Trojaner-Board
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Virus Befall: e621ca05 (https://www.trojaner-board.de/124930-virus-befall-e621ca05.html)

schrauber 08.10.2012 15:53
Sieht so aus als dürftest du alle Deine externen Platten/Sticks und Co formatieren :)

Dann ein frisches OTL logfile bitte.

Onion99 08.10.2012 16:02
eine frage als ich den virus drauf hatte hab ich auch einmal mein handy dran gehabt sollte ich das auch noch formatieren oder kann ich alles so lassen ?

schrauber 08.10.2012 16:03
Handy sollte kein Problem sein, aber alles andere Externe.

Onion99 08.10.2012 16:05
Bei J:
kommt nur ein fehler :Windows konnte die Formatierung nicht abschließen
dort sind folgende ordner:
$RECYCLE.BIN
Boot

schrauber 08.10.2012 16:25
Dann lass das mal weg.

Onion99 08.10.2012 16:49
ESET onlinescanner ist fertig und hat nichts mehr gefunden

schrauber 08.10.2012 17:00
Ich denk der war oben schon fertig als du die Funde auf K: gepostet hast?

Onion99 08.10.2012 17:03
ich hab wie du gesagt hast die externen formatiert und ihn dann nochmal laufen lassen

schrauber 08.10.2012 17:03
Achso, dann bitte ein neues OTL logfile.

Onion99 08.10.2012 17:11
OTL Logfile:
Code:
OTL logfile created on: 08.10.2012 18:05:48 - Run 2
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\ImperatorZwiebel\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,99 Gb Total Physical Memory | 2,41 Gb Available Physical Memory | 60,43% Memory free
7,98 Gb Paging File | 5,85 Gb Available in Paging File | 73,29% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 905,41 Gb Total Space | 863,00 Gb Free Space | 95,32% Space Free | Partition Type: NTFS
Drive D: | 25,00 Gb Total Space | 24,91 Gb Free Space | 99,65% Space Free | Partition Type: NTFS
Drive I: | 186,31 Gb Total Space | 186,21 Gb Free Space | 99,95% Space Free | Partition Type: NTFS
Drive J: | 100,00 Mb Total Space | 71,20 Mb Free Space | 71,20% Space Free | Partition Type: NTFS
Drive K: | 1397,26 Gb Total Space | 1397,13 Gb Free Space | 99,99% Space Free | Partition Type: NTFS
 
Computer Name: PAUL-COMPUTER | User Name: ImperatorZwiebel | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - File not found --
PRC - [2012.10.07 11:03:51 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\ImperatorZwiebel\Desktop\OTL.exe
PRC - [2012.10.06 10:58:56 | 000,529,744 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe
PRC - [2012.10.06 10:58:38 | 001,353,080 | ---- | M] (Valve Corporation) -- C:\Steam\Steam.exe
PRC - [2012.09.25 11:43:01 | 001,239,064 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
PRC - [2012.08.30 21:14:00 | 001,258,856 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2012.08.30 10:40:00 | 000,382,312 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.10.06 10:58:56 | 001,099,616 | ---- | M] () -- C:\Steam\bin\avcodec-53.dll
MOD - [2012.10.06 10:58:56 | 000,190,816 | ---- | M] () -- C:\Steam\bin\avformat-53.dll
MOD - [2012.10.06 10:58:56 | 000,123,232 | ---- | M] () -- C:\Steam\bin\avutil-51.dll
MOD - [2012.09.25 11:42:58 | 000,460,312 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.79\ppGoogleNaClPluginChrome.dll
MOD - [2012.09.25 11:42:57 | 012,278,808 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.79\PepperFlash\pepflashplayer.dll
MOD - [2012.09.25 11:42:55 | 004,005,912 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.79\pdf.dll
MOD - [2012.09.25 11:41:39 | 000,578,072 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.79\libglesv2.dll
MOD - [2012.09.25 11:41:38 | 000,123,416 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.79\libegl.dll
MOD - [2012.09.25 11:41:27 | 000,156,712 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.79\avutil-51.dll
MOD - [2012.09.25 11:41:26 | 000,275,496 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.79\avformat-54.dll
MOD - [2012.09.25 11:41:24 | 002,168,360 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.79\avcodec-54.dll
 
 
========== Services (SafeList) ==========
 
SRV - [2012.10.06 10:58:56 | 000,529,744 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.08.30 21:14:00 | 001,258,856 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012.08.30 10:40:00 | 000,382,312 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.10.01 17:14:23 | 000,129,576 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.09.24 09:58:11 | 000,027,800 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2012.09.13 15:52:59 | 000,099,248 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.06.10 06:34:52 | 000,539,240 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010.11.15 01:26:34 | 000,012,416 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\trustms.sys -- (trustms)
DRV:64bit: - [2010.04.07 12:14:50 | 000,446,304 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\netr6164.sys -- (rt61x64)
DRV:64bit: - [2009.09.16 08:02:42 | 000,031,232 | ---- | M] (Tunngle.net) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tap0901t.sys -- (tap0901t)
DRV:64bit: - [2009.07.31 03:40:32 | 000,025,600 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\XENfiltv.sys -- (XENfiltv)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: I:\Java 64bit\bin\plugin2\npjp2.dll File not found
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
 
 
========== Chrome  ==========
 
CHR - homepage:
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage:
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.79\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.79\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.79\pdf.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - Extension: YouTube = C:\Users\ImperatorZwiebel\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\ImperatorZwiebel\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Stylish = C:\Users\ImperatorZwiebel\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe\0.10_0\
CHR - Extension: AdBlock = C:\Users\ImperatorZwiebel\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.45_0\
CHR - Extension: Night Time In New York City = C:\Users\ImperatorZwiebel\AppData\Local\Google\Chrome\User Data\Default\Extensions\jnimonidkipnhnpgkhgliocfnnpgkhek\1.2_0\
CHR - Extension: YouTube = C:\Users\ImperatorZwiebel\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\ImperatorZwiebel\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Stylish = C:\Users\ImperatorZwiebel\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe\0.10_0\
CHR - Extension: AdBlock = C:\Users\ImperatorZwiebel\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.45_0\
CHR - Extension: Night Time In New York City = C:\Users\ImperatorZwiebel\AppData\Local\Google\Chrome\User Data\Default\Extensions\jnimonidkipnhnpgkhgliocfnnpgkhek\1.2_0\
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - I:\Java 64bit\bin\ssv.dll File not found
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - I:\Java 64bit\bin\jp2ssv.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] "I:\Avira\Avira\AntiVir Desktop\avgnt.exe" /min File not found
O4 - HKCU..\Run: [Steam] C:\Steam\Steam.exe (Valve Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D7FFE5B6-7D0F-4FF0-A2FA-36DAE669EAA8}: DhcpNameServer = 192.168.178.1
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
 
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
File not found -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Neue Funktion 1
[2012.10.08 16:00:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.10.08 15:59:30 | 002,322,184 | ---- | C] (ESET) -- C:\Users\ImperatorZwiebel\Desktop\esetsmartinstaller_enu.exe
[2012.10.07 21:36:26 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Roaming\Malwarebytes
[2012.10.07 21:36:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.10.07 21:36:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.10.07 21:36:14 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.10.07 19:42:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
[2012.10.07 11:03:43 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\ImperatorZwiebel\Desktop\OTL.exe
[2012.10.06 17:42:59 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Roaming\LolClient
[2012.10.06 17:07:19 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\InstallShield Installation Information
[2012.10.06 16:24:24 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Local\PMB Files
[2012.10.06 16:24:23 | 000,000,000 | ---D | C] -- C:\ProgramData\PMB Files
[2012.10.06 16:24:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Pando Networks
[2012.10.06 16:11:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET
[2012.10.06 15:26:29 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012.10.06 15:04:26 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Roaming\Macromedia
[2012.10.06 15:04:25 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Roaming\Adobe
[2012.10.06 12:33:16 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012.10.06 12:28:41 | 004,762,471 | R--- | C] (Swearware) -- C:\Users\ImperatorZwiebel\Desktop\ComboFix.exe
[2012.10.06 12:10:42 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012.10.06 12:10:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012.10.06 12:04:11 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Roaming\WinRAR
[2012.10.06 12:04:09 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2012.10.06 11:40:05 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Macromed
[2012.10.06 11:40:05 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
[2012.10.06 11:39:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe
[2012.10.06 11:11:38 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012.10.06 11:11:38 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012.10.06 11:11:38 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012.10.06 11:11:34 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012.10.06 11:11:26 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2012.10.06 11:04:36 | 000,031,232 | ---- | C] (Tunngle.net) -- C:\Windows\SysNative\drivers\tap0901t.sys
[2012.10.06 11:04:36 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Tunngle
[2012.10.06 11:04:36 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\Documents\Tunngle
[2012.10.06 11:04:36 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Roaming\Tunngle
[2012.10.06 11:04:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Tunngle
[2012.10.06 11:04:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tunngle
[2012.10.06 10:58:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
[2012.10.06 10:58:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Steam
[2012.10.06 10:57:34 | 000,000,000 | ---D | C] -- C:\Spiele
[2012.10.06 10:57:29 | 000,000,000 | ---D | C] -- C:\Steam
[2012.10.06 10:44:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SweetIM
[2012.10.06 10:37:02 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Roaming\Skype
[2012.10.06 10:36:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype
[2012.10.06 01:00:34 | 000,000,000 | ---D | C] -- C:\Windows\Panther
[2012.10.06 00:56:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
[2012.10.06 00:52:46 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA
[2012.10.06 00:52:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NVIDIA Corporation
[2012.10.06 00:51:48 | 000,060,776 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll
[2012.10.06 00:51:48 | 000,052,584 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll
[2012.10.06 00:51:48 | 000,000,000 | ---D | C] -- C:\temp
[2012.10.06 00:51:35 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation
[2012.10.06 00:50:25 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Roaming\Avira
[2012.10.06 00:49:22 | 000,000,000 | ---D | C] -- C:\Program Files\NVIDIA Corporation
[2012.10.06 00:48:58 | 000,000,000 | ---D | C] -- C:\NVIDIA
[2012.10.06 00:44:52 | 000,129,576 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys
[2012.10.06 00:44:52 | 000,099,248 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2012.10.06 00:44:52 | 000,027,800 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2012.10.06 00:44:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2012.10.06 00:38:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2012.10.06 00:38:21 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2012.10.06 00:38:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google
[2012.10.06 00:38:15 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Local\Google
[2012.10.06 00:38:03 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Local\Apps
[2012.10.06 00:38:02 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Local\Deployment
[2012.10.06 00:37:01 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Local\ElevatedDiagnostics
[2012.10.06 00:34:53 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\Desktop\Games
[2012.10.06 00:34:45 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\Desktop\Programme
[2012.10.06 00:26:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\EPSON
[2012.10.06 00:25:33 | 000,000,000 | R--D | C] -- C:\Users\ImperatorZwiebel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2012.10.06 00:25:33 | 000,000,000 | R--D | C] -- C:\Users\ImperatorZwiebel\Searches
[2012.10.06 00:25:33 | 000,000,000 | R--D | C] -- C:\Users\ImperatorZwiebel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2012.10.06 00:25:27 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Roaming\Identities
[2012.10.06 00:25:25 | 000,000,000 | R--D | C] -- C:\Users\ImperatorZwiebel\Contacts
[2012.10.06 00:25:23 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Local\VirtualStore
[2012.10.06 00:25:10 | 000,000,000 | --SD | C] -- C:\Users\ImperatorZwiebel\AppData\Roaming\Microsoft
[2012.10.06 00:25:10 | 000,000,000 | R--D | C] -- C:\Users\ImperatorZwiebel\Videos
[2012.10.06 00:25:10 | 000,000,000 | R--D | C] -- C:\Users\ImperatorZwiebel\Saved Games
[2012.10.06 00:25:10 | 000,000,000 | R--D | C] -- C:\Users\ImperatorZwiebel\Pictures
[2012.10.06 00:25:10 | 000,000,000 | R--D | C] -- C:\Users\ImperatorZwiebel\Music
[2012.10.06 00:25:10 | 000,000,000 | R--D | C] -- C:\Users\ImperatorZwiebel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2012.10.06 00:25:10 | 000,000,000 | R--D | C] -- C:\Users\ImperatorZwiebel\Links
[2012.10.06 00:25:10 | 000,000,000 | R--D | C] -- C:\Users\ImperatorZwiebel\Favorites
[2012.10.06 00:25:10 | 000,000,000 | R--D | C] -- C:\Users\ImperatorZwiebel\Downloads
[2012.10.06 00:25:10 | 000,000,000 | R--D | C] -- C:\Users\ImperatorZwiebel\Documents
[2012.10.06 00:25:10 | 000,000,000 | R--D | C] -- C:\Users\ImperatorZwiebel\Desktop
[2012.10.06 00:25:10 | 000,000,000 | R--D | C] -- C:\Users\ImperatorZwiebel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2012.10.06 00:25:10 | 000,000,000 | -HSD | C] -- C:\Users\ImperatorZwiebel\Vorlagen
[2012.10.06 00:25:10 | 000,000,000 | -HSD | C] -- C:\Users\ImperatorZwiebel\AppData\Local\Verlauf
[2012.10.06 00:25:10 | 000,000,000 | -HSD | C] -- C:\Users\ImperatorZwiebel\AppData\Local\Temporary Internet Files
[2012.10.06 00:25:10 | 000,000,000 | -HSD | C] -- C:\Users\ImperatorZwiebel\Startmenü
[2012.10.06 00:25:10 | 000,000,000 | -HSD | C] -- C:\Users\ImperatorZwiebel\SendTo
[2012.10.06 00:25:10 | 000,000,000 | -HSD | C] -- C:\Users\ImperatorZwiebel\Recent
[2012.10.06 00:25:10 | 000,000,000 | -HSD | C] -- C:\Users\ImperatorZwiebel\Netzwerkumgebung
[2012.10.06 00:25:10 | 000,000,000 | -HSD | C] -- C:\Users\ImperatorZwiebel\Lokale Einstellungen
[2012.10.06 00:25:10 | 000,000,000 | -HSD | C] -- C:\Users\ImperatorZwiebel\Documents\Eigene Videos
[2012.10.06 00:25:10 | 000,000,000 | -HSD | C] -- C:\Users\ImperatorZwiebel\Documents\Eigene Musik
[2012.10.06 00:25:10 | 000,000,000 | -HSD | C] -- C:\Users\ImperatorZwiebel\Eigene Dateien
[2012.10.06 00:25:10 | 000,000,000 | -HSD | C] -- C:\Users\ImperatorZwiebel\Documents\Eigene Bilder
[2012.10.06 00:25:10 | 000,000,000 | -HSD | C] -- C:\Users\ImperatorZwiebel\Druckumgebung
[2012.10.06 00:25:10 | 000,000,000 | -HSD | C] -- C:\Users\ImperatorZwiebel\Cookies
[2012.10.06 00:25:10 | 000,000,000 | -HSD | C] -- C:\Users\ImperatorZwiebel\AppData\Local\Anwendungsdaten
[2012.10.06 00:25:10 | 000,000,000 | -HSD | C] -- C:\Users\ImperatorZwiebel\Anwendungsdaten
[2012.10.06 00:25:10 | 000,000,000 | -H-D | C] -- C:\Users\ImperatorZwiebel\AppData
[2012.10.06 00:25:10 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Local\Temp
[2012.10.06 00:25:10 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Local\Microsoft
[2012.10.06 00:25:10 | 000,000,000 | ---D | C] -- C:\Users\ImperatorZwiebel\AppData\Roaming\Media Center Programs
[2012.10.06 00:24:59 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen
[2012.10.06 00:24:59 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü
[2012.10.06 00:24:59 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien
[2012.10.06 00:24:59 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten
[2012.10.06 00:24:59 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos
[2012.10.06 00:24:59 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik
[2012.10.06 00:24:59 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder
[2012.10.06 00:24:59 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente
[2012.10.06 00:24:59 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten
[2012.10.06 00:04:21 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2012.10.06 00:02:12 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch
 
========== Files - Modified Within 30 Days ==========
 
[2012.10.08 17:48:03 | 000,001,130 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.10.08 17:46:32 | 000,000,017 | ---- | M] () -- C:\Users\ImperatorZwiebel\AppData\Roaming\mbam.context.scan
[2012.10.08 17:25:10 | 000,019,264 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.10.08 17:25:10 | 000,019,264 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.10.08 15:59:36 | 002,322,184 | ---- | M] (ESET) -- C:\Users\ImperatorZwiebel\Desktop\esetsmartinstaller_enu.exe
[2012.10.08 15:27:04 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.10.08 15:27:04 | 000,653,928 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.10.08 15:27:04 | 000,615,810 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.10.08 15:27:04 | 000,129,800 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.10.08 15:27:04 | 000,106,190 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.10.08 15:23:00 | 000,001,126 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.10.08 15:22:54 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.10.08 15:22:36 | 3214,233,600 | -HS- | M] () -- C:\hiberfil.sys
[2012.10.07 11:03:51 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\ImperatorZwiebel\Desktop\OTL.exe
[2012.10.06 16:01:25 | 000,266,992 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.10.06 15:11:13 | 000,072,822 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf
[2012.10.06 15:11:10 | 000,072,822 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf
[2012.10.06 12:28:53 | 004,762,471 | R--- | M] (Swearware) -- C:\Users\ImperatorZwiebel\Desktop\ComboFix.exe
[2012.10.06 00:39:01 | 000,002,255 | ---- | M] () -- C:\Users\ImperatorZwiebel\Desktop\Google Chrome.lnk
[2012.10.06 00:06:39 | 000,207,887 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
[2012.10.06 00:06:39 | 000,207,887 | ---- | M] () -- C:\Windows\SysNative\license.rtf
[2012.10.06 00:04:14 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2012.10.01 17:14:23 | 000,129,576 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys
[2012.09.24 09:58:11 | 000,027,800 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2012.09.13 15:52:59 | 000,099,248 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys
 
========== Files Created - No Company Name ==========
 
[2012.10.08 17:31:27 | 000,000,017 | ---- | C] () -- C:\Users\ImperatorZwiebel\AppData\Roaming\mbam.context.scan
[2012.10.06 15:11:13 | 000,072,822 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf
[2012.10.06 15:11:10 | 000,072,822 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf
[2012.10.06 11:11:38 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012.10.06 11:11:38 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012.10.06 11:11:38 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012.10.06 11:11:38 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012.10.06 11:11:38 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012.10.06 10:45:21 | 000,000,670 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader.lnk
[2012.10.06 10:45:21 | 000,000,630 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader Deinstallationsprogramm.lnk
[2012.10.06 10:45:21 | 000,000,615 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader Update.lnk
[2012.10.06 00:50:40 | 000,016,366 | ---- | C] () -- C:\Windows\SysNative\nvinfo.pb
[2012.10.06 00:39:01 | 000,002,255 | ---- | C] () -- C:\Users\ImperatorZwiebel\Desktop\Google Chrome.lnk
[2012.10.06 00:38:20 | 000,001,130 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.10.06 00:38:19 | 000,001,126 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.10.06 00:25:38 | 000,001,413 | ---- | C] () -- C:\Users\ImperatorZwiebel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
[2012.10.06 00:25:34 | 000,001,447 | ---- | C] () -- C:\Users\ImperatorZwiebel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2012.10.06 00:06:19 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2012.10.06 00:06:18 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2012.10.06 00:04:14 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2012.10.06 00:01:22 | 3214,233,600 | -HS- | C] () -- C:\hiberfil.sys
[2012.08.30 10:40:14 | 000,429,416 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2011.03.31 08:59:24 | 000,002,169 | ---- | C] () -- C:\Windows\XENcfg.ini
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2012.10.06 17:42:59 | 000,000,000 | ---D | M] -- C:\Users\ImperatorZwiebel\AppData\Roaming\LolClient
[2012.10.06 11:04:59 | 000,000,000 | ---D | M] -- C:\Users\ImperatorZwiebel\AppData\Roaming\Tunngle
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %SYSTEMDRIVE%\*. >
[2012.10.06 15:26:29 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN
[2009.07.14 07:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2012.03.11 20:49:34 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2009.09.11 08:50:19 | 000,000,000 | ---D | M] -- C:\Intel
[2009.09.11 09:41:07 | 000,000,000 | R--D | M] -- C:\MSOCache
[2012.10.06 00:48:58 | 000,000,000 | ---D | M] -- C:\NVIDIA
[2009.07.14 05:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2012.10.06 12:04:09 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.10.08 16:00:08 | 000,000,000 | R--D | M] -- C:\Program Files (x86)
[2012.10.07 21:36:16 | 000,000,000 | ---D | M] -- C:\ProgramData
[2012.03.11 20:49:34 | 000,000,000 | -HSD | M] -- C:\Programme
[2012.10.06 12:33:16 | 000,000,000 | ---D | M] -- C:\Qoobox
[2012.10.06 00:25:00 | 000,000,000 | ---D | M] -- C:\Recovery
[2012.10.06 16:24:55 | 000,000,000 | ---D | M] -- C:\Spiele
[2012.10.08 15:28:45 | 000,000,000 | ---D | M] -- C:\Steam
[2012.10.08 18:06:58 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2012.10.06 00:51:48 | 000,000,000 | ---D | M] -- C:\temp
[2012.10.06 00:53:12 | 000,000,000 | R--D | M] -- C:\Users
[2012.10.06 16:53:24 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
< %windir%\installer\*. /5 >
[2012.10.07 22:27:59 | 000,000,000 | -HSD | M] -- C:\Windows\installer\$PatchCache$
[2012.10.06 10:58:17 | 000,000,000 | ---D | M] -- C:\Windows\installer\{048298C9-A4D3-490B-9FF9-AB023A9238F3}
[2012.10.06 00:53:28 | 000,000,000 | ---D | M] -- C:\Windows\installer\{2FDD750F-49B7-40C1-9D5E-D2955BC0E2D8}
 
< %localappdata%\*. /5 >
[2012.10.06 00:25:10 | 000,000,000 | -HSD | M] -- C:\Users\ImperatorZwiebel\AppData\Local\Anwendungsdaten
[2012.10.06 00:38:03 | 000,000,000 | ---D | M] -- C:\Users\ImperatorZwiebel\AppData\Local\Apps
[2012.10.06 00:38:15 | 000,000,000 | ---D | M] -- C:\Users\ImperatorZwiebel\AppData\Local\Deployment
[2012.10.06 00:37:01 | 000,000,000 | ---D | M] -- C:\Users\ImperatorZwiebel\AppData\Local\ElevatedDiagnostics
[2012.10.06 00:39:01 | 000,000,000 | ---D | M] -- C:\Users\ImperatorZwiebel\AppData\Local\Google
[2012.10.06 00:41:39 | 000,000,000 | ---D | M] -- C:\Users\ImperatorZwiebel\AppData\Local\Microsoft
[2012.10.07 21:47:09 | 000,000,000 | ---D | M] -- C:\Users\ImperatorZwiebel\AppData\Local\PMB Files
[2012.10.08 18:06:11 | 000,000,000 | ---D | M] -- C:\Users\ImperatorZwiebel\AppData\Local\Temp
[2012.10.06 00:25:10 | 000,000,000 | -HSD | M] -- C:\Users\ImperatorZwiebel\AppData\Local\Temporary Internet Files
[2012.10.06 00:25:10 | 000,000,000 | -HSD | M] -- C:\Users\ImperatorZwiebel\AppData\Local\Verlauf
[2012.10.06 00:25:23 | 000,000,000 | ---D | M] -- C:\Users\ImperatorZwiebel\AppData\Local\VirtualStore

< End of report >
--- --- ---

schrauber 08.10.2012 17:54
Noch Probleme mit dem System?

Onion99 08.10.2012 18:29
C:\$RECYCLE.BIN

das werde ich noch löschen aber sonst ist alles sauber :)

Vielen Dank für die Hilfe :)

schrauber 08.10.2012 18:34
Was hat Dir denn der Papierkorb getan? ;)

Der is nach nem Reboot wieder da.

Windows-Taste+R > Combofix /Uninstall > Enter

OTL öffnen > Button Bereinigung drücken



Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Onion99 08.10.2012 19:02
So alles gemacht was du geschrieben hast :) alle sachen installiert ;)


Großen dank an dich :)

hab eig jetzt keine fragen mehr :)

schrauber 08.10.2012 19:11
Gern Geschehen :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 00:45 Uhr.
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131