Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: In die Spyhunter-Falle getappt

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 14.07.2013, 10:08   #1
Flodder
 
In die Spyhunter-Falle getappt - Standard

In die Spyhunter-Falle getappt



Hallo zusammen,

Ich bin leider auch dem Spyhunter-Fake aufgesessen und habe das erst gemerkt als ich die "günstige" Vollversion kaufen sollte und glücklicherweise erstmal Google bemüht habe.
Ich habe das Programm zwar mit CCleaner deinstalliert, kann mir aber nicht vorstellen daß es damit restlos entfernt wurde, zumal noch einige Dateien davon vorhanden sind.
Ich wäre für professionelle Hilfe sehr dankbar...
Hier die gemäß Checkliste erstellten Logdateien von OTL und Gmer :



OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 14.07.2013 09:22:01 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\xxx\Desktop
 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16635)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,49 Gb Total Physical Memory | 0,93 Gb Available Physical Memory | 62,66% Memory free
2,98 Gb Paging File | 2,22 Gb Available in Paging File | 74,55% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 37,16 Gb Total Space | 17,42 Gb Free Space | 46,87% Space Free | Partition Type: NTFS
 
Computer Name: NC6120 | User Name: xxx | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.07.13 20:50:23 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\xxx\Desktop\OTL.exe
PRC - [2013.06.26 13:21:47 | 000,084,024 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2013.06.26 13:21:43 | 000,111,160 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\ipmgui.exe
PRC - [2013.06.26 13:21:26 | 000,076,856 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2013.06.26 13:21:23 | 000,345,144 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2013.06.26 13:21:23 | 000,108,088 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2013.06.12 02:23:57 | 000,770,648 | ---- | M] (Microsoft Corporation) -- C:\Programme\Internet Explorer\iexplore.exe
PRC - [2013.05.11 12:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013.05.02 18:48:51 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2013.05.01 07:20:08 | 000,812,424 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\Macromed\Flash\FlashUtil32_11_7_700_169_ActiveX.exe
PRC - [2013.03.28 07:23:28 | 001,106,288 | ---- | M] (Samsung) -- C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
PRC - [2013.03.28 07:23:26 | 000,310,640 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Programme\Samsung\Kies\KiesTrayAgent.exe
PRC - [2013.03.28 07:23:22 | 001,511,792 | ---- | M] (Samsung) -- C:\Programme\Samsung\Kies\Kies.exe
PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2009.02.26 18:36:46 | 000,030,040 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe
PRC - [2002.10.28 08:10:00 | 000,106,561 | ---- | M] (WinZip Computing, Inc. and H.C. Top Systems B.V.) -- C:\Programme\WinZip\WZQKPICK.EXE
 
 
========== Modules (No Company Name) ==========
 
MOD - [2013.07.11 17:06:48 | 018,022,912 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\f3770f9a13d7516e4c03f23dbd319cba\PresentationFramework.ni.dll
MOD - [2013.07.11 17:06:25 | 011,522,048 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\4572de8445038600e4552429b18fbe32\PresentationCore.ni.dll
MOD - [2013.07.11 17:05:48 | 005,628,416 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\c1c41a9e1a25999e74defafecb2aa0bc\System.Xml.ni.dll
MOD - [2013.07.11 17:05:43 | 001,014,272 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\7546a01feb9d477570b883eec56cc673\System.Configuration.ni.dll
MOD - [2013.07.11 17:05:38 | 007,070,720 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\64b92e2a22bb8c1e86486bd22828acc5\System.Core.ni.dll
MOD - [2013.07.11 17:05:27 | 003,883,008 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\112f6448b7434699af4bcc05f25ce12b\WindowsBase.ni.dll
MOD - [2013.07.11 17:05:19 | 009,100,288 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\89445d5b924ad94744d00f1b6cd2285d\System.ni.dll
MOD - [2013.07.11 17:05:09 | 014,418,432 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a01e07e47ecdd94ae099e8c4bf650516\mscorlib.ni.dll
 
 
========== Services (SafeList) ==========
 
SRV - [2013.07.04 10:41:50 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.06.26 13:21:47 | 000,084,024 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2013.06.26 13:21:23 | 000,108,088 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2013.05.27 06:57:27 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2013.05.11 12:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.07.20 05:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.02.26 18:36:22 | 000,064,856 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Microsoft Office\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service)
SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard)
DRV - [2013.06.04 09:15:02 | 000,181,912 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssudmdm.sys -- (ssudmdm)
DRV - [2013.06.04 09:15:02 | 000,084,248 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssudbus.sys -- (dg_ssudbus)
DRV - [2013.04.03 09:58:08 | 000,153,672 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadmdm.sys -- (ssadmdm)
DRV - [2013.04.03 09:58:08 | 000,136,904 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadbus.sys -- (ssadbus)
DRV - [2013.04.03 09:58:08 | 000,130,248 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadserd.sys -- (ssadserd)
DRV - [2013.04.03 09:58:08 | 000,032,064 | ---- | M] (Google Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadadb.sys -- (androidusb)
DRV - [2013.04.03 09:58:08 | 000,017,864 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadmdfl.sys -- (ssadmdfl)
DRV - [2013.03.06 15:13:37 | 000,037,352 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2013.02.27 12:22:36 | 000,135,136 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2013.02.27 12:22:36 | 000,084,744 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012.08.27 14:50:24 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2007.12.14 09:21:56 | 000,290,816 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tifm21.sys -- (tifm21)
DRV - [2007.05.09 13:27:00 | 000,097,280 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\gtipci21.sys -- (GTIPCI21)
DRV - [2006.10.18 15:44:30 | 000,031,232 | ---- | M] (SMSC) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\smscirda.sys -- (SMSCIRDA)
DRV - [2005.11.16 14:12:46 | 001,066,278 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2005.11.02 09:07:32 | 003,298,432 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\w29n51.sys -- (w29n51)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.gmx.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 00 C9 A2 8C EC 45 CE 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.gmx.de/"
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:22.0
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.6: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 22.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 22.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2013.05.03 20:49:38 | 000,000,000 | ---D | M] (No name found) -- C:\Users\xxx\AppData\Roaming\mozilla\Extensions
[2013.07.11 21:15:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\en35stal.default\extensions
[2013.07.11 16:11:51 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\Extensions
[2013.07.04 10:41:40 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\browser\extensions
[2013.07.04 10:41:50 | 000,000,000 | ---D | M] (Default) -- C:\Programme\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [KiesTrayAgent] C:\Programme\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKCU..\Run: [] C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe (Samsung)
O4 - HKCU..\Run: [KiesPreload] C:\Program Files\Samsung\Kies\Kies.exe (Samsung)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{10BDCCE1-0E5A-4F65-8733-9AFC56F2C8F6}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - Winlogon\Notify\ScCertProp: DllName - (wlnotify.dll) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.07.13 21:14:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2013.07.13 21:14:13 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2013.07.13 21:01:38 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013.07.13 20:51:49 | 000,559,441 | ---- | C] (Oleg N. Scherbakov) -- C:\Users\xxx\Desktop\JRT.exe
[2013.07.13 20:50:12 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\xxx\Desktop\OTL.exe
[2013.07.13 16:40:18 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group
[2013.07.13 16:37:22 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard
[2013.07.11 16:11:55 | 000,000,000 | ---D | C] -- C:\Users\xxx\.android
[2013.07.11 16:11:53 | 000,000,000 | ---D | C] -- C:\Users\xxx\Local Settings
[2013.07.11 16:09:36 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\MyPhoneExplorer
[2013.07.11 16:09:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyPhoneExplorer
[2013.07.11 16:08:33 | 000,000,000 | ---D | C] -- C:\Program Files\MyPhoneExplorer
[2013.07.11 16:00:34 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\cm10
[2013.07.10 21:40:23 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\Odin_3.07
[2013.07.06 17:05:10 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\Auspuff
[2013.07.06 17:03:05 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\CrashDump
[2013.07.06 17:02:00 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\Capri
[2013.07.05 19:16:32 | 000,000,000 | ---D | C] -- C:\Users\xxx\Documents\SelfMV
[2013.07.05 19:16:05 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\Harley
[2013.07.05 19:15:47 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\Felgen
[2013.07.05 19:12:36 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\NativeFus_Log
[2013.07.05 19:12:19 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\Samsung
[2013.07.05 19:12:13 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\Samsung
[2013.07.05 19:11:26 | 000,000,000 | ---D | C] -- C:\Users\xxx\Documents\samsung
[2013.07.04 10:41:39 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2013.06.20 19:54:41 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\save
[2013.06.20 19:43:25 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\handy
[2013.06.20 19:38:50 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Convar
[2013.06.20 19:38:50 | 000,000,000 | ---D | C] -- C:\Program Files\Convar
[2013.06.20 19:22:48 | 000,000,000 | ---D | C] -- C:\Users\xxx\Documents\CardRecovery
[2013.06.18 20:56:00 | 000,000,000 | ---D | C] -- C:\Users\xxx\Documents\C16
[2013.06.17 07:07:08 | 000,000,000 | ---D | C] -- C:\Users\xxx\Documents\Bodensee13
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.07.14 09:20:27 | 000,000,000 | ---- | M] () -- C:\Users\xxx\defogger_reenable
[2013.07.14 08:55:04 | 000,013,728 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.07.14 08:55:04 | 000,013,728 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.07.14 08:46:48 | 000,000,350 | ---- | M] () -- C:\Windows\tasks\Lyrics-Pal Update.job
[2013.07.14 08:46:42 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.07.14 08:46:31 | 1201,217,536 | -HS- | M] () -- C:\hiberfil.sys
[2013.07.13 21:14:15 | 000,000,969 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2013.07.13 21:11:34 | 000,377,856 | ---- | M] () -- C:\Users\xxx\Desktop\gmer_2.1.19163.exe
[2013.07.13 21:10:50 | 000,050,477 | ---- | M] () -- C:\Users\xxx\Desktop\Defogger.exe
[2013.07.13 20:51:50 | 000,559,441 | ---- | M] (Oleg N. Scherbakov) -- C:\Users\xxx\Desktop\JRT.exe
[2013.07.13 20:50:23 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\xxx\Desktop\OTL.exe
[2013.07.13 20:43:00 | 000,662,345 | ---- | M] () -- C:\Users\xxx\Desktop\adwcleaner.exe
[2013.07.11 20:29:53 | 000,616,008 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.07.11 20:29:52 | 000,654,166 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.07.11 20:29:52 | 000,130,006 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.07.11 20:29:52 | 000,106,388 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.07.11 20:23:37 | 000,410,064 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.07.11 16:09:24 | 000,002,019 | ---- | M] () -- C:\Users\Public\Desktop\MyPhoneExplorer.lnk
[2013.07.11 16:08:23 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_Kernel_ssadadb_01005.Wdf
[2013.06.26 13:21:50 | 000,067,168 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avnetflt.sys
[2013.06.21 11:18:01 | 000,000,903 | ---- | M] () -- C:\Users\xxx\Desktop\WinVICE-2.4-x86.lnk
[2013.06.20 19:38:51 | 000,001,284 | ---- | M] () -- C:\Users\xxx\Desktop\PC Inspector File Recovery.lnk
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.07.14 09:20:27 | 000,000,000 | ---- | C] () -- C:\Users\xxx\defogger_reenable
[2013.07.13 21:14:15 | 000,000,969 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2013.07.13 21:11:34 | 000,377,856 | ---- | C] () -- C:\Users\xxx\Desktop\gmer_2.1.19163.exe
[2013.07.13 21:10:50 | 000,050,477 | ---- | C] () -- C:\Users\xxx\Desktop\Defogger.exe
[2013.07.13 20:42:59 | 000,662,345 | ---- | C] () -- C:\Users\xxx\Desktop\adwcleaner.exe
[2013.07.11 16:09:58 | 000,000,350 | ---- | C] () -- C:\Windows\tasks\Lyrics-Pal Update.job
[2013.07.11 16:09:24 | 000,002,019 | ---- | C] () -- C:\Users\Public\Desktop\MyPhoneExplorer.lnk
[2013.07.11 16:08:23 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_Kernel_ssadadb_01005.Wdf
[2013.06.21 11:18:01 | 000,000,903 | ---- | C] () -- C:\Users\xxx\Desktop\WinVICE-2.4-x86.lnk
[2013.06.20 19:38:51 | 000,001,284 | ---- | C] () -- C:\Users\xxx\Desktop\PC Inspector File Recovery.lnk
[2013.05.19 09:41:44 | 000,015,873 | ---- | C] () -- C:\Windows\System32\Inetde.dll
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 03:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2013.05.24 18:46:18 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\BOM
[2013.05.06 22:45:50 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\CCS64
[2013.05.03 20:29:54 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\DVDVideoSoft
[2013.07.11 16:09:36 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\MyPhoneExplorer
[2013.07.05 19:12:28 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Samsung
 
========== Purity Check ==========
 
 

< End of report >
         
--- --- ---
OTL Logfile:
Code:
ATTFilter
OTL Extras logfile created on: 14.07.2013 09:22:01 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\xxx\Desktop
 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16635)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,49 Gb Total Physical Memory | 0,93 Gb Available Physical Memory | 62,66% Memory free
2,98 Gb Paging File | 2,22 Gb Available in Paging File | 74,55% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 37,16 Gb Total Space | 17,42 Gb Free Space | 46,87% Space Free | Partition Type: NTFS
 
Computer Name: NC6120 | User Name: xxx | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htafile [open] -- "%1" %*
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{07282184-BFF9-4939-A964-53C8070A24F6}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{090A2709-1B91-4B9E-B7AA-CA1D36726087}" = rport=137 | protocol=17 | dir=out | app=system | 
"{13EDA6A1-7BF2-4C62-9A3D-FE89CE55DE0A}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{1A33A90A-6805-496F-80D6-E3C3EC721611}" = lport=445 | protocol=6 | dir=in | app=system | 
"{1B707A38-D6EA-453B-B591-B84D0EA43C42}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{2E2DDC0E-857A-48CA-AD33-A5DD9653265B}" = rport=445 | protocol=6 | dir=out | app=system | 
"{31FD715E-BF0F-4F9E-AD9D-FFE92D5D60B6}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{3A419E76-A023-4CC4-A501-2BB8654E5173}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{43D585EE-06A0-4577-B149-D49935998371}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{5006D0DA-ABFA-44D2-84AC-3F3270956C12}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{5B26818F-1AB2-4621-A432-82EDB4DA4715}" = lport=137 | protocol=17 | dir=in | app=system | 
"{5D0755F6-6806-4F93-8BE6-501F31B34E45}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{5D76EBCA-A4BE-4F5F-B99D-D8360F8E6950}" = lport=138 | protocol=17 | dir=in | app=system | 
"{7237C61C-6B02-4BC9-A80A-F21DFA40658C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{7866FC77-67AD-45FC-A1D6-7ECEBA32F78C}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{7F532DCE-4CB0-40CE-945A-70B1F0E39263}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{9B378BED-9BD9-41CA-98D5-C9A1EF025835}" = rport=138 | protocol=17 | dir=out | app=system | 
"{9DA5AB38-3200-4B84-9270-8F38F3D79220}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{A31B27A7-015C-4B2F-B0CB-B555CABA2AE6}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | 
"{A3BAF06E-B291-42B8-B4A5-F2691AAAD7BC}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{C3CF0FAC-A132-4293-8804-CDF29C959E01}" = rport=139 | protocol=6 | dir=out | app=system | 
"{CEAF100D-DD82-4F18-B928-2E5CA4BC3256}" = lport=139 | protocol=6 | dir=in | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{08D94AB8-B94B-4CE2-920E-6C4EDE80B004}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{0D29C8DF-05B7-4845-B8BA-5D49B1589B69}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{138190D6-0C23-454C-A9B8-D52D6E2AC37E}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{13AA94A8-1FBA-4404-ACDF-5663836D69D6}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{381CE5A2-056B-4779-91DD-ADABA5C851FE}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{3FAF90B3-1D08-4B78-B69E-50671FFF53F9}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{4534B1E9-70E4-47EC-84F1-C2422E018BF7}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{4F116E28-8575-4617-8FF1-4C0BBBD6F1A9}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{513BE6B0-832C-4F44-A3AD-9E96DC4161FD}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{6328705A-39D9-4E48-9DAB-47B424396E98}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{6D51F25A-3C07-4C52-90CC-757D04FF270A}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{764B2297-56FE-471F-AB73-4B6D02331B16}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{7ACACA9B-6541-423D-A839-914EE6A58F44}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{8B524CA8-D5ED-4A7D-A512-3EFD5545E7EA}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{900CB704-1C64-4AEC-8C98-A8790FB1E4B6}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{9479C03D-FD6C-4705-A170-D08C4984E383}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{A86CE3D9-086F-41B2-929E-DF68A79E9BE2}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{CE8AA108-D1CD-43C8-AF40-36838C5AA55B}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{D09D2C5F-918B-4F93-B45E-4C1B48859D07}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{DF3BA611-FD61-444D-A93E-FECD5CCD3BA0}" = protocol=6 | dir=out | app=system | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1AEC7728-1640-4E98-AABC-5EBE3FB57FE4}" = SMSC Fast Infrared Driver
"{355FADAF-55C4-4E08-88D4-A86C4CA6930C}" = HP Wireless Assistant
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{529125EF-E3AC-4B74-97E6-F688A7C0F1BF}" = Paint.NET v3.5.10
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{767B964C-D9B4-422D-802B-F7ACBE2D310A}" = TIPCI
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISER_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISER_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISER_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISER_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISER_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.03) - Deutsch
"{B7B5A370-3DFF-4F0E-AE11-FD267C4938AA}" = CCS64 V3.9
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"6F8C52CF07BBF1FE2471DC68C08F06D7C58B7D49" = Windows Driver Package - Intel (w29n51) net  (09/12/2005 9.0.3.9)
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Agere Systems Soft Modem" = Agere Systems AC'97 Modem
"Avira AntiVir Desktop" = Avira Free Antivirus
"Biet-O-Matic v2.14.12" = Biet-O-Matic v2.14.12
"Broadcom 802.11b Network Adapter" = Broadcom 802.11 Wireless LAN Adapter
"CCleaner" = CCleaner
"E61C4CD368E9E2830A85919D7F5030333F381837" = Windows Driver Package - Intel (w39n51) net  (09/28/2005 10.0.0.120)
"ENTERPRISER" = Microsoft Office Enterprise 2007
"Free YouTube Download_is1" = Free YouTube Download version 3.2.2.426
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.12.2.426
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"InstallShield_{767B964C-D9B4-422D-802B-F7ACBE2D310A}" = Texas Instruments PCIxx21/x515/xx12 drivers.
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 22.0 (x86 de)" = Mozilla Firefox 22.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MPE" = MyPhoneExplorer
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"VLC media player" = VLC media player 2.0.6
"WinZip" = WinZip
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"MyFreeCodec" = MyFreeCodec
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 13.07.2013 15:24:32 | Computer Name = NC6120 | Source = ESENT | ID = 455
Description = Windows (2752) Windows: Fehler -1811 beim Öffnen von Protokolldatei
 C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS00024.log.
 
Error - 13.07.2013 15:24:33 | Computer Name = NC6120 | Source = Windows Search Service | ID = 9000
Description = 
 
Error - 13.07.2013 15:24:33 | Computer Name = NC6120 | Source = Windows Search Service | ID = 7040
Description = 
 
Error - 13.07.2013 15:24:33 | Computer Name = NC6120 | Source = Windows Search Service | ID = 7042
Description = 
 
Error - 13.07.2013 15:24:33 | Computer Name = NC6120 | Source = Windows Search Service | ID = 9002
Description = 
 
Error - 13.07.2013 15:24:33 | Computer Name = NC6120 | Source = Windows Search Service | ID = 3029
Description = 
 
Error - 13.07.2013 15:24:34 | Computer Name = NC6120 | Source = Windows Search Service | ID = 3029
Description = 
 
Error - 13.07.2013 15:24:34 | Computer Name = NC6120 | Source = Windows Search Service | ID = 3028
Description = 
 
Error - 13.07.2013 15:24:34 | Computer Name = NC6120 | Source = Windows Search Service | ID = 3058
Description = 
 
Error - 13.07.2013 15:24:34 | Computer Name = NC6120 | Source = Windows Search Service | ID = 7010
Description = 
 
[ System Events ]
Error - 13.07.2013 15:24:34 | Computer Name = NC6120 | Source = Service Control Manager | ID = 7024
Description = Der Dienst "Windows Search" wurde mit folgendem dienstspezifischem
 Fehler beendet: %%-1073473535.
 
Error - 13.07.2013 15:24:34 | Computer Name = NC6120 | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits
 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt:
 Neustart des Diensts.
 
 
< End of report >
         
--- --- ---

GMER Logfile:
Code:
ATTFilter
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-07-14 10:55:45
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 FUJITSU_MHW2040AT rev.0000000B 37,26GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Heiko\AppData\Local\Temp\kxldqpog.sys


---- System - GMER 2.1 ----

SSDT            8CCE81CE                                                                                               ZwCreateSection
SSDT            8CCE81D8                                                                                               ZwRequestWaitReplyPort
SSDT            8CCE81D3                                                                                               ZwSetContextThread
SSDT            8CCE81DD                                                                                               ZwSetSecurityObject
SSDT            8CCE81E2                                                                                               ZwSystemDebugControl
SSDT            8CCE816F                                                                                               ZwTerminateProcess

---- Kernel code sections - GMER 2.1 ----

.text           ntkrnlpa.exe!ZwRollbackEnlistment + 140D                                                               828759F5 1 Byte  [06]
.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                 828AF1F2 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text           ntkrnlpa.exe!KeRemoveQueueEx + 11F7                                                                    828B653C 4 Bytes  [CE, 81, CE, 8C]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1553                                                                    828B6898 4 Bytes  [D8, 81, CE, 8C]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1597                                                                    828B68DC 4 Bytes  [D3, 81, CE, 8C]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1613                                                                    828B6958 4 Bytes  [DD, 81, CE, 8C]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1667                                                                    828B69AC 4 Bytes  [E2, 81, CE, 8C]
.text           ...                                                                                                    

---- User code sections - GMER 2.1 ----

.text           C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[1944] ntdll.dll!DbgBreakPoint       7756410C 1 Byte  [C3]
.text           C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[1944] ntdll.dll!DbgUiRemoteBreakin  775CF17D 5 Bytes  JMP 7758E342 C:\Windows\SYSTEM32\ntdll.dll

---- Devices - GMER 2.1 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                SynTP.sys
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                                SynTP.sys

---- EOF - GMER 2.1 ----
         
Code:
ATTFilter
         
--- --- ---


Ich bin wie gesagt für jeden Tip dankbar wie ich diesen Plagegeist wieder loswerde.
Schönen Dank schonmal im voraus !
Gruß Flodder

Alt 14.07.2013, 10:21   #2
ryder
/// TB-Ausbilder
 
In die Spyhunter-Falle getappt - Standard

In die Spyhunter-Falle getappt



Da ist schon fast alles weg:

Fix mit OTL
Warnung: Dieses Skript wurde nur für diesen User und diese spezielle Situation geschrieben. Auf anderen Computern ausgeführt kann es nachhaltige Schäden anrichten!
Hinweis: Wenn du deinen Benutzernamen unkenntlich gemacht hast, musst du wieder deinen richtigen Namen einsetzen, ansonsten wird das Skript nicht funktionieren.
  • Starte bitte die OTL.exe.
  • Kopiere nun den Inhalt aus der Codebox in die Textbox.
Code:
ATTFilter
:OTL
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Enigma Software Group -- (esgiguard)
         
  • Schliesse bitte nun alle Programme.
  • Klicke nun bitte auf den Fix Button.
  • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
  • Nach dem Neustart findest Du ein Textdokument auf deinem Desktop. ( Auch zu finden unter C:\_OTL\MovedFiles\<time_date>.txt)
  • Kopiere nun den Inhalt hier in deinen Thread, möglichst in Code-Tags.

Hinweis: Die Ausführung des Kommandos kann einige Minuten dauern und OTL scheint in dieser Zeit nicht zu reagieren. Bitte geduldig sein!
__________________

__________________

Alt 14.07.2013, 11:15   #3
Flodder
 
In die Spyhunter-Falle getappt - Standard

In die Spyhunter-Falle getappt



Melde Vollzug :

Code:
ATTFilter
========== OTL ==========
Service esgiguard stopped successfully!
Service esgiguard deleted successfully!
File C:\Program Files\Enigma Software Group not found.
 
OTL by OldTimer - Version 3.2.69.0 log created on 07142013_121419
         
__________________

Alt 14.07.2013, 11:54   #4
ryder
/// TB-Ausbilder
 
In die Spyhunter-Falle getappt - Standard

In die Spyhunter-Falle getappt



Okay, das müßte eigentlich der letzte Rest gewesen sein.
__________________
Digitale Freibeuter gegen Malware!
Keine Hilfe per PM!

Alt 14.07.2013, 16:21   #5
Flodder
 
In die Spyhunter-Falle getappt - Standard

In die Spyhunter-Falle getappt



Prima... Herzlichen Dank für die schnelle Hilfe !!


Alt 14.07.2013, 16:35   #6
ryder
/// TB-Ausbilder
 
In die Spyhunter-Falle getappt - Standard

In die Spyhunter-Falle getappt



Schön, dass wir helfen konnten

Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Solltest Du das Thema erneut brauchen schicke mir bitte eine PM.

Jeder andere bitte hier klicken und einen eigenen Thread erstellen

Falls du noch Lob oder Kritik loswerden möchtest, dann gibt es diesen Bereich hier: Lob, Kritik und Wünsche - Trojaner-Board
__________________
--> In die Spyhunter-Falle getappt

Antwort

Themen zu In die Spyhunter-Falle getappt
adobe reader xi, antivir, autorun, avira, bho, checkliste, converter, error, fehler, firefox, flash player, google, helper, home, install.exe, installation, logfile, lyrics-pal, mozilla, mp3, ntdll.dll, programm, registry, rundll, scan, security, senden, software, svchost.exe, windows




Ähnliche Themen: In die Spyhunter-Falle getappt


  1. PROBLEME mit Spyhunter und mystart! Wie bekomme ich Spyhunter wieder weg?
    Plagegeister aller Art und deren Bekämpfung - 14.11.2014 (13)
  2. bin auf Facebook Falle reingefallen (Win7, pup.optional.livesoftaction)
    Log-Analyse und Auswertung - 30.10.2014 (11)
  3. UMTS-Stick mit SMS-Falle
    Nachrichten - 02.06.2014 (0)
  4. SpyHunter
    Plagegeister aller Art und deren Bekämpfung - 11.03.2014 (3)
  5. Spyhunter 4
    Lob, Kritik und Wünsche - 09.01.2014 (0)
  6. Mit Spyhunter 47 Bedrohungen gefunden, Spyhunter wurde aber wieder deinstalliert.
    Log-Analyse und Auswertung - 25.10.2013 (9)
  7. Windows 7: "Hotel-Reservierungs-Falle" - Computer Infiziert
    Log-Analyse und Auswertung - 19.08.2013 (1)
  8. Honeywords sollen Passwortdiebe in die Falle locken
    Nachrichten - 07.05.2013 (0)
  9. Habe SpyHunter 4 auf dem PC...
    Plagegeister aller Art und deren Bekämpfung - 24.04.2013 (18)
  10. Falle ständig auf den Desktop Zurück
    Plagegeister aller Art und deren Bekämpfung - 18.10.2012 (13)
  11. FBI warnt vor Hotspot-Falle
    Nachrichten - 09.05.2012 (0)
  12. Akm-Virus Falle
    Plagegeister aller Art und deren Bekämpfung - 05.03.2012 (37)
  13. Anonymous tappt in Trojaner-Falle
    Nachrichten - 05.03.2012 (0)
  14. In Falle getappt und link geöffnet
    Log-Analyse und Auswertung - 21.02.2010 (6)
  15. Bin vermutlich in eine Phishing Falle geraten
    Log-Analyse und Auswertung - 09.12.2009 (3)
  16. Ich teste Dateien auf Stealer/Trojaner und entferne Logs im Falle einer Infizierung
    Plagegeister aller Art und deren Bekämpfung - 10.12.2008 (7)
  17. Spyhunter
    Antiviren-, Firewall- und andere Schutzprogramme - 14.09.2007 (4)

Zum Thema In die Spyhunter-Falle getappt - Hallo zusammen, Ich bin leider auch dem Spyhunter-Fake aufgesessen und habe das erst gemerkt als ich die "günstige" Vollversion kaufen sollte und glücklicherweise erstmal Google bemüht habe. Ich habe das - In die Spyhunter-Falle getappt...
Archiv
Du betrachtest: In die Spyhunter-Falle getappt auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.