Guten Tag liebe Trojaner-Helferlein,

mein laptop wurde durch einen Trojaner gesperrt. Abgesicherter Modus funktioniert aber nach wie vor
Kann mir bitte jemand weiterhelfen? Hab schon versucht, mit Malwarebytes nach Viren zu suchen...Leider ohne Erfolg!

Danke und liebe Grüße


FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-08-2013
Ran by Sevi (administrator) on 29-08-2013 14:57:50
Running from F:\Neuer Ordner
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Safe Mode (minimal)

==================== Processes (Whitelisted) =================


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2884880 2012-02-23] (Synaptics Incorporated)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12452456 2012-02-21] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1158248 2012-02-08] (Realtek Semiconductor)
HKLM\...\Run: [BTMTrayAgent] - C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll [11406608 2011-12-20] (Intel Corporation)
HKLM\...\Run: [IntelliPoint] - c:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-01] (Microsoft Corporation)
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] C:\$Recycle.Bin\S-1-5-18\$af501eb35a953f75bf4fd83fa3268fe4\n. ATTENTION! ====> ZeroAccess?
HKCU\...\Run: [GoogleChromeAutoLaunch_1872065BA3F5B9D08D962ED5A71C2576] - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [829392 2013-08-16] (Google Inc.)
HKCU\...\Run: [Pando Media Booster] - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [4287536 2013-08-19] ()
HKCR\...409d6c4515e9\InprocServer32: [Default-shell32] C:\$Recycle.Bin\S-1-5-21-3871998862-3824107612-3321841078-1000\$af501eb35a953f75bf4fd83fa3268fe4\n. ATTENTION! ====> ZeroAccess?
MountPoints2: {7ee6f5d9-eabf-11e1-9735-685d43a9a924} - F:\AutoRun.exe
MountPoints2: {7ee6f5e7-eabf-11e1-9735-685d43a9a924} - F:\AutoRun.exe
MountPoints2: {7ee6f5e9-eabf-11e1-9735-685d43a9a924} - F:\AutoRun.exe
MountPoints2: {87ddebf1-eabd-11e1-868f-4c72b9525a94} - F:\AutoRun.exe
MountPoints2: {933506ed-ea2c-11e1-b6c2-4c72b9525a94} - F:\AutoRun.exe
MountPoints2: {933506f6-ea2c-11e1-b6c2-4c72b9525a94} - F:\AutoRun.exe
MountPoints2: {9335071b-ea2c-11e1-b6c2-685d43a9a924} - F:\AutoRun.exe
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-01-05] (Intel Corporation)
HKLM-x32\...\Run: [Dolby Advanced Audio v2] - C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [507744 2011-12-21] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [CLMLServer] - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [107816 2010-08-04] (CyberLink)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [87336 2011-03-31] (CyberLink Corp.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-08-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [UIExec] - C:\Program Files (x86)\T-Mobile Internet Manager\UIExec.exe [132608 2009-06-22] ()
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [946352 2012-12-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] - C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [703888 2013-03-26] (Cisco Systems, Inc.)
HKU\Default\...\RunOnce: [Screensaver] - C:\Windows\Web\Wallpaper\MEDION\start.vbs [x]
HKU\Default User\...\RunOnce: [Screensaver] - C:\Windows\Web\Wallpaper\MEDION\start.vbs [x]
AppInit_DLLs:     [0 ] ()
AppInit_DLLs-x32: c:\progra~3\browse~2\261339~1.144\{c16c1~1\browse~1.dll [0 ] ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\simplicheck.lnk
ShortcutTarget: simplicheck.lnk -> C:\Program Files (x86)\simplitec\simplicheck\simplicheck.exe (simplitec)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk
ShortcutTarget: vpngui.exe.lnk -> C:\Windows\Installer\{467D5E81-8349-4892-9E81-C3674ED8E451}\Icon09DB8A851.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\watchmi tray.lnk
ShortcutTarget: watchmi tray.lnk -> C:\Windows\Installer\{F0559C5E-7912-4391-B1A0-6B975F0E5064}\SHCT_TRAY_PROGRAMG_A10D8603999C4E9488776EF2533C58C9.exe (Acresso Software Inc.)
Startup: C:\Users\Sevi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cklmamxtcrjrtylcanj.lnk
ShortcutTarget: cklmamxtcrjrtylcanj.lnk -> C:\Users\Sevi\AppData\Local\Temp\jnaclytrjrctxmamlkc.bfg (Microsoft Corporation)
Startup: C:\Users\Sevi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Sevi\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Sevi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.at/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {30112F2A-33F7-65A9-501C-165F5B10EEA9} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=342&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {31113A9F-5118-6D92-B818-563F63B450A4} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=342&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKCU - {31113A9F-5118-6D92-B818-563F63B450A4} URL = 
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~4\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {538793D5-659C-4639-A56C-A179AD87ED44} https://univpn.uni-graz.at/CACHE/stc/5/binaries/vpnweb.cab
Winsock: Catalog5 01 mswsock.dll File Not found (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5 05 mswsock.dll File Not found (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
Winsock: Catalog5-x64 01 mswsock.dll File Not found (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5-x64 05 mswsock.dll File Not found (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
Tcpip\Parameters: [DhcpNameServer] 212.186.211.21 195.34.133.21
Tcpip\..\Interfaces\{4AA1361A-1311-435D-83A4-1E390C98E780}: [NameServer]213.162.69.169

FireFox:
========
FF ProfilePath: C:\Users\Sevi\AppData\Roaming\Mozilla\Firefox\Profiles\cqouvf2n.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.52 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\wikipedia-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Sevi\AppData\Roaming\Mozilla\Firefox\Profiles\cqouvf2n.default\Extensions\abb@amazon.com
FF Extension: HolaSearch - C:\Users\Sevi\AppData\Roaming\Mozilla\Firefox\Profiles\cqouvf2n.default\Extensions\ffxtlbr@holasearch.com
FF Extension: fhdp3 - C:\Users\Sevi\AppData\Roaming\Mozilla\Firefox\Profiles\cqouvf2n.default\Extensions\fhdp3@freehdsp.tv.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [bgnnidmnbdkmhfkjgdnngciimpdgohok] - C:\Program Files (x86)\LSHunter.TV\stv12.crx
CHR HKLM-x32\...\Chrome\Extension: [fagpjgjmoaccgkkpjeoinehnoaimnbla] - C:\Users\Sevi\AppData\Roaming\BabSolution\CR\hola.crx
CHR HKLM-x32\...\Chrome\Extension: [nbdbmopeebalgaeghmjoegpkngglikgn] - C:\Program Files (x86)\FreeHDSport.TV\freehdsporttv10.crx

==================== Services (Whitelisted) =================

S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-08-20] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-20] (Avira Operations GmbH & Co. KG)
S2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-14] (CyberLink)
S2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-14] (CyberLink)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2011-12-16] (Intel Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2011-12-08] ()
S2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2010-08-19] ()
S2 UI Assistant Service; C:\Program Files (x86)\T-Mobile Internet Manager\AssistantServices.exe [241664 2009-06-22] ()
S2 watchmi; C:\Program Files (x86)\watchmi\TvdService.exe [70144 2012-01-31] ()
S2 WebCakeUpdater; C:\Program Files (x86)\Movdap\WBDesktop.Updater.1.0.0.16.exe [51992 2013-08-15] (cake bake)
S2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [594704 2011-12-08] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-08-20] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-08-20] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-04-02] (Avira Operations GmbH & Co. KG)
S3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [304784 2010-03-23] ()
S3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [304784 2010-03-23] ()
S3 IT9135BDA; C:\Windows\System32\Drivers\IT9135BDA.sys [165504 2012-05-04] (ITE                      )
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-29 14:57 - 2013-08-29 14:57 - 00000000 ____D C:\FRST
2013-08-29 12:02 - 2013-08-29 12:02 - 00000000 __SHD C:\found.000
2013-08-29 11:32 - 2013-08-29 11:32 - 00000165 _____ C:\ProgramData\cklmamxtcrjrtylcanj.reg
2013-08-29 11:32 - 2013-08-29 11:32 - 00000070 _____ C:\ProgramData\cklmamxtcrjrtylcanj.bat
2013-08-29 10:19 - 2013-08-29 10:19 - 00000162 ____H C:\Users\Sevi\Desktop\~$mokratische Erziehung in einem demokratischen System.odt
2013-08-25 21:33 - 2013-08-25 21:33 - 00003032 _____ C:\Windows\System32\Tasks\{9ABDFA2F-7366-4730-B059-C4CBD81CF425}
2013-08-25 21:30 - 2013-08-25 21:33 - 00000000 ____D C:\Program Files (x86)\EA SPORTS
2013-08-25 19:48 - 2013-08-25 19:48 - 00178800 _____ (Sony DADC Austria AG.) C:\Windows\SysWOW64\CmdLineExt_x64.dll
2013-08-25 19:34 - 2013-08-25 19:35 - 00000004 _____ C:\Users\Sevi\AppData\Roaming\cache.ini
2013-08-25 19:22 - 2008-07-12 08:18 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2013-08-25 19:05 - 2013-08-25 19:05 - 100156396 _____ C:\Windows\SysWOW64\鄸Ꙉ±
2013-08-20 15:56 - 2013-08-28 20:00 - 00017290 _____ C:\Users\Sevi\Desktop\Demokratische Erziehung in einem demokratischen System.odt
2013-08-20 11:26 - 2013-08-20 11:26 - 00000000 ____D C:\Program Files (x86)\Microsoft Analysis Services
2013-08-19 18:40 - 2013-08-19 19:43 - 00000000 ____D C:\Users\Sevi\Documents\888poker
2013-08-19 18:40 - 2013-08-19 18:42 - 00000000 ____D C:\Users\Sevi\AppData\Roaming\PacificPoker
2013-08-19 18:40 - 2013-08-19 18:40 - 00002009 _____ C:\Users\Sevi\Desktop\888poker.lnk
2013-08-19 18:40 - 2013-08-19 18:40 - 00000000 ____D C:\Users\Sevi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\888poker
2013-08-19 18:39 - 2013-08-19 18:40 - 00000000 ____D C:\Program Files (x86)\PacificPoker
2013-08-19 18:27 - 2013-08-19 18:27 - 00000786 _____ C:\Users\Sevi\Desktop\Resume Download of CrossFire_NA.url
2013-08-19 18:25 - 2013-08-19 18:29 - 1055037512 _____ C:\Users\Sevi\Desktop\CrossFire_Setup_v1136.exe.downloading
2013-08-19 18:24 - 2013-08-29 11:32 - 00000000 ____D C:\Users\Sevi\AppData\Local\PMB Files
2013-08-19 18:24 - 2013-08-19 18:25 - 00000000 ____D C:\ProgramData\PMB Files
2013-08-19 18:24 - 2013-08-19 18:24 - 00000000 ____D C:\Program Files (x86)\Pando Networks
2013-08-19 18:22 - 2013-08-19 18:22 - 00000000 ____D C:\Users\Sevi\.swt
2013-08-18 13:01 - 2013-08-18 13:01 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-17 01:28 - 2013-08-17 01:29 - 00008516 _____ C:\AdwCleaner[S2].txt
2013-08-17 01:24 - 2013-08-17 01:25 - 00009459 _____ C:\AdwCleaner[R2].txt
2013-08-17 01:23 - 2013-08-17 01:23 - 00666633 _____ C:\Users\Sevi\Downloads\adwcleaner2306.exe
2013-08-15 12:50 - 2013-08-17 01:15 - 00000000 ____D C:\Users\Sevi\AppData\Roaming\Movdap
2013-08-15 12:50 - 2013-08-15 12:50 - 00000000 ____D C:\Program Files (x86)\Movdap
2013-08-10 16:53 - 2013-08-15 12:18 - 00000000 ____D C:\Users\Sevi\AppData\Roaming\Tepfel
2013-08-10 16:53 - 2013-08-10 16:54 - 00000000 ____D C:\Program Files (x86)\Tepfel
2013-08-10 16:53 - 2013-08-10 16:53 - 00000000 ____D C:\Program Files (x86)\FreeHDSport.TV
2013-08-07 06:13 - 2013-08-07 06:13 - 00002216 _____ C:\Users\Public\Desktop\Google Earth.lnk

==================== One Month Modified Files and Folders =======

2013-08-29 14:57 - 2013-08-29 14:57 - 00000000 ____D C:\FRST
2013-08-29 14:46 - 2012-08-20 13:17 - 00196608 _____ C:\Windows\system32\Ikeext.etl
2013-08-29 14:46 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-29 14:45 - 2009-07-14 06:51 - 00110632 _____ C:\Windows\setupact.log
2013-08-29 13:26 - 2012-02-21 20:50 - 00654372 _____ C:\Windows\system32\perfh007.dat
2013-08-29 13:26 - 2012-02-21 20:50 - 00129986 _____ C:\Windows\system32\perfc007.dat
2013-08-29 13:26 - 2009-07-14 07:13 - 01499844 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-29 13:21 - 2012-08-12 19:13 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-29 12:02 - 2013-08-29 12:02 - 00000000 __SHD C:\found.000
2013-08-29 11:46 - 2012-08-26 21:48 - 00000000 ____D C:\Users\Sevi\AppData\Roaming\Dropbox
2013-08-29 11:45 - 2012-08-26 21:50 - 00000000 ___RD C:\Users\Sevi\Dropbox
2013-08-29 11:32 - 2013-08-29 11:32 - 00000165 _____ C:\ProgramData\cklmamxtcrjrtylcanj.reg
2013-08-29 11:32 - 2013-08-29 11:32 - 00000070 _____ C:\ProgramData\cklmamxtcrjrtylcanj.bat
2013-08-29 11:32 - 2013-08-19 18:24 - 00000000 ____D C:\Users\Sevi\AppData\Local\PMB Files
2013-08-29 11:32 - 2012-08-12 19:21 - 00000000 ___RD C:\Users\Sevi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-08-29 11:16 - 2012-08-12 19:13 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-29 10:48 - 2013-06-23 12:16 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-29 10:19 - 2013-08-29 10:19 - 00000162 ____H C:\Users\Sevi\Desktop\~$mokratische Erziehung in einem demokratischen System.odt
2013-08-29 09:40 - 2009-07-14 06:45 - 00017488 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-29 09:40 - 2009-07-14 06:45 - 00017488 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-29 09:35 - 2012-08-12 19:30 - 00000000 ____D C:\Users\Sevi\Documents\Youcam
2013-08-29 09:34 - 2012-11-13 09:59 - 00000000 ____D C:\Users\Sevi\AppData\Local\CrashDumps
2013-08-28 20:00 - 2013-08-20 15:56 - 00017290 _____ C:\Users\Sevi\Desktop\Demokratische Erziehung in einem demokratischen System.odt
2013-08-28 12:57 - 2012-09-16 20:00 - 00003922 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{D08D5A64-3C31-4BE3-A3C9-97B9E4DC9B1A}
2013-08-28 12:56 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\tracing
2013-08-25 21:33 - 2013-08-25 21:33 - 00003032 _____ C:\Windows\System32\Tasks\{9ABDFA2F-7366-4730-B059-C4CBD81CF425}
2013-08-25 21:33 - 2013-08-25 21:30 - 00000000 ____D C:\Program Files (x86)\EA SPORTS
2013-08-25 19:48 - 2013-08-25 19:48 - 00178800 _____ (Sony DADC Austria AG.) C:\Windows\SysWOW64\CmdLineExt_x64.dll
2013-08-25 19:35 - 2013-08-25 19:34 - 00000004 _____ C:\Users\Sevi\AppData\Roaming\cache.ini
2013-08-25 19:05 - 2013-08-25 19:05 - 100156396 _____ C:\Windows\SysWOW64\鄸Ꙉ±
2013-08-22 11:14 - 2009-07-14 06:45 - 00540496 _____ C:\Windows\system32\FNTCACHE.DAT
2013-08-22 11:13 - 2010-11-21 05:47 - 00635526 _____ C:\Windows\PFRO.log
2013-08-21 16:51 - 2013-06-23 12:16 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-21 16:51 - 2013-06-23 12:16 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-21 16:51 - 2012-02-21 23:31 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-20 12:21 - 2012-08-12 19:23 - 00152472 _____ C:\Users\Sevi\AppData\Local\GDIPFONTCACHEV1.DAT
2013-08-20 11:48 - 2012-08-12 19:10 - 01571515 _____ C:\Windows\WindowsUpdate.log
2013-08-20 11:42 - 2012-08-27 11:07 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-20 11:39 - 2009-07-14 04:34 - 00000478 _____ C:\Windows\win.ini
2013-08-20 11:37 - 2012-08-12 19:39 - 00000000 ____D C:\Users\Sevi\AppData\Roaming\SoftGrid Client
2013-08-20 11:37 - 2012-02-21 23:11 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2013-08-20 11:32 - 2011-04-12 10:28 - 00000000 ____D C:\Windows\ShellNew
2013-08-20 11:27 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-08-20 11:26 - 2013-08-20 11:26 - 00000000 ____D C:\Program Files (x86)\Microsoft Analysis Services
2013-08-20 11:11 - 2013-05-07 16:36 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-08-20 11:11 - 2013-04-02 13:37 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-08-20 11:11 - 2013-04-02 13:37 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-08-20 11:03 - 2013-04-01 14:35 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-19 19:43 - 2013-08-19 18:40 - 00000000 ____D C:\Users\Sevi\Documents\888poker
2013-08-19 18:42 - 2013-08-19 18:40 - 00000000 ____D C:\Users\Sevi\AppData\Roaming\PacificPoker
2013-08-19 18:40 - 2013-08-19 18:40 - 00002009 _____ C:\Users\Sevi\Desktop\888poker.lnk
2013-08-19 18:40 - 2013-08-19 18:40 - 00000000 ____D C:\Users\Sevi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\888poker
2013-08-19 18:40 - 2013-08-19 18:39 - 00000000 ____D C:\Program Files (x86)\PacificPoker
2013-08-19 18:29 - 2013-08-19 18:25 - 1055037512 _____ C:\Users\Sevi\Desktop\CrossFire_Setup_v1136.exe.downloading
2013-08-19 18:27 - 2013-08-19 18:27 - 00000786 _____ C:\Users\Sevi\Desktop\Resume Download of CrossFire_NA.url
2013-08-19 18:25 - 2013-08-19 18:24 - 00000000 ____D C:\ProgramData\PMB Files
2013-08-19 18:24 - 2013-08-19 18:24 - 00000000 ____D C:\Program Files (x86)\Pando Networks
2013-08-19 18:22 - 2013-08-19 18:22 - 00000000 ____D C:\Users\Sevi\.swt
2013-08-19 18:22 - 2012-08-12 19:21 - 00000000 ____D C:\Users\Sevi
2013-08-18 13:01 - 2013-08-18 13:01 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-17 01:29 - 2013-08-17 01:28 - 00008516 _____ C:\AdwCleaner[S2].txt
2013-08-17 01:25 - 2013-08-17 01:24 - 00009459 _____ C:\AdwCleaner[R2].txt
2013-08-17 01:23 - 2013-08-17 01:23 - 00666633 _____ C:\Users\Sevi\Downloads\adwcleaner2306.exe
2013-08-17 01:15 - 2013-08-15 12:50 - 00000000 ____D C:\Users\Sevi\AppData\Roaming\Movdap
2013-08-16 19:19 - 2013-02-15 14:31 - 00000000 ____D C:\Users\Sevi\AppData\Local\Paint.NET
2013-08-15 12:50 - 2013-08-15 12:50 - 00000000 ____D C:\Program Files (x86)\Movdap
2013-08-15 12:18 - 2013-08-10 16:53 - 00000000 ____D C:\Users\Sevi\AppData\Roaming\Tepfel
2013-08-11 13:51 - 2013-02-23 16:53 - 00000000 ____D C:\Program Files (x86)\LSHunter.TV
2013-08-11 13:51 - 2012-02-22 00:35 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-08-10 16:54 - 2013-08-10 16:53 - 00000000 ____D C:\Program Files (x86)\Tepfel
2013-08-10 16:53 - 2013-08-10 16:53 - 00000000 ____D C:\Program Files (x86)\FreeHDSport.TV
2013-08-07 06:13 - 2013-08-07 06:13 - 00002216 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-08-07 06:13 - 2012-08-12 19:13 - 00000000 ____D C:\Program Files (x86)\Google

ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-3871998862-3824107612-3321841078-1000\$af501eb35a953f75bf4fd83fa3268fe4

ZeroAccess:
C:\$Recycle.Bin\S-1-5-18\$af501eb35a953f75bf4fd83fa3268fe4

Files to move or delete:
====================
c:\progra~3\browse~2\261339~1.144\{c16c1~1\browse~1.dll
C:\ProgramData\cklmamxtcrjrtylcanj.bat
C:\ProgramData\cklmamxtcrjrtylcanj.reg
C:\Users\Sevi\2590097.exe
C:\Users\Sevi\AppData\Roaming\skype.ini
C:\Users\Sevi\AppData\Roaming\cache.dat
C:\Users\Sevi\AppData\Roaming\cache.ini
C:\Users\Sevi\AppData\Local\Temp\647216.exe
C:\Users\Sevi\AppData\Local\Temp\7de9d852eca849f8.exe
C:\Users\Sevi\AppData\Local\Temp\AskSLib.dll
C:\Users\Sevi\AppData\Local\Temp\DataCard_Setup64.exe
C:\Users\Sevi\AppData\Local\Temp\DelayInst.exe
C:\Users\Sevi\AppData\Local\Temp\drm_dyndata_7380009.dll
C:\Users\Sevi\AppData\Local\Temp\InstallFlashPlayer.exe
C:\Users\Sevi\AppData\Local\Temp\installservice.exe
C:\Users\Sevi\AppData\Local\Temp\install_flashplayer11x32_mssa_aih.exe
C:\Users\Sevi\AppData\Local\Temp\ResetDevice.exe
C:\Users\Sevi\AppData\Local\Temp\SHSetup.exe
C:\Users\Sevi\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Sevi\AppData\Local\Temp\swt-win32-3740.dll
C:\Users\Sevi\AppData\Local\Temp\vpnclient_setup.exe
C:\Users\Sevi\AppData\Local\Temp\xvtupijpqwgclwbwn.exe
C:\Users\Sevi\AppData\Local\Temp\_is21CA.exe
C:\Users\Sevi\AppData\Local\Temp\{C0ED53CD-0E37-49D5-9366-99F01BF8065D}\{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}\difxapi.dll
C:\Users\Sevi\AppData\Local\Temp\{B0BF7057-6869-4E4B-920C-EA2A58DA07F0}\InstHelper.dll
C:\Users\Sevi\AppData\Local\Temp\{467D5E81-8349-4892-9E81-C3674ED8E451}\InstHelper.dll
C:\Users\Sevi\AppData\Local\Temp\updBE9D\BabScheduler2000201.exe
C:\Users\Sevi\AppData\Local\Temp\Temp1_cstrial.zip\Setup.exe
C:\Users\Sevi\AppData\Local\Temp\setup_3921205\888pokersetup.exe
C:\Users\Sevi\AppData\Local\Temp\SDIAG_593042b7-5a6d-4440-8f76-d911ebd2346f\DiagPackage.dll
C:\Users\Sevi\AppData\Local\Temp\nsr2F3D.tmp\stack.dll
C:\Users\Sevi\AppData\Local\Temp\nsr2F3D.tmp\System.dll
C:\Users\Sevi\AppData\Local\Temp\nsr2F3D.tmp\zplugins.dll
C:\Users\Sevi\AppData\Local\Temp\64419B3B-BAB0-7891-9CA6-AC719364FC70\Setup.exe
C:\Users\Sevi\AppData\Local\Temp\64419B3B-BAB0-7891-9CA6-AC719364FC70\sqlite3.dll
C:\Users\Sevi\AppData\Local\Temp\64419B3B-BAB0-7891-9CA6-AC719364FC70\Latest\ccp.exe
C:\Users\Sevi\AppData\Local\Temp\64419B3B-BAB0-7891-9CA6-AC719364FC70\Latest\ChromeToolbarSetup.dll
C:\Users\Sevi\AppData\Local\Temp\64419B3B-BAB0-7891-9CA6-AC719364FC70\Latest\CrxInstaller.dll
C:\Users\Sevi\AppData\Local\Temp\64419B3B-BAB0-7891-9CA6-AC719364FC70\Latest\GUninstaller.exe
C:\Users\Sevi\AppData\Local\Temp\64419B3B-BAB0-7891-9CA6-AC719364FC70\Latest\IEHelper.dll
C:\Users\Sevi\AppData\Local\Temp\64419B3B-BAB0-7891-9CA6-AC719364FC70\Latest\MyBabylonTB.exe
C:\Users\Sevi\AppData\Local\Temp\64419B3B-BAB0-7891-9CA6-AC719364FC70\Latest\Setup.exe
C:\Users\Sevi\AppData\Local\Temp\64419B3B-BAB0-7891-9CA6-AC719364FC70\Latest\sqlite3.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\GoogleEarth.exe
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\alchemyext.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\earthps.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\geplugin.exe
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\ge_expat.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\googleearth_free.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\icudt.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\IGAttrs.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\IGCore.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\IGExportCommon.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\IGGfx.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\IGMath.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\IGOpt.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\IGSg.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\IGUtils.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\msvcp100.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\msvcr100.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\npgeplugin.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\plugin_ax.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\QtCore4.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\QtGui4.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\QtNetwork4.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\QtWebKit4.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\imageformats\qgif4.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\imageformats\qjpeg4.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\alchemy\optimizations\IGOptExtension.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\alchemy\ogles20\D3DCompiler_43.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\alchemy\ogles20\d3dx9_43.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\alchemy\ogles20\IGAttrs.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\alchemy\ogles20\IGGfx.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\alchemy\ogles20\IGSg.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\alchemy\ogles20\libEGL.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\alchemy\ogles20\libGLESv2.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\alchemy\ogl\IGAttrs.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\alchemy\ogl\IGGfx.dll
C:\Users\Sevi\AppData\Local\Temp\._msigeplugin61\program files\Google\Google Earth\plugin\alchemy\ogl\IGSg.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\GoogleEarth.exe
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\alchemyext.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\earthps.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\geplugin.exe
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\ge_expat.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\googleearth_free.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\icudt.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\IGAttrs.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\IGCore.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\IGExportCommon.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\IGGfx.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\IGMath.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\IGOpt.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\IGSg.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\IGUtils.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\Leap.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\msvcp100.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\msvcr100.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\npgeplugin.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\plugin_ax.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\QtCore4.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\QtGui4.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\QtNetwork4.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\QtWebKit4.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\imageformats\qgif4.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\imageformats\qjpeg4.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\alchemy\optimizations\IGOptExtension.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\alchemy\ogles20\D3DCompiler_43.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\alchemy\ogles20\d3dx9_43.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\alchemy\ogles20\IGAttrs.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\alchemy\ogles20\IGGfx.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\alchemy\ogles20\IGSg.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\alchemy\ogles20\libEGL.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\alchemy\ogles20\libGLESv2.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\alchemy\ogl\IGAttrs.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\alchemy\ogl\IGGfx.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\alchemy\ogl\IGSg.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\alchemyext.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\earthflashsol.exe
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\earthps.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\ge_expat.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\googleearth.exe
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\googleearth_free.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\gpsbabel.exe
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\icudt.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\IGAttrs.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\IGCore.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\IGExportCommon.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\IGGfx.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\IGMath.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\IGOpt.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\IGSg.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\IGUtils.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\Leap.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\msvcp100.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\msvcr100.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\QtCore4.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\QtGui4.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\QtNetwork4.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\QtWebKit4.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\Plugins\npgeinprocessplugin.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\imageformats\qgif4.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\imageformats\qjpeg4.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\alchemy\optimizations\IGOptExtension.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\alchemy\ogles20\D3DCompiler_43.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\alchemy\ogles20\d3dx9_43.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\alchemy\ogles20\IGAttrs.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\alchemy\ogles20\IGGfx.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\alchemy\ogles20\IGSg.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\alchemy\ogles20\libEGL.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\alchemy\ogles20\libGLESv2.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\alchemy\ogl\IGAttrs.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\alchemy\ogl\IGGfx.dll
C:\Users\Sevi\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\alchemy\ogl\IGSg.dll
C:\Users\Sevi\AppData\Local\Temp\.972978\BrowserConnection.dll
C:\Users\Sevi\AppData\Local\Temp\.972978\datamngr.dll
C:\Users\Sevi\AppData\Local\Temp\.972978\DnsBHO.dll
C:\Users\Sevi\AppData\Local\Temp\.972978\IEBHO.dll
C:\Users\Sevi\AppData\Local\Temp\.972978\installhelper.dll
C:\Users\Sevi\AppData\Local\Temp\.972978\x64\BrowserConnection.dll
C:\Users\Sevi\AppData\Local\Temp\.972978\x64\datamngr.dll
C:\Users\Sevi\AppData\Local\Temp\.972978\x64\datamngrUI.exe
C:\Users\Sevi\AppData\Local\Temp\.972978\x64\DnsBHO.dll
C:\Users\Sevi\AppData\Local\Temp\.972978\x64\IEBHO.dll
C:\Users\Sevi\AppData\Local\Temp\.972978\ToolBar\dtUser.exe
C:\Users\Sevi\AppData\Local\Temp\.972978\ToolBar\searchquband.dll
C:\Users\Sevi\AppData\Local\Temp\.972978\ToolBar\searchqudtx.dll
C:\Users\Sevi\AppData\Local\Temp\.972978\ToolBar\uninstall.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-07-26 17:40

==================== End Of Log ============================
         

--- --- ---

--- --- ---

ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-3871998862-3824107612-3321841078-1000\$af501eb35a953f75bf4fd83fa3268fe4

ZeroAccess:
C:\$Recycle.Bin\S-1-5-18\$af501eb35a953f75bf4fd83fa3268fe4

Lesestoff:
Rootkit-Warnung
Dein Computer wurde mit einem besonderen Schädling infiziert, der sich vor herkömmlichen Virenscannern und dem Betriebssystem selbst verstecken kann. Zusätzlich hat so ein Schädling meist auch Backdoor-Funktionalität, reißt also ganz bewußt Löcher durch alle Schutzmaßnahmen, damit er weiteren Schadcode nachladen oder die Daten, die er so sammelt, an die "bösen Jungs" weiterleiten kann. Was heißt das jetzt für dich?

• Entscheide bitte ganz bewußt, ob du mit der Bereinigung fortfahren möchtest. Ein einmal derartig kompromittiertes System kann man niemals mit 100%iger Sicherheit wieder absichern. Auch wenn wir gute Chancen haben, deinen Computer zu bereinigen, kann es dennoch möglich sein, dass uns am Ende nur die Neuinstallation bleibt.
  
  
• Wenn du mit diesem Computer beispielsweise Onlinebanking machst, dann solltest du zumindest dein Passwort von deiner Bank ändern lassen, wenn du ein ansonsten sicheres Verfahren wie beispielsweise "chip-TAN-comfort" nutzt. Hast du noch alte TAN-Bögen auf Papierbasis? Dann ist es höchste Zeit dich bei deiner Bank zu melden und notfalls das Konto temporär sperren zu lassen. Der Sperrnotruf 116 116 von www.sperr-notruf.de kann Tag und Nacht dafür benutzt werden.
  
  
• Hast du ansonsten sensible Daten auf deinem Computer, dann solltest du auch darüber nachdenken, wie du damit umgehst, da sie sich praktisch "jeder" ansehen konnte.

Teile mir also mit, wie du dich entschieden hast.

hallo,
erstmal danke für deinehilfe. ich habe mich für die erste option entschieden: kompromittiertes System.

danke für weitere infos,
sevi

ich habe mich für die erste option entschieden: kompromittiertes System.

Bitte was?
Du sollst dich entscheiden ob Bereinigung oder Neuinstallation
Dass dein System kompromittiert ist wissen wir schon längst.

entschuldige bitte.

hab mich für eine bereinigung entschieden.

danke

Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Startup: C:\Users\Sevi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cklmamxtcrjrtylcanj.lnk
ShortcutTarget: cklmamxtcrjrtylcanj.lnk -> C:\Users\Sevi\AppData\Local\Temp\jnaclytrjrctxmamlkc.bfg (Microsoft Corporation)
AppInit_DLLs:     [0 ] ()
AppInit_DLLs-x32: c:\progra~3\browse~2\261339~1.144\{c16c1~1\browse~1.dll [0 ] ()
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] C:\$Recycle.Bin\S-1-5-18\$af501eb35a953f75bf4fd83fa3268fe4\n. ATTENTION! ====> ZeroAccess?
HKCU\...\Run: [Pando Media Booster] - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [4287536 2013-08-19] ()
HKCR\...409d6c4515e9\InprocServer32: [Default-shell32] C:\$Recycle.Bin\S-1-5-21-3871998862-3824107612-3321841078-1000\$af501eb35a953f75bf4fd83fa3268fe4\n. ATTENTION! ====> ZeroAccess?
C:\Users\Sevi\AppData\Roaming\cache.ini
C:\Windows\SysWOW64\鄸Ꙉ±
C:\$Recycle.Bin\S-1-5-21-3871998862-3824107612-3321841078-1000\$af501eb35a953f75bf4fd83fa3268fe4
C:\$Recycle.Bin\S-1-5-18\$af501eb35a953f75bf4fd83fa3268fe4
c:\progra~3\browse~2\
C:\ProgramData\cklmamxtcrjrtylcanj.bat
C:\ProgramData\cklmamxtcrjrtylcanj.reg
C:\Users\Sevi\2590097.exe
C:\Users\Sevi\AppData\Roaming\skype.ini
C:\Users\Sevi\AppData\Roaming\cache.dat
C:\Users\Sevi\AppData\Roaming\cache.ini
C:\Users\Sevi\AppData\Local\Temp\647216.exe
C:\Users\Sevi\AppData\Local\Temp\7de9d852eca849f8.exe
C:\Users\Sevi\AppData\Local\Temp\AskSLib.dll
C:\Users\Sevi\AppData\Local\Temp\DataCard_Setup64.exe
C:\Users\Sevi\AppData\Local\Temp\DelayInst.exe
C:\Users\Sevi\AppData\Local\Temp\drm_dyndata_7380009.dll
C:\Users\Sevi\AppData\Local\Temp\InstallFlashPlayer.exe
C:\Users\Sevi\AppData\Local\Temp\installservice.exe
C:\Users\Sevi\AppData\Local\Temp\install_flashplayer11x32_mssa_aih.exe
C:\Users\Sevi\AppData\Local\Temp\ResetDevice.exe
C:\Users\Sevi\AppData\Local\Temp\SHSetup.exe
C:\Users\Sevi\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Sevi\AppData\Local\Temp\swt-win32-3740.dll
C:\Users\Sevi\AppData\Local\Temp\vpnclient_setup.exe
C:\Users\Sevi\AppData\Local\Temp\xvtupijpqwgclwbwn.exe
C:\Users\Sevi\AppData\Local\Temp\_is21CA.exe
C:\Users\Sevi\AppData\Local\Temp\{C0ED53CD-0E37-49D5-9366-99F01BF8065D}\{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}\difxapi.dll
C:\Users\Sevi\AppData\Local\Temp\{B0BF7057-6869-4E4B-920C-EA2A58DA07F0}\InstHelper.dll
C:\Users\Sevi\AppData\Local\Temp\{467D5E81-8349-4892-9E81-C3674ED8E451}\InstHelper.dll
C:\Users\Sevi\AppData\Local\Temp\updBE9D\BabScheduler2000201.exe
C:\Users\Sevi\AppData\Local\Temp\Temp1_cstrial.zip\Setup.exe
C:\Users\Sevi\AppData\Local\Temp\setup_3921205\888pokersetup.exe
C:\Users\Sevi\AppData\Local\Temp\SDIAG_593042b7-5a6d-4440-8f76-d911ebd2346f\DiagPackage.dll
C:\Users\Sevi\AppData\Local\Temp\nsr2F3D.tmp
         

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

• Starte deinen Rechner erneut in die Reparaturoptionen
• Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 28-08-2013
Ran by Sevi at 2013-08-30 12:47:19 Run:1
Running from F:\Neuer Ordner
Boot Mode: Safe Mode (minimal)
==============================================

Content of fixlist:
*****************
Startup: C:\Users\Sevi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cklmamxtcrjrtylcanj.lnk
ShortcutTarget: cklmamxtcrjrtylcanj.lnk -> C:\Users\Sevi\AppData\Local\Temp\jnaclytrjrctxmamlkc.bfg (Microsoft Corporation)
AppInit_DLLs:     [0 ] ()
AppInit_DLLs-x32: c:\progra~3\browse~2\261339~1.144\{c16c1~1\browse~1.dll [0 ] ()
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] C:\$Recycle.Bin\S-1-5-18\$af501eb35a953f75bf4fd83fa3268fe4\n. ATTENTION! ====> ZeroAccess?
HKCU\...\Run: [Pando Media Booster] - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [4287536 2013-08-19] ()
HKCR\...409d6c4515e9\InprocServer32: [Default-shell32] C:\$Recycle.Bin\S-1-5-21-3871998862-3824107612-3321841078-1000\$af501eb35a953f75bf4fd83fa3268fe4\n. ATTENTION! ====> ZeroAccess?
C:\Users\Sevi\AppData\Roaming\cache.ini
C:\Windows\SysWOW64\???±
C:\$Recycle.Bin\S-1-5-21-3871998862-3824107612-3321841078-1000\$af501eb35a953f75bf4fd83fa3268fe4
C:\$Recycle.Bin\S-1-5-18\$af501eb35a953f75bf4fd83fa3268fe4
c:\progra~3\browse~2\
C:\ProgramData\cklmamxtcrjrtylcanj.bat
C:\ProgramData\cklmamxtcrjrtylcanj.reg
C:\Users\Sevi\2590097.exe
C:\Users\Sevi\AppData\Roaming\skype.ini
C:\Users\Sevi\AppData\Roaming\cache.dat
C:\Users\Sevi\AppData\Roaming\cache.ini
C:\Users\Sevi\AppData\Local\Temp\647216.exe
C:\Users\Sevi\AppData\Local\Temp\7de9d852eca849f8.exe
C:\Users\Sevi\AppData\Local\Temp\AskSLib.dll
C:\Users\Sevi\AppData\Local\Temp\DataCard_Setup64.exe
C:\Users\Sevi\AppData\Local\Temp\DelayInst.exe
C:\Users\Sevi\AppData\Local\Temp\drm_dyndata_7380009.dll
C:\Users\Sevi\AppData\Local\Temp\InstallFlashPlayer.exe
C:\Users\Sevi\AppData\Local\Temp\installservice.exe
C:\Users\Sevi\AppData\Local\Temp\install_flashplayer11x32_mssa_aih.exe
C:\Users\Sevi\AppData\Local\Temp\ResetDevice.exe
C:\Users\Sevi\AppData\Local\Temp\SHSetup.exe
C:\Users\Sevi\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Sevi\AppData\Local\Temp\swt-win32-3740.dll
C:\Users\Sevi\AppData\Local\Temp\vpnclient_setup.exe
C:\Users\Sevi\AppData\Local\Temp\xvtupijpqwgclwbwn.exe
C:\Users\Sevi\AppData\Local\Temp\_is21CA.exe
C:\Users\Sevi\AppData\Local\Temp\{C0ED53CD-0E37-49D5-9366-99F01BF8065D}\{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}\difxapi.dll
C:\Users\Sevi\AppData\Local\Temp\{B0BF7057-6869-4E4B-920C-EA2A58DA07F0}\InstHelper.dll
C:\Users\Sevi\AppData\Local\Temp\{467D5E81-8349-4892-9E81-C3674ED8E451}\InstHelper.dll
C:\Users\Sevi\AppData\Local\Temp\updBE9D\BabScheduler2000201.exe
C:\Users\Sevi\AppData\Local\Temp\Temp1_cstrial.zip\Setup.exe
C:\Users\Sevi\AppData\Local\Temp\setup_3921205\888pokersetup.exe
C:\Users\Sevi\AppData\Local\Temp\SDIAG_593042b7-5a6d-4440-8f76-d911ebd2346f\DiagPackage.dll
C:\Users\Sevi\AppData\Local\Temp\nsr2F3D.tmp
     


*****************

C:\Users\Sevi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cklmamxtcrjrtylcanj.lnk => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\jnaclytrjrctxmamlkc.bfg => Moved successfully.
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs => Value was restored successfully.
HKLM\Software\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\\Default => Value was restored successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\Pando Media Booster => Value deleted successfully.
HKCU\Software\Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} => Key deleted successfully.
C:\Users\Sevi\AppData\Roaming\cache.ini => Moved successfully.
C:\Windows\SysWOW64\???± => Moved successfully.
C:\$Recycle.Bin\S-1-5-21-3871998862-3824107612-3321841078-1000\$af501eb35a953f75bf4fd83fa3268fe4 => Moved successfully.
C:\$Recycle.Bin\S-1-5-18\$af501eb35a953f75bf4fd83fa3268fe4 => Moved successfully.
"c:\progra~3\browse~2\" => File/Directory not found.
C:\ProgramData\cklmamxtcrjrtylcanj.bat => Moved successfully.
C:\ProgramData\cklmamxtcrjrtylcanj.reg => Moved successfully.
C:\Users\Sevi\2590097.exe => Moved successfully.
C:\Users\Sevi\AppData\Roaming\skype.ini => Moved successfully.
C:\Users\Sevi\AppData\Roaming\cache.dat => Moved successfully.
"C:\Users\Sevi\AppData\Roaming\cache.ini" => File/Directory not found.
C:\Users\Sevi\AppData\Local\Temp\647216.exe => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\7de9d852eca849f8.exe => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\AskSLib.dll => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\DataCard_Setup64.exe => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\DelayInst.exe => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\drm_dyndata_7380009.dll => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\InstallFlashPlayer.exe => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\installservice.exe => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\install_flashplayer11x32_mssa_aih.exe => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\ResetDevice.exe => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\SHSetup.exe => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\SkypeSetup.exe => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\swt-win32-3740.dll => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\vpnclient_setup.exe => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\xvtupijpqwgclwbwn.exe => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\_is21CA.exe => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\{C0ED53CD-0E37-49D5-9366-99F01BF8065D}\{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}\difxapi.dll => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\{B0BF7057-6869-4E4B-920C-EA2A58DA07F0}\InstHelper.dll => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\{467D5E81-8349-4892-9E81-C3674ED8E451}\InstHelper.dll => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\updBE9D\BabScheduler2000201.exe => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\Temp1_cstrial.zip\Setup.exe => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\setup_3921205\888pokersetup.exe => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\SDIAG_593042b7-5a6d-4440-8f76-d911ebd2346f\DiagPackage.dll => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\nsr2F3D.tmp => Moved successfully.

==== End of Fixlog ====
         

Bitte KEINE PHP-Tags verwenden! Die Logs nur in CODE-Tags posten.

Startet Windows wieder normal?

hallo,

windows startet wieder ganz normal. danke vielmals.
was ist jetzt der nächste schritt?

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 28-08-2013
Ran by Sevi at 2013-08-30 12:47:19 Run:1
Running from F:\Neuer Ordner
Boot Mode: Safe Mode (minimal)
==============================================

Content of fixlist:
*****************
Startup: C:\Users\Sevi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cklmamxtcrjrtylcanj.lnk
ShortcutTarget: cklmamxtcrjrtylcanj.lnk -> C:\Users\Sevi\AppData\Local\Temp\jnaclytrjrctxmamlkc.bfg (Microsoft Corporation)
AppInit_DLLs:     [0 ] ()
AppInit_DLLs-x32: c:\progra~3\browse~2\261339~1.144\{c16c1~1\browse~1.dll [0 ] ()
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] C:\$Recycle.Bin\S-1-5-18\$af501eb35a953f75bf4fd83fa3268fe4\n. ATTENTION! ====> ZeroAccess?
HKCU\...\Run: [Pando Media Booster] - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [4287536 2013-08-19] ()
HKCR\...409d6c4515e9\InprocServer32: [Default-shell32] C:\$Recycle.Bin\S-1-5-21-3871998862-3824107612-3321841078-1000\$af501eb35a953f75bf4fd83fa3268fe4\n. ATTENTION! ====> ZeroAccess?
C:\Users\Sevi\AppData\Roaming\cache.ini
C:\Windows\SysWOW64\???±
C:\$Recycle.Bin\S-1-5-21-3871998862-3824107612-3321841078-1000\$af501eb35a953f75bf4fd83fa3268fe4
C:\$Recycle.Bin\S-1-5-18\$af501eb35a953f75bf4fd83fa3268fe4
c:\progra~3\browse~2\
C:\ProgramData\cklmamxtcrjrtylcanj.bat
C:\ProgramData\cklmamxtcrjrtylcanj.reg
C:\Users\Sevi\2590097.exe
C:\Users\Sevi\AppData\Roaming\skype.ini
C:\Users\Sevi\AppData\Roaming\cache.dat
C:\Users\Sevi\AppData\Roaming\cache.ini
C:\Users\Sevi\AppData\Local\Temp\647216.exe
C:\Users\Sevi\AppData\Local\Temp\7de9d852eca849f8.exe
C:\Users\Sevi\AppData\Local\Temp\AskSLib.dll
C:\Users\Sevi\AppData\Local\Temp\DataCard_Setup64.exe
C:\Users\Sevi\AppData\Local\Temp\DelayInst.exe
C:\Users\Sevi\AppData\Local\Temp\drm_dyndata_7380009.dll
C:\Users\Sevi\AppData\Local\Temp\InstallFlashPlayer.exe
C:\Users\Sevi\AppData\Local\Temp\installservice.exe
C:\Users\Sevi\AppData\Local\Temp\install_flashplayer11x32_mssa_aih.exe
C:\Users\Sevi\AppData\Local\Temp\ResetDevice.exe
C:\Users\Sevi\AppData\Local\Temp\SHSetup.exe
C:\Users\Sevi\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Sevi\AppData\Local\Temp\swt-win32-3740.dll
C:\Users\Sevi\AppData\Local\Temp\vpnclient_setup.exe
C:\Users\Sevi\AppData\Local\Temp\xvtupijpqwgclwbwn.exe
C:\Users\Sevi\AppData\Local\Temp\_is21CA.exe
C:\Users\Sevi\AppData\Local\Temp\{C0ED53CD-0E37-49D5-9366-99F01BF8065D}\{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}\difxapi.dll
C:\Users\Sevi\AppData\Local\Temp\{B0BF7057-6869-4E4B-920C-EA2A58DA07F0}\InstHelper.dll
C:\Users\Sevi\AppData\Local\Temp\{467D5E81-8349-4892-9E81-C3674ED8E451}\InstHelper.dll
C:\Users\Sevi\AppData\Local\Temp\updBE9D\BabScheduler2000201.exe
C:\Users\Sevi\AppData\Local\Temp\Temp1_cstrial.zip\Setup.exe
C:\Users\Sevi\AppData\Local\Temp\setup_3921205\888pokersetup.exe
C:\Users\Sevi\AppData\Local\Temp\SDIAG_593042b7-5a6d-4440-8f76-d911ebd2346f\DiagPackage.dll
C:\Users\Sevi\AppData\Local\Temp\nsr2F3D.tmp
     


*****************

C:\Users\Sevi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cklmamxtcrjrtylcanj.lnk => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\jnaclytrjrctxmamlkc.bfg => Moved successfully.
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs => Value was restored successfully.
HKLM\Software\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\\Default => Value was restored successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\Pando Media Booster => Value deleted successfully.
HKCU\Software\Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} => Key deleted successfully.
C:\Users\Sevi\AppData\Roaming\cache.ini => Moved successfully.
C:\Windows\SysWOW64\???± => Moved successfully.
C:\$Recycle.Bin\S-1-5-21-3871998862-3824107612-3321841078-1000\$af501eb35a953f75bf4fd83fa3268fe4 => Moved successfully.
C:\$Recycle.Bin\S-1-5-18\$af501eb35a953f75bf4fd83fa3268fe4 => Moved successfully.
"c:\progra~3\browse~2\" => File/Directory not found.
C:\ProgramData\cklmamxtcrjrtylcanj.bat => Moved successfully.
C:\ProgramData\cklmamxtcrjrtylcanj.reg => Moved successfully.
C:\Users\Sevi\2590097.exe => Moved successfully.
C:\Users\Sevi\AppData\Roaming\skype.ini => Moved successfully.
C:\Users\Sevi\AppData\Roaming\cache.dat => Moved successfully.
"C:\Users\Sevi\AppData\Roaming\cache.ini" => File/Directory not found.
C:\Users\Sevi\AppData\Local\Temp\647216.exe => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\7de9d852eca849f8.exe => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\AskSLib.dll => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\DataCard_Setup64.exe => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\DelayInst.exe => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\drm_dyndata_7380009.dll => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\InstallFlashPlayer.exe => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\installservice.exe => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\install_flashplayer11x32_mssa_aih.exe => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\ResetDevice.exe => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\SHSetup.exe => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\SkypeSetup.exe => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\swt-win32-3740.dll => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\vpnclient_setup.exe => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\xvtupijpqwgclwbwn.exe => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\_is21CA.exe => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\{C0ED53CD-0E37-49D5-9366-99F01BF8065D}\{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}\difxapi.dll => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\{B0BF7057-6869-4E4B-920C-EA2A58DA07F0}\InstHelper.dll => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\{467D5E81-8349-4892-9E81-C3674ED8E451}\InstHelper.dll => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\updBE9D\BabScheduler2000201.exe => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\Temp1_cstrial.zip\Setup.exe => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\setup_3921205\888pokersetup.exe => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\SDIAG_593042b7-5a6d-4440-8f76-d911ebd2346f\DiagPackage.dll => Moved successfully.
C:\Users\Sevi\AppData\Local\Temp\nsr2F3D.tmp => Moved successfully.

==== End of Fixlog ====
         
--------------------------------------------------------------------------------
Geändert von cosinus (Heute um 12:51 Uhr) Grund: PHP => CODE
         

Dann bitte jetzt Combofix ausführen:

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.