Trojaner-Board - Firefox öffnet eigenständig ein Tab(http://e.ligatus.com/LigatusFallback.gif?ids=34088)

Hallo,

mir ist heute ein Problem bei meinem Firefox Browser aufgefallen.
Es hat sich mehrmals eigenständig ein Tab mit folgender Adresse geöffnet:

hxxp://e.ligatus.com/LigatusFallback.gif?ids=34088

Ich bin dann über Google hier im Forum gelandet und habe mich darüber informiert bzw. einen Thread mit selbigem Problem durchgelesen.

Ich hoffe jetzt, dass mir jemand hier bei meinem Problem helfen kann.
Danke im Voraus für eure Mühe.

Gruß,
smoggy

Hier die Logfiles:

OTL:
OTL:
[OTL Logfile:

Code:

OTL logfile created on: 06.05.2013 21:03:27 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\simon\Desktop

 Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,99 Gb Total Physical Memory | 1,94 Gb Available Physical Memory | 64,90% Memory free

5,98 Gb Paging File | 4,96 Gb Available in Paging File | 82,91% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 148,95 Gb Total Space | 98,54 Gb Free Space | 66,15% Space Free | Partition Type: NTFS

 

Computer Name: SIMON-PC | User Name: simon | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2013.05.06 21:01:02 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\simon\Desktop\OTL.exe

PRC - [2012.06.08 21:49:10 | 000,151,552 | ---- | M] () -- C:\Windows\KMService.exe

PRC - [2012.06.08 21:49:10 | 000,008,192 | ---- | M] () -- C:\Windows\System32\srvany.exe

PRC - [2011.07.16 06:31:12 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe

PRC - [2011.03.28 20:31:16 | 000,193,920 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE

PRC - [2011.03.28 20:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE

PRC - [2010.01.09 21:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

PRC - [2009.12.03 20:28:08 | 000,026,112 | ---- | M] (LSI Corporation) -- C:\Programme\LSI SoftModem\agrsmsvc.exe

PRC - [2009.11.11 14:00:54 | 000,076,856 | ---- | M] ( Hewlett-Packard Development Company, L.P.) -- C:\Programme\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe

PRC - [2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2009.09.29 13:03:46 | 000,735,960 | ---- | M] (ESET) -- C:\Programme\ESET\ESET NOD32 Antivirus\ekrn.exe

PRC - [2009.09.29 13:02:52 | 002,054,360 | ---- | M] (ESET) -- C:\Programme\ESET\ESET NOD32 Antivirus\egui.exe

PRC - [2009.07.14 03:14:47 | 001,121,280 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe

PRC - [2009.07.14 03:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe

PRC - [2009.07.14 03:14:38 | 001,173,504 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe

PRC - [2007.02.06 11:44:24 | 000,069,632 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\AEADISRV.EXE

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2010.01.30 02:41:12 | 004,254,560 | ---- | M] () -- C:\Programme\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF

MOD - [2008.09.16 20:18:06 | 000,132,608 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll

 

 
 ========== Services (SafeList) ==========

 

SRV - [2013.04.19 23:10:50 | 000,543,656 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)

SRV - [2013.04.12 10:11:44 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2013.04.11 10:00:44 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2013.03.01 12:11:32 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2012.06.08 21:49:10 | 000,008,192 | ---- | M] () [Auto | Running] -- C:\Windows\System32\srvany.exe -- (KMService)

SRV - [2011.03.28 20:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)

SRV - [2010.03.25 10:25:22 | 030,969,208 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)

SRV - [2010.01.09 21:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)

SRV - [2010.01.09 21:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)

SRV - [2009.12.03 20:28:08 | 000,026,112 | ---- | M] (LSI Corporation) [Auto | Running] -- C:\Programme\LSI SoftModem\agrsmsvc.exe -- (AgereModemAudio)

SRV - [2009.09.29 13:11:10 | 000,020,680 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Programme\ESET\ESET NOD32 Antivirus\EHttpSrv.exe -- (EhttpSrv)

SRV - [2009.09.29 13:03:46 | 000,735,960 | ---- | M] (ESET) [Auto | Running] -- C:\Programme\ESET\ESET NOD32 Antivirus\ekrn.exe -- (ekrn)

SRV - [2009.07.14 03:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)

SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)

SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)

SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2009.07.14 03:14:47 | 001,121,280 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)

SRV - [2007.05.31 17:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)

SRV - [2007.05.31 17:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)

SRV - [2007.02.06 11:44:24 | 000,069,632 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\AEADISRV.EXE -- (AEADIFilters)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2010.02.25 00:02:30 | 000,015,544 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CPQBTTN.sys -- (HBtnKey)

DRV - [2010.02.08 01:11:12 | 000,016,688 | ---- | M] (IBM) [Kernel | System | Running] -- C:\Windows\System32\drivers\LUMDriver.sys -- (LUMDriver)

DRV - [2010.01.26 17:38:06 | 001,163,328 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)

DRV - [2009.09.29 13:05:58 | 000,095,896 | ---- | M] (ESET) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\epfwwfpr.sys -- (epfwwfpr)

DRV - [2009.09.29 13:02:58 | 000,108,792 | ---- | M] (ESET) [Kernel | System | Running] -- C:\Windows\System32\drivers\ehdrv.sys -- (ehdrv)

DRV - [2009.09.29 12:56:32 | 000,116,008 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\Windows\System32\drivers\eamon.sys -- (eamon)

DRV - [2009.07.14 03:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)

DRV - [2009.07.14 03:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)

DRV - [2009.07.14 03:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)

DRV - [2009.07.14 01:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WINUSB)

DRV - [2009.07.14 01:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)

DRV - [2009.07.14 01:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)

DRV - [2009.06.05 19:12:34 | 000,219,352 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1e6232.sys -- (e1express)

DRV - [2009.04.29 07:46:54 | 000,015,872 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 30 EE 9F CF 4F CA CD 01  [binary data]

IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1

FF - user.js - File not found

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_169.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.04.12 10:11:45 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2012.06.08 21:06:00 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.04.12 10:11:45 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

 

[2012.06.08 22:20:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\simon\AppData\Roaming\mozilla\Extensions

[2012.12.12 15:51:02 | 000,000,000 | ---D | M] (No name found) -- C:\Users\simon\AppData\Roaming\mozilla\Firefox\Profiles\bwtiaom9.default\extensions

[2012.12.12 15:51:02 | 000,036,098 | ---- | M] () (No name found) -- C:\Users\simon\AppData\Roaming\mozilla\firefox\profiles\bwtiaom9.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi

[2013.04.12 10:11:34 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2013.04.12 10:11:45 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2012.06.16 19:04:44 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.08.30 13:08:49 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

[2012.06.16 19:04:44 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml

[2012.06.16 19:04:44 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.06.16 19:04:44 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.06.16 19:04:44 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)

O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)

O4 - HKLM..\Run: [PDFPrint] C:\Programme\PDF24\pdf24.exe (Geek Software GmbH)

O4 - HKCU..\Run: [Steam] C:\Program Files\Steam\Steam.exe (Valve Corporation)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\simon\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)

O9 - Extra Button: ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - C:\Programme\ICQ7M\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - C:\Programme\ICQ7M\ICQ.exe (ICQ, LLC.)

O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)

O13 - gopher Prefix: missing

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2912FB0D-3E3C-45A3-BC14-A46BC4C95150}: DhcpNameServer = 192.168.2.1

O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll File not found

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll File not found

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2013.05.06 21:00:48 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\simon\Desktop\OTL.exe

[2013.05.06 10:48:21 | 000,000,000 | ---D | C] -- C:\Users\simon\Desktop\Rezepte

[2013.05.02 11:01:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

[2013.05.02 11:01:39 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype

[2013.05.02 11:01:28 | 000,000,000 | R--D | C] -- C:\Program Files\Skype

[2013.05.02 10:56:20 | 000,000,000 | ---D | C] -- C:\Users\simon\AppData\Local\{2631BFFA-BFE1-4747-B714-2C17FD4F80BA}

[2013.04.30 16:49:42 | 000,000,000 | ---D | C] -- C:\Users\simon\AppData\Local\{C5B2260E-760D-4FDB-8F3B-D0E572D3D90D}

[2013.04.29 13:22:55 | 000,000,000 | ---D | C] -- C:\Users\simon\AppData\Local\{48481B6B-1EEB-4BC7-AE06-897D68FA70CF}

[2013.04.27 12:16:35 | 000,000,000 | ---D | C] -- C:\Users\simon\AppData\Local\{FE438C95-009E-4884-8B6F-15684683BF46}

[2013.04.25 12:24:35 | 000,000,000 | ---D | C] -- C:\Users\simon\AppData\Local\{0F603058-CDC4-47BF-BAE8-F0DC3054BA5C}

[2013.04.24 12:12:23 | 000,000,000 | ---D | C] -- C:\Users\simon\AppData\Local\{5EC22BB5-7047-4D2E-9BDC-5605FABFA8E5}

[2013.04.23 15:46:15 | 000,000,000 | ---D | C] -- C:\Users\simon\AppData\Local\{CB17B1B0-58F8-446C-9A70-873AF0F3C6EA}

[2013.04.22 15:59:08 | 000,000,000 | ---D | C] -- C:\Users\simon\AppData\Local\{0FFEC2E9-3AC8-4151-9AC0-C5A27C3C4D2F}

[2013.04.18 16:00:26 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java

[2013.04.12 10:11:33 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox

[2013.04.09 15:05:53 | 000,000,000 | ---D | C] -- C:\Users\simon\AppData\Local\{ABA85EF9-2550-42FA-A31C-FF024FDB4CDF}

 
 ========== Files - Modified Within 30 Days ==========

 

[2013.05.06 21:01:02 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\simon\Desktop\OTL.exe

[2013.05.06 20:59:54 | 000,000,000 | ---- | M] () -- C:\Users\simon\defogger_reenable

[2013.05.06 20:59:18 | 000,050,477 | ---- | M] () -- C:\Users\simon\Desktop\Defogger.exe

[2013.05.06 20:23:25 | 000,014,112 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2013.05.06 20:23:25 | 000,014,112 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2013.05.06 20:14:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2013.05.06 19:52:07 | 000,643,866 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2013.05.06 19:52:07 | 000,607,190 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2013.05.06 19:52:07 | 000,126,394 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2013.05.06 19:52:07 | 000,103,568 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2013.05.06 13:27:51 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2013.05.06 10:30:37 | 2409,078,784 | -HS- | M] () -- C:\hiberfil.sys

 
 ========== Files Created - No Company Name ==========

 

[2013.05.06 20:59:54 | 000,000,000 | ---- | C] () -- C:\Users\simon\defogger_reenable

[2013.05.06 20:59:17 | 000,050,477 | ---- | C] () -- C:\Users\simon\Desktop\Defogger.exe

[2012.06.15 16:53:22 | 000,007,605 | ---- | C] () -- C:\Users\simon\AppData\Local\Resmon.ResmonCfg

[2012.06.08 22:12:57 | 000,140,288 | ---- | C] () -- C:\Windows\System32\igfxtvcx.dll

[2012.06.08 21:49:30 | 000,151,552 | ---- | C] () -- C:\Windows\KMService.exe

[2012.06.08 21:49:30 | 000,008,192 | ---- | C] () -- C:\Windows\System32\srvany.exe

 
 ========== ZeroAccess Check ==========

 

[2009.07.14 06:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2010.07.27 16:03:24 | 012,867,584 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.07.14 03:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 03:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 
 ========== LOP Check ==========

 

[2013.03.02 16:23:10 | 000,000,000 | ---D | M] -- C:\Users\simon\AppData\Roaming\.Torrent Stream

[2012.12.26 17:00:45 | 000,000,000 | ---D | M] -- C:\Users\simon\AppData\Roaming\APP_NAME_NON_STRING

[2012.07.09 18:00:14 | 000,000,000 | ---D | M] -- C:\Users\simon\AppData\Roaming\DassaultSystemes

[2012.06.25 20:42:02 | 000,000,000 | ---D | M] -- C:\Users\simon\AppData\Roaming\DVDVideoSoft

[2012.06.09 10:53:54 | 000,000,000 | ---D | M] -- C:\Users\simon\AppData\Roaming\DVDVideoSoftIEHelpers

[2013.05.06 20:26:33 | 000,000,000 | ---D | M] -- C:\Users\simon\AppData\Roaming\ICQ

[2012.12.26 17:01:17 | 000,000,000 | ---D | M] -- C:\Users\simon\AppData\Roaming\PDF Software

[2012.06.09 15:52:29 | 000,000,000 | ---D | M] -- C:\Users\simon\AppData\Roaming\Sports Interactive

 
 ========== Purity Check ==========

 

 
 

< End of report >

--- --- ---
/]

Extras:
[OTL Logfile:

Code:

OTL Extras logfile created on: 06.05.2013 21:03:27 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\simon\Desktop

 Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,99 Gb Total Physical Memory | 1,94 Gb Available Physical Memory | 64,90% Memory free

5,98 Gb Paging File | 4,96 Gb Available in Paging File | 82,91% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 148,95 Gb Total Space | 98,54 Gb Free Space | 66,15% Space Free | Partition Type: NTFS

 

Computer Name: SIMON-PC | User Name: simon | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 
 ========== Authorized Applications List ==========

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{089D00F7-42ED-4AB4-8F5F-FF6DA4BAEF29}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{1DCF1EF9-9F79-4E8A-A6B3-E1427A4F57C9}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{21F2574B-94ED-42A3-A246-4BCEBF923B3B}" = rport=10243 | protocol=6 | dir=out | app=system | 

"{2A47037A-2BDC-41C1-AF1F-4D5FFD798068}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 

"{3BD95D1B-D6A9-4D91-8B6E-2399C58041DF}" = lport=137 | protocol=17 | dir=in | app=system | 

"{473C94C2-6623-4C77-A57B-8311A139B604}" = lport=138 | protocol=17 | dir=in | app=system | 

"{50295CE0-4F4B-4740-84E5-8D40D0FCAA1B}" = rport=137 | protocol=17 | dir=out | app=system | 

"{52374622-195B-4922-8D80-19DC9DEDA605}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{5EEED55D-6E45-4126-9CCD-F4AD9DA3F241}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office14\outlook.exe | 

"{72652912-791C-45B4-9F4B-C7733053712E}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 

"{7B8983E0-7D72-4A40-BAB4-96BF92635151}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{897E7EEF-F56A-4DCB-A222-A6E38902F886}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 

"{A1907710-0096-4C94-BA46-DFD29D535F1C}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{A198B3B2-01C6-4453-A7A1-571F76311D98}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{A4052571-4B44-4BA5-98A7-93AB7977CF65}" = lport=10243 | protocol=6 | dir=in | app=system | 

"{A578B68A-DC97-4F87-8929-76D88F149593}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{A5AE40A1-F6EE-482B-B276-13BA6416497F}" = lport=445 | protocol=6 | dir=in | app=system | 

"{B78C97A4-771B-4454-9C7F-E5F78F53BA36}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{C4D32163-D331-4C55-8947-2B353892335A}" = rport=139 | protocol=6 | dir=out | app=system | 

"{C895F50A-7E4B-466B-A35C-D638BF752C5F}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{CED107F4-C0B2-4226-B6F2-CC2E72FC0133}" = lport=139 | protocol=6 | dir=in | app=system | 

"{D1DC0EDD-7483-44A7-B04C-B63ED497C28C}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{D20A1B68-7529-4007-B517-E9EE309F68B0}" = rport=138 | protocol=17 | dir=out | app=system | 

"{DF9D9BA9-5118-48C4-840D-0C5987AA4F58}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{E3A1536F-CA71-4D7B-8AB8-F2BC47DD6C94}" = rport=445 | protocol=6 | dir=out | app=system | 

"{F8D19AB3-F016-4A83-9CC8-5500F09318D5}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{0055F9C5-A067-494C-B856-CCA95F599970}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 

"{1190523A-9DB0-4C31-ADED-4DB6A7DCF482}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 

"{1B1D5E56-1794-4980-873D-C6C0FFEB38F6}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\groove.exe | 

"{1D23376D-BE37-4AB3-BC40-0520C5033735}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{20B3DF86-1B9E-4DCA-802F-F73873B4742B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{235CC5D3-0E9F-4630-AE06-2B73772FAF87}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{23655E4F-FF3A-4A7A-BF9B-CE96C23DA486}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 

"{27846B21-962B-4E66-AB6E-67556A9FA734}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{3C90AAE2-1E3E-47E7-8A15-1C971C2FA767}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\football manager 2012\fm.exe | 

"{3EB7E0A6-AB57-4033-A3C6-A3CFF7ADB134}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 

"{4592D240-336B-41E9-AF4A-F82D9785FC62}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{51BB9368-26CE-45D7-A732-5627BF7D903C}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 

"{52AE0F89-DCB5-42FB-A0AD-9779CA4EE23D}" = protocol=17 | dir=in | app=c:\program files\icq7m\icq.exe | 

"{5924D5A2-66EC-4476-8BB9-E1C555603843}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe | 

"{5AF69BF8-D0AF-4595-80DB-65CED3A48BF0}" = protocol=6 | dir=in | app=c:\program files\icq7m\icq.exe | 

"{5F29FCF7-22DF-412E-8A2C-5CF2B9DC0974}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 

"{74941FAF-C7C0-4F91-B60E-3710D917B763}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{75CB3173-5B8C-4820-B0A8-623085C9FC92}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe | 

"{923CC086-2300-430C-A4CD-97860F6CA4FA}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe | 

"{9326C90B-F185-4E89-B1D7-1F13CD5B8BE0}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe | 

"{95171AAC-A18C-4DA8-AA65-A788217D7C63}" = protocol=58 | dir=in | app=system | 

"{95805212-3328-4675-8A0A-D17F36FC2A91}" = protocol=17 | dir=in | app=c:\users\simon\appdata\roaming\torrentstream\engine\tsengine.exe | 

"{A27E29D5-D16F-4CF1-A6E1-02E418D07442}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{A8B291E4-8638-4F6C-88CD-4DF964336CF7}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-503 | 

"{BB56B9D2-C929-4B81-A23C-6F3D818011CE}" = protocol=6 | dir=in | app=c:\program files\icq7m\icq.exe | 

"{BD572A06-6A92-4382-9A26-7BD5208D5207}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{BD96D896-84ED-47AA-B744-F651F6B3EA90}" = protocol=6 | dir=in | app=c:\users\simon\appdata\roaming\torrentstream\engine\tsengine.exe | 

"{BDA6D8A6-FFB1-4C88-846F-2B24AD21464D}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\football manager 2012\fm.exe | 

"{C21777F6-8353-4294-ADC1-394CC9469C6B}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{C74D79FC-AA75-4999-81AB-7B2E489604B6}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 

"{C977FABF-F435-4E1E-866B-D9BD868C8CC5}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{D5C84E6F-5702-4825-B281-CB0E149BFE14}" = protocol=6 | dir=out | app=system | 

"{D5ED8056-FFB3-4AA6-809B-C9274AB064A5}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{DC46A37E-93E1-4350-96F0-8053AB73A55F}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 

"{DF6DB0BD-4409-4C16-BF35-E2EFDE91A30E}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 

"{E30FED99-1606-4F58-9B5A-24027F8EFB9E}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 

"{E9F455A0-7F4D-4F69-8273-53209094B261}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe | 

"{EC47E3B0-B630-4F55-BA31-77976A168801}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{EF44B19A-8C51-49DC-BAD6-8F94EBC47D4C}" = protocol=17 | dir=in | app=c:\program files\icq7m\icq.exe | 

"{F5EE334E-62C6-4F8E-AF1B-A9FD0FA3CC98}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\groove.exe | 

"TCP Query User{3E2DFB02-4911-4EAF-A043-E4D5838F12CA}C:\program files\dassault systemes\b19\intel_a\code\bin\orbixd.exe" = protocol=6 | dir=in | app=c:\program files\dassault systemes\b19\intel_a\code\bin\orbixd.exe | 

"TCP Query User{4A21EF03-CDEE-45E0-9810-0C943A4A39D8}C:\program files\dassault systemes\b19\intel_a\code\bin\catsysdemon.exe" = protocol=6 | dir=in | app=c:\program files\dassault systemes\b19\intel_a\code\bin\catsysdemon.exe | 

"TCP Query User{5388F161-B1CB-44CE-85C9-967C78CB3204}C:\program files\dassault systemes\b19\intel_a\code\bin\cnext.exe" = protocol=6 | dir=in | app=c:\program files\dassault systemes\b19\intel_a\code\bin\cnext.exe | 

"TCP Query User{65819973-7E15-4F05-9D94-5C7553315C43}C:\users\simon\downloads\downloader_diablo2_dede.exe" = protocol=6 | dir=in | app=c:\users\simon\downloads\downloader_diablo2_dede.exe | 

"TCP Query User{ADEE1CAE-C160-4E3F-8BCA-217262C5F8B4}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe | 

"TCP Query User{E5622E62-CEEE-4AC5-8C79-0218C38AD7B0}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe | 

"TCP Query User{EA1F74B8-2BE9-48AB-8011-499F98F2B71A}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 

"UDP Query User{569726D1-4096-4B87-BB1C-C4A287981BC1}C:\users\simon\downloads\downloader_diablo2_dede.exe" = protocol=17 | dir=in | app=c:\users\simon\downloads\downloader_diablo2_dede.exe | 

"UDP Query User{A41A8A0D-A090-4746-95C7-A6087582A524}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 

"UDP Query User{B502A9A1-C35C-4CCF-A8F7-9E331AF8A44D}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe | 

"UDP Query User{B89194AF-A520-4B3A-ADCF-B18DE279A244}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe | 

"UDP Query User{C7E43684-6FC2-4A9E-8E41-73936ADC49DC}C:\program files\dassault systemes\b19\intel_a\code\bin\cnext.exe" = protocol=17 | dir=in | app=c:\program files\dassault systemes\b19\intel_a\code\bin\cnext.exe | 

"UDP Query User{D3A8B753-F314-4EAD-AF64-F927FFC13A6E}C:\program files\dassault systemes\b19\intel_a\code\bin\orbixd.exe" = protocol=17 | dir=in | app=c:\program files\dassault systemes\b19\intel_a\code\bin\orbixd.exe | 

"UDP Query User{F8CC5905-92BA-4F19-B7D1-729C7B06758F}C:\program files\dassault systemes\b19\intel_a\code\bin\catsysdemon.exe" = protocol=17 | dir=in | app=c:\program files\dassault systemes\b19\intel_a\code\bin\catsysdemon.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam

"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer

"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger

"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions

"{26A24AE4-039D-4CA4-87B4-2F83217017FF}" = Java 7 Update 21

"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons

"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.3

"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM

"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE

"{781B39EC-2E18-41FC-9B00-B84E4FFCA85F}" = ICQ7M

"{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1" = PDF24 Creator 5.2.0

"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform

"{85C70286-A56F-4834-BD24-B34EB76A93A2}" = ESET NOD32 Antivirus

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT

"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010

"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010

"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010

"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010

"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010

"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010

"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010

"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010

"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010

"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010

"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010

"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010

"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010

"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010

"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010

"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010

"{904CCF62-818D-4675-BC76-D37EB399F917}" = Windows Mobile-Gerätecenter

"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting

"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common

"{AD09CC9A-6901-4921-B66D-9402FF32EF27}_is1" = PDF-XChange Lite 2012

"{BD8A0C60-1AEB-11D6-B8E1-00025521AE60}" = VBA (3821b)

"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common

"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant

"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform

"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform

"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10

"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger

"{F1D7AC58-554A-4A58-B784-B61558B1449A}" = QLBCASL

"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials

"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin

"Adobe Shockwave Player" = Adobe Shockwave Player 12.0

"Diablo II" = Diablo II

"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.7.804

"HDMI" = Intel(R) Graphics Media Accelerator Driver

"LSI Soft Modem" = LSI HDA Modem

"Mozilla Firefox 20.0.1 (x86 de)" = Mozilla Firefox 20.0.1 (x86 de)

"MozillaMaintenanceService" = Mozilla Maintenance Service

"Office14.PROPLUS" = Microsoft Office Professional Plus 2010

"R for Windows 2.15.1_is1" = R for Windows 2.15.1

"SopCast" = SopCast 3.5.0

"Steam App 71270" = Football Manager 2012

"SynTPDeinstKey" = Synaptics Pointing Device Driver

"TVWiz" = Intel(R) TV Wizard

"VLC media player" = VLC media player 1.1.4

"WinLiveSuite" = Windows Live Essentials

"WinRAR archiver" = WinRAR

 
 ========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 04.05.2013 04:57:25 | Computer Name = simon-PC | Source = Winlogon | ID = 4103

Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x00000000.

 

Error - 04.05.2013 05:01:30 | Computer Name = simon-PC | Source = Winlogon | ID = 4103

Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x00000000.

 

Error - 04.05.2013 05:04:00 | Computer Name = simon-PC | Source = Software Protection Platform Service | ID = 8198

Description = Fehler bei der Lizenzaktivierung (slui.exe). Fehlercode:  0x80070005

 

Error - 04.05.2013 05:04:00 | Computer Name = simon-PC | Source = Winlogon | ID = 4103

Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x00000000.

 

Error - 04.05.2013 11:18:45 | Computer Name = simon-PC | Source = Winlogon | ID = 4103

Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x00000000.

 

Error - 05.05.2013 04:16:43 | Computer Name = simon-PC | Source = Software Protection Platform Service | ID = 8198

Description = Fehler bei der Lizenzaktivierung (slui.exe). Fehlercode:  0x80070005

 

Error - 05.05.2013 04:16:43 | Computer Name = simon-PC | Source = Winlogon | ID = 4103

Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x00000000.

 

Error - 05.05.2013 05:28:29 | Computer Name = simon-PC | Source = Winlogon | ID = 4103

Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x00000000.

 

Error - 06.05.2013 04:31:06 | Computer Name = simon-PC | Source = Software Protection Platform Service | ID = 8198

Description = Fehler bei der Lizenzaktivierung (slui.exe). Fehlercode:  0x80070005

 

Error - 06.05.2013 04:31:06 | Computer Name = simon-PC | Source = Winlogon | ID = 4103

Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x00000000.

 

[ System Events ]

Error - 13.12.2012 04:30:31 | Computer Name = simon-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers

 nicht gestartet:   %%1053

 

Error - 13.12.2012 04:41:49 | Computer Name = simon-PC | Source = EventLog | ID = 6008

Description = Das System wurde zuvor am ?13.?12.?2012 um 09:40:49 unerwartet heruntergefahren.

 

Error - 15.12.2012 20:02:42 | Computer Name = simon-PC | Source = WMPNetworkSvc | ID = 866300

Description = 

 

Error - 17.12.2012 10:37:59 | Computer Name = simon-PC | Source = WMPNetworkSvc | ID = 866300

Description = 

 

Error - 18.12.2012 10:05:49 | Computer Name = simon-PC | Source = WMPNetworkSvc | ID = 866300

Description = 

 

Error - 18.12.2012 11:23:49 | Computer Name = simon-PC | Source = Server | ID = 2505

Description = Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht

 \Device\NetBT_Tcpip_{E6A8AF95-9BD1-4B5F-8BCC-E7D90A7A0B91} vom Serverdienst nicht

 gebunden werden. Der Serverdienst konnte nicht gestartet werden.

 

Error - 18.12.2012 11:24:09 | Computer Name = simon-PC | Source = Server | ID = 2505

Description = Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht

 \Device\NetBT_Tcpip_{E6A8AF95-9BD1-4B5F-8BCC-E7D90A7A0B91} vom Serverdienst nicht

 gebunden werden. Der Serverdienst konnte nicht gestartet werden.

 

Error - 21.12.2012 04:58:00 | Computer Name = simon-PC | Source = Service Control Manager | ID = 7009

Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst

 Steam Client Service erreicht.

 

Error - 21.12.2012 04:58:00 | Computer Name = simon-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers

 nicht gestartet:   %%1053

 

Error - 21.12.2012 13:22:06 | Computer Name = simon-PC | Source = Service Control Manager | ID = 7011

Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung

 von Dienst ShellHWDetection erreicht.

 

 

< End of report >

--- --- ---
/]

Gmer:
[GMER Logfile:

Code:

GMER 2.1.19163 - hxxp://www.gmer.net

Rootkit scan 2013-05-06 22:17:21

Windows 6.1.7600  \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-2 FUJITSU_MHZ2160BH_G2 rev.8909 149,05GB

Running: gmer_2.1.19163.exe; Driver: C:\Users\simon\AppData\Local\Temp\agloypog.sys
 
 

---- Kernel code sections - GMER 2.1 ----
 

.text           ntkrnlpa.exe!ZwRollbackTransaction + 13E9                                                                               82A7D599 1 Byte  [06]

.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                                  82AA2092 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
 

---- User code sections - GMER 2.1 ----
 

.text           C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1552] kernel32.dll!SetUnhandledExceptionFilter                      761130E2 4 Bytes  [C2, 04, 00, 00]
 

---- Devices - GMER 2.1 ----
 

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                                  eamon.sys

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                                 Wdf01000.sys

AttachedDevice  \FileSystem\fastfat \Fat                                                                                                fltmgr.sys

AttachedDevice  \FileSystem\fastfat \Fat                                                                                                eamon.sys
 

---- Registry - GMER 2.1 ----
 

Reg             HKLM\SOFTWARE\Microsoft\Windows Search\UsnNotifier\Windows\Catalogs\SystemIndex@{F32218FD-B199-11E1-8B2A-806E6F6E6963}  5055317624
 

---- EOF - GMER 2.1 ----/]

--- --- ---