|
Falsche Weiterleitung von Browserlinks Hallo, wie bereits einige andere in diesem Forum habe ich das Problem, dass das Anklicken von Links im Browser zu falschen Zielen führt. Bei Eingabe der Adresse in die Adressleiste funktioniert alles. Betroffen sind IE9, Firefox, Chrome, jeweils in aktueller Version. Suchanbieter sind ebenfalls alle betroffen, Eingabe in Suchleiste oder Suchfeld ebenfalls gleich, der entstehende Link wird immer falsch verlinkt. Ich habe mit Spybot, Malwarebytes und Norton Internet Security nach Ursachen gesucht, aber keine Lösung in Sicht. Anbei die ersten LOG Files: defogger.txt defogger_disable by jpshortstuff (23.02.10.1) Log created at 07:16 on 03/02/2013 (*****) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- OTL.txt OTL logfile created on: 2/3/2013 7:17:46 AM - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\*****\Desktop Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2.96 Gb Total Physical Memory | 1.18 Gb Available Physical Memory | 39.92% Memory free 5.92 Gb Paging File | 4.06 Gb Available in Paging File | 68.53% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files Drive C: | 141.49 Gb Total Space | 73.12 Gb Free Space | 51.67% Space Free | Partition Type: NTFS Drive D: | 141.50 Gb Total Space | 140.52 Gb Free Space | 99.31% Space Free | Partition Type: NTFS Drive E: | 99.82 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Computer Name: *****-7 | User Name: ***** | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013/02/03 07:11:40 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\*****\Desktop\OTL.exe PRC - [2012/12/05 02:40:03 | 000,143,928 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton Internet Security\Engine\20.2.1.22\ccsvchst.exe PRC - [2012/11/30 03:55:25 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe PRC - [2012/11/23 03:48:41 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2012/11/22 10:50:02 | 000,166,424 | ---- | M] (Microsoft Corp.) -- C:\Program Files\Microsoft\BingDesktop\BingDesktopUpdater.exe PRC - [2012/11/13 14:08:14 | 003,500,568 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy 2\SDWelcome.exe PRC - [2012/11/13 14:07:52 | 003,906,584 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy 2\SDScan.exe PRC - [2012/11/13 14:07:20 | 001,369,624 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe PRC - [2012/11/13 14:07:16 | 001,103,392 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe PRC - [2012/07/16 18:28:36 | 006,974,360 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version5\TeamViewer.exe PRC - [2012/07/16 18:28:36 | 002,025,368 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe PRC - [2012/02/24 02:29:58 | 000,059,240 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe PRC - [2012/02/23 11:30:40 | 000,059,240 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Internet Services\ubd.exe PRC - [2012/02/23 11:22:56 | 000,059,240 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe PRC - [2012/02/20 20:28:32 | 000,059,240 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe PRC - [2011/09/09 16:01:16 | 001,804,648 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe PRC - [2011/02/25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2010/11/30 01:23:56 | 001,037,672 | ---- | M] (Symantec Corporation) -- C:\Program Files\Norton Utilities 15\Tools\SpeedDisk\SpeedDiskSrv.exe PRC - [2010/11/30 01:23:56 | 000,406,888 | ---- | M] (Symantec Corporation) -- C:\Program Files\Norton Utilities 15\Tools\SpeedDisk\SpeedDiskSrvProxy.exe PRC - [2010/11/30 01:23:44 | 001,029,480 | ---- | M] (Symantec Corporation) -- C:\Program Files\Norton Utilities 15\Tools\Disk Doctor\DiskDoctorSrv.exe PRC - [2010/11/30 01:23:44 | 000,406,888 | ---- | M] (Symantec Corporation) -- C:\Program Files\Norton Utilities 15\Tools\Disk Doctor\DiskDoctorSrvProxy.exe PRC - [2009/11/11 15:17:02 | 000,771,360 | ---- | M] (Apple Inc.) -- C:\Program Files\AirPort\APAgent.exe PRC - [2009/11/04 05:11:48 | 000,835,072 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe PRC - [2009/10/26 12:53:14 | 000,091,136 | ---- | M] (SAMSUNG Electronics) -- C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe PRC - [2009/10/20 10:12:58 | 000,013,312 | ---- | M] (DoctorSoft) -- C:\Program Files\AnyPC Client\APLangApp.exe PRC - [2009/10/13 11:03:04 | 000,716,800 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe PRC - [2009/10/07 02:31:56 | 002,246,144 | ---- | M] (SEC) -- C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe PRC - [2009/08/13 21:58:10 | 000,044,312 | ---- | M] () -- C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe PRC - [2009/01/12 02:52:00 | 000,354,304 | ---- | M] ((C) Michael Schiel) -- C:\Program Files\TrayBackup\traybackup.exe ========== Modules (No Company Name) ========== MOD - [2012/11/13 14:06:32 | 000,158,624 | ---- | M] () -- C:\Program Files\Spybot - Search & Destroy 2\snlFileFormats150.bpl MOD - [2012/11/13 14:06:30 | 000,108,960 | ---- | M] () -- C:\Program Files\Spybot - Search & Destroy 2\snlThirdParty150.bpl MOD - [2012/11/13 14:06:28 | 000,554,400 | ---- | M] () -- C:\Program Files\Spybot - Search & Destroy 2\VirtualTreesDXE150.bpl MOD - [2012/11/13 14:06:28 | 000,528,288 | ---- | M] () -- C:\Program Files\Spybot - Search & Destroy 2\JSDialogPack150.bpl MOD - [2012/11/13 14:06:28 | 000,416,160 | ---- | M] () -- C:\Program Files\Spybot - Search & Destroy 2\DEC150.bpl MOD - [2012/08/23 09:38:24 | 000,574,840 | ---- | M] () -- C:\Program Files\Spybot - Search & Destroy 2\sqlite3.dll MOD - [2012/05/30 07:51:08 | 000,699,280 | R--- | M] () -- C:\Program Files\Norton Internet Security\Engine\20.2.1.22\wincfi39.dll MOD - [2012/02/20 20:29:04 | 000,087,912 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2012/02/20 20:28:42 | 001,242,472 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll MOD - [2006/08/12 04:48:40 | 000,049,152 | ---- | M] () -- C:\Program Files\Samsung\Easy Display Manager\HookDllPS2.dll ========== Services (SafeList) ========== SRV - File not found [Auto | Stopped] -- C:\Program Files\Spybot -- (SDWSCService) SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SDUpdateService) SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SDScannerService) SRV - [2013/01/18 08:02:44 | 000,251,400 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012/12/05 02:40:03 | 000,143,928 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Norton Internet Security\Engine\20.2.1.22\ccSvcHst.exe -- (NIS) SRV - [2012/11/22 10:50:02 | 000,166,424 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Program Files\Microsoft\BingDesktop\BingDesktopUpdater.exe -- (BingDesktopUpdate) SRV - [2012/07/16 18:28:36 | 002,025,368 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe -- (TeamViewer5) SRV - [2012/07/13 12:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2010/11/30 01:23:56 | 001,037,672 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Norton Utilities 15\Tools\SpeedDisk\SpeedDiskSrv.exe -- (SpeedDiskService) SRV - [2010/11/30 01:23:44 | 001,029,480 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Norton Utilities 15\Tools\Disk Doctor\DiskDoctorSrv.exe -- (DiskDoctorService) SRV - [2009/08/13 21:58:10 | 000,044,312 | ---- | M] () [Auto | Running] -- C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe -- (OberonGameConsoleService) SRV - [2009/07/14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009/07/14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2008/01/29 16:09:02 | 000,394,704 | ---- | M] (Symantec, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe -- (Symantec RemoteAssist) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard) DRV - [2013/01/18 10:28:56 | 001,603,824 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130201.033\NAVEX15.SYS -- (NAVEX15) DRV - [2013/01/18 10:28:56 | 000,093,296 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130201.033\NAVENG.SYS -- (NAVENG) DRV - [2013/01/17 16:30:20 | 000,386,720 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20130201.001\IDSvix86.sys -- (IDSVix86) DRV - [2013/01/16 03:51:12 | 000,997,464 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130116.013\BHDrvx86.sys -- (BHDrvx86) DRV - [2012/10/21 14:03:05 | 000,142,496 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SYMEVENT.SYS -- (SymEvent) DRV - [2012/10/09 02:00:02 | 000,586,400 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\NIS\1402010.016\srtsp.sys -- (SRTSP) DRV - [2012/10/04 02:40:35 | 000,927,904 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\System32\drivers\NIS\1402010.016\symefa.sys -- (SymEFA) DRV - [2012/10/04 02:40:20 | 000,368,288 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\NIS\1402010.016\symds.sys -- (SymDS) DRV - [2012/09/07 03:05:14 | 000,338,592 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\NIS\1402010.016\symnets.sys -- (SymNetS) DRV - [2012/09/07 02:48:08 | 000,175,264 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\NIS\1402010.016\ironx86.sys -- (SymIRON) DRV - [2012/08/23 15:44:32 | 000,014,848 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV - [2012/08/23 15:40:25 | 000,049,664 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV - [2012/08/20 20:49:49 | 000,134,304 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\NIS\1402010.016\ccsetx86.sys -- (ccSet_NIS) DRV - [2012/08/09 07:04:29 | 000,376,480 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl) DRV - [2012/08/09 07:04:29 | 000,106,656 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv) DRV - [2012/05/24 22:36:56 | 000,032,888 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\NIS\1402010.016\srtspx.sys -- (SRTSPX) DRV - [2011/12/13 03:32:24 | 002,228,224 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr) DRV - [2010/11/30 01:24:00 | 000,108,800 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SymSpeedDisk.sys -- (SYMSpeedDisk) DRV - [2010/11/30 01:23:58 | 000,128,248 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SymDSMon.sys -- (SymDSMon) DRV - [2010/11/20 10:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb) DRV - [2009/09/28 10:22:00 | 000,315,392 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\yk62x86.sys -- (yukonw7) DRV - [2009/07/14 00:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp) DRV - [2009/07/10 14:44:52 | 000,122,880 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://de.yahoo.com/" FF - prefs.js..extensions.enabledAddons: %7BBBDA0591-3099-440a-AA10-41764D9DB4DB%7D:11.1.1.5%20-%202 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.1 FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:3.0 FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:2010.9.0.6 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\windows\system32\C2MP\npdivx32.dll (DivX,Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\coFFPlgn\ [2013/02/03 06:31:11 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\IPSFFPlgn\ [2012/10/21 14:29:02 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.2\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2013/01/23 08:45:09 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 17.0.2\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2013/01/23 08:45:09 | 000,000,000 | ---D | M] [2012/02/03 15:14:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Extensions [2010/02/22 15:16:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2012/02/03 15:14:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Extensions\home2@tomtom.com [2012/10/25 09:13:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\urn0o53f.default\extensions [2012/10/21 14:29:02 | 000,000,000 | ---D | M] (Norton Vulnerability Protection) -- C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\IPSFFPLGN O1 HOSTS File: ([2013/02/02 14:12:59 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\20.2.1.22\coieplg.dll (Symantec Corporation) O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\20.2.1.22\ips\ipsbho.dll (Symantec Corporation) O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\20.2.1.22\coieplg.dll (Symantec Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\20.2.1.22\coieplg.dll (Symantec Corporation) O4 - HKLM..\Run: [AirPort Base Station Agent] C:\Program Files\AirPort\APAgent.exe (Apple Inc.) O4 - HKLM..\Run: [APLangApp] C:\Program Files\AnyPC Client\APLangApp.exe (DoctorSoft) O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [BingDesktop] C:\Program Files\Microsoft\BingDesktop\BingDesktop.exe (Microsoft Corp.) O4 - HKLM..\Run: [PDVD8LanguageShortcut] C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe (CyberLink Corp.) O4 - HKCU..\Run: [ApplePhotoStreams] C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Apple Inc.) O4 - HKCU..\Run: [HP Officejet Pro 8600 (NET)] C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe (Hewlett-Packard Co.) O4 - HKCU..\Run: [iCloudServices] C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.) O4 - HKCU..\Run: [MobileDocuments] C:\Program Files\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.) O4 - HKCU..\Run: [TrayBackup] C:\Program Files\TrayBackup\traybackup.exe ((C) Michael Schiel) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O15 - HKCU\..Trusted Domains: fritz.repeater ([]* in Local intranet) O15 - HKCU\..Trusted Ranges: Range1 ([*] in Local intranet) O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4A9BECE1-AC4C-49E8-9A78-FC0628D26295}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{52354A84-BE2E-4B44-BF08-91B1DCBFBB9D}: DhcpNameServer = 192.168.1.250 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{95DE52F9-5E06-47C9-BE22-4B7FE2603F77}: DhcpNameServer = 192.168.2.1 192.168.2.1 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009/06/10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013/02/03 07:16:29 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\*****\Desktop\OTL.exe [2013/02/02 15:28:44 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\Malwarebytes [2013/02/02 15:28:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2013/02/02 15:28:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2013/02/02 15:28:32 | 000,021,104 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys [2013/02/02 15:28:32 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2013/02/02 14:27:17 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner [2013/02/02 14:14:34 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN [2013/02/02 14:14:31 | 000,000,000 | ---D | C] -- C:\windows\temp [2013/02/02 14:14:31 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\temp [2013/02/02 13:29:01 | 000,000,000 | ---D | C] -- C:\windows\erdnt [2013/02/02 11:41:06 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\*****-BasisRenten-Rechner [2013/02/02 11:39:38 | 000,000,000 | ---D | C] -- C:\Program Files\*****-BasisRenten-Rechner [2013/02/02 11:05:49 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group [2013/02/02 11:04:42 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard [2013/02/02 10:49:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy [2013/02/02 10:49:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2 [2013/02/02 10:49:42 | 000,015,224 | ---- | C] (Safer Networking Limited) -- C:\windows\System32\sdnclean.exe [2013/02/02 10:49:38 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy 2 [2013/02/02 10:49:19 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\Programs [2013/01/23 08:45:08 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Thunderbird [2013/01/19 15:02:42 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2010/02/22 15:03:28 | 000,720,315 | ---- | C] (Macromedia, Inc.) -- C:\Users\*****\Kopie von BuonNatale.exe [2010/02/22 15:03:14 | 000,720,315 | ---- | C] (Macromedia, Inc.) -- C:\Users\*****\BuonNatale.exe [1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013/02/03 07:16:59 | 000,000,000 | ---- | M] () -- C:\Users\*****\defogger_reenable [2013/02/03 07:12:05 | 000,365,568 | ---- | M] () -- C:\Users\*****\Desktop\gmer_2.0.18454.exe [2013/02/03 07:11:40 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\*****\Desktop\OTL.exe [2013/02/03 07:11:31 | 000,050,477 | ---- | M] () -- C:\Users\*****\Desktop\Defogger.exe [2013/02/03 07:01:00 | 000,000,884 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job [2013/02/03 06:35:24 | 000,014,512 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013/02/03 06:35:24 | 000,014,512 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013/02/03 06:28:09 | 000,000,308 | ---- | M] () -- C:\windows\tasks\Wyrts.job [2013/02/03 06:27:58 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat [2013/02/03 06:27:56 | 2384,941,056 | -HS- | M] () -- C:\hiberfil.sys [2013/02/02 15:28:34 | 000,001,031 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk [2013/02/02 14:27:20 | 000,000,929 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk [2013/02/02 14:12:59 | 000,000,027 | ---- | M] () -- C:\windows\System32\drivers\etc\hosts [2013/02/02 12:57:26 | 000,654,400 | ---- | M] () -- C:\windows\System32\perfh007.dat [2013/02/02 12:57:26 | 000,616,242 | ---- | M] () -- C:\windows\System32\perfh009.dat [2013/02/02 12:57:26 | 000,130,240 | ---- | M] () -- C:\windows\System32\perfc007.dat [2013/02/02 12:57:26 | 000,106,622 | ---- | M] () -- C:\windows\System32\perfc009.dat [2013/02/02 11:41:06 | 000,002,080 | ---- | M] () -- C:\Users\*****\Desktop\*****-BasisRenten-Rechner.lnk [2013/02/01 20:15:06 | 000,000,248 | ---- | M] () -- C:\windows\tasks\NUSchedule.job [2013/01/24 15:52:32 | 001,734,147 | ---- | M] () -- C:\windows\System32\drivers\NIS\1402010.016\Cat.DB [2013/01/24 15:51:02 | 000,014,818 | ---- | M] () -- C:\windows\System32\drivers\NIS\1402010.016\VT20130115.021 [2013/01/21 08:31:52 | 000,001,944 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk [2013/01/19 10:16:06 | 000,350,312 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT [2013/01/10 08:44:09 | 000,000,172 | ---- | M] () -- C:\windows\System32\drivers\NIS\1402010.016\isolate.ini [1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2013/02/03 07:16:59 | 000,000,000 | ---- | C] () -- C:\Users\*****\defogger_reenable [2013/02/03 07:16:29 | 000,365,568 | ---- | C] () -- C:\Users\*****\Desktop\gmer_2.0.18454.exe [2013/02/03 07:16:29 | 000,050,477 | ---- | C] () -- C:\Users\*****\Desktop\Defogger.exe [2013/02/02 15:28:34 | 000,001,031 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk [2013/02/02 14:27:19 | 000,000,929 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk [2013/02/02 11:41:06 | 000,002,080 | ---- | C] () -- C:\Users\*****\Desktop\*****-BasisRenten-Rechner.lnk [2013/02/02 10:49:49 | 000,002,095 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk [2012/11/14 16:46:33 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini [2012/10/20 18:24:44 | 000,094,208 | RHS- | C] () -- C:\windows\System32\KBDLTF.dll [2012/09/06 09:34:39 | 000,000,288 | ---- | C] () -- C:\Users\*****\AppData\Roaming\.backup.dm [2011/11/18 10:01:14 | 000,000,046 | ---- | C] () -- C:\windows\hmview.ini [2011/10/19 19:39:29 | 000,036,712 | ---- | C] () -- C:\windows\System32\CleanMFT32.exe [2011/03/21 16:10:29 | 000,000,530 | ---- | C] () -- C:\windows\System32\tx16_ic.ini [2011/02/11 17:40:40 | 000,004,096 | ---- | C] ( ) -- C:\windows\System32\IGFXDEVLib.dll [2011/01/19 09:22:52 | 000,001,940 | ---- | C] () -- C:\Users\*****\AppData\Local\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini [2010/03/15 15:27:09 | 000,000,000 | ---- | C] () -- C:\Users\*****\AppData\Roaming\AVSMediaPlayer.m3u [2010/03/15 14:57:41 | 000,000,218 | ---- | C] () -- C:\Users\*****\AppData\Roaming\wklnhst.dat [2010/02/22 17:30:36 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2010/02/22 15:03:42 | 000,438,574 | ---- | C] () -- C:\Users\*****\Zelladhaesion.pdf [2010/02/22 15:03:41 | 004,244,300 | ---- | C] () -- C:\Users\*****\wake-up.wmv [2010/02/22 15:03:40 | 000,671,694 | ---- | C] () -- C:\Users\*****\Typhus_Ratzmotegma.bmp [2010/02/22 15:03:40 | 000,035,345 | ---- | C] () -- C:\Users\*****\Volker Spieler KV.pdf [2010/02/22 15:03:40 | 000,000,461 | ---- | C] () -- C:\Users\*****\Verknüpfung mit Lebenslauf.dot.lnk [2010/02/22 15:03:35 | 065,806,408 | ---- | C] () -- C:\Users\*****\Track No06.nrg [2010/02/22 15:03:35 | 002,288,402 | ---- | C] () -- C:\Users\*****\Track No05.mp4 [2010/02/22 15:03:34 | 003,093,332 | ---- | C] () -- C:\Users\*****\Track No02.mp4 [2010/02/22 15:03:34 | 002,730,729 | ---- | C] () -- C:\Users\*****\Track No04.mp4 [2010/02/22 15:03:34 | 002,504,789 | ---- | C] () -- C:\Users\*****\Track No03.mp4 [2010/02/22 15:03:34 | 002,335,344 | ---- | C] () -- C:\Users\*****\Track No01.mp4 [2010/02/22 15:03:33 | 000,580,534 | ---- | C] () -- C:\Users\*****\Reiseablauf-Version-2.pdf [2010/02/22 15:03:33 | 000,174,414 | ---- | C] () -- C:\Users\*****\sepia.jpg [2010/02/22 15:03:33 | 000,140,531 | ---- | C] () -- C:\Users\*****\Stephan Fiederer.pdf [2010/02/22 15:03:33 | 000,078,408 | ---- | C] () -- C:\Users\*****\Susanne Hanke.pdf [2010/02/22 15:03:33 | 000,073,317 | ---- | C] () -- C:\Users\*****\Tanja Kohler.pdf [2010/02/22 15:03:33 | 000,018,602 | ---- | C] () -- C:\Users\*****\Steffen Bockhahn.pdf [2010/02/22 15:03:32 | 001,669,545 | ---- | C] () -- C:\Users\*****\PICT0800.JPG [2010/02/22 15:03:32 | 000,137,632 | ---- | C] () -- C:\Users\*****\Rainer Kling.pdf [2010/02/22 15:03:32 | 000,132,964 | ---- | C] () -- C:\Users\*****\Rainer Klink.pdf [2010/02/22 15:03:31 | 002,359,350 | ---- | C] () -- C:\Users\*****\PICT0242a.bmp [2010/02/22 15:03:29 | 009,437,238 | ---- | C] () -- C:\Users\*****\PICT0242.bmp [2010/02/22 15:03:29 | 000,148,866 | ---- | C] () -- C:\Users\*****\Matthias Schwarz.pdf [2010/02/22 15:03:29 | 000,050,353 | ---- | C] () -- C:\Users\*****\N.Schönfeld.pdf [2010/02/22 15:03:29 | 000,040,424 | ---- | C] () -- C:\Users\*****\Michael Staggat.pdf [2010/02/22 15:03:29 | 000,022,611 | ---- | C] () -- C:\Users\*****\Marsa Alam.nri [2010/02/22 15:03:28 | 000,060,677 | ---- | C] () -- C:\Users\*****\krigar.pdf [2010/02/22 15:03:28 | 000,037,676 | ---- | C] () -- C:\Users\*****\KVTWIN.pdf [2010/02/22 15:03:28 | 000,032,225 | ---- | C] () -- C:\Users\*****\Margit Häfele.pdf [2010/02/22 15:03:28 | 000,031,065 | ---- | C] () -- C:\Users\*****\Lars Armbruster.pdf [2010/02/22 15:03:27 | 000,154,345 | ---- | C] () -- C:\Users\*****\Kersten Rohmer.pdf [2010/02/22 15:03:26 | 000,017,835 | ---- | C] () -- C:\Users\*****\Karl Rothmund.pdf [2010/02/22 15:03:25 | 010,273,692 | ---- | C] () -- C:\Users\*****\Jessi RV Magazin.pdf [2010/02/22 15:03:25 | 000,035,104 | ---- | C] () -- C:\Users\*****\Jess und Luke.jpg [2010/02/22 15:03:17 | 000,016,880 | ---- | C] () -- C:\Users\*****\horgenzell2006.pdf [2010/02/22 15:03:16 | 000,704,238 | ---- | C] () -- C:\Users\*****\Glck_mit_dem_Wetter_0_.pdf [2010/02/22 15:03:16 | 000,144,550 | ---- | C] () -- C:\Users\*****\Harald Stockfleht.pdf [2010/02/22 15:03:16 | 000,067,740 | ---- | C] () -- C:\Users\*****\hofherr, wolfgang.pdf [2010/02/22 15:03:16 | 000,010,240 | ---- | C] () -- C:\Users\*****\Grupp-Bank2008optimal.wps [2010/02/22 15:03:15 | 000,059,250 | ---- | C] () -- C:\Users\*****\Geiselmann.pdf [2010/02/22 15:03:15 | 000,052,390 | ---- | C] () -- C:\Users\*****\Eugen Breith.pdf [2010/02/22 15:03:15 | 000,019,866 | ---- | C] () -- C:\Users\*****\Fam. Rittler pflege.pdf [2010/02/22 15:03:14 | 000,148,934 | ---- | C] () -- C:\Users\*****\bw.jpg [2010/02/22 15:03:14 | 000,080,332 | ---- | C] () -- C:\Users\*****\Christiane Möller.pdf [2010/02/22 15:03:14 | 000,064,618 | ---- | C] () -- C:\Users\*****\Caroline Berger.pdf [2010/02/22 15:03:14 | 000,064,505 | ---- | C] () -- C:\Users\*****\Caroline Berger 2.pdf [2010/02/22 15:03:14 | 000,051,722 | ---- | C] () -- C:\Users\*****\DIE KRISE.pdf [2010/02/22 15:03:13 | 000,729,658 | ---- | C] () -- C:\Users\*****\Buchungsbestätigung.JPG [2010/02/22 15:03:13 | 000,593,031 | ---- | C] () -- C:\Users\*****\bluefin[1].pdf [2010/02/22 15:03:13 | 000,184,844 | ---- | C] () -- C:\Users\*****\blue.jpg [2010/02/22 15:03:13 | 000,090,035 | ---- | C] () -- C:\Users\*****\Bernd Schatz.pdf [2010/02/22 15:03:12 | 000,149,282 | ---- | C] () -- C:\Users\*****\bafög.zip [2010/02/22 15:03:12 | 000,121,285 | ---- | C] () -- C:\Users\*****\Bankmitarbeiterinfo_VVG.pdf [2010/02/22 15:03:12 | 000,079,528 | ---- | C] () -- C:\Users\*****\bafög2.zip [2010/02/22 15:03:12 | 000,041,668 | ---- | C] () -- C:\Users\*****\Avartar James Cameron.htm [2010/02/22 15:03:12 | 000,021,646 | ---- | C] () -- C:\Users\*****\70 jährigr ohne PE.pdf [2010/02/22 15:03:11 | 000,022,281 | ---- | C] () -- C:\Users\*****\69 jährige ohne PE.pdf ========== ZeroAccess Check ========== [2009/07/14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012/06/09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009/07/14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2012/10/04 09:28:22 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\gotomaxx [2010/11/11 21:32:48 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\TeamViewer [2010/03/15 14:59:33 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Template [2010/02/22 15:16:15 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Thunderbird [2010/07/23 09:34:28 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Tific [2012/02/03 15:13:58 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\TomTom ========== Purity Check ========== < End of report > Extras.txt OTL Extras logfile created on: 2/3/2013 7:17:46 AM - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\*****\Desktop Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2.96 Gb Total Physical Memory | 1.18 Gb Available Physical Memory | 39.92% Memory free 5.92 Gb Paging File | 4.06 Gb Available in Paging File | 68.53% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files Drive C: | 141.49 Gb Total Space | 73.12 Gb Free Space | 51.67% Space Free | Partition Type: NTFS Drive D: | 141.50 Gb Total Space | 140.52 Gb Free Space | 99.31% Space Free | Partition Type: NTFS Drive E: | 99.82 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Computer Name: *****-7 | User Name: ***** | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\windows\System32\control.exe (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\windows\winhlp32.exe (Microsoft Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) htafile [open] -- "%1" %* inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 0 "FirewallDisableNotify" = 0 "AntiVirusDisableNotify" = 0 "UpdatesDisableNotify" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = Reg Error: Unknown registry data type -- File not found "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 ========== System Restore Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore] "DisableSR" = 0 ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile] [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon -- (Safer-Networking Ltd.) "C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D 2 Scanner Service -- (Safer-Networking Ltd.) "C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater -- (Safer-Networking Ltd.) "C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service -- (Safer-Networking Ltd.) ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{0005C686-A33B-423A-B59C-97553627AAD4}" = rport=445 | protocol=6 | dir=out | app=system | "{03E3F9E7-3E84-4079-A68A-316DB80A3C3F}" = lport=137 | protocol=17 | dir=in | app=system | "{06785053-0E37-4BE8-81C1-108732FF0248}" = rport=137 | protocol=17 | dir=out | app=system | "{1510DC41-0F3C-4D3B-9A13-B5FEC8D232A4}" = lport=138 | protocol=17 | dir=in | app=system | "{17A74BC4-D65A-4C3A-9EDB-995D7DAF1F1B}" = lport=2869 | protocol=6 | dir=in | app=system | "{2532B705-569D-43DD-97F0-7DC7866BADC6}" = rport=10243 | protocol=6 | dir=out | app=system | "{4124D0CA-ECE0-4C11-A1D1-CA9698EB1A05}" = lport=2869 | protocol=6 | dir=in | name=tcp 2869 | "{5209287C-74A4-47EE-A20F-3FE01924E41F}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{5BD024AE-62D1-4377-9796-2EC8CCF1CF98}" = lport=139 | protocol=6 | dir=in | app=system | "{6D97190F-5C08-41FD-888D-1582A8152BE8}" = rport=138 | protocol=17 | dir=out | app=system | "{7326A686-E01D-4C00-AD3C-5CD3FE416877}" = lport=1900 | protocol=17 | dir=in | name=udp 1900 | "{7CD58C29-55E2-46F3-AFA5-F352D6C0BE35}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | "{7D180019-2E32-4988-B052-433E0AE571D6}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{7D434896-AC9D-4BAA-B821-0773D2C11C8F}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{7F03F016-AC68-43C1-8D6B-9FC7016F2DE3}" = lport=445 | protocol=6 | dir=in | app=system | "{84F0D991-501D-4378-80C6-584F771DC85A}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{8B62E4E0-E675-49BC-AC52-CEAD5C5E235C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | "{A2E87285-0AAB-492B-8B96-DA34C4F791B6}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{AA302B38-4B2F-468E-B8CC-A97F0785BC20}" = rport=139 | protocol=6 | dir=out | app=system | "{AD0A2A9B-3D2F-45BB-829D-6BDA080C1385}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{BC4ABC9B-FCB6-4AFF-A7FE-A6CE006835F7}" = lport=2869 | protocol=6 | dir=in | app=system | "{CEED2447-6492-4BF2-9799-ADE9ABEABFAF}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{D1219BE8-DAFE-4FF2-A0F4-0D6D7DB3270A}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{D8A7F2CB-E2CB-491D-B86A-5D9A7C6C2106}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{D99A02ED-6896-4BD2-8F2A-2DBB379A2F6D}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{DCC2360F-FA46-4B4F-8FDB-D86D69259775}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{FDB0B3DF-D5E7-4584-9C56-7E3493FC8C1B}" = lport=10243 | protocol=6 | dir=in | app=system | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{00754578-6EE4-4408-AC40-F67A125A7057}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{068F0458-C5EA-4AD7-AD30-01BF3A57813C}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{17A31DA7-D629-42F9-87E1-29031569F477}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{1BD21FD3-7B37-422D-98AB-EFA13BACDE1E}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version5\teamviewer_service.exe | "{2159400A-5144-4D4F-9C21-9FBAD2D23115}" = dir=in | app=c:\program files\skype\phone\skype.exe | "{241C464A-2FA7-4EBB-ADD2-7F318E500D26}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | "{305F9C3B-6616-42C0-A09C-602E3015B637}" = dir=in | app=c:\program files\cyberlink\powerdvd8\powerdvd8.exe | "{3DB9FF8B-4972-49F1-8B81-8F773684F3FA}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | "{3DE7E805-B589-49CC-B38E-471F2E5CA9E6}" = dir=in | app=c:\program files\hp\hp officejet pro 8600\bin\devicesetup.exe | "{486D8870-2E95-4E07-8B5E-B7189C795450}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | "{4A087178-E575-4006-88AF-E041F0583B84}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{4A425126-57AB-4B2B-8038-641B23EE920C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{6AEF3D5C-5758-4DA5-A259-B74032C3739D}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{6D9D1A9C-8D4D-4FAB-9CCD-74395350E2A5}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{72B9E09C-EEC0-4EE6-854D-D49D83D1129B}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version5\teamviewer_service.exe | "{761B7127-3B7E-44E4-8629-A794DCF1C1F1}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | "{808E1420-3E26-400A-A677-295705D86A4B}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "{822CBFDB-93D4-4E00-9558-F6CFAD28EA45}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | "{895FD37D-B4E0-46AB-88FB-684517B522C2}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe | "{89AF244B-069E-4226-9122-4FE59142167E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{8A3C80AC-10D6-4F30-87C2-B681C004E70E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{8C5D737F-9916-4FE8-A040-7F56D40A9B22}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version5\teamviewer.exe | "{978B94D9-19F6-4120-931B-42F25C2BDE36}" = dir=in | app=c:\program files\windows live\messenger\wlc*****.exe | "{9A10ABEA-D2DC-4C40-ADAC-5DE0F8241CE7}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | "{9E09BA18-56CF-4445-919D-AC7A4FA2983B}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{A205B521-83F6-4514-96C7-5E517A49F92F}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version5\teamviewer.exe | "{B53D8DA0-5F76-4E44-ACCE-9C0B5932450D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{C29BD9A8-D671-4B1B-AEF0-38C7B82A4031}" = dir=in | app=c:\program files\airport\apagent.exe | "{C44EF3A6-073A-4905-8B46-5816816745C0}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "{C82FC289-E4FB-40A9-A791-31367D558415}" = dir=in | app=c:\program files\hp\hp officejet pro 8600\bin\hpnetworkcommunicator.exe | "{CA00BBD0-798F-4513-B758-E651C55A1A2F}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | "{E92E9420-C573-4E2D-A9DF-A593DC05ADF3}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | "{F0A411FB-4E60-4759-8051-A7A97E9F91E5}" = protocol=6 | dir=out | app=system | "{F426A254-E1C6-4318-B434-9B526A2F3B68}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{01310914-E3B8-40E8-BCF7-9C42E0639A43}" = gotomaxx PDFMAILER "{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam "{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime "{10C0E43D-9D84-4DF7-9516-43B74FA5FDEA}" = *****-Komponenten 02/2009 "{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution 4 "{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager "{178EE5F4-0F86-4BF0-A0D1-9790AFF409D1}" = EasyBatteryManager "{1AFA1FEF-8CF9-4A51-AC46-64FAA7F3D9E2}" = AnyPC Client "{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite "{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool "{20C53FA2-4307-4671-A93F-9463B29DFCF1}" = Symantec Technical Support Web Controls "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT "{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie "{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8 "{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}" = HP Update "{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works "{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile "{3EFEF049-23D4-4B46-8903-4592FEA51018}" = Windows Live Movie Maker "{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go "{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger "{4412F224-3849-4461-A3E9-DEEF8D252790}" = Visual Studio C++ 10.0 Runtime "{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent "{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call "{619387A7-F174-457C-9A4F-AB68D928D1A2}" = funkwerk Eumex 401 WIN-Tools V2.00 "{63eafc52-b963-4297-a7eb-d412944e7065}_is1" = Game Pack "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable "{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update "{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour "{82583139-4677-11D8-9B7A-D6C20956C046}" = ***** Angebotsprogramm "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}" = Alice Greenfingers "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-114072167}" = Go-Go Gourmet "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115053100}" = Dairy Dash "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11531173}" = Farm Frenzy 2 "{853F8A41-A3C9-43FA-87FA-1AE74FC6F3F7}" = BatteryLifeExtender "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules "{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007 "{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007 "{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007 "{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007 "{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007 "{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System "{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007 "{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007 "{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007 "{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In "{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager "{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007 "{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3) "{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German) "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting "{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars "{98D64F70-1BE2-4E06-A58E-50FF642B3F24}" = HP Officejet Pro 8600 - Grundlegende Software für das Gerät "{994223F3-A99B-4DDD-9E1D-0190A17C6860}" = Windows Live Family Safety "{99CBA603-937D-4058-806F-7A9AF711A1AA}" = Eumex RNDIS Driver V1.00 "{A5675A9E-F073-414A-9A04-F9BCD50459D7}" = Easy Network Manager "{AA68AAAE-41F0-40B5-8896-5947F5FD6889}" = AirPort "{AC76BA86-7AD7-1031-7B44-A95000000001}" = Adobe Reader 9.5.3 - Deutsch "{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1" = Spybot - Search & Destroy "{B6F5C6D8-C443-4B55-932F-AE11B5743FC4}" = HP Officejet Pro 8600 Hilfe "{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer "{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}" = User Guide "{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail "{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint "{CA6BCA2F-EDEB-408F-850B-31404BE16A61}" = I.R.I.S. OCR "{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector "{CCC2B140-B47A-45FA-AAE3-BD60DA41AE00}" = Samsung Support Center "{D1434266-0486-4469-B338-A60082CC04E1}" = Atheros Client Installation Program "{D3F2FAA5-FEC4-42AA-9ABA-1F763919A2B5}" = Samsung Update Plus "{DA7DF8E2-4B8F-4286-97FE-DE3FFFE9B728}" = iCloud "{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer "{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update "{E2F2D836-B7DC-401B-8D3B-EF6B0A6F5121}" = *****-BasisRenten-Rechner "{E33EAB77-A36A-4FBF-BB15-2BBF74C7A796}" = iPhoneBrowser "{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant "{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support "{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10 "{EF367AA4-070B-493C-9575-85BE59D789C9}" = Easy SpeedUp Manager "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU] "{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 "{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5 "{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials "AC3Filter_is1" = AC3Filter 1.63b "Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin "AVS Update Manager_is1" = AVS Update Manager 1.0 "AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.3 "CCleaner" = CCleaner "ESET Online Scanner" = ESET Online Scanner v3 "FreePDF_XP" = FreePDF (Remove only) "GOM Player" = GOM Player "GPL Ghostscript 8.71" = GPL Ghostscript 8.71 "HDMI" = Intel(R) Graphics Media Accelerator Driver "HOMESTUDENTR" = Microsoft Office Home and Student 2007 "InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam "InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite "InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8 "InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go "InstallShield_{619387A7-F174-457C-9A4F-AB68D928D1A2}" = funkwerk Eumex 401 WIN-Tools V2.00 "InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer "InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint "InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector "Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100 "Marvell Miniport Driver" = Marvell Miniport Driver "Media Player - Codec Pack" = Media Player Codec Pack 3.9.2 "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Mozilla Thunderbird 17.0.2 (x86 de)" = Mozilla Thunderbird 17.0.2 (x86 de) "MyTomTom" = MyTomTom 3.2.0.700 "NIS" = Norton Internet Security "Norton Utilities 15_is1" = Norton Utilities 15 "Redirection Port Monitor" = RedMon - Redirection Port Monitor "SynTPDeinstKey" = Synaptics Pointing Device Driver "TeamViewer 5" = TeamViewer 5 "WinLiveSuite_Wave3" = Windows Live Essentials "WinZip" = WinZip ========== Last 20 Event Log Errors ========== [ Application Events ] Error - 1/29/2013 3:07:59 AM | Computer Name = *****-7 | Source = Windows Search Service | ID = 3058 Description = Error - 1/29/2013 3:07:59 AM | Computer Name = *****-7 | Source = Windows Search Service | ID = 7010 Description = Error - 1/29/2013 9:16:02 AM | Computer Name = *****-7 | Source = SideBySide | ID = 16842785 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Samsung\Samsung Support Center\Drv\drv2x64\KStartMem.exe.Manifest". Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error - 1/29/2013 9:16:23 AM | Computer Name = *****-7 | Source = SideBySide | ID = 16842785 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Samsung\BatteryLifeExtender\Drv\SABI2x64\KStartMem.exe.Manifest". Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error - 1/31/2013 2:46:46 AM | Computer Name = *****-7 | Source = Windows Search Service | ID = 3038 Description = Error - 1/31/2013 2:46:46 AM | Computer Name = *****-7 | Source = Windows Search Service | ID = 7040 Description = Error - 1/31/2013 2:46:46 AM | Computer Name = *****-7 | Source = Windows Search Service | ID = 7042 Description = Error - 1/31/2013 2:46:53 AM | Computer Name = *****-7 | Source = Windows Search Service | ID = 3028 Description = Error - 1/31/2013 2:46:53 AM | Computer Name = *****-7 | Source = Windows Search Service | ID = 3058 Description = Error - 1/31/2013 2:46:53 AM | Computer Name = *****-7 | Source = Windows Search Service | ID = 7010 Description = [ Spybot - Search and Destroy Events ] Error - 2/2/2013 6:29:02 AM | Computer Name = *****-7 | Source = SDCleaner | ID = 100 Description = LoadCleaningInstructions [ System Events ] Error - 2/2/2013 7:41:45 AM | Computer Name = *****-7 | Source = Service Control Manager | ID = 7001 Description = Der Dienst "Spybot-S&D 2 Security Center Service" ist vom Dienst "Sicherheitscenter" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1058 Error - 2/2/2013 7:50:09 AM | Computer Name = *****-7 | Source = Service Control Manager | ID = 7001 Description = Der Dienst "Spybot-S&D 2 Security Center Service" ist vom Dienst "Sicherheitscenter" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1058 Error - 2/2/2013 8:01:54 AM | Computer Name = *****-7 | Source = Service Control Manager | ID = 7001 Description = Der Dienst "Spybot-S&D 2 Security Center Service" ist vom Dienst "Sicherheitscenter" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1058 Error - 2/2/2013 8:08:39 AM | Computer Name = *****-7 | Source = Service Control Manager | ID = 7001 Description = Der Dienst "Spybot-S&D 2 Security Center Service" ist vom Dienst "Sicherheitscenter" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1058 Error - 2/2/2013 8:33:23 AM | Computer Name = *****-7 | Source = Service Control Manager | ID = 7030 Description = Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren. Error - 2/2/2013 8:39:32 AM | Computer Name = *****-7 | Source = BROWSER | ID = 8032 Description = Error - 2/2/2013 9:04:43 AM | Computer Name = *****-7 | Source = Service Control Manager | ID = 7030 Description = Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren. Error - 2/2/2013 9:13:02 AM | Computer Name = *****-7 | Source = Service Control Manager | ID = 7030 Description = Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren. Error - 2/2/2013 10:21:27 AM | Computer Name = *****-7 | Source = Service Control Manager | ID = 7001 Description = Der Dienst "Spybot-S&D 2 Security Center Service" ist vom Dienst "Sicherheitscenter" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1058 Error - 2/3/2013 1:28:11 AM | Computer Name = *****-7 | Source = Service Control Manager | ID = 7001 Description = Der Dienst "Spybot-S&D 2 Security Center Service" ist vom Dienst "Sicherheitscenter" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1058 < End of report > gmer.txt GMER 2.0.18454 - hxxp://www.gmer.net Rootkit scan 2013-02-03 07:45:44 Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.PB3O 298,09GB Running: gmer_2.0.18454.exe; Driver: C:\Users\*****\AppData\Local\Temp\ugldypow.sys ---- System - GMER 2.0 ---- SSDT 87277218 ZwAlertResumeThread SSDT 872772F8 ZwAlertThread SSDT 87274678 ZwAllocateVirtualMemory SSDT 871E5408 ZwAlpcConnectPort SSDT 87277970 ZwAssignProcessToJobObject SSDT 87277F18 ZwCreateMutant SSDT 87277690 ZwCreateSymbolicLinkObject SSDT 87272468 ZwCreateThread SSDT 87277780 ZwCreateThreadEx SSDT 87277A50 ZwDebugActiveProcess SSDT 870D1E28 ZwDuplicateObject SSDT 87272960 ZwFreeVirtualMemory SSDT 87277058 ZwImpersonateAnonymousToken SSDT 87277138 ZwImpersonateThread SSDT 871E4C70 ZwLoadDriver SSDT 87272860 ZwMapViewOfSection SSDT 87277E38 ZwOpenEvent SSDT 87274880 ZwOpenProcess SSDT 872716B0 ZwOpenProcessToken SSDT 87277C78 ZwOpenSection SSDT 872722A8 ZwOpenThread SSDT 87277880 ZwProtectVirtualMemory SSDT 87277400 ZwResumeThread SSDT 872762C0 ZwSetContextThread SSDT 872763A0 ZwSetInformationProcess SSDT 87277B30 ZwSetSystemInformation SSDT 87277D58 ZwSuspendProcess SSDT 87276100 ZwSuspendThread SSDT 87274720 ZwTerminateProcess SSDT 872761E0 ZwTerminateThread SSDT 87272780 ZwUnmapViewOfSection SSDT 87272A50 ZwWriteVirtualMemory ---- Kernel code sections - GMER 2.0 ---- .text ntoskrnl.exe!ZwRollbackEnlistment + 1401 8304E9C9 1 Byte [06] .text ntoskrnl.exe!KiDispatchInterrupt + 5A2 8306E4E2 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3} .text ntoskrnl.exe!KeRemoveQueueEx + 13A3 83075760 6 Bytes [18, 72, 27, 87, F8, 72] .text ntoskrnl.exe!KeRemoveQueueEx + 13AA 83075767 1 Byte [87] .text ntoskrnl.exe!KeRemoveQueueEx + 13BB 83075778 4 Bytes [78, 46, 27, 87] .text ntoskrnl.exe!KeRemoveQueueEx + 13C7 83075784 4 Bytes [08, 54, 1E, 87] {OR [ESI+EBX-0x79], DL} .text ntoskrnl.exe!KeRemoveQueueEx + 141B 830757D8 4 Bytes [70, 79, 27, 87] .text ... ---- User code sections - GMER 2.0 ---- .text C:\Program Files\CyberLink\Shared files\RichVideo.exe[404] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C .text C:\Program Files\CyberLink\Shared files\RichVideo.exe[404] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 003F0930 .text C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe[444] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C .text C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe[444] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 003A0AF4 .text C:\Program Files\Spybot - Search & Destroy 2\SDWelcome.exe[716] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C .text C:\Program Files\Spybot - Search & Destroy 2\SDWelcome.exe[716] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 002F0AF4 .text C:\Program Files\Norton Utilities 15\Tools\SpeedDisk\SpeedDiskSrv.exe[1212] kernel32.dll!SetUnhandledExceptionFilter 7592F4FB 4 Bytes [C2, 04, 00, 00] .text C:\Program Files\Common Files\Apple\Internet Services\ubd.exe[1684] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C .text C:\Program Files\Common Files\Apple\Internet Services\ubd.exe[1684] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 002F0930 .text C:\Program Files\Bonjour\mDNSResponder.exe[1764] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C .text C:\Program Files\Bonjour\mDNSResponder.exe[1764] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 000F0930 .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[1788] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[1788] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 001F0AF4 .text C:\Program Files\Norton Utilities 15\Tools\Disk Doctor\DiskDoctorSrv.exe[1792] kernel32.dll!SetUnhandledExceptionFilter 7592F4FB 4 Bytes [C2, 04, 00, 00] .text C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe[2076] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0048004C .text C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe[2076] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 005A0AF4 .text C:\Program Files\AirPort\APAgent.exe[2464] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 001F004C .text C:\Program Files\AirPort\APAgent.exe[2464] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 00210AF4 .text C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe[2796] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C .text C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe[2796] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 000F0930 .text C:\Program Files\TrayBackup\traybackup.exe[2884] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C .text C:\Program Files\TrayBackup\traybackup.exe[2884] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 003E0930 .text C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe[2904] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C .text C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe[2904] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 001F0930 .text C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2912] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C .text C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2912] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 00300930 .text C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe[2980] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C .text C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe[2980] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 00080AF4 .text C:\Program Files\Norton Utilities 15\Tools\Disk Doctor\DiskDoctorSrvProxy.exe[3004] kernel32.dll!SetUnhandledExceptionFilter 7592F4FB 4 Bytes [C2, 04, 00, 00] .text C:\Program Files\Norton Utilities 15\Tools\SpeedDisk\SpeedDiskSrvProxy.exe[3192] kernel32.dll!SetUnhandledExceptionFilter 7592F4FB 4 Bytes [C2, 04, 00, 00] .text C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe[3264] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C .text C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe[3264] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 001F0930 .text C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe[3324] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C .text C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe[3324] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 00180930 .text C:\Program Files\TeamViewer\Version5\TeamViewer.exe[3336] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C .text C:\Program Files\TeamViewer\Version5\TeamViewer.exe[3336] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 001F0AF4 .text C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe[3344] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 001E004C .text C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe[3344] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 00200930 .text C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe[3356] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C .text C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe[3356] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 00080048 .text C:\windows\system32\igfxext.exe[3564] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C .text C:\windows\system32\igfxext.exe[3564] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 001F0930 .text C:\windows\system32\igfxsrvc.exe[3600] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C .text C:\windows\system32\igfxsrvc.exe[3600] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 00180930 .text C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe[3924] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0014004C .text C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe[3924] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 00180930 .text C:\Program Files\AnyPC Client\APLangApp.exe[3996] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C .text C:\Program Files\AnyPC Client\APLangApp.exe[3996] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 00180048 .text C:\Windows\System32\igfxtray.exe[4012] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 001E004C .text C:\Windows\System32\igfxtray.exe[4012] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 00200930 .text C:\Windows\System32\hkcmd.exe[4028] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 002E004C .text C:\Windows\System32\hkcmd.exe[4028] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 00440930 .text C:\Windows\System32\igfxpers.exe[4040] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0017004C .text C:\Windows\System32\igfxpers.exe[4040] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 00440930 .text C:\Users\*****\Desktop\gmer_2.0.18454.exe[4836] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C .text C:\Users\*****\Desktop\gmer_2.0.18454.exe[4836] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 001F0930 .text C:\Program Files\Spybot - Search & Destroy 2\SDScan.exe[4932] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C .text C:\Program Files\Spybot - Search & Destroy 2\SDScan.exe[4932] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 003B0AF4 ---- User IAT/EAT - GMER 2.0 ---- IAT C:\windows\system32\rundll32.exe[1656] @ C:\windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation) IAT C:\windows\system32\rundll32.exe[1656] @ C:\windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation) IAT C:\windows\system32\rundll32.exe[1656] @ C:\windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation) IAT C:\windows\system32\rundll32.exe[1656] @ C:\windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation) IAT C:\windows\system32\rundll32.exe[1656] @ C:\windows\system32\WININET.dll [KERNEL32.dll!GetProcAddress] [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation) IAT C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe[2076] @ C:\windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation) IAT C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe[2076] @ C:\windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation) IAT C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe[2076] @ C:\windows\system32\advapi32.dll [KERNEL32.dll!GetProcAddress] [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation) IAT C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe[2076] @ C:\windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation) IAT C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe[2076] @ C:\windows\system32\crypt32.dll [KERNEL32.dll!GetProcAddress] [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation) IAT C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe[2076] @ C:\windows\system32\wininet.dll [KERNEL32.dll!GetProcAddress] [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation) IAT C:\windows\Explorer.EXE[3144] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [73FA24CB] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\windows\Explorer.EXE[3144] @ C:\windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [73F8562E] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\windows\Explorer.EXE[3144] @ C:\windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [73F856EC] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\windows\Explorer.EXE[3144] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipFree] [73FA2546] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\windows\Explorer.EXE[3144] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [73F985AA] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\windows\Explorer.EXE[3144] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [73F94D5E] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\windows\Explorer.EXE[3144] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [73F95105] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\windows\Explorer.EXE[3144] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [73F951DA] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\windows\Explorer.EXE[3144] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromHBITMAP] [73F96707] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\windows\Explorer.EXE[3144] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [73F98301] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\windows\Explorer.EXE[3144] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [73F98850] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\windows\Explorer.EXE[3144] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [73F990B1] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\windows\Explorer.EXE[3144] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [73F9E254] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\windows\Explorer.EXE[3144] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [73F94C90] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) ---- EOF - GMER 2.0 ---- malwarebytes hat nichts gefunden Bitte um Hilfe, da ich den Rechner ungern neu aufsetzen möchte Vielen Dank im Voraus abaldus |
hi öffne Malwarebytes, Logdateien, poste Berichte mit Funden. dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user. wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts. • Starte bitte die OTL.exe • Kopiere nun das Folgende in die Textbox. Code: :OTL• Schliesse bitte nun alle Programme. • Klicke nun bitte auf den Fix Button. • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen. • Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren. Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang in den Thread posten! Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + E Taste.
downloade get info: http://markusg.trojaner-board.de/GetInfo.exe doppelklicke die .exe im selben ordner wird nun eine .txt erstellt: summary-info.txt diese doppelklicken und deren inhalt posten. Frage: hast du zum infektionszeitpunkt, bzw evtl. einen tag davor, etwas runtergeladen und instaliert bzw ausgeführt? wurdest du beim besuch einer seite aufgefordert etwas zu instalieren bzw runterzuladen? diese infos hätte ich auch gern als private nachicht. |
Hi, erstmal vielen Dank für die schnelle Hilfe. Anbei die gewünschten Logs: malwarebytes: Code: Malwarebytes Anti-Malware 1.70.0.1100OTL Code: All processes killedGetInfo Summary Code: System volume information: dwHighDateTime = 0x1ca75e1,dwLowDateTime = 0xb214ee9fDanke und Gruß Noch eine kurze Info: Ich habe den Laptop momentan Offline. Wenn ich wieder ins Netz gehen soll um den Zustand zu testen, bitte Info. Danke :dankeschoen: |
hi ins Netz kann er wieder. download tdss killer: http://www.trojaner-board.de/82358-t...entfernen.html Klicke auf Change parameters • Setze die Haken bei Verify driver digital signatures und Detect TDLFS file system • Klick auf OK und anschließend auf Start scan - bei funden erst mal immer skip wählen, log posten c: öffnen, tdsskiller-datum-version.txt öffnen, Inhalt posten |
Hi, anbei TDSS Log File Code: 18:37:52.0570 5212 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35Gruß 18:57 Uhr Eben getestet, verhält sich "Normal", klasse. Ist das jetzt der .job gewesen? Ich teste morgen nochmal und melde mich dann. Erstmal danke für eure tolle Arbeit :party: |
sieht gut aus, schaun wir weiter: combofix: Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!Downloade dir bitte Combofix von einem dieser Downloadspiegel Link 1 Link 2 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
|
Hi, Problem scheint echt gelöst zu sein. Combofix [CODE] Combofix Logfile: Code: ComboFix 13-02-03.03 - Jutta 05.02.2013 19:02:56.2.2 - x86[CODE] Besten Dank |
hi lade den CCleaner standard: CCleaner - Download - Filepony falls der CCleaner bereits instaliert, überspringen. öffnen, Tools (extras),uninstall Llist, als txt speichern. öffnen. hinter, jedes von dir benötigte programm, schreibe notwendig. hinter, jedes, von dir nicht benötigte, unnötig. hinter, dir unbekannte, unbekannt. liste posten. |
CCleaner Log Code: AC3Filter 1.63b Alexander Vigovsky 15.03.2010 1.63b **NOTWENDIG** |
deinstaliere: Adobe Flash Player alle Adobe - Adobe Flash Player installieren neueste version laden, instalieren. adobe reader: Adobe - Adobe Reader herunterladen - Alle Versionen haken bei mcafee security scan raus nehmen bitte auch mal den adobe reader wie folgt konfigurieren: adobe reader öffnen, bearbeiten, voreinstellungen. allgemein: nur zertifizierte zusatz module verwenden, anhaken. internet: hier sollte alles deaktiviert werden, es ist sehr unsicher pdfs automatisch zu öffnen, zu downloaden etc. es ist immer besser diese direkt abzuspeichern da man nur so die kontrolle hat was auf dem pc vor geht. bei javascript den haken bei java script verwenden raus nehmen bei updater, automatisch instalieren wählen. übernehmen /ok deinstaliere: Alice Dairy ESET Farm Go-Go Skype Toolbars : bitte verzichte auf toolbars, zusatz risiko und machen den Browser lam Spybot : ebenfalls unnötig, bringt nichts. TeamViewer : 1. total veraltet, aktuell ist version 8 2. würde ich solche Software nur bei Bedarf instalieren Öffne CCleaner, analysieren starten, PC neustarten. Downloade Dir bitte  AdwCleaner auf deinen Desktop.
|
So, alles aktualisiert bzw. deinstalliert. adw log AdwCleaner Logfile: Code: # AdwCleaner v2.109 - Datei am 05/02/2013 um 23:17:33 erstellt[/CODE] |
Teste, wie PC + Programme wie Browser laufen bitte |
Hi, habe alle relevanten Programme ausprobiert und Backups erstellt, Online geht auch... Firefox einmal abgeschmiert (Download nicht richtig beendet), Mail funzt auch, soweit alles vernünftig. Die nächsten Tage werden den Rest zeigen, sieht aber kompetent gelöst aus ^^. :party: |
hi na n abgebrochener Download kann schon mal passieren. Öffne OTL, bereinigen, PC startet neu, Remover werden gelöscht. Lösche übrig gebliebene Remover, Setups, Logs, leere den Papierkorb. PC absichern: als antimalware programm würde ich emsisoft empfehlen. diese haben für mich den besten schutz kostet aber etwas. Computeractive Software Store - Emsisoft Anti-Malware 7 [1-PC] - 63% off RRP testversion: Meine Antivirus-Empfehlung: Emsisoft Anti-Malware insbesondere wenn du onlinebanking, einkäufe, sonstige zahlungsabwicklungen oder ähnlich wichtiges, wie zb berufliches machst, also sensible daten zu schützen sind, solltest du in sicherheitssoftware investieren. vor dem aktivieren der lizenz die 30 tage testzeitraum ausnutzen. kostenlos, aber eben nicht ganz so gut währe avast zu empfehlen. http://www.trojaner-board.de/110895-...antivirus.html sag mir welches du nutzt, dann gebe ich konfigurationshinweise. bitte dein bisheriges av deinstalieren die folgende anleitung ist umfangreich, dass ist mir klar, sie sollte aber umgesetzt werden, da nur dann dein pc sicher ist. stelle so viele fragen wie nötig, ich arbeite gern alles mit dir durch! http://www.trojaner-board.de/96344-a...-rechners.html Starte bitte mit der Passage, Windows Vista und Windows 7 Bitte beginne damit, Windows Updates zu instalieren. Am besten geht dies, wenn du über Start, Suchen gehst, und dort Windows Updates eingibst. Prüfe unter "Einstellungen ändern" dass folgendes ausgewählt ist: - Updates automatisch Instalieren, - Täglich - Uhrzeit wählen - Bitte den gesammten rest anhaken, außer: - detailierte benachichtungen anzeigen, wenn neue Microsoft software verfügbar ist. Klicke jetzt die Schaltfläche "OK" Klicke jetzt "nach Updates suchen". Bitte instaliere zunächst wichtige Updates. Es wird nötig sein, den PC zwischendurch neu zu starten. falls dies der Fall ist, musst du erneut über Start, Suchen, Windows Update aufrufen, auf Updates suchen klicken und die nächsten instalieren. Mache das selbe bitte mit den optionalen Updates. Bitte übernimm den rest so, wie es im Abschnitt windows 7 / Vista zu lesen ist. aus dem Abschnitt xp, bitte den punkt "datenausführungsverhinderung, dep" übernehmen. als browser rate ich dir zu chrome: Installation von Google Chrome für mehrere Nutzerkonten - Google Chrome-Hilfe anleitung lesen bitte falls du nen andern nutzen willst, sags mir dann muss ich teile der nun folgenden anleitung anpassen. Sandboxie Die devinition einer Sandbox ist hier nachzulesen: Sandbox Kurz gesagt, man kann Programme fast 100 %ig isuliert vom System ausführen. Der Vorteil liegt klar auf der Hand, wenn über den Browser Schadcode eingeschläust wird, kann dieser nicht nach außen dringen. Download Link: Sandboxie - Download - Filepony anleitung: http://www.trojaner-board.de/71542-a...sandboxie.html ausführliche anleitung als pdf, auch abarbeiten: Sandbox Einstellungen | bitte folgende zusatz konfiguration machen: sandboxie control öffnen, menü sandbox anklicken, defauldbox wählen. dort klicke auf sandbox einstellungen. beschrenkungen, bei programm start und internet zugriff schreibe: chrome.exe dann gehe auf anwendungen, webbrowser, chrome. dort aktiviere alles außer gesammten profil ordner freigeben. Wie du evtl. schon gesehen hast, kannst du einige Funktionen nicht nutzen. Dies ist nur in der Vollversion nötig, zu deren Kauf ich dir rate. Du kannst zb unter "Erzwungene Programmstarts" festlegen, dass alle Browser in der Sandbox starten. Ansonsten musst du immer auf "Sandboxed webbrowser" klicken bzw Rechtsklick, in Sandboxie starten. Eine lebenslange Lizenz kostet 30 €, und ist auf allen deinen PC's nutzbar. Weiter mit: Maßnahmen für ALLE Windows-Versionen alles komplett durcharbeiten anmerkung zu file hippo. in den settings zusätzlich auswählen: hide beta updates. Run updateChecker when Windows starts Backup Programm: in meiner Anleitung ist bereits ein Backup Programm verlinkt, als Alternative bietet sich auch das Windows eigene Backup Programm an: http://www.trojaner-board.de/82962-w...en-backup.html Dies ist aber leider nur für Windows 7 Nutzer vernünftig nutzbar. Alle Anderen sollten sich aber auf jeden fall auch ein Backup Programm instalieren, denn dies kann unter Umständen sehr wichtig sein, zum Beispiel, wenn die Festplatte einmal kaputt ist. Zum Schluss, die allgemeinen sicherheitstipps beachten, wenn es dich betrifft, den Tipp zum Onlinebanking beachten und alle Passwörter ändern bitte auch lesen, wie mache ich programme für alle sichtbar: Programme für alle Konten nutzbar machen - PCtipp.ch - Praxis & Hilfe surfe jetzt also nur noch im standard nutzer konto und dort in der sandbox. wenn du die kostenlose version nutzt, dann mit klick auf sandboxed web browser, wenn du die bezahlversion hast, kannst du erzwungene programm starts festlegen, dann wird sandboxie immer gestartet wenn du nen browser aufrufst. wenn du mit der maus über den browser fährst sollte der eingerahmt sein, dann bist du im sandboxed web browser passwort sicherheit: jeder dienst benötigt ein eigenes, mindestens 12-stelliges passwort bei der passwort verwaltung und erstellung hilft roboform Passwort Manager, Formular Ausfueller, Passwort Management | RoboForm Passwort Manager anleitung: RoboForm-Bedienungsanleitung: Passwort-Manager, Verwalten von Passwörtern und persönlichen Daten |
Hi, also, emisoft ist installiert. Norton Internet Security 2013 wird benutzt. Windows Updates sind wie vorgeschlagen konfiguriert. Backup Programm ist Paragon B&R 2012 sandbox muss ich nochmal genau nachlesen, hört sich aber sehr hilfreich an. Ich nehme an dass der bei Mozilla genauso funktioniert. Nochmal heißen Dank für die Hilfe!!! abaldus |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 03:31 Uhr. |
Copyright ©2000-2025, Trojaner-Board