-9522-AC9BF37916A7} "{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" - ? -   (File not found | COM-object registry key not found) / hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Plug-In" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

<binary data> "Adobe PDF" - "Adobe Systems Incorporated" - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "AcroIEHlprObj Class" - "Adobe Systems Incorporated" - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

{AE7CD045-E861-484f-8273-0445EE161910} "AcroIEToolbarHelper Class" - "Adobe Systems Incorporated" - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype Plug-In" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

{AA102584-3B97-47e7-B9BC-75D54C110A7D} "Tunebite_WebRipPlugin Class" - "RapidSolution Software" - C:\Program Files\RapidSolution\Tunebite\plugins\IE\TB_WebRipIePlugin.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

{5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? -   (File not found | COM-object registry key not found)

{83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} "{83A2F9B1-01A2-4AA5-87D1-45B6B8505E96}" - ? -   (File not found | COM-object registry key not found)
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

"Microsoft Office.lnk" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office10\OSA.EXE  (Shortcut exists | File exists)

"TwonkyMedia.lnk" - "PacketVideo" - C:\Program Files\TwonkyMedia\twonkymediaserverconfig.exe  (Shortcut exists | File exists)

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"AppleSyncNotifier" - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

"eAudio" - "CyberLink" - "C:\Acer\Empowering Technology\eAudio\eAudio.exe"

"IAAnotif" - "Intel Corporation" - C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe

"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"

"LexwareInfoService" - "Haufe-Lexware GmbH & Co. KG" - C:\Program Files\Common Files\Lexware\Update Manager\LxUpdateManager.exe /autostart

"LManager" - "Dritek System Inc." - C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE

"PlayMovie" - "CyberLink Corp." - "C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe"

"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

"TMController" - ? - C:\Windows\system32\TMController.exe

"WarReg_PopUp" - "Acer Inc." - C:\Acer\WR_PopUp\WarReg_PopUp.exe
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"Adobe PDF Port" - "Adobe Systems Incorporated." - C:\Windows\system32\AdobePDF.dll
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

"Adobe LM Service" (Adobe LM Service) - "Adobe Systems" - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

"Adobe Version Cue CS2" (Adobe Version Cue CS2) - "Adobe Systems Incorporated" - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe

"ALaunch Service" (ALaunchService) - ? - C:\Acer\ALaunch\ALaunchSvc.exe

"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

"Cisco Systems, Inc. VPN Service" (CVPND) - "Cisco Systems, Inc." - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe

"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe

"eLock Service" (eLockService) - "Acer Inc." - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe

"eNet Service" (eNet Service) - "Acer Inc." - C:\Acer\Empowering Technology\eNet\eNet Service.exe

"ePower Service" (WMIService) - "acer" - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe

"eRecovery Service" (eRecoveryService) - "Acer Inc." - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe

"eSettings Service" (eSettingsService) - ? - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe

"Google Updater Service" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

"Intel(R) Matrix Storage Event Monitor" (IAANTMON) - "Intel Corporation" - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe

"LightScribeService Direct Disc Labeling Service" (LightScribeService) - "Hewlett-Packard Company" - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"MobilityService" (MobilityService) - ? - C:\Acer\Mobility Center\MobilityService.exe  (File found, but it contains no detailed information)

"Pml Driver HPZ12" (Pml Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZipm12.dll

"Symantec Lic NetConnect service" (CLTNetCnService) - ? - "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon  (File not found)

"TGCM_ImportWiFiSvc" (TGCM_ImportWiFiSvc) - "Telefónica I+D" - C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe

"TwonkyMedia" (TwonkyMedia) - "PacketVideo" - C:\Program Files\TwonkyMedia\twonkymediaserverwatchdog.exe
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----

"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

und hier das log von mbrcheck:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer: Acer, Inc.
BIOS Manufacturer: Acer
System Manufacturer: Acer, inc.
System Product Name: Aspire 5920G
Logical Drives Mask: 0x0000002c

Kernel Drivers (total 167):
0x82C46000 \SystemRoot\system32\ntkrnlpa.exe
0x82C13000 \SystemRoot\system32\hal.dll
0x80608000 \SystemRoot\system32\kdcom.dll
0x8060F000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x8067F000 \SystemRoot\system32\PSHED.dll
0x80690000 \SystemRoot\system32\BOOTVID.dll
0x80698000 \SystemRoot\system32\CLFS.SYS
0x806D9000 \SystemRoot\system32\CI.dll
0x8320D000 \SystemRoot\system32\drivers\Wdf01000.sys
0x83289000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x83296000 \SystemRoot\system32\drivers\acpi.sys
0x832DC000 \SystemRoot\system32\drivers\WMILIB.SYS
0x832E5000 \SystemRoot\system32\drivers\msisadrv.sys
0x832ED000 \SystemRoot\system32\drivers\pci.sys
0x83314000 \SystemRoot\System32\drivers\partmgr.sys
0x83323000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x83326000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x83330000 \SystemRoot\system32\drivers\volmgr.sys
0x8333F000 \SystemRoot\System32\drivers\volmgrx.sys
0x83389000 \SystemRoot\system32\drivers\intelide.sys
0x83390000 \SystemRoot\system32\drivers\PCIIDEX.SYS
0x8339E000 \SystemRoot\System32\drivers\mountmgr.sys
0x88804000 \SystemRoot\system32\drivers\iastorv.sys
0x888A4000 \SystemRoot\system32\drivers\iastor.sys
0x88962000 \SystemRoot\system32\drivers\atapi.sys
0x8896A000 \SystemRoot\system32\drivers\ataport.SYS
0x88988000 \SystemRoot\system32\drivers\fltmgr.sys
0x889BA000 \SystemRoot\system32\drivers\fileinfo.sys
0x88A09000 \SystemRoot\System32\Drivers\ksecdd.sys
0x88A7A000 \SystemRoot\system32\drivers\ndis.sys
0x88B85000 \SystemRoot\system32\drivers\msrpc.sys
0x88BB0000 \SystemRoot\system32\drivers\NETIO.SYS
0x88C0A000 \SystemRoot\System32\drivers\tcpip.sys
0x88CF4000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x88E00000 \SystemRoot\System32\Drivers\Ntfs.sys
0x88F10000 \SystemRoot\system32\drivers\volsnap.sys
0x88F49000 \SystemRoot\System32\Drivers\spldr.sys
0x88F51000 \SystemRoot\System32\Drivers\mup.sys
0x88F60000 \SystemRoot\System32\drivers\ecache.sys
0x88F87000 \SystemRoot\system32\drivers\disk.sys
0x88F98000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x88FB9000 \SystemRoot\system32\drivers\crcdisk.sys
0x88FCF000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x88FDA000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x88FE3000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x8CC0B000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
0x8D2D6000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8D376000 \SystemRoot\System32\drivers\watchdog.sys
0x8D382000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x8D38D000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8D3CB000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8D80D000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8DA0F000 \SystemRoot\system32\DRIVERS\NETw4v32.sys
0x8DC36000 \SystemRoot\system32\DRIVERS\b57nd60x.sys
0x8DC65000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x8DC75000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x8DC83000 \SystemRoot\system32\DRIVERS\sdbus.sys
0x8DC9D000 \SystemRoot\system32\DRIVERS\rimmptsk.sys
0x8DCAC000 \SystemRoot\system32\DRIVERS\rimsptsk.sys
0x8DCC0000 \SystemRoot\system32\DRIVERS\rixdptsk.sys
0x8DD11000 \SystemRoot\system32\DRIVERS\winbondcir.sys
0x8DD26000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x8DD39000 \SystemRoot\system32\DRIVERS\DKbFltr.sys
0x8DD43000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x8DD4E000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x8DD7A000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x8DD7C000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x8DD87000 \SystemRoot\system32\drivers\Afc.sys
0x8DD8F000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8DDA7000 \SystemRoot\system32\DRIVERS\NTIDrvr.sys
0x8DDA9000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
0x8DDAF000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x8DDB3000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x8DDBC000 \SystemRoot\system32\DRIVERS\dne2000.sys
0x8D89A000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8D8C9000 \SystemRoot\system32\DRIVERS\storport.sys
0x8DDDA000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8DDE5000 \SystemRoot\system32\drivers\tbhsd.sys
0x8D90A000 \SystemRoot\system32\drivers\portcls.sys
0x8D937000 \SystemRoot\system32\drivers\drmk.sys
0x8D95C000 \SystemRoot\system32\drivers\ks.sys
0x8D986000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8DDEF000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x8D99D000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x8DA00000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x8D9C0000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x8D9D4000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x8D9E9000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8DDFA000 \SystemRoot\system32\DRIVERS\seehcri.sys
0x8D9F9000 \SystemRoot\system32\DRIVERS\swenum.sys
0x8D3DA000 \SystemRoot\system32\DRIVERS\circlass.sys
0x8D800000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x889CA000 \SystemRoot\system32\DRIVERS\NWADIenum.sys
0x8D3E8000 \SystemRoot\system32\DRIVERS\umbus.sys
0x833AE000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x88DCD000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x8EC0A000 \SystemRoot\system32\drivers\RTKVHDA.sys
0x807B9000 \SystemRoot\system32\DRIVERS\HSXHWAZL.sys
0x8EE08000 \SystemRoot\system32\DRIVERS\HSX_DPV.sys
0x8EF0B000 \SystemRoot\system32\DRIVERS\HSX_CNXT.sys
0x8EFC0000 \SystemRoot\system32\drivers\modem.sys
0x8EFCD000 \SystemRoot\system32\DRIVERS\hidir.sys
0x8EFD8000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x8EFE8000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x8EFEF000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x8EFF8000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x90803000 \SystemRoot\system32\DRIVERS\snp2uvc.sys
0x909AA000 \SystemRoot\system32\DRIVERS\STREAM.SYS
0x909B7000 \SystemRoot\system32\DRIVERS\sncduvc.SYS
0x909BE000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x909C7000 \SystemRoot\System32\Drivers\Null.SYS
0x909CE000 \SystemRoot\System32\Drivers\Beep.SYS
0x909D5000 \SystemRoot\System32\drivers\vga.sys
0x88DDE000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x909E1000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x909E9000 \SystemRoot\system32\drivers\rdpencdd.sys
0x909F1000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8EDE5000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8EDF3000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x833E3000 \SystemRoot\system32\DRIVERS\tdx.sys
0x88BEB000 \SystemRoot\system32\DRIVERS\smb.sys
0x92C04000 \SystemRoot\system32\drivers\afd.sys
0x92C4C000 \SystemRoot\System32\DRIVERS\netbt.sys
0x92C7E000 \SystemRoot\system32\DRIVERS\pacer.sys
0x92C94000 \SystemRoot\system32\DRIVERS\netbios.sys
0x92CA2000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x92CB5000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x92CF1000 \SystemRoot\system32\drivers\nsiproxy.sys
0x92CFB000 \SystemRoot\System32\Drivers\dfsc.sys
0x92D12000 \SystemRoot\system32\DRIVERS\usbprint.sys
0x92D1C000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x92D25000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x92D3B000 \SystemRoot\System32\Drivers\crashdmp.sys
0x88D0F000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x80CF0000 \SystemRoot\System32\win32k.sys
0x92D48000 \SystemRoot\System32\drivers\Dxapi.sys
0x92D52000 \SystemRoot\system32\DRIVERS\monitor.sys
0x80F10000 \SystemRoot\System32\TSDDD.dll
0x80F30000 \SystemRoot\System32\cdd.dll
0x80F40000 \SystemRoot\System32\ATMFD.DLL
0x92D61000 \SystemRoot\system32\drivers\luafv.sys
0xA1E07000 \SystemRoot\system32\drivers\spsys.sys
0xA1EB7000 \SystemRoot\system32\DRIVERS\RMCAST.sys
0xA1EE7000 \SystemRoot\system32\DRIVERS\lltdio.sys
0xA1EF7000 \SystemRoot\system32\DRIVERS\nwifi.sys
0xA1F21000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xA1F2B000 \SystemRoot\system32\DRIVERS\rspndr.sys
0xA1F3E000 \SystemRoot\system32\drivers\HTTP.sys
0xA1FAB000 \SystemRoot\System32\DRIVERS\srvnet.sys
0xA1FC8000 \SystemRoot\system32\DRIVERS\bowser.sys
0xA1FE1000 \SystemRoot\System32\drivers\mpsdrv.sys
0x92D84000 \SystemRoot\system32\drivers\mrxdav.sys
0x92DA5000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x92DC4000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0xA3005000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0xA301D000 \SystemRoot\System32\DRIVERS\srv2.sys
0xA3045000 \SystemRoot\System32\DRIVERS\srv.sys
0xA30AB000 \??\C:\Windows\system32\Drivers\CVPNDRVA.sys
0xA313B000 \??\C:\Acer\Empowering Technology\eRecovery\int15.sys
0xA314C000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0xA6208000 \SystemRoot\system32\drivers\peauth.sys
0xA62E6000 \SystemRoot\System32\Drivers\secdrv.SYS
0xA62F0000 \SystemRoot\System32\drivers\tcpipreg.sys
0xA62FC000 \SystemRoot\system32\DRIVERS\xaudio.sys
0xA6304000 \??\C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl
0xA6306000 \??\C:\Users\CHRIST~1\AppData\Local\Temp\fxlyiuod.sys
0x77830000 \Windows\System32\ntdll.dll

Processes (total 75):
0 System Idle Process
4 System
504 C:\Windows\System32\smss.exe
636 csrss.exe
688 csrss.exe
696 C:\Windows\System32\wininit.exe
732 C:\Windows\System32\services.exe
744 C:\Windows\System32\lsass.exe
752 C:\Windows\System32\lsm.exe
892 C:\Windows\System32\svchost.exe
952 C:\Windows\System32\svchost.exe
988 C:\Windows\System32\svchost.exe
1040 C:\Windows\System32\svchost.exe
1068 C:\Windows\System32\svchost.exe
1100 C:\Windows\System32\svchost.exe
1148 C:\Windows\System32\winlogon.exe
1212 C:\Windows\System32\audiodg.exe
1240 C:\Windows\System32\SLsvc.exe
1268 C:\Windows\System32\svchost.exe
1400 C:\Windows\System32\svchost.exe
1728 C:\Windows\System32\spoolsv.exe
1756 C:\Windows\System32\svchost.exe
124 C:\Acer\ALaunch\ALaunchSvc.exe
396 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
628 C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
748 C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
1792 C:\Acer\Empowering Technology\eNet\eNet Service.exe
640 C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
2056 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
2108 C:\Acer\Mobility Center\MobilityService.exe
2180 C:\Windows\System32\svchost.exe
2220 C:\Windows\System32\svchost.exe
2240 C:\Program Files\CyberLink\Shared Files\RichVideo.exe
2288 C:\Windows\System32\svchost.exe
2392 C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe
2444 C:\Windows\System32\svchost.exe
2480 C:\Windows\System32\SearchIndexer.exe
2520 C:\Windows\System32\drivers\XAudio.exe
2548 C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
2592 C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
2648 C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
2856 WmiPrvSE.exe
2916 unsecapp.exe
3040 WmiPrvSE.exe
3168 C:\Windows\System32\taskeng.exe
400 C:\Windows\System32\taskeng.exe
2816 C:\Windows\System32\dwm.exe
1620 C:\Windows\explorer.exe
2660 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
2388 C:\Acer\Empowering Technology\eAudio\eAudio.exe
868 C:\Windows\RtHDVCpl.exe
3000 C:\Program Files\Launch Manager\QtZgAcer.EXE
1600 C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
3052 C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
3636 C:\Windows\System32\rundll32.exe
3848 C:\Windows\System32\TMController.exe
3880 C:\Program Files\Common Files\Java\Java Update\jusched.exe
3900 C:\Program Files\iTunes\iTunesHelper.exe
3904 C:\Program Files\Common Files\Lexware\Update Manager\LxUpdateManager.exe
3820 C:\Program Files\TwonkyMedia\twonkymediaserverconfig.exe
2840 C:\Windows\System32\rundll32.exe
3524 C:\Windows\System32\svchost.exe
1196 C:\Program Files\Windows Media Player\wmpnetwk.exe
3216 C:\Users\CHRIST~1\AppData\Local\temp\RtkBtMnt.exe
3424 C:\Program Files\iPod\bin\iPodService.exe
3764 C:\Windows\System32\wuauclt.exe
5520 C:\Program Files\Internet Explorer\ieuser.exe
2836 C:\Program Files\Internet Explorer\iexplore.exe
5772 C:\Windows\System32\Macromed\Flash\FlashUtil10i_ActiveX.exe
3692 C:\Windows\System32\SearchProtocolHost.exe
5424 C:\Windows\System32\SearchFilterHost.exe
2940 dllhost.exe
5256 dllhost.exe
724 C:\Users\Christian\Desktop\MBRCheck.exe
4360 C:\Windows\System32\conime.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000002`70a00000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x0000001e`5ce00000 (NTFS)

PhysicalDrive0 Model Number: WDCWD2500BEVS-22UST0, Rev: 01.01A01

Size Device Name MBR Status
--------------------------------------------
232 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: 31171527C24A94682C92F34EB1E387CDC8AD21FC

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:
Options:
[1] Dump the MBR of a physical disk to file.
[2] Restore the MBR of a physical disk with a standard boot code.
[3] Exit.

Enter your choice:

Done!

Grüße
chris0780