| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: In die Spyhunter-Falle getapptWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
14.07.2013, 10:08
| #1 |
| |  In die Spyhunter-Falle getappt Hallo zusammen, Ich bin leider auch dem Spyhunter-Fake aufgesessen und habe das erst gemerkt als ich die "günstige" Vollversion kaufen sollte und glücklicherweise erstmal Google bemüht habe. Ich habe das Programm zwar mit CCleaner deinstalliert, kann mir aber nicht vorstellen daß es damit restlos entfernt wurde, zumal noch einige Dateien davon vorhanden sind. Ich wäre für professionelle Hilfe sehr dankbar... Hier die gemäß Checkliste erstellten Logdateien von OTL und Gmer : OTL Logfile: Code:
ATTFilter OTL logfile created on: 14.07.2013 09:22:01 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\xxx\Desktop Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.10.9200.16635) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,49 Gb Total Physical Memory | 0,93 Gb Available Physical Memory | 62,66% Memory free 2,98 Gb Paging File | 2,22 Gb Available in Paging File | 74,55% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 37,16 Gb Total Space | 17,42 Gb Free Space | 46,87% Space Free | Partition Type: NTFS Computer Name: NC6120 | User Name: xxx | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.07.13 20:50:23 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\xxx\Desktop\OTL.exe PRC - [2013.06.26 13:21:47 | 000,084,024 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2013.06.26 13:21:43 | 000,111,160 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\ipmgui.exe PRC - [2013.06.26 13:21:26 | 000,076,856 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2013.06.26 13:21:23 | 000,345,144 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2013.06.26 13:21:23 | 000,108,088 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2013.06.12 02:23:57 | 000,770,648 | ---- | M] (Microsoft Corporation) -- C:\Programme\Internet Explorer\iexplore.exe PRC - [2013.05.11 12:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2013.05.02 18:48:51 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2013.05.01 07:20:08 | 000,812,424 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\Macromed\Flash\FlashUtil32_11_7_700_169_ActiveX.exe PRC - [2013.03.28 07:23:28 | 001,106,288 | ---- | M] (Samsung) -- C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe PRC - [2013.03.28 07:23:26 | 000,310,640 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Programme\Samsung\Kies\KiesTrayAgent.exe PRC - [2013.03.28 07:23:22 | 001,511,792 | ---- | M] (Samsung) -- C:\Programme\Samsung\Kies\Kies.exe PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe PRC - [2009.02.26 18:36:46 | 000,030,040 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe PRC - [2002.10.28 08:10:00 | 000,106,561 | ---- | M] (WinZip Computing, Inc. and H.C. Top Systems B.V.) -- C:\Programme\WinZip\WZQKPICK.EXE ========== Modules (No Company Name) ========== MOD - [2013.07.11 17:06:48 | 018,022,912 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\f3770f9a13d7516e4c03f23dbd319cba\PresentationFramework.ni.dll MOD - [2013.07.11 17:06:25 | 011,522,048 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\4572de8445038600e4552429b18fbe32\PresentationCore.ni.dll MOD - [2013.07.11 17:05:48 | 005,628,416 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\c1c41a9e1a25999e74defafecb2aa0bc\System.Xml.ni.dll MOD - [2013.07.11 17:05:43 | 001,014,272 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\7546a01feb9d477570b883eec56cc673\System.Configuration.ni.dll MOD - [2013.07.11 17:05:38 | 007,070,720 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\64b92e2a22bb8c1e86486bd22828acc5\System.Core.ni.dll MOD - [2013.07.11 17:05:27 | 003,883,008 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\112f6448b7434699af4bcc05f25ce12b\WindowsBase.ni.dll MOD - [2013.07.11 17:05:19 | 009,100,288 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\89445d5b924ad94744d00f1b6cd2285d\System.ni.dll MOD - [2013.07.11 17:05:09 | 014,418,432 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a01e07e47ecdd94ae099e8c4bf650516\mscorlib.ni.dll ========== Services (SafeList) ========== SRV - [2013.07.04 10:41:50 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013.06.26 13:21:47 | 000,084,024 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2013.06.26 13:21:23 | 000,108,088 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2013.05.27 06:57:27 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2013.05.11 12:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011.07.20 05:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv) SRV - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009.02.26 18:36:22 | 000,064,856 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Microsoft Office\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service) SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard) DRV - [2013.06.04 09:15:02 | 000,181,912 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssudmdm.sys -- (ssudmdm) DRV - [2013.06.04 09:15:02 | 000,084,248 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssudbus.sys -- (dg_ssudbus) DRV - [2013.04.03 09:58:08 | 000,153,672 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadmdm.sys -- (ssadmdm) DRV - [2013.04.03 09:58:08 | 000,136,904 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadbus.sys -- (ssadbus) DRV - [2013.04.03 09:58:08 | 000,130,248 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadserd.sys -- (ssadserd) DRV - [2013.04.03 09:58:08 | 000,032,064 | ---- | M] (Google Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadadb.sys -- (androidusb) DRV - [2013.04.03 09:58:08 | 000,017,864 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadmdfl.sys -- (ssadmdfl) DRV - [2013.03.06 15:13:37 | 000,037,352 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr) DRV - [2013.02.27 12:22:36 | 000,135,136 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2013.02.27 12:22:36 | 000,084,744 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2012.08.27 14:50:24 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV - [2007.12.14 09:21:56 | 000,290,816 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tifm21.sys -- (tifm21) DRV - [2007.05.09 13:27:00 | 000,097,280 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\gtipci21.sys -- (GTIPCI21) DRV - [2006.10.18 15:44:30 | 000,031,232 | ---- | M] (SMSC) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\smscirda.sys -- (SMSCIRDA) DRV - [2005.11.16 14:12:46 | 001,066,278 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem) DRV - [2005.11.02 09:07:32 | 003,298,432 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\w29n51.sys -- (w29n51) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.gmx.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 00 C9 A2 8C EC 45 CE 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "hxxp://www.gmx.de/" FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:22.0 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll () FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.6: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 22.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 22.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.05.03 20:49:38 | 000,000,000 | ---D | M] (No name found) -- C:\Users\xxx\AppData\Roaming\mozilla\Extensions [2013.07.11 21:15:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\en35stal.default\extensions [2013.07.11 16:11:51 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\Extensions [2013.07.04 10:41:40 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\browser\extensions [2013.07.04 10:41:50 | 000,000,000 | ---D | M] (Default) -- C:\Programme\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [KiesTrayAgent] C:\Programme\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.) O4 - HKLM..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.) O4 - HKCU..\Run: [] C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe (Samsung) O4 - HKCU..\Run: [KiesPreload] C:\Program Files\Samsung\Kies\Kies.exe (Samsung) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{10BDCCE1-0E5A-4F65-8733-9AFC56F2C8F6}: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - Winlogon\Notify\ScCertProp: DllName - (wlnotify.dll) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.07.13 21:14:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner [2013.07.13 21:14:13 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner [2013.07.13 21:01:38 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT [2013.07.13 20:51:49 | 000,559,441 | ---- | C] (Oleg N. Scherbakov) -- C:\Users\xxx\Desktop\JRT.exe [2013.07.13 20:50:12 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\xxx\Desktop\OTL.exe [2013.07.13 16:40:18 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group [2013.07.13 16:37:22 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard [2013.07.11 16:11:55 | 000,000,000 | ---D | C] -- C:\Users\xxx\.android [2013.07.11 16:11:53 | 000,000,000 | ---D | C] -- C:\Users\xxx\Local Settings [2013.07.11 16:09:36 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\MyPhoneExplorer [2013.07.11 16:09:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyPhoneExplorer [2013.07.11 16:08:33 | 000,000,000 | ---D | C] -- C:\Program Files\MyPhoneExplorer [2013.07.11 16:00:34 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\cm10 [2013.07.10 21:40:23 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\Odin_3.07 [2013.07.06 17:05:10 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\Auspuff [2013.07.06 17:03:05 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\CrashDump [2013.07.06 17:02:00 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\Capri [2013.07.05 19:16:32 | 000,000,000 | ---D | C] -- C:\Users\xxx\Documents\SelfMV [2013.07.05 19:16:05 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\Harley [2013.07.05 19:15:47 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\Felgen [2013.07.05 19:12:36 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\NativeFus_Log [2013.07.05 19:12:19 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\Samsung [2013.07.05 19:12:13 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\Samsung [2013.07.05 19:11:26 | 000,000,000 | ---D | C] -- C:\Users\xxx\Documents\samsung [2013.07.04 10:41:39 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2013.06.20 19:54:41 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\save [2013.06.20 19:43:25 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\handy [2013.06.20 19:38:50 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Convar [2013.06.20 19:38:50 | 000,000,000 | ---D | C] -- C:\Program Files\Convar [2013.06.20 19:22:48 | 000,000,000 | ---D | C] -- C:\Users\xxx\Documents\CardRecovery [2013.06.18 20:56:00 | 000,000,000 | ---D | C] -- C:\Users\xxx\Documents\C16 [2013.06.17 07:07:08 | 000,000,000 | ---D | C] -- C:\Users\xxx\Documents\Bodensee13 [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013.07.14 09:20:27 | 000,000,000 | ---- | M] () -- C:\Users\xxx\defogger_reenable [2013.07.14 08:55:04 | 000,013,728 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.07.14 08:55:04 | 000,013,728 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.07.14 08:46:48 | 000,000,350 | ---- | M] () -- C:\Windows\tasks\Lyrics-Pal Update.job [2013.07.14 08:46:42 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.07.14 08:46:31 | 1201,217,536 | -HS- | M] () -- C:\hiberfil.sys [2013.07.13 21:14:15 | 000,000,969 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk [2013.07.13 21:11:34 | 000,377,856 | ---- | M] () -- C:\Users\xxx\Desktop\gmer_2.1.19163.exe [2013.07.13 21:10:50 | 000,050,477 | ---- | M] () -- C:\Users\xxx\Desktop\Defogger.exe [2013.07.13 20:51:50 | 000,559,441 | ---- | M] (Oleg N. Scherbakov) -- C:\Users\xxx\Desktop\JRT.exe [2013.07.13 20:50:23 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\xxx\Desktop\OTL.exe [2013.07.13 20:43:00 | 000,662,345 | ---- | M] () -- C:\Users\xxx\Desktop\adwcleaner.exe [2013.07.11 20:29:53 | 000,616,008 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2013.07.11 20:29:52 | 000,654,166 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2013.07.11 20:29:52 | 000,130,006 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2013.07.11 20:29:52 | 000,106,388 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2013.07.11 20:23:37 | 000,410,064 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2013.07.11 16:09:24 | 000,002,019 | ---- | M] () -- C:\Users\Public\Desktop\MyPhoneExplorer.lnk [2013.07.11 16:08:23 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_Kernel_ssadadb_01005.Wdf [2013.06.26 13:21:50 | 000,067,168 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avnetflt.sys [2013.06.21 11:18:01 | 000,000,903 | ---- | M] () -- C:\Users\xxx\Desktop\WinVICE-2.4-x86.lnk [2013.06.20 19:38:51 | 000,001,284 | ---- | M] () -- C:\Users\xxx\Desktop\PC Inspector File Recovery.lnk [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2013.07.14 09:20:27 | 000,000,000 | ---- | C] () -- C:\Users\xxx\defogger_reenable [2013.07.13 21:14:15 | 000,000,969 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk [2013.07.13 21:11:34 | 000,377,856 | ---- | C] () -- C:\Users\xxx\Desktop\gmer_2.1.19163.exe [2013.07.13 21:10:50 | 000,050,477 | ---- | C] () -- C:\Users\xxx\Desktop\Defogger.exe [2013.07.13 20:42:59 | 000,662,345 | ---- | C] () -- C:\Users\xxx\Desktop\adwcleaner.exe [2013.07.11 16:09:58 | 000,000,350 | ---- | C] () -- C:\Windows\tasks\Lyrics-Pal Update.job [2013.07.11 16:09:24 | 000,002,019 | ---- | C] () -- C:\Users\Public\Desktop\MyPhoneExplorer.lnk [2013.07.11 16:08:23 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_Kernel_ssadadb_01005.Wdf [2013.06.21 11:18:01 | 000,000,903 | ---- | C] () -- C:\Users\xxx\Desktop\WinVICE-2.4-x86.lnk [2013.06.20 19:38:51 | 000,001,284 | ---- | C] () -- C:\Users\xxx\Desktop\PC Inspector File Recovery.lnk [2013.05.19 09:41:44 | 000,015,873 | ---- | C] () -- C:\Windows\System32\Inetde.dll ========== ZeroAccess Check ========== [2009.07.14 06:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 03:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2013.05.24 18:46:18 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\BOM [2013.05.06 22:45:50 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\CCS64 [2013.05.03 20:29:54 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\DVDVideoSoft [2013.07.11 16:09:36 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\MyPhoneExplorer [2013.07.05 19:12:28 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Samsung ========== Purity Check ========== < End of report > OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 14.07.2013 09:22:01 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\xxx\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16635)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,49 Gb Total Physical Memory | 0,93 Gb Available Physical Memory | 62,66% Memory free
2,98 Gb Paging File | 2,22 Gb Available in Paging File | 74,55% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 37,16 Gb Total Space | 17,42 Gb Free Space | 46,87% Space Free | Partition Type: NTFS
Computer Name: NC6120 | User Name: xxx | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htafile [open] -- "%1" %*
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{07282184-BFF9-4939-A964-53C8070A24F6}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{090A2709-1B91-4B9E-B7AA-CA1D36726087}" = rport=137 | protocol=17 | dir=out | app=system |
"{13EDA6A1-7BF2-4C62-9A3D-FE89CE55DE0A}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{1A33A90A-6805-496F-80D6-E3C3EC721611}" = lport=445 | protocol=6 | dir=in | app=system |
"{1B707A38-D6EA-453B-B591-B84D0EA43C42}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{2E2DDC0E-857A-48CA-AD33-A5DD9653265B}" = rport=445 | protocol=6 | dir=out | app=system |
"{31FD715E-BF0F-4F9E-AD9D-FFE92D5D60B6}" = lport=2869 | protocol=6 | dir=in | app=system |
"{3A419E76-A023-4CC4-A501-2BB8654E5173}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{43D585EE-06A0-4577-B149-D49935998371}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{5006D0DA-ABFA-44D2-84AC-3F3270956C12}" = lport=10243 | protocol=6 | dir=in | app=system |
"{5B26818F-1AB2-4621-A432-82EDB4DA4715}" = lport=137 | protocol=17 | dir=in | app=system |
"{5D0755F6-6806-4F93-8BE6-501F31B34E45}" = rport=10243 | protocol=6 | dir=out | app=system |
"{5D76EBCA-A4BE-4F5F-B99D-D8360F8E6950}" = lport=138 | protocol=17 | dir=in | app=system |
"{7237C61C-6B02-4BC9-A80A-F21DFA40658C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{7866FC77-67AD-45FC-A1D6-7ECEBA32F78C}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{7F532DCE-4CB0-40CE-945A-70B1F0E39263}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{9B378BED-9BD9-41CA-98D5-C9A1EF025835}" = rport=138 | protocol=17 | dir=out | app=system |
"{9DA5AB38-3200-4B84-9270-8F38F3D79220}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{A31B27A7-015C-4B2F-B0CB-B555CABA2AE6}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{A3BAF06E-B291-42B8-B4A5-F2691AAAD7BC}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{C3CF0FAC-A132-4293-8804-CDF29C959E01}" = rport=139 | protocol=6 | dir=out | app=system |
"{CEAF100D-DD82-4F18-B928-2E5CA4BC3256}" = lport=139 | protocol=6 | dir=in | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{08D94AB8-B94B-4CE2-920E-6C4EDE80B004}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{0D29C8DF-05B7-4845-B8BA-5D49B1589B69}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{138190D6-0C23-454C-A9B8-D52D6E2AC37E}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{13AA94A8-1FBA-4404-ACDF-5663836D69D6}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{381CE5A2-056B-4779-91DD-ADABA5C851FE}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{3FAF90B3-1D08-4B78-B69E-50671FFF53F9}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{4534B1E9-70E4-47EC-84F1-C2422E018BF7}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{4F116E28-8575-4617-8FF1-4C0BBBD6F1A9}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{513BE6B0-832C-4F44-A3AD-9E96DC4161FD}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{6328705A-39D9-4E48-9DAB-47B424396E98}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{6D51F25A-3C07-4C52-90CC-757D04FF270A}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{764B2297-56FE-471F-AB73-4B6D02331B16}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{7ACACA9B-6541-423D-A839-914EE6A58F44}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{8B524CA8-D5ED-4A7D-A512-3EFD5545E7EA}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{900CB704-1C64-4AEC-8C98-A8790FB1E4B6}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{9479C03D-FD6C-4705-A170-D08C4984E383}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A86CE3D9-086F-41B2-929E-DF68A79E9BE2}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{CE8AA108-D1CD-43C8-AF40-36838C5AA55B}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{D09D2C5F-918B-4F93-B45E-4C1B48859D07}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{DF3BA611-FD61-444D-A93E-FECD5CCD3BA0}" = protocol=6 | dir=out | app=system |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1AEC7728-1640-4E98-AABC-5EBE3FB57FE4}" = SMSC Fast Infrared Driver
"{355FADAF-55C4-4E08-88D4-A86C4CA6930C}" = HP Wireless Assistant
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{529125EF-E3AC-4B74-97E6-F688A7C0F1BF}" = Paint.NET v3.5.10
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{767B964C-D9B4-422D-802B-F7ACBE2D310A}" = TIPCI
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISER_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISER_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISER_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISER_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISER_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.03) - Deutsch
"{B7B5A370-3DFF-4F0E-AE11-FD267C4938AA}" = CCS64 V3.9
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"6F8C52CF07BBF1FE2471DC68C08F06D7C58B7D49" = Windows Driver Package - Intel (w29n51) net (09/12/2005 9.0.3.9)
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Agere Systems Soft Modem" = Agere Systems AC'97 Modem
"Avira AntiVir Desktop" = Avira Free Antivirus
"Biet-O-Matic v2.14.12" = Biet-O-Matic v2.14.12
"Broadcom 802.11b Network Adapter" = Broadcom 802.11 Wireless LAN Adapter
"CCleaner" = CCleaner
"E61C4CD368E9E2830A85919D7F5030333F381837" = Windows Driver Package - Intel (w39n51) net (09/28/2005 10.0.0.120)
"ENTERPRISER" = Microsoft Office Enterprise 2007
"Free YouTube Download_is1" = Free YouTube Download version 3.2.2.426
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.12.2.426
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"InstallShield_{767B964C-D9B4-422D-802B-F7ACBE2D310A}" = Texas Instruments PCIxx21/x515/xx12 drivers.
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 22.0 (x86 de)" = Mozilla Firefox 22.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MPE" = MyPhoneExplorer
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"VLC media player" = VLC media player 2.0.6
"WinZip" = WinZip
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"MyFreeCodec" = MyFreeCodec
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 13.07.2013 15:24:32 | Computer Name = NC6120 | Source = ESENT | ID = 455
Description = Windows (2752) Windows: Fehler -1811 beim Öffnen von Protokolldatei
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS00024.log.
Error - 13.07.2013 15:24:33 | Computer Name = NC6120 | Source = Windows Search Service | ID = 9000
Description =
Error - 13.07.2013 15:24:33 | Computer Name = NC6120 | Source = Windows Search Service | ID = 7040
Description =
Error - 13.07.2013 15:24:33 | Computer Name = NC6120 | Source = Windows Search Service | ID = 7042
Description =
Error - 13.07.2013 15:24:33 | Computer Name = NC6120 | Source = Windows Search Service | ID = 9002
Description =
Error - 13.07.2013 15:24:33 | Computer Name = NC6120 | Source = Windows Search Service | ID = 3029
Description =
Error - 13.07.2013 15:24:34 | Computer Name = NC6120 | Source = Windows Search Service | ID = 3029
Description =
Error - 13.07.2013 15:24:34 | Computer Name = NC6120 | Source = Windows Search Service | ID = 3028
Description =
Error - 13.07.2013 15:24:34 | Computer Name = NC6120 | Source = Windows Search Service | ID = 3058
Description =
Error - 13.07.2013 15:24:34 | Computer Name = NC6120 | Source = Windows Search Service | ID = 7010
Description =
[ System Events ]
Error - 13.07.2013 15:24:34 | Computer Name = NC6120 | Source = Service Control Manager | ID = 7024
Description = Der Dienst "Windows Search" wurde mit folgendem dienstspezifischem
Fehler beendet: %%-1073473535.
Error - 13.07.2013 15:24:34 | Computer Name = NC6120 | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits
1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt:
Neustart des Diensts.
< End of report >
GMER Logfile: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-07-14 10:55:45
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 FUJITSU_MHW2040AT rev.0000000B 37,26GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Heiko\AppData\Local\Temp\kxldqpog.sys
---- System - GMER 2.1 ----
SSDT 8CCE81CE ZwCreateSection
SSDT 8CCE81D8 ZwRequestWaitReplyPort
SSDT 8CCE81D3 ZwSetContextThread
SSDT 8CCE81DD ZwSetSecurityObject
SSDT 8CCE81E2 ZwSystemDebugControl
SSDT 8CCE816F ZwTerminateProcess
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!ZwRollbackEnlistment + 140D 828759F5 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 828AF1F2 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!KeRemoveQueueEx + 11F7 828B653C 4 Bytes [CE, 81, CE, 8C]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1553 828B6898 4 Bytes [D8, 81, CE, 8C]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1597 828B68DC 4 Bytes [D3, 81, CE, 8C]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1613 828B6958 4 Bytes [DD, 81, CE, 8C]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1667 828B69AC 4 Bytes [E2, 81, CE, 8C]
.text ...
---- User code sections - GMER 2.1 ----
.text C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[1944] ntdll.dll!DbgBreakPoint 7756410C 1 Byte [C3]
.text C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[1944] ntdll.dll!DbgUiRemoteBreakin 775CF17D 5 Bytes JMP 7758E342 C:\Windows\SYSTEM32\ntdll.dll
---- Devices - GMER 2.1 ----
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 SynTP.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 SynTP.sys
---- EOF - GMER 2.1 ----
Code:
ATTFilter
Ich bin wie gesagt für jeden Tip dankbar wie ich diesen Plagegeist wieder loswerde. Schönen Dank schonmal im voraus ! Gruß Flodder |
|
14.07.2013, 10:21
| #2 |
| /// TB-Ausbilder  | In die Spyhunter-Falle getappt Da ist schon fast alles weg:
__________________Fix mit OTL
__________________ |
|
14.07.2013, 11:15
| #3 |
| | In die Spyhunter-Falle getappt Melde Vollzug :
__________________Code:
ATTFilter ========== OTL ==========
Service esgiguard stopped successfully!
Service esgiguard deleted successfully!
File C:\Program Files\Enigma Software Group not found.
OTL by OldTimer - Version 3.2.69.0 log created on 07142013_121419
|
|
14.07.2013, 11:54
| #4 |
| /// TB-Ausbilder | In die Spyhunter-Falle getappt Okay, das müßte eigentlich der letzte Rest gewesen sein.
__________________  Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
14.07.2013, 16:21
| #5 |
| | In die Spyhunter-Falle getappt Prima... Herzlichen Dank für die schnelle Hilfe !!  |
|
14.07.2013, 16:35
| #6 |
| /// TB-Ausbilder | In die Spyhunter-Falle getappt Schön, dass wir helfen konnten  Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Solltest Du das Thema erneut brauchen schicke mir bitte eine PM. Jeder andere bitte hier klicken und einen eigenen Thread erstellen Falls du noch Lob oder Kritik loswerden möchtest, dann gibt es diesen Bereich hier: Lob, Kritik und Wünsche - Trojaner-Board
__________________ --> In die Spyhunter-Falle getappt |
|
| Themen zu In die Spyhunter-Falle getappt |
| adobe reader xi, antivir, autorun, avira, bho, checkliste, converter, error, fehler, firefox, flash player, google, helper, home, install.exe, installation, logfile, lyrics-pal, mozilla, mp3, ntdll.dll, programm, registry, rundll, scan, security, senden, software, svchost.exe, windows |
Warnung: Dieses Skript wurde nur für diesen User und diese spezielle Situation geschrieben. Auf anderen Computern ausgeführt kann es nachhaltige Schäden anrichten!
Textbox.
Linear-Darstellung
