Trojaner-Board - In die Spyhunter-Falle getappt

Hallo zusammen,

Ich bin leider auch dem Spyhunter-Fake aufgesessen und habe das erst gemerkt als ich die "günstige" Vollversion kaufen sollte und glücklicherweise erstmal Google bemüht habe.
Ich habe das Programm zwar mit CCleaner deinstalliert, kann mir aber nicht vorstellen daß es damit restlos entfernt wurde, zumal noch einige Dateien davon vorhanden sind.
Ich wäre für professionelle Hilfe sehr dankbar...
Hier die gemäß Checkliste erstellten Logdateien von OTL und Gmer :

OTL Logfile:

Code:

OTL logfile created on: 14.07.2013 09:22:01 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\xxx\Desktop

 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.10.9200.16635)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

1,49 Gb Total Physical Memory | 0,93 Gb Available Physical Memory | 62,66% Memory free

2,98 Gb Paging File | 2,22 Gb Available in Paging File | 74,55% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 37,16 Gb Total Space | 17,42 Gb Free Space | 46,87% Space Free | Partition Type: NTFS

 

Computer Name: NC6120 | User Name: xxx | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2013.07.13 20:50:23 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\xxx\Desktop\OTL.exe

PRC - [2013.06.26 13:21:47 | 000,084,024 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe

PRC - [2013.06.26 13:21:43 | 000,111,160 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\ipmgui.exe

PRC - [2013.06.26 13:21:26 | 000,076,856 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe

PRC - [2013.06.26 13:21:23 | 000,345,144 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe

PRC - [2013.06.26 13:21:23 | 000,108,088 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe

PRC - [2013.06.12 02:23:57 | 000,770,648 | ---- | M] (Microsoft Corporation) -- C:\Programme\Internet Explorer\iexplore.exe

PRC - [2013.05.11 12:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2013.05.02 18:48:51 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe

PRC - [2013.05.01 07:20:08 | 000,812,424 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\Macromed\Flash\FlashUtil32_11_7_700_169_ActiveX.exe

PRC - [2013.03.28 07:23:28 | 001,106,288 | ---- | M] (Samsung) -- C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

PRC - [2013.03.28 07:23:26 | 000,310,640 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Programme\Samsung\Kies\KiesTrayAgent.exe

PRC - [2013.03.28 07:23:22 | 001,511,792 | ---- | M] (Samsung) -- C:\Programme\Samsung\Kies\Kies.exe

PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe

PRC - [2009.02.26 18:36:46 | 000,030,040 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe

PRC - [2002.10.28 08:10:00 | 000,106,561 | ---- | M] (WinZip Computing, Inc. and H.C. Top Systems B.V.) -- C:\Programme\WinZip\WZQKPICK.EXE

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2013.07.11 17:06:48 | 018,022,912 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\f3770f9a13d7516e4c03f23dbd319cba\PresentationFramework.ni.dll

MOD - [2013.07.11 17:06:25 | 011,522,048 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\4572de8445038600e4552429b18fbe32\PresentationCore.ni.dll

MOD - [2013.07.11 17:05:48 | 005,628,416 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\c1c41a9e1a25999e74defafecb2aa0bc\System.Xml.ni.dll

MOD - [2013.07.11 17:05:43 | 001,014,272 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\7546a01feb9d477570b883eec56cc673\System.Configuration.ni.dll

MOD - [2013.07.11 17:05:38 | 007,070,720 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\64b92e2a22bb8c1e86486bd22828acc5\System.Core.ni.dll

MOD - [2013.07.11 17:05:27 | 003,883,008 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\112f6448b7434699af4bcc05f25ce12b\WindowsBase.ni.dll

MOD - [2013.07.11 17:05:19 | 009,100,288 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\89445d5b924ad94744d00f1b6cd2285d\System.ni.dll

MOD - [2013.07.11 17:05:09 | 014,418,432 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a01e07e47ecdd94ae099e8c4bf650516\mscorlib.ni.dll

 

 
 ========== Services (SafeList) ==========

 

SRV - [2013.07.04 10:41:50 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2013.06.26 13:21:47 | 000,084,024 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2013.06.26 13:21:23 | 000,108,088 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2013.05.27 06:57:27 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2013.05.11 12:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011.07.20 05:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv)

SRV - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)

SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)

SRV - [2009.02.26 18:36:22 | 000,064,856 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Microsoft Office\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service)

SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard)

DRV - [2013.06.04 09:15:02 | 000,181,912 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssudmdm.sys -- (ssudmdm)

DRV - [2013.06.04 09:15:02 | 000,084,248 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssudbus.sys -- (dg_ssudbus)

DRV - [2013.04.03 09:58:08 | 000,153,672 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadmdm.sys -- (ssadmdm)

DRV - [2013.04.03 09:58:08 | 000,136,904 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadbus.sys -- (ssadbus)

DRV - [2013.04.03 09:58:08 | 000,130,248 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadserd.sys -- (ssadserd)

DRV - [2013.04.03 09:58:08 | 000,032,064 | ---- | M] (Google Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadadb.sys -- (androidusb)

DRV - [2013.04.03 09:58:08 | 000,017,864 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadmdfl.sys -- (ssadmdfl)

DRV - [2013.03.06 15:13:37 | 000,037,352 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)

DRV - [2013.02.27 12:22:36 | 000,135,136 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2013.02.27 12:22:36 | 000,084,744 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2012.08.27 14:50:24 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV - [2007.12.14 09:21:56 | 000,290,816 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tifm21.sys -- (tifm21)

DRV - [2007.05.09 13:27:00 | 000,097,280 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\gtipci21.sys -- (GTIPCI21)

DRV - [2006.10.18 15:44:30 | 000,031,232 | ---- | M] (SMSC) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\smscirda.sys -- (SMSCIRDA)

DRV - [2005.11.16 14:12:46 | 001,066,278 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)

DRV - [2005.11.02 09:07:32 | 003,298,432 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\w29n51.sys -- (w29n51)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\..\SearchScopes,DefaultScope = 

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.gmx.de/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 00 C9 A2 8C EC 45 CE 01  [binary data]

IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR

IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.startup.homepage: "hxxp://www.gmx.de/"

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:22.0

FF - user.js - File not found

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.6: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 22.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 22.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

 

[2013.05.03 20:49:38 | 000,000,000 | ---D | M] (No name found) -- C:\Users\xxx\AppData\Roaming\mozilla\Extensions

[2013.07.11 21:15:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\en35stal.default\extensions

[2013.07.11 16:11:51 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\Extensions

[2013.07.04 10:41:40 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\browser\extensions

[2013.07.04 10:41:50 | 000,000,000 | ---D | M] (Default) -- C:\Programme\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

 

O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [KiesTrayAgent] C:\Programme\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)

O4 - HKLM..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)

O4 - HKCU..\Run: [] C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe (Samsung)

O4 - HKCU..\Run: [KiesPreload] C:\Program Files\Samsung\Kies\Kies.exe (Samsung)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O13 - gopher Prefix: missing

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{10BDCCE1-0E5A-4F65-8733-9AFC56F2C8F6}: DhcpNameServer = 192.168.2.1

O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - Winlogon\Notify\ScCertProp: DllName - (wlnotify.dll) -  File not found

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2013.07.13 21:14:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2013.07.13 21:14:13 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2013.07.13 21:01:38 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT

[2013.07.13 20:51:49 | 000,559,441 | ---- | C] (Oleg N. Scherbakov) -- C:\Users\xxx\Desktop\JRT.exe

[2013.07.13 20:50:12 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\xxx\Desktop\OTL.exe

[2013.07.13 16:40:18 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group

[2013.07.13 16:37:22 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard

[2013.07.11 16:11:55 | 000,000,000 | ---D | C] -- C:\Users\xxx\.android

[2013.07.11 16:11:53 | 000,000,000 | ---D | C] -- C:\Users\xxx\Local Settings

[2013.07.11 16:09:36 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\MyPhoneExplorer

[2013.07.11 16:09:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyPhoneExplorer

[2013.07.11 16:08:33 | 000,000,000 | ---D | C] -- C:\Program Files\MyPhoneExplorer

[2013.07.11 16:00:34 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\cm10

[2013.07.10 21:40:23 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\Odin_3.07

[2013.07.06 17:05:10 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\Auspuff

[2013.07.06 17:03:05 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\CrashDump

[2013.07.06 17:02:00 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\Capri

[2013.07.05 19:16:32 | 000,000,000 | ---D | C] -- C:\Users\xxx\Documents\SelfMV

[2013.07.05 19:16:05 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\Harley

[2013.07.05 19:15:47 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\Felgen

[2013.07.05 19:12:36 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\NativeFus_Log

[2013.07.05 19:12:19 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\Samsung

[2013.07.05 19:12:13 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\Samsung

[2013.07.05 19:11:26 | 000,000,000 | ---D | C] -- C:\Users\xxx\Documents\samsung

[2013.07.04 10:41:39 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox

[2013.06.20 19:54:41 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\save

[2013.06.20 19:43:25 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\handy

[2013.06.20 19:38:50 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Convar

[2013.06.20 19:38:50 | 000,000,000 | ---D | C] -- C:\Program Files\Convar

[2013.06.20 19:22:48 | 000,000,000 | ---D | C] -- C:\Users\xxx\Documents\CardRecovery

[2013.06.18 20:56:00 | 000,000,000 | ---D | C] -- C:\Users\xxx\Documents\C16

[2013.06.17 07:07:08 | 000,000,000 | ---D | C] -- C:\Users\xxx\Documents\Bodensee13

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2013.07.14 09:20:27 | 000,000,000 | ---- | M] () -- C:\Users\xxx\defogger_reenable

[2013.07.14 08:55:04 | 000,013,728 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2013.07.14 08:55:04 | 000,013,728 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2013.07.14 08:46:48 | 000,000,350 | ---- | M] () -- C:\Windows\tasks\Lyrics-Pal Update.job

[2013.07.14 08:46:42 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2013.07.14 08:46:31 | 1201,217,536 | -HS- | M] () -- C:\hiberfil.sys

[2013.07.13 21:14:15 | 000,000,969 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2013.07.13 21:11:34 | 000,377,856 | ---- | M] () -- C:\Users\xxx\Desktop\gmer_2.1.19163.exe

[2013.07.13 21:10:50 | 000,050,477 | ---- | M] () -- C:\Users\xxx\Desktop\Defogger.exe

[2013.07.13 20:51:50 | 000,559,441 | ---- | M] (Oleg N. Scherbakov) -- C:\Users\xxx\Desktop\JRT.exe

[2013.07.13 20:50:23 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\xxx\Desktop\OTL.exe

[2013.07.13 20:43:00 | 000,662,345 | ---- | M] () -- C:\Users\xxx\Desktop\adwcleaner.exe

[2013.07.11 20:29:53 | 000,616,008 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2013.07.11 20:29:52 | 000,654,166 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2013.07.11 20:29:52 | 000,130,006 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2013.07.11 20:29:52 | 000,106,388 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2013.07.11 20:23:37 | 000,410,064 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2013.07.11 16:09:24 | 000,002,019 | ---- | M] () -- C:\Users\Public\Desktop\MyPhoneExplorer.lnk

[2013.07.11 16:08:23 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_Kernel_ssadadb_01005.Wdf

[2013.06.26 13:21:50 | 000,067,168 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avnetflt.sys

[2013.06.21 11:18:01 | 000,000,903 | ---- | M] () -- C:\Users\xxx\Desktop\WinVICE-2.4-x86.lnk

[2013.06.20 19:38:51 | 000,001,284 | ---- | M] () -- C:\Users\xxx\Desktop\PC Inspector File Recovery.lnk

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2013.07.14 09:20:27 | 000,000,000 | ---- | C] () -- C:\Users\xxx\defogger_reenable

[2013.07.13 21:14:15 | 000,000,969 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2013.07.13 21:11:34 | 000,377,856 | ---- | C] () -- C:\Users\xxx\Desktop\gmer_2.1.19163.exe

[2013.07.13 21:10:50 | 000,050,477 | ---- | C] () -- C:\Users\xxx\Desktop\Defogger.exe

[2013.07.13 20:42:59 | 000,662,345 | ---- | C] () -- C:\Users\xxx\Desktop\adwcleaner.exe

[2013.07.11 16:09:58 | 000,000,350 | ---- | C] () -- C:\Windows\tasks\Lyrics-Pal Update.job

[2013.07.11 16:09:24 | 000,002,019 | ---- | C] () -- C:\Users\Public\Desktop\MyPhoneExplorer.lnk

[2013.07.11 16:08:23 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_Kernel_ssadadb_01005.Wdf

[2013.06.21 11:18:01 | 000,000,903 | ---- | C] () -- C:\Users\xxx\Desktop\WinVICE-2.4-x86.lnk

[2013.06.20 19:38:51 | 000,001,284 | ---- | C] () -- C:\Users\xxx\Desktop\PC Inspector File Recovery.lnk

[2013.05.19 09:41:44 | 000,015,873 | ---- | C] () -- C:\Windows\System32\Inetde.dll

 
 ========== ZeroAccess Check ==========

 

[2009.07.14 06:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 03:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 
 ========== LOP Check ==========

 

[2013.05.24 18:46:18 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\BOM

[2013.05.06 22:45:50 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\CCS64

[2013.05.03 20:29:54 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\DVDVideoSoft

[2013.07.11 16:09:36 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\MyPhoneExplorer

[2013.07.05 19:12:28 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Samsung

 
 ========== Purity Check ==========

 

 
 

< End of report >

--- --- ---
OTL Logfile:

Code:

OTL Extras logfile created on: 14.07.2013 09:22:01 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\xxx\Desktop

 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.10.9200.16635)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

1,49 Gb Total Physical Memory | 0,93 Gb Available Physical Memory | 62,66% Memory free

2,98 Gb Paging File | 2,22 Gb Available in Paging File | 74,55% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 37,16 Gb Total Space | 17,42 Gb Free Space | 46,87% Space Free | Partition Type: NTFS

 

Computer Name: NC6120 | User Name: xxx | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

htafile [open] -- "%1" %*

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 
 ========== Authorized Applications List ==========

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{07282184-BFF9-4939-A964-53C8070A24F6}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{090A2709-1B91-4B9E-B7AA-CA1D36726087}" = rport=137 | protocol=17 | dir=out | app=system | 

"{13EDA6A1-7BF2-4C62-9A3D-FE89CE55DE0A}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{1A33A90A-6805-496F-80D6-E3C3EC721611}" = lport=445 | protocol=6 | dir=in | app=system | 

"{1B707A38-D6EA-453B-B591-B84D0EA43C42}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{2E2DDC0E-857A-48CA-AD33-A5DD9653265B}" = rport=445 | protocol=6 | dir=out | app=system | 

"{31FD715E-BF0F-4F9E-AD9D-FFE92D5D60B6}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{3A419E76-A023-4CC4-A501-2BB8654E5173}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{43D585EE-06A0-4577-B149-D49935998371}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{5006D0DA-ABFA-44D2-84AC-3F3270956C12}" = lport=10243 | protocol=6 | dir=in | app=system | 

"{5B26818F-1AB2-4621-A432-82EDB4DA4715}" = lport=137 | protocol=17 | dir=in | app=system | 

"{5D0755F6-6806-4F93-8BE6-501F31B34E45}" = rport=10243 | protocol=6 | dir=out | app=system | 

"{5D76EBCA-A4BE-4F5F-B99D-D8360F8E6950}" = lport=138 | protocol=17 | dir=in | app=system | 

"{7237C61C-6B02-4BC9-A80A-F21DFA40658C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{7866FC77-67AD-45FC-A1D6-7ECEBA32F78C}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 

"{7F532DCE-4CB0-40CE-945A-70B1F0E39263}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{9B378BED-9BD9-41CA-98D5-C9A1EF025835}" = rport=138 | protocol=17 | dir=out | app=system | 

"{9DA5AB38-3200-4B84-9270-8F38F3D79220}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 

"{A31B27A7-015C-4B2F-B0CB-B555CABA2AE6}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | 

"{A3BAF06E-B291-42B8-B4A5-F2691AAAD7BC}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{C3CF0FAC-A132-4293-8804-CDF29C959E01}" = rport=139 | protocol=6 | dir=out | app=system | 

"{CEAF100D-DD82-4F18-B928-2E5CA4BC3256}" = lport=139 | protocol=6 | dir=in | app=system | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{08D94AB8-B94B-4CE2-920E-6C4EDE80B004}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 

"{0D29C8DF-05B7-4845-B8BA-5D49B1589B69}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{138190D6-0C23-454C-A9B8-D52D6E2AC37E}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 

"{13AA94A8-1FBA-4404-ACDF-5663836D69D6}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{381CE5A2-056B-4779-91DD-ADABA5C851FE}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 

"{3FAF90B3-1D08-4B78-B69E-50671FFF53F9}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{4534B1E9-70E4-47EC-84F1-C2422E018BF7}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 

"{4F116E28-8575-4617-8FF1-4C0BBBD6F1A9}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 

"{513BE6B0-832C-4F44-A3AD-9E96DC4161FD}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 

"{6328705A-39D9-4E48-9DAB-47B424396E98}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{6D51F25A-3C07-4C52-90CC-757D04FF270A}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 

"{764B2297-56FE-471F-AB73-4B6D02331B16}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{7ACACA9B-6541-423D-A839-914EE6A58F44}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{8B524CA8-D5ED-4A7D-A512-3EFD5545E7EA}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 

"{900CB704-1C64-4AEC-8C98-A8790FB1E4B6}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{9479C03D-FD6C-4705-A170-D08C4984E383}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{A86CE3D9-086F-41B2-929E-DF68A79E9BE2}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{CE8AA108-D1CD-43C8-AF40-36838C5AA55B}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{D09D2C5F-918B-4F93-B45E-4C1B48859D07}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{DF3BA611-FD61-444D-A93E-FECD5CCD3BA0}" = protocol=6 | dir=out | app=system | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{1AEC7728-1640-4E98-AABC-5EBE3FB57FE4}" = SMSC Fast Infrared Driver

"{355FADAF-55C4-4E08-88D4-A86C4CA6930C}" = HP Wireless Assistant

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{529125EF-E3AC-4B74-97E6-F688A7C0F1BF}" = Paint.NET v3.5.10

"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies

"{767B964C-D9B4-422D-802B-F7ACBE2D310A}" = TIPCI

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007

"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007

"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007

"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007

"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007

"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007

"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007

"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISER_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISER_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISER_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007

"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISER_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007

"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007

"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007

"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISER_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007

"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007

"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In

"{91120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007

"{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.03) - Deutsch

"{B7B5A370-3DFF-4F0E-AE11-FD267C4938AA}" = CCS64 V3.9

"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones

"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5

"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"6F8C52CF07BBF1FE2471DC68C08F06D7C58B7D49" = Windows Driver Package - Intel (w29n51) net  (09/12/2005 9.0.3.9)

"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin

"Agere Systems Soft Modem" = Agere Systems AC'97 Modem

"Avira AntiVir Desktop" = Avira Free Antivirus

"Biet-O-Matic v2.14.12" = Biet-O-Matic v2.14.12

"Broadcom 802.11b Network Adapter" = Broadcom 802.11 Wireless LAN Adapter

"CCleaner" = CCleaner

"E61C4CD368E9E2830A85919D7F5030333F381837" = Windows Driver Package - Intel (w39n51) net  (09/28/2005 10.0.0.120)

"ENTERPRISER" = Microsoft Office Enterprise 2007

"Free YouTube Download_is1" = Free YouTube Download version 3.2.2.426

"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.12.2.426

"HDMI" = Intel(R) Graphics Media Accelerator Driver

"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies

"InstallShield_{767B964C-D9B4-422D-802B-F7ACBE2D310A}" = Texas Instruments PCIxx21/x515/xx12 drivers.

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"Mozilla Firefox 22.0 (x86 de)" = Mozilla Firefox 22.0 (x86 de)

"MozillaMaintenanceService" = Mozilla Maintenance Service

"MPE" = MyPhoneExplorer

"SynTPDeinstKey" = Synaptics Pointing Device Driver

"VLC media player" = VLC media player 2.0.6

"WinZip" = WinZip

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"MyFreeCodec" = MyFreeCodec

 
 ========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 13.07.2013 15:24:32 | Computer Name = NC6120 | Source = ESENT | ID = 455

Description = Windows (2752) Windows: Fehler -1811 beim Öffnen von Protokolldatei

 C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS00024.log.

 

Error - 13.07.2013 15:24:33 | Computer Name = NC6120 | Source = Windows Search Service | ID = 9000

Description = 

 

Error - 13.07.2013 15:24:33 | Computer Name = NC6120 | Source = Windows Search Service | ID = 7040

Description = 

 

Error - 13.07.2013 15:24:33 | Computer Name = NC6120 | Source = Windows Search Service | ID = 7042

Description = 

 

Error - 13.07.2013 15:24:33 | Computer Name = NC6120 | Source = Windows Search Service | ID = 9002

Description = 

 

Error - 13.07.2013 15:24:33 | Computer Name = NC6120 | Source = Windows Search Service | ID = 3029

Description = 

 

Error - 13.07.2013 15:24:34 | Computer Name = NC6120 | Source = Windows Search Service | ID = 3029

Description = 

 

Error - 13.07.2013 15:24:34 | Computer Name = NC6120 | Source = Windows Search Service | ID = 3028

Description = 

 

Error - 13.07.2013 15:24:34 | Computer Name = NC6120 | Source = Windows Search Service | ID = 3058

Description = 

 

Error - 13.07.2013 15:24:34 | Computer Name = NC6120 | Source = Windows Search Service | ID = 7010

Description = 

 

[ System Events ]

Error - 13.07.2013 15:24:34 | Computer Name = NC6120 | Source = Service Control Manager | ID = 7024

Description = Der Dienst "Windows Search" wurde mit folgendem dienstspezifischem

 Fehler beendet: %%-1073473535.

 

Error - 13.07.2013 15:24:34 | Computer Name = NC6120 | Source = Service Control Manager | ID = 7031

Description = Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits

 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt:

 Neustart des Diensts.

 

 

< End of report >

--- --- ---

GMER Logfile:

Code:

GMER 2.1.19163 - hxxp://www.gmer.net

Rootkit scan 2013-07-14 10:55:45

Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 FUJITSU_MHW2040AT rev.0000000B 37,26GB

Running: gmer_2.1.19163.exe; Driver: C:\Users\Heiko\AppData\Local\Temp\kxldqpog.sys
 
 

---- System - GMER 2.1 ----
 

SSDT            8CCE81CE                                                                                               ZwCreateSection

SSDT            8CCE81D8                                                                                               ZwRequestWaitReplyPort

SSDT            8CCE81D3                                                                                               ZwSetContextThread

SSDT            8CCE81DD                                                                                               ZwSetSecurityObject

SSDT            8CCE81E2                                                                                               ZwSystemDebugControl

SSDT            8CCE816F                                                                                               ZwTerminateProcess
 

---- Kernel code sections - GMER 2.1 ----
 

.text           ntkrnlpa.exe!ZwRollbackEnlistment + 140D                                                               828759F5 1 Byte  [06]

.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                 828AF1F2 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

.text           ntkrnlpa.exe!KeRemoveQueueEx + 11F7                                                                    828B653C 4 Bytes  [CE, 81, CE, 8C]

.text           ntkrnlpa.exe!KeRemoveQueueEx + 1553                                                                    828B6898 4 Bytes  [D8, 81, CE, 8C]

.text           ntkrnlpa.exe!KeRemoveQueueEx + 1597                                                                    828B68DC 4 Bytes  [D3, 81, CE, 8C]

.text           ntkrnlpa.exe!KeRemoveQueueEx + 1613                                                                    828B6958 4 Bytes  [DD, 81, CE, 8C]

.text           ntkrnlpa.exe!KeRemoveQueueEx + 1667                                                                    828B69AC 4 Bytes  [E2, 81, CE, 8C]

.text           ...                                                                                                    
 

---- User code sections - GMER 2.1 ----
 

.text           C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[1944] ntdll.dll!DbgBreakPoint       7756410C 1 Byte  [C3]

.text           C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[1944] ntdll.dll!DbgUiRemoteBreakin  775CF17D 5 Bytes  JMP 7758E342 C:\Windows\SYSTEM32\ntdll.dll
 

---- Devices - GMER 2.1 ----
 

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                SynTP.sys

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                                SynTP.sys
 

---- EOF - GMER 2.1 ----

Code:

--- --- ---

Ich bin wie gesagt für jeden Tip dankbar wie ich diesen Plagegeist wieder loswerde.
Schönen Dank schonmal im voraus !
Gruß Flodder