Virus Befall: e621ca05

schrauber · 08.10.2012, 15:53

Sieht so aus als dürftest du alle Deine externen Platten/Sticks und Co formatieren

Dann ein frisches OTL logfile bitte.

Onion99 · 08.10.2012, 16:02

eine frage als ich den virus drauf hatte hab ich auch einmal mein handy dran gehabt sollte ich das auch noch formatieren oder kann ich alles so lassen ?

schrauber · 08.10.2012, 16:03

Handy sollte kein Problem sein, aber alles andere Externe.

Onion99 · 08.10.2012, 16:05

Bei J:
kommt nur ein fehler :Windows konnte die Formatierung nicht abschließen
dort sind folgende ordner:
$RECYCLE.BIN
Boot

schrauber · 08.10.2012, 16:25

Dann lass das mal weg.

Onion99 · 08.10.2012, 16:49

ESET onlinescanner ist fertig und hat nichts mehr gefunden

schrauber · 08.10.2012, 17:00

Ich denk der war oben schon fertig als du die Funde auf K: gepostet hast?

Onion99 · 08.10.2012, 17:03

ich hab wie du gesagt hast die externen formatiert und ihn dann nochmal laufen lassen

schrauber · 08.10.2012, 17:03

Achso, dann bitte ein neues OTL logfile.

Onion99 · 08.10.2012, 17:11

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 08.10.2012 18:05:48 - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\ImperatorZwiebel\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,99 Gb Total Physical Memory | 2,41 Gb Available Physical Memory | 60,43% Memory free
7,98 Gb Paging File | 5,85 Gb Available in Paging File | 73,29% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 905,41 Gb Total Space | 863,00 Gb Free Space | 95,32% Space Free | Partition Type: NTFS
Drive D: | 25,00 Gb Total Space | 24,91 Gb Free Space | 99,65% Space Free | Partition Type: NTFS
Drive I: | 186,31 Gb Total Space | 186,21 Gb Free Space | 99,95% Space Free | Partition Type: NTFS
Drive J: | 100,00 Mb Total Space | 71,20 Mb Free Space | 71,20% Space Free | Partition Type: NTFS
Drive K: | 1397,26 Gb Total Space | 1397,13 Gb Free Space | 99,99% Space Free | Partition Type: NTFS
 
Computer Name: PAUL-COMPUTER | User Name: ImperatorZwiebel | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - File not found -- 
PRC - [2012.10.07 11:03:51 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\ImperatorZwiebel\Desktop\OTL.exe
PRC - [2012.10.06 10:58:56 | 000,529,744 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe
PRC - [2012.10.06 10:58:38 | 001,353,080 | ---- | M] (Valve Corporation) -- C:\Steam\Steam.exe
PRC - [2012.09.25 11:43:01 | 001,239,064 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
PRC - [2012.08.30 21:14:00 | 001,258,856 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2012.08.30 10:40:00 | 000,382,312 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.10.06 10:58:56 | 001,099,616 | ---- | M] () -- C:\Steam\bin\avcodec-53.dll
MOD - [2012.10.06 10:58:56 | 000,190,816 | ---- | M] () -- C:\Steam\bin\avformat-53.dll
MOD - [2012.10.06 10:58:56 | 000,123,232 | ---- | M] () -- C:\Steam\bin\avutil-51.dll
MOD - [2012.09.25 11:42:58 | 000,460,312 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.79\ppGoogleNaClPluginChrome.dll
MOD - [2012.09.25 11:42:57 | 012,278,808 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.79\PepperFlash\pepflashplayer.dll
MOD - [2012.09.25 11:42:55 | 004,005,912 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.79\pdf.dll
MOD - [2012.09.25 11:41:39 | 000,578,072 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.79\libglesv2.dll
MOD - [2012.09.25 11:41:38 | 000,123,416 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.79\libegl.dll
MOD - [2012.09.25 11:41:27 | 000,156,712 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.79\avutil-51.dll
MOD - [2012.09.25 11:41:26 | 000,275,496 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.79\avformat-54.dll
MOD - [2012.09.25 11:41:24 | 002,168,360 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.79\avcodec-54.dll
 
 
========== Services (SafeList) ==========
 
SRV - [2012.10.06 10:58:56 | 000,529,744 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.08.30 21:14:00 | 001,258,856 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012.08.30 10:40:00 | 000,382,312 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.10.01 17:14:23 | 000,129,576 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.09.24 09:58:11 | 000,027,800 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2012.09.13 15:52:59 | 000,099,248 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.06.10 06:34:52 | 000,539,240 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010.11.15 01:26:34 | 000,012,416 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\trustms.sys -- (trustms)
DRV:64bit: - [2010.04.07 12:14:50 | 000,446,304 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\netr6164.sys -- (rt61x64)
DRV:64bit: - [2009.09.16 08:02:42 | 000,031,232 | ---- | M] (Tunngle.net) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tap0901t.sys -- (tap0901t)
DRV:64bit: - [2009.07.31 03:40:32 | 000,025,600 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\XENfiltv.sys -- (XENfiltv)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: I:\Java 64bit\bin\plugin2\npjp2.dll File not found
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
 
 
========== Chrome  ==========
 
CHR - homepage: 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: 
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.79\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.79\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.79\pdf.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - Extension: YouTube = C:\Users\ImperatorZwiebel\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\ImperatorZwiebel\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Stylish = C:\Users\ImperatorZwiebel\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe\0.10_0\
CHR - Extension: AdBlock = C:\Users\ImperatorZwiebel\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.45_0\
CHR - Extension: Night Time In New York City = C:\Users\ImperatorZwiebel\AppData\Local\Google\Chrome\User Data\Default\Extensions\jnimonidkipnhnpgkhgliocfnnpgkhek\1.2_0\
CHR - Extension: YouTube = C:\Users\ImperatorZwiebel\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\ImperatorZwiebel\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Stylish = C:\Users\ImperatorZwiebel\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe\0.10_0\
CHR - Extension: AdBlock = C:\Users\ImperatorZwiebel\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.45_0\
CHR - Extension: Night Time In New York City = C:\Users\ImperatorZwiebel\AppData\Local\Google\Chrome\User Data\Default\Extensions\jnimonidkipnhnpgkhgliocfnnpgkhek\1.2_0\
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - I:\Java 64bit\bin\ssv.dll File not found
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - I:\Java 64bit\bin\jp2ssv.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] "I:\Avira\Avira\AntiVir Desktop\avgnt.exe" /min File not found
O4 - HKCU..\Run: [Steam] C:\Steam\Steam.exe (Valve Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D7FFE5B6-7D0F-4FF0-A2FA-36DAE669EAA8}: DhcpNameServer = 192.168.178.1
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
 
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
File not found -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Neue Funktion 1
[2012.10.08 16:00:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.10.08 15:59:30 | 002,322,184 | ---- | C] (ESET) -- C:\Users\ImperatorZwiebel\Desktop\esetsmartinstaller_enu.exe
[2012.10.07 21:36:26 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Roaming\Malwarebytes
[2012.10.07 21:36:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.10.07 21:36:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.10.07 21:36:14 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.10.07 19:42:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
[2012.10.07 11:03:43 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\ImperatorZwiebel\Desktop\OTL.exe
[2012.10.06 17:42:59 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Roaming\LolClient
[2012.10.06 17:07:19 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\InstallShield Installation Information
[2012.10.06 16:24:24 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Local\PMB Files
[2012.10.06 16:24:23 | 000,000,000 | ---D | C] -- C:\ProgramData\PMB Files
[2012.10.06 16:24:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Pando Networks
[2012.10.06 16:11:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET
[2012.10.06 15:26:29 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012.10.06 15:04:26 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Roaming\Macromedia
[2012.10.06 15:04:25 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Roaming\Adobe
[2012.10.06 12:33:16 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012.10.06 12:28:41 | 004,762,471 | R--- | C] (Swearware) -- C:\Users\ImperatorZwiebel\Desktop\ComboFix.exe
[2012.10.06 12:10:42 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012.10.06 12:10:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012.10.06 12:04:11 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Roaming\WinRAR
[2012.10.06 12:04:09 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2012.10.06 11:40:05 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Macromed
[2012.10.06 11:40:05 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
[2012.10.06 11:39:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe
[2012.10.06 11:11:38 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012.10.06 11:11:38 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012.10.06 11:11:38 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012.10.06 11:11:34 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012.10.06 11:11:26 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2012.10.06 11:04:36 | 000,031,232 | ---- | C] (Tunngle.net) -- C:\Windows\SysNative\drivers\tap0901t.sys
[2012.10.06 11:04:36 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Tunngle
[2012.10.06 11:04:36 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\Documents\Tunngle
[2012.10.06 11:04:36 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Roaming\Tunngle
[2012.10.06 11:04:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Tunngle
[2012.10.06 11:04:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tunngle
[2012.10.06 10:58:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
[2012.10.06 10:58:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Steam
[2012.10.06 10:57:34 | 000,000,000 | ---D | C] -- C:\Spiele
[2012.10.06 10:57:29 | 000,000,000 | ---D | C] -- C:\Steam
[2012.10.06 10:44:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SweetIM
[2012.10.06 10:37:02 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Roaming\Skype
[2012.10.06 10:36:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype
[2012.10.06 01:00:34 | 000,000,000 | ---D | C] -- C:\Windows\Panther
[2012.10.06 00:56:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
[2012.10.06 00:52:46 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA
[2012.10.06 00:52:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NVIDIA Corporation
[2012.10.06 00:51:48 | 000,060,776 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll
[2012.10.06 00:51:48 | 000,052,584 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll
[2012.10.06 00:51:48 | 000,000,000 | ---D | C] -- C:\temp
[2012.10.06 00:51:35 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation
[2012.10.06 00:50:25 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Roaming\Avira
[2012.10.06 00:49:22 | 000,000,000 | ---D | C] -- C:\Program Files\NVIDIA Corporation
[2012.10.06 00:48:58 | 000,000,000 | ---D | C] -- C:\NVIDIA
[2012.10.06 00:44:52 | 000,129,576 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys
[2012.10.06 00:44:52 | 000,099,248 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2012.10.06 00:44:52 | 000,027,800 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2012.10.06 00:44:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2012.10.06 00:38:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2012.10.06 00:38:21 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2012.10.06 00:38:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google
[2012.10.06 00:38:15 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Local\Google
[2012.10.06 00:38:03 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Local\Apps
[2012.10.06 00:38:02 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Local\Deployment
[2012.10.06 00:37:01 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Local\ElevatedDiagnostics
[2012.10.06 00:34:53 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\Desktop\Games
[2012.10.06 00:34:45 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\Desktop\Programme
[2012.10.06 00:26:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\EPSON
[2012.10.06 00:25:33 | 000,000,000 | R--D | C] -- C:\Users\ImperatorZwiebel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2012.10.06 00:25:33 | 000,000,000 | R--D | C] -- C:\Users\ImperatorZwiebel\Searches
[2012.10.06 00:25:33 | 000,000,000 | R--D | C] -- C:\Users\ImperatorZwiebel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2012.10.06 00:25:27 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Roaming\Identities
[2012.10.06 00:25:25 | 000,000,000 | R--D | C] -- C:\Users\ImperatorZwiebel\Contacts
[2012.10.06 00:25:23 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Local\VirtualStore
[2012.10.06 00:25:10 | 000,000,000 | --SD | C] -- C:\Users\ImperatorZwiebel\AppData\Roaming\Microsoft
[2012.10.06 00:25:10 | 000,000,000 | R--D | C] -- C:\Users\ImperatorZwiebel\Videos
[2012.10.06 00:25:10 | 000,000,000 | R--D | C] -- C:\Users\ImperatorZwiebel\Saved Games
[2012.10.06 00:25:10 | 000,000,000 | R--D | C] -- C:\Users\ImperatorZwiebel\Pictures
[2012.10.06 00:25:10 | 000,000,000 | R--D | C] -- C:\Users\ImperatorZwiebel\Music
[2012.10.06 00:25:10 | 000,000,000 | R--D | C] -- C:\Users\ImperatorZwiebel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2012.10.06 00:25:10 | 000,000,000 | R--D | C] -- C:\Users\ImperatorZwiebel\Links
[2012.10.06 00:25:10 | 000,000,000 | R--D | C] -- C:\Users\ImperatorZwiebel\Favorites
[2012.10.06 00:25:10 | 000,000,000 | R--D | C] -- C:\Users\ImperatorZwiebel\Downloads
[2012.10.06 00:25:10 | 000,000,000 | R--D | C] -- C:\Users\ImperatorZwiebel\Documents
[2012.10.06 00:25:10 | 000,000,000 | R--D | C] -- C:\Users\ImperatorZwiebel\Desktop
[2012.10.06 00:25:10 | 000,000,000 | R--D | C] -- C:\Users\ImperatorZwiebel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2012.10.06 00:25:10 | 000,000,000 | -HSD | C] -- C:\Users\ImperatorZwiebel\Vorlagen
[2012.10.06 00:25:10 | 000,000,000 | -HSD | C] -- C:\Users\ImperatorZwiebel\AppData\Local\Verlauf
[2012.10.06 00:25:10 | 000,000,000 | -HSD | C] -- C:\Users\ImperatorZwiebel\AppData\Local\Temporary Internet Files
[2012.10.06 00:25:10 | 000,000,000 | -HSD | C] -- C:\Users\ImperatorZwiebel\Startmenü
[2012.10.06 00:25:10 | 000,000,000 | -HSD | C] -- C:\Users\ImperatorZwiebel\SendTo
[2012.10.06 00:25:10 | 000,000,000 | -HSD | C] -- C:\Users\ImperatorZwiebel\Recent
[2012.10.06 00:25:10 | 000,000,000 | -HSD | C] -- C:\Users\ImperatorZwiebel\Netzwerkumgebung
[2012.10.06 00:25:10 | 000,000,000 | -HSD | C] -- C:\Users\ImperatorZwiebel\Lokale Einstellungen
[2012.10.06 00:25:10 | 000,000,000 | -HSD | C] -- C:\Users\ImperatorZwiebel\Documents\Eigene Videos
[2012.10.06 00:25:10 | 000,000,000 | -HSD | C] -- C:\Users\ImperatorZwiebel\Documents\Eigene Musik
[2012.10.06 00:25:10 | 000,000,000 | -HSD | C] -- C:\Users\ImperatorZwiebel\Eigene Dateien
[2012.10.06 00:25:10 | 000,000,000 | -HSD | C] -- C:\Users\ImperatorZwiebel\Documents\Eigene Bilder
[2012.10.06 00:25:10 | 000,000,000 | -HSD | C] -- C:\Users\ImperatorZwiebel\Druckumgebung
[2012.10.06 00:25:10 | 000,000,000 | -HSD | C] -- C:\Users\ImperatorZwiebel\Cookies
[2012.10.06 00:25:10 | 000,000,000 | -HSD | C] -- C:\Users\ImperatorZwiebel\AppData\Local\Anwendungsdaten
[2012.10.06 00:25:10 | 000,000,000 | -HSD | C] -- C:\Users\ImperatorZwiebel\Anwendungsdaten
[2012.10.06 00:25:10 | 000,000,000 | -H-D | C] -- C:\Users\ImperatorZwiebel\AppData
[2012.10.06 00:25:10 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Local\Temp
[2012.10.06 00:25:10 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Local\Microsoft
[2012.10.06 00:25:10 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Roaming\Media Center Programs
[2012.10.06 00:24:59 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen
[2012.10.06 00:24:59 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü
[2012.10.06 00:24:59 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien
[2012.10.06 00:24:59 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten
[2012.10.06 00:24:59 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos
[2012.10.06 00:24:59 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik
[2012.10.06 00:24:59 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder
[2012.10.06 00:24:59 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente
[2012.10.06 00:24:59 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten
[2012.10.06 00:04:21 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2012.10.06 00:02:12 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch
 
========== Files - Modified Within 30 Days ==========
 
[2012.10.08 17:48:03 | 000,001,130 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.10.08 17:46:32 | 000,000,017 | ---- | M] () -- C:\Users\ImperatorZwiebel\AppData\Roaming\mbam.context.scan
[2012.10.08 17:25:10 | 000,019,264 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.10.08 17:25:10 | 000,019,264 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.10.08 15:59:36 | 002,322,184 | ---- | M] (ESET) -- C:\Users\ImperatorZwiebel\Desktop\esetsmartinstaller_enu.exe
[2012.10.08 15:27:04 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.10.08 15:27:04 | 000,653,928 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.10.08 15:27:04 | 000,615,810 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.10.08 15:27:04 | 000,129,800 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.10.08 15:27:04 | 000,106,190 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.10.08 15:23:00 | 000,001,126 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.10.08 15:22:54 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.10.08 15:22:36 | 3214,233,600 | -HS- | M] () -- C:\hiberfil.sys
[2012.10.07 11:03:51 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\ImperatorZwiebel\Desktop\OTL.exe
[2012.10.06 16:01:25 | 000,266,992 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.10.06 15:11:13 | 000,072,822 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf
[2012.10.06 15:11:10 | 000,072,822 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf
[2012.10.06 12:28:53 | 004,762,471 | R--- | M] (Swearware) -- C:\Users\ImperatorZwiebel\Desktop\ComboFix.exe
[2012.10.06 00:39:01 | 000,002,255 | ---- | M] () -- C:\Users\ImperatorZwiebel\Desktop\Google Chrome.lnk
[2012.10.06 00:06:39 | 000,207,887 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
[2012.10.06 00:06:39 | 000,207,887 | ---- | M] () -- C:\Windows\SysNative\license.rtf
[2012.10.06 00:04:14 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2012.10.01 17:14:23 | 000,129,576 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys
[2012.09.24 09:58:11 | 000,027,800 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2012.09.13 15:52:59 | 000,099,248 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys
 
========== Files Created - No Company Name ==========
 
[2012.10.08 17:31:27 | 000,000,017 | ---- | C] () -- C:\Users\ImperatorZwiebel\AppData\Roaming\mbam.context.scan
[2012.10.06 15:11:13 | 000,072,822 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf
[2012.10.06 15:11:10 | 000,072,822 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf
[2012.10.06 11:11:38 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012.10.06 11:11:38 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012.10.06 11:11:38 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012.10.06 11:11:38 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012.10.06 11:11:38 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012.10.06 10:45:21 | 000,000,670 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader.lnk
[2012.10.06 10:45:21 | 000,000,630 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader Deinstallationsprogramm.lnk
[2012.10.06 10:45:21 | 000,000,615 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader Update.lnk
[2012.10.06 00:50:40 | 000,016,366 | ---- | C] () -- C:\Windows\SysNative\nvinfo.pb
[2012.10.06 00:39:01 | 000,002,255 | ---- | C] () -- C:\Users\ImperatorZwiebel\Desktop\Google Chrome.lnk
[2012.10.06 00:38:20 | 000,001,130 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.10.06 00:38:19 | 000,001,126 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.10.06 00:25:38 | 000,001,413 | ---- | C] () -- C:\Users\ImperatorZwiebel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
[2012.10.06 00:25:34 | 000,001,447 | ---- | C] () -- C:\Users\ImperatorZwiebel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2012.10.06 00:06:19 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2012.10.06 00:06:18 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2012.10.06 00:04:14 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2012.10.06 00:01:22 | 3214,233,600 | -HS- | C] () -- C:\hiberfil.sys
[2012.08.30 10:40:14 | 000,429,416 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2011.03.31 08:59:24 | 000,002,169 | ---- | C] () -- C:\Windows\XENcfg.ini
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2012.10.06 17:42:59 | 000,000,000 | ---D | M] -- C:\Users\ImperatorZwiebel\AppData\Roaming\LolClient
[2012.10.06 11:04:59 | 000,000,000 | ---D | M] -- C:\Users\ImperatorZwiebel\AppData\Roaming\Tunngle
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %SYSTEMDRIVE%\*. >
[2012.10.06 15:26:29 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN
[2009.07.14 07:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2012.03.11 20:49:34 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2009.09.11 08:50:19 | 000,000,000 | ---D | M] -- C:\Intel
[2009.09.11 09:41:07 | 000,000,000 | R--D | M] -- C:\MSOCache
[2012.10.06 00:48:58 | 000,000,000 | ---D | M] -- C:\NVIDIA
[2009.07.14 05:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2012.10.06 12:04:09 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.10.08 16:00:08 | 000,000,000 | R--D | M] -- C:\Program Files (x86)
[2012.10.07 21:36:16 | 000,000,000 | ---D | M] -- C:\ProgramData
[2012.03.11 20:49:34 | 000,000,000 | -HSD | M] -- C:\Programme
[2012.10.06 12:33:16 | 000,000,000 | ---D | M] -- C:\Qoobox
[2012.10.06 00:25:00 | 000,000,000 | ---D | M] -- C:\Recovery
[2012.10.06 16:24:55 | 000,000,000 | ---D | M] -- C:\Spiele
[2012.10.08 15:28:45 | 000,000,000 | ---D | M] -- C:\Steam
[2012.10.08 18:06:58 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2012.10.06 00:51:48 | 000,000,000 | ---D | M] -- C:\temp
[2012.10.06 00:53:12 | 000,000,000 | R--D | M] -- C:\Users
[2012.10.06 16:53:24 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
< %windir%\installer\*. /5 >
[2012.10.07 22:27:59 | 000,000,000 | -HSD | M] -- C:\Windows\installer\$PatchCache$
[2012.10.06 10:58:17 | 000,000,000 | ---D | M] -- C:\Windows\installer\{048298C9-A4D3-490B-9FF9-AB023A9238F3}
[2012.10.06 00:53:28 | 000,000,000 | ---D | M] -- C:\Windows\installer\{2FDD750F-49B7-40C1-9D5E-D2955BC0E2D8}
 
< %localappdata%\*. /5 >
[2012.10.06 00:25:10 | 000,000,000 | -HSD | M] -- C:\Users\ImperatorZwiebel\AppData\Local\Anwendungsdaten
[2012.10.06 00:38:03 | 000,000,000 | ---D | M] -- C:\Users\ImperatorZwiebel\AppData\Local\Apps
[2012.10.06 00:38:15 | 000,000,000 | ---D | M] -- C:\Users\ImperatorZwiebel\AppData\Local\Deployment
[2012.10.06 00:37:01 | 000,000,000 | ---D | M] -- C:\Users\ImperatorZwiebel\AppData\Local\ElevatedDiagnostics
[2012.10.06 00:39:01 | 000,000,000 | ---D | M] -- C:\Users\ImperatorZwiebel\AppData\Local\Google
[2012.10.06 00:41:39 | 000,000,000 | ---D | M] -- C:\Users\ImperatorZwiebel\AppData\Local\Microsoft
[2012.10.07 21:47:09 | 000,000,000 | ---D | M] -- C:\Users\ImperatorZwiebel\AppData\Local\PMB Files
[2012.10.08 18:06:11 | 000,000,000 | ---D | M] -- C:\Users\ImperatorZwiebel\AppData\Local\Temp
[2012.10.06 00:25:10 | 000,000,000 | -HSD | M] -- C:\Users\ImperatorZwiebel\AppData\Local\Temporary Internet Files
[2012.10.06 00:25:10 | 000,000,000 | -HSD | M] -- C:\Users\ImperatorZwiebel\AppData\Local\Verlauf
[2012.10.06 00:25:23 | 000,000,000 | ---D | M] -- C:\Users\ImperatorZwiebel\AppData\Local\VirtualStore

< End of report >

--- --- ---

schrauber · 08.10.2012, 17:54

Noch Probleme mit dem System?

Onion99 · 08.10.2012, 18:29

C:\$RECYCLE.BIN

das werde ich noch löschen aber sonst ist alles sauber

Vielen Dank für die Hilfe

schrauber · 08.10.2012, 18:34

Was hat Dir denn der Papierkorb getan?

Der is nach nem Reboot wieder da.

Windows-Taste+R > Combofix /Uninstall > Enter

OTL öffnen > Button Bereinigung drücken

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Onion99 · 08.10.2012, 19:02

So alles gemacht was du geschrieben hast

alle sachen installiert

Großen dank an dich

hab eig jetzt keine fragen mehr

schrauber · 08.10.2012, 19:11

Gern Geschehen

08.10.2012, 15:53	#16
schrauber /// the machine /// TB-Ausbilder	Virus Befall: e621ca05 Sieht so aus als dürftest du alle Deine externen Platten/Sticks und Co formatieren Dann ein frisches OTL logfile bitte. __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

08.10.2012, 16:03	#18
schrauber /// the machine /// TB-Ausbilder	Virus Befall: e621ca05 Handy sollte kein Problem sein, aber alles andere Externe. __________________ __________________

08.10.2012, 16:25	#20
schrauber /// the machine /// TB-Ausbilder	Virus Befall: e621ca05 Dann lass das mal weg. __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

08.10.2012, 17:00	#22
schrauber /// the machine /// TB-Ausbilder	Virus Befall: e621ca05 Ich denk der war oben schon fertig als du die Funde auf K: gepostet hast? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

08.10.2012, 17:03	#24
schrauber /// the machine /// TB-Ausbilder	Virus Befall: e621ca05 Achso, dann bitte ein neues OTL logfile. __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Virus Befall: e621ca05

Log-Analyse und Auswertung: Virus Befall: e621ca05