Trajaner Remover zeigte 2 Infektionen an
----------
Checks for rogue DNS NameServers completed
----------
Checking for specific malicious files:
C:\Users\Netz\AppData\Roaming\appconf32.exe - Trojan.Spy.Banker
C:\Users\Netz\AppData\Roaming\appconf32.exe
51152 bytes
Created: 09.12.2008 17:23
Modified: 09.12.2008 17:23
Company: [no info]
C:\Users\Netz\AppData\Roaming\appconf32.exe - process is either not running or could not be terminated
C:\Users\Netz\AppData\Roaming\appconf32.exe - MoveFileEx call failed
C:\Users\Netz\AppData\Roaming\appconf32.exe - marked for renaming when the PC is restarted
----------
Additional checks completed

************************************************************
11:33:18: Scanning ----- RUNNING PROCESSES -----

C:\Windows\system32\taskeng.exe
171520 bytes
Created: 02.06.2012 20:55
Modified: 04.11.2010 18:34
Company: Microsoft Corporation
C:\Users\Netz\AppData\Roaming\BAcroIEHelpe172.dll appears to contain: ROOTKIT.AGENT
C:\Users\Netz\AppData\Roaming\BAcroIEHelpe172.dll - MoveFileEx call failed (in ForceRename)
C:\Users\Netz\AppData\Roaming\BAcroIEHelpe172.dll - file renamed to: C:\Users\Netz\AppData\Roaming\BAcroIEHelpe172.dll.vir
[81 loaded modules in total]

die er auch als behoben meldet bin mir aber nicht sicher ob auch wirklich alles sauber ist
habe OTL durchlaufen lassen und hier sind die logs vielleicht kann sich das mal einer ansehen im Voraus schon mal danke
OTL
OTL logfile created on: 22.07.2012 12:21:26 - Run 1
OTL by OldTimer - Version 3.2.54.0 Folder = C:\Users\Netz\Desktop
Windows Vista Ultimate Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

765,94 Mb Total Physical Memory | 82,14 Mb Available Physical Memory | 10,72% Memory free
1,75 Gb Paging File | 0,96 Gb Available in Paging File | 54,99% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 69,88 Gb Total Space | 31,45 Gb Free Space | 45,01% Space Free | Partition Type: NTFS
Drive E: | 1,91 Gb Total Space | 0,61 Gb Free Space | 32,14% Space Free | Partition Type: FAT

Computer Name: *****| User Name: **** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Netz\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_3_300_265.exe (Adobe Systems, Inc.)
PRC - C:\Programme\Trojan Remover\Rmvtrjan.exe (Simply Super Software)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Users\Netz\AppData\Local\Temp\RtkBtMnt.exe (Realtek Semiconductor Corp.)
PRC - C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Programme\Microsoft Security Client\msseces.exe (Microsoft Corporation)
PRC - c:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conime.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)


========== Modules (No Company Name) ==========

MOD - C:\Users\Netz\AppData\Roaming\13001.028\components\AcroFF028.dll ()
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32_11_3_300_265.dll ()
MOD - C:\Programme\Mozilla Firefox\mozjs.dll ()
MOD - C:\Windows\System32\ztvunrar36.dll ()


========== Win32 Services (SafeList) ==========

SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeARMservice) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (NisSrv) -- c:\Programme\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)
SRV - (MsMpSvc) -- c:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found
DRV - (NisDrv) -- C:\Windows\System32\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvm60x32.sys (NVIDIA Corporation)
DRV - (nvsmu) -- C:\Windows\System32\drivers\nvsmu.sys (NVIDIA Corporation)
DRV - (tifm21) -- C:\Windows\System32\drivers\tifm21.sys (Texas Instruments)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/?affID=110819&babsrc=HP_ss&mntrId=acaf21ee00000000000000197e5718a5
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C9 25 72 1F 07 40 CD 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=110819&babsrc=SP_ss&mntrId=acaf21ee00000000000000197e5718a5
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "about:home"
FF - prefs.js..keyword.URL: "hxxp://search.babylon.com/?affID=110819&babsrc=KW_ss&mntrId=acaf21ee00000000000000197e5718a5&q="


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_265.dll ()
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.4.1: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.4.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.06.07 10:12:52 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.07.09 14:48:16 | 000,000,000 | ---D | M]

[2012.06.01 17:40:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Danny\AppData\Roaming\mozilla\Extensions
[2012.07.22 11:19:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Danny\AppData\Roaming\mozilla\Firefox\Profiles\p792o8to.default\extensions
[2012.06.01 17:51:43 | 000,000,000 | ---D | M] (Fire.fm) -- C:\Users\Danny\AppData\Roaming\mozilla\Firefox\Profiles\p792o8to.default\extensions\{6F0976E6-26F3-4AFE-BBEC-9E99E27E4DF3}
[2012.07.16 20:26:17 | 000,000,000 | ---D | M] ("I Want This") -- C:\Users\Danny\AppData\Roaming\mozilla\Firefox\Profiles\p792o8to.default\extensions\crossriderapp2258@crossrider.com
[2012.06.01 17:41:58 | 000,000,000 | ---D | M] (German Dictionary) -- C:\Users\Danny\AppData\Roaming\mozilla\Firefox\Profiles\p792o8to.default\extensions\de-DE@dictionaries.addons.mozilla.org
[2012.06.01 17:43:33 | 000,000,000 | ---D | M] (Dictionary Switcher) -- C:\Users\Danny\AppData\Roaming\mozilla\Firefox\Profiles\p792o8to.default\extensions\dictionary-switcher@design-noir.de
[2012.07.22 11:19:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Danny\AppData\Roaming\mozilla\Firefox\Profiles\p792o8to.default\extensions\staged
[2012.06.01 17:37:25 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.06.01 17:41:58 | 000,061,219 | ---- | M] () (No name found) -- C:\USERS\DANNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P792O8TO.DEFAULT\EXTENSIONS\{9AA46F4F-4DC7-4C06-97AF-5035170634FE}.XPI
[2012.06.01 17:51:43 | 000,438,080 | ---- | M] () (No name found) -- C:\USERS\DANNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P792O8TO.DEFAULT\EXTENSIONS\STEFANVANDAMME@STEFANVD.NET.XPI
[2012.06.07 10:12:51 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.01.23 11:50:38 | 000,170,080 | ---- | M] (Tracker Software Products (Canada) Ltd.) -- C:\Program Files\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll
[2012.04.21 03:54:08 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.01 17:55:06 | 000,002,313 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2012.04.21 03:54:08 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.04.21 03:54:08 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.04.21 03:54:08 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.04.21 03:54:08 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.04.21 03:54:08 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (I Want This) - {11111111-1111-1111-1111-110011221158} - C:\Programme\I Want This\I Want This.dll (215 Apps)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [PDFPrint] C:\Programme\PDF24\pdf24.exe (Geek Software GmbH)
O4 - HKLM..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe (Simply Super Software)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E4361990-05F8-42C5-8B6E-67A21CC7A1E8}: DhcpNameServer = 192.168.178.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img20.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img20.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012.07.22 11:28:31 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2012.07.22 11:23:37 | 000,000,000 | ---D | C] -- C:\Program Files\Trojan Remover
[2012.07.18 18:26:07 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\MCE Logs
[2012.07.16 19:31:17 | 000,000,000 | ---D | C] -- C:\Users\Danny\AppData\Local\Macromedia
[2012.07.15 23:21:46 | 000,000,000 | ---D | C] -- C:\Windows\System32\appmgmt
[2012.07.15 14:54:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24
[2012.07.15 14:54:14 | 000,000,000 | ---D | C] -- C:\Program Files\PDF24
[2012.07.12 18:15:49 | 000,000,000 | ---D | C] -- C:\ProgramData\WindowsSearch
[2012.07.12 18:15:30 | 002,047,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012.07.12 18:12:39 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2012.07.12 18:12:33 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012.07.12 18:12:31 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012.07.12 18:12:24 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012.07.12 18:12:20 | 001,800,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012.07.12 18:12:15 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2012.07.12 18:12:11 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012.07.11 21:30:07 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll
[2012.07.01 14:06:10 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2012.07.01 14:06:10 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2012.07.01 14:04:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe

========== Files - Modified Within 30 Days ==========

[2012.07.22 11:52:09 | 000,003,760 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.22 11:52:09 | 000,003,760 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.22 11:44:20 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.22 11:44:14 | 803,913,728 | -HS- | M] () -- C:\hiberfil.sys
[2012.07.22 11:24:01 | 000,000,936 | ---- | M] () -- C:\Users\Public\Desktop\Trojan Remover.lnk
[2012.07.22 11:15:35 | 000,013,025 | ---- | M] () -- C:\Users\Danny\AppData\Roaming\nvModes.001
[2012.07.22 10:43:29 | 000,620,468 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.07.22 10:43:29 | 000,589,278 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.07.22 10:43:29 | 000,123,830 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.07.22 10:43:29 | 000,102,250 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.07.20 21:17:58 | 000,001,974 | ---- | M] () -- C:\Users\Public\Desktop\Lightroom 4.1.lnk
[2012.07.16 21:42:07 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2012.07.16 21:42:07 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012.07.16 19:29:48 | 000,013,025 | ---- | M] () -- C:\Users\Danny\AppData\Roaming\nvModes.dat
[2012.07.15 14:54:30 | 000,001,653 | ---- | M] () -- C:\Users\Public\Desktop\PDF24 Editor.lnk
[2012.07.15 14:54:30 | 000,001,638 | ---- | M] () -- C:\Users\Public\Desktop\PDF24 Fax.lnk
[2012.07.12 18:23:07 | 000,228,840 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.07.01 14:08:16 | 000,001,892 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk

========== Files Created - No Company Name ==========

[2012.07.22 11:24:01 | 000,000,936 | ---- | C] () -- C:\Users\Public\Desktop\Trojan Remover.lnk
[2012.07.20 21:17:58 | 000,001,974 | ---- | C] () -- C:\Users\Public\Desktop\Lightroom 4.1.lnk
[2012.07.20 21:17:58 | 000,001,974 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop Lightroom 4.1.lnk
[2012.07.15 14:54:30 | 000,001,653 | ---- | C] () -- C:\Users\Public\Desktop\PDF24 Editor.lnk
[2012.07.15 14:54:30 | 000,001,638 | ---- | C] () -- C:\Users\Public\Desktop\PDF24 Fax.lnk
[2012.07.01 14:08:16 | 000,001,892 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2012.07.01 14:08:15 | 000,001,804 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2012.06.11 20:25:08 | 000,178,176 | ---- | C] () -- C:\Windows\System32\ztvunrar39.dll
[2012.06.11 20:25:08 | 000,162,304 | ---- | C] () -- C:\Windows\System32\ztvunrar36.dll
[2012.06.11 20:25:08 | 000,153,088 | ---- | C] () -- C:\Windows\System32\UNRAR3.dll
[2012.06.11 20:25:08 | 000,077,312 | ---- | C] () -- C:\Windows\System32\ztvunace26.dll
[2012.06.11 20:25:08 | 000,075,264 | ---- | C] () -- C:\Windows\System32\unacev2.dll
[2012.06.02 12:01:09 | 000,013,025 | ---- | C] () -- C:\Users\Danny\AppData\Roaming\nvModes.dat
[2012.06.02 12:01:09 | 000,013,025 | ---- | C] () -- C:\Users\Danny\AppData\Roaming\nvModes.001
[2012.06.01 20:41:34 | 000,272,629 | ---- | C] () -- C:\Windows\System32\drivers\RTAIODAT.DAT
[2012.06.01 16:53:50 | 000,000,680 | ---- | C] () -- C:\Users\Danny\AppData\Local\d3d9caps.dat

========== LOP Check ==========

[2012.06.01 17:54:54 | 000,000,000 | ---D | M] -- C:\Users\Danny\AppData\Roaming\Babylon
[2012.06.04 14:35:09 | 000,000,000 | ---D | M] -- C:\Users\Danny\AppData\Roaming\IrfanView
[2012.06.10 12:39:53 | 000,000,000 | ---D | M] -- C:\Users\Danny\AppData\Roaming\pdfforge
[2012.06.11 20:24:50 | 000,000,000 | ---D | M] -- C:\Users\Danny\AppData\Roaming\Simply Super Software
[2012.07.22 11:43:23 | 000,032,560 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 150 bytes -> C:\ProgramData\TEMP:CB0AACC9

< End of report >

Extra
OTL Extras logfile created on: 22.07.2012 12:21:26 - Run 1
OTL by OldTimer - Version 3.2.54.0 Folder = C:\Users\Netz\Desktop
Windows Vista Ultimate Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

765,94 Mb Total Physical Memory | 82,14 Mb Available Physical Memory | 10,72% Memory free
1,75 Gb Paging File | 0,96 Gb Available in Paging File | 54,99% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 69,88 Gb Total Space | 31,45 Gb Free Space | 45,01% Space Free | Partition Type: NTFS
Drive E: | 1,91 Gb Total Space | 0,61 Gb Free Space | 32,14% Space Free | Partition Type: FAT

Computer Name: DANNY-PC | User Name: Danny | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Browse with &IrfanView] -- "C:\Program Files\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0F842B77-56EA-4AAF-8295-81A022350B5E}" = Microsoft Security Client
"{1111706F-666A-4037-7777-210328764D10}" = JavaFX 2.1.0
"{26A24AE4-039D-4CA4-87B4-2F83217004FF}" = Java(TM) 7 Update 4
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros for Acer MyAllm Driver v7.1.0.90 Installation Program
"{3A6F4A31-8CFD-46B4-8385-E1F384DB121E}" = PDF-XChange Viewer
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1" = PDF24 Creator 4.7.0
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{C1575982-F1CA-46DC-A77D-43FF12F2EFC7}" = Adobe Photoshop Lightroom 4.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F7B05784-334C-4F76-8BAB-30ABEB7FD534}" = TIPCI
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"I Want This" = I Want This
"InstallShield_{F7B05784-334C-4F76-8BAB-30ABEB7FD534}" = Texas Instruments PCIxx21/x515/xx12 drivers.
"IrfanView" = IrfanView (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Security Client" = Microsoft Security Essentials
"Mozilla Firefox 13.0 (x86 de)" = Mozilla Firefox 13.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIA Drivers" = NVIDIA Drivers
"Trojan Remover_is1" = Trojan Remover 6.8.4

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"FLV Player" = FLV Player

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 20.07.2012 16:54:15 | Computer Name = Danny-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 20.07.2012 16:57:17 | Computer Name = Danny-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 20.07.2012 16:59:15 | Computer Name = Danny-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 20.07.2012 16:59:15 | Computer Name = Danny-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 20.07.2012 16:59:21 | Computer Name = Danny-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 20.07.2012 16:59:21 | Computer Name = Danny-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 20.07.2012 16:59:21 | Computer Name = Danny-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 20.07.2012 16:59:21 | Computer Name = Danny-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 20.07.2012 16:59:21 | Computer Name = Danny-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 20.07.2012 16:59:22 | Computer Name = Danny-PC | Source = Windows Search Service | ID = 3013
Description =

[ System Events ]
Error - 08.07.2012 06:13:38 | Computer Name = Danny-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 08.07.2012 14:29:44 | Computer Name = Danny-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 09.07.2012 08:31:21 | Computer Name = Danny-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 10.07.2012 11:46:41 | Computer Name = Danny-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 10.07.2012 14:42:42 | Computer Name = Danny-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 11.07.2012 15:19:17 | Computer Name = Danny-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 12.07.2012 11:55:20 | Computer Name = Danny-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 12.07.2012 12:07:11 | Computer Name = Danny-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 12.07.2012 um 18:04:32 unerwartet heruntergefahren.

Error - 12.07.2012 12:08:28 | Computer Name = Danny-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 12.07.2012 12:20:00 | Computer Name = Danny-PC | Source = Service Control Manager | ID = 7011
Description =


< End of report >

Bitte erstmal routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

 hier steht das Log