selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc......
 

Hallo Leute,

Ich habe nun seit längerer Zeit kleinere .exe Dateien auf meinem Laptop (Windows 7 Home Premium).
Die Dateien sind nicht sehr groß. Lediglich rund 350 KB.
Sie befinden sich im Ordner Roaming. In der Suchleiste bei Windows einfach "%appdata%" eingeben.
Die Minecraft-Spieler kennen den Ordner. Es ist der Ordner in in den man den .minecraft Ordner platzieren muss.
Und genau darin befinden sich die Dateien. Sie erstellen sich auch immer neu.:headbang: Ich habe schon mehrmals versucht sie einfach zu löschen, aber es funktioniert nicht. Sie werden einfach wieder erstellt. Und es sind auch nicht immer dieselben Dateinamen. Und sie öffnen sich auch automatisch; Im Taskmanager unter Prozesse werden IMMER 2 identische Viren geöffnet. Egal welchen Namen sie haben, es sind immer 2 gleiche. Ich poste mal ein Screenshot hier rein, wie das bei mir aussieht:

Also erstmal der Roaming Ordner wo sich die Dateien befinden:
http://s14.directupload.net/file/d/3...bmjum6_png.htm


Und hier ist der/ sind die Prozesse im Task Manager:
http://s7.directupload.net/file/d/3029/zer9y2o9_png.htm


Ich habe keiner Ahnung wo diese Teile herkommen.
Durch irgendeinen Download höchstwahrscheinlich.

Der Virus bremst auch erheblich die Systemleistung aus.


Wenn mir jemand helfen kann, wäre ich sehr dankbar :singsing:

Gruß, Janis

Hi,


Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

• Starte bitte die OTL.exe.
• Kopiere nun den Inhalt aus der Codebox in die http://larusso.trojaner-board.de/Images/otlfix.jpg Textbox.

• Schliesse bitte nun alle Programme. (Wichtig)
• Klicke nun bitte auf den Quick Scan Button.
• Kopiere nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Danke erstmal, schrauber...

Ich habe den Scan gestartet, jedoch hängt sich das Programm immer auf wenn folgendes gescannt wird:

"Scanning HKEY_CURRENT_USER Run Keys..."

Muss ich einfach nur lange warten? Ich hatte nämlich ca. 15 Minuten gewartet, doch es hat sich nichts getan....:balla:

Dann versuchen wir was andres.


Downloade dir bitte dds ( von sUBs ) von einem der folgenden Downloadspiegel und speichere die Datei auf deinem Desktop.

dds.com
dds.scr
dds.pif

• Schließe alle laufenden Programme.
• Starte DDS mit Doppelklick.
• Es wird 2 Logfiles erstellen.
  • dds.txt
  • attach.txt
• Speichere beide Logfiles auf deinem Desktop
• Poste beide Logfiles hier.

Danke, hat geklappt.

Also hier ist das Attach file:

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.DDS Logfile:
[/CODE]
--- --- ---
--- --- ---

--- --- ---


Das war's,
Gruß, Janis

Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1


WICHTIG - Speichere Combofix auf deinem Desktop

• Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Danke, schrauber.

Das ist das Text file:

Combofix Logfile:
--- --- ---

Combofix muss vom Desktop ausgeführt werden. Bitte Combofix löschen, neu laden auf den Desktop und nochmal laufen lassen.

Alles klar, ich hab das jetzt nochmal gemacht.
Wenns wieder falsch ist, weiß ich auch nicht was los ist...

Combofix Logfile:
--- --- ---

Verschieb doch einfach die Combofix.exe vom Downloads-Ordner auf den Desktop :)

:balla: dafuq

Ich hab das Teil doch auf den Desktop gezogen o__o
Ok ich machs nochmal :crazy:

Mach am Besten ausschneiden/einfügen, nicht dass du durch irgend nen dummen zufall nur ne verknüpfung machst :)

Rate, was ich aus irgend nem dummen Zufall gemacht hab...:kloppen:

Aber egal :P Hier ist jetz das richtige:

Combofix Logfile:
--- --- ---

Hi,

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Starte die adwcleaner.exe mit einem Doppelklick.
• Klicke auf Suche.
• Nach Ende des Suchlaufs öffnet sich eine Textdatei.
• Poste mir den Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

Danke schrauber, hier ist das Text file:

# AdwCleaner v2.003 - Logfile created 10/04/2012 at 17:56:18
# Updated 23/09/2012 by Xplode
# Operating system : Windows 7 Home Premium (32 bits)
# User : Janis - JANIS-PC
# Boot Mode : Normal
# Running from : C:\Users\Janis\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

File Found : C:\Program Files\Mozilla Firefox\defaults\pref\all-iminent.js
File Found : C:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml
File Found : C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
File Found : C:\Program Files\Mozilla Firefox\searchplugins\SearchTheWeb.xml
File Found : C:\Users\Janis\AppData\Roaming\Mozilla\Firefox\Profiles\bw776v5k.default\searchplugins\SearchTheWeb.xml
Folder Found : C:\Program Files\AVG Secure Search
Folder Found : C:\ProgramData\Babylon
Folder Found : C:\ProgramData\boost_interprocess
Folder Found : C:\ProgramData\Iminent
Folder Found : C:\ProgramData\InstallMate
Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Iminent
Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Finder
Folder Found : C:\ProgramData\Premium
Folder Found : C:\Users\Janis\AppData\LocalLow\BabylonToolbar
Folder Found : C:\Users\Janis\AppData\Roaming\Iminent
Folder Found : C:\Users\Janis\AppData\Roaming\Media Finder
Folder Found : C:\Users\Janis\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\gencrawler@some.com
Folder Found : C:\Users\Janis\AppData\Roaming\Mozilla\Firefox\Profiles\bw776v5k.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}

***** [Registry] *****

Key Found : HKCU\Software\IGearSettings
Key Found : HKCU\Software\Iminent
Key Found : HKCU\Software\MediaFinder
Key Found : HKCU\Software\Microsoft\Internet Explorer\MenuExt\Download with &Media Finder
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{BFFED5CA-8BDF-47CC-AED0-23F4E6D77732}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{CA4520F3-AE13-4FB1-A513-58E23991C86D}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CA4520F3-AE13-4FB1-A513-58E23991C86D}
Key Found : HKCU\Software\Softonic
Key Found : HKLM\Software\Babylon
Key Found : HKLM\SOFTWARE\Classes\AppID\{01994268-3C10-4044-A1EA-7A9C1B739A11}
Key Found : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Key Found : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Found : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Found : HKLM\SOFTWARE\Classes\AppID\Iminent.WebBooster.InternetExplorer.DLL
Key Found : HKLM\SOFTWARE\Classes\CLSID\{01A602A0-D0B9-445B-8081-719E4177C4A7}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{02C9C7B0-C7C8-4AAC-A9E4-55295BF60F8F}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{0398B101-6DA7-473F-A290-17D2FBC88CC0}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{0CC36196-8589-4B80-A771-D659411D7F90}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{143D96F9-EB64-48B3-B192-91C2C41A1F43}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{14F7D91F-F669-45C9-9F42-BACBFDB86EAD}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{187A6488-6E71-4A2A-B118-7BEFBFE58257}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{26C9BBE4-6D45-4AB6-A5B4-E068C9F5EF6D}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{2D065204-A024-4C39-8A38-EE7078EC7ACF}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{30F5476C-677B-4DB0-B397-51F5BFD86840}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{351798B1-C1D2-45AB-92B4-4D6C2D6AB5AF}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{3AEA1BEF-6195-46F4-ACA2-0ED14F7EFA1B}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{3D7F9AC3-BAC3-4E51-81D7-D121D79E550A}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{4498C5E9-93C6-4142-B6BE-F0C6DC48B77A}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{479BF2D6-E362-4A99-B1AB-BC764D7B97AE}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{492A108F-51D0-4BD8-899D-AD4AB2893064}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{4B6D6E60-FBD2-4E79-BF4B-886BC98F1797}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{5C176BA0-6FC0-4EBD-8ACF-24AC592506B6}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{60893E02-2E5B-43F9-A93A-BAD60C2DF6EF}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{6D39931F-451E-4BDD-BAF4-37FB96DBBA5D}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{76C684D2-C35D-4284-976A-D862F53ADB81}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{796D822A-C3F9-4A97-BAAB-42FE7628EA63}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{79EF3691-EC1A-4705-A01A-D2E36EC11758}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{82F41418-8E64-47EB-A7F1-4702A974D289}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{85D920CE-63A7-46DC-8992-41D1D2E07FAD}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{895ED5E8-ABB4-40C3-A0CA-2571964268E2}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{8AAC123A-1959-4A45-BFC5-E2D50783098A}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{A07956CD-81F8-4A03-B524-5D87E690DC83}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{B5E3B26B-6E5C-4865-A63D-58D04B10E245}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{B84D2DC5-42B2-4E5E-BF61-7B48152FF8EF}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{B89D5309-0367-4494-A92F-3D4C94F88307}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{C014EBF8-8854-448B-B5A4-557C4090EDCE}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{C31191DB-2F64-464C-B97C-6AC81ACB7AAC}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{C342C7A7-F622-4EF3-8B7F-ABB9FBE73F14}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{C4765B07-BC2F-477B-925C-B2BF24887823}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{C875C0A1-09E3-48D5-9F8E-BD337796FD14}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{CA4520F3-AE13-4FB1-A513-58E23991C86D}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{CD126DA6-FF5B-4181-AC13-54A62240D2FA}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{D8F01233-2DE6-4EE7-8988-37263F00651B}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{DD438708-AAB4-422D-A322-B619589F5680}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E812AE43-7799-4E67-8CF8-4104297A2D16}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{F0BAAEC7-9AE0-49FF-9C4B-86E774FF397F}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{F92193FD-2243-4401-9ACC-49FF30885898}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{FD21B8A2-910B-45AC-9C10-45E6A8B84984}
Key Found : HKLM\SOFTWARE\Classes\gencrawler_gc.GenCrawler
Key Found : HKLM\SOFTWARE\Classes\Iminent
Key Found : HKLM\SOFTWARE\Classes\Iminent.Business.Tinyfying.DownloadArgs
Key Found : HKLM\SOFTWARE\Classes\Iminent.Business.Tinyfying.LinkToPromoteArgs
Key Found : HKLM\SOFTWARE\Classes\Iminent.Business.Tinyfying.RawDataArgs
Key Found : HKLM\SOFTWARE\Classes\Iminent.Business.Tinyfying.TinyUrlArgs
Key Found : HKLM\SOFTWARE\Classes\Iminent.Business.Tinyfying.ViralLinkArgs
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.ClientCallback
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.ContractBase
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.AddToUserContentCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.CheckLoginStatusCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.CleanCacheCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GameOverCallback
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetCreditCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetInstallationContextCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetLoginStatusCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetLoginStatusResult
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetVariableCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetVariableResult
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.InstallationContextResult
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.LoadContentCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.LoadContentCommandResult
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.LoginCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.LoginStatusChangedCallback
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.LogoutCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.MergeIdentityCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.MyAccountCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.PlayContentCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.PostContentCallback
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.RecycleViewsCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.SetVariableCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.ShowBrowserWindowCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.ShowControlCenterCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.ShowPluginWindowCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.UserContentChangedCallback
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.VariableChangedCallback
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.WarmUpCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.WelcomeCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.ServerCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.ServerResult
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.LightContent
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.LightUri
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.MediatorServiceProxy
Key Found : HKLM\SOFTWARE\Classes\IminentWebBooster.ActiveContentHandle.1
Key Found : HKLM\SOFTWARE\Classes\IminentWebBooster.ActiveContentHandler
Key Found : HKLM\SOFTWARE\Classes\IminentWebBooster.BrowserHelperObject
Key Found : HKLM\SOFTWARE\Classes\IminentWebBooster.BrowserHelperObject.1
Key Found : HKLM\SOFTWARE\Classes\IminentWebBooster.ScriptExtender
Key Found : HKLM\SOFTWARE\Classes\IminentWebBooster.ScriptExtender.1
Key Found : HKLM\SOFTWARE\Classes\IminentWebBooster.TinyUrlHandler
Key Found : HKLM\SOFTWARE\Classes\IminentWebBooster.TinyUrlHandler.1
Key Found : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Key Found : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Found : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Key Found : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Key Found : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Key Found : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Key Found : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Key Found : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Key Found : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Key Found : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Key Found : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Key Found : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Key Found : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Key Found : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Key Found : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Key Found : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Key Found : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Key Found : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Key Found : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Key Found : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Key Found : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Key Found : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Key Found : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Key Found : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Key Found : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Found : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Key Found : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Key Found : HKLM\SOFTWARE\Classes\Interface\{ACA608DB-A210-4253-B799-3FD24E9A7BF5}
Key Found : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Key Found : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Key Found : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Key Found : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Key Found : HKLM\SOFTWARE\Classes\Interface\{C58D664A-3DBC-4925-AE74-0382007DF113}
Key Found : HKLM\SOFTWARE\Classes\Interface\{C776D7F4-BA85-4B75-AAFC-3A0A11FE6E36}
Key Found : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Key Found : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Key Found : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Key Found : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Key Found : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Key Found : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Key Found : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Key Found : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Key Found : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Key Found : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Key Found : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Key Found : HKLM\SOFTWARE\Classes\MF
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{A9CAF365-EA35-45DA-BD8B-2EFA09D374AC}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\igdhbblpcellaljokkpfhcjlagemhgjl
Key Found : HKLM\Software\Iminent
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0AF350D9-3916-454B-AC53-0B0B65F41301}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BFFED5CA-8BDF-47CC-AED0-23F4E6D77732}
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA4520F3-AE13-4FB1-A513-58E23991C86D}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F7CF0E9A-D48B-4942-9537-259ED0568DF4}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP
Key Found : HKU\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Key Found : HKU\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKU\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Internet Explorer\SearchScopes\{BFFED5CA-8BDF-47CC-AED0-23F4E6D77732}
Value Found : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [webbooster@iminent.com]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxps://isearch.avg.com/?cid={123DB6E3-65D0-4739-BE8A-6F30961BFD49}&mid=796bcf77900347d08b28d16a1c858f15-4dda9021002b6c4077fe60294b0ad61d9441fe9a&lang=en&ds=yu012&pr=sa&d=2012-08-14 15:54:10&v=12.1.0.20&sap=hp

-\\ Mozilla Firefox v13.0.1 (de)

Profile name : default
File : C:\Users\Janis\AppData\Roaming\Mozilla\Firefox\Profiles\bw776v5k.default\prefs.js

Found : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com");
Found : user_pref("browser.search.defaultenginename", "AVG Secure Search");
Found : user_pref("browser.search.order.1", "Search the web (Babylon)");
Found : user_pref("browser.startup.homepage", "hxxp://search.iminent.com/?appId=f4539de6-f4fd-40fe-9b84-0c6e[...]
Found : user_pref("extensions.BabylonToolbar_i.aflt", "babsst");
Found : user_pref("extensions.BabylonToolbar_i.babExt", "");
Found : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=112555&tt=060612_5_");
Found : user_pref("extensions.BabylonToolbar_i.hardId", "70fd172f00000000000000235a6166e6");
Found : user_pref("extensions.BabylonToolbar_i.id", "70fd172f00000000000000235a6166e6");
Found : user_pref("extensions.BabylonToolbar_i.instlDay", "15511");
Found : user_pref("extensions.BabylonToolbar_i.instlRef", "sst");
Found : user_pref("extensions.BabylonToolbar_i.newTab", true);
Found : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?affID=112555&tt=06061[...]
Found : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");
Found : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");
Found : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Found : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Found : user_pref("extensions.BabylonToolbar_i.tlbrId", "base");
Found : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");
Found : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1720:56:43");
Found : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");
Found : user_pref("greasemonkey.scriptvals.71f8f12556abe601d230ac099af2e207/Sharecash survey bypasser, metho[...]
Found : user_pref("keyword.URL", "hxxps://isearch.avg.com/search?cid={123DB6E3-65D0-4739-BE8A-6F30961BFD49}&[...]

-\\ Google Chrome v22.0.1229.79

File : C:\Users\Janis\AppData\Local\Google\Chrome\User Data\Default\Preferences

Found [l.12] : homepage = "hxxps://isearch.avg.com/?cid={123DB6E3-65D0-4739-BE8A-6F30961BFD49}&mid=796bcf77900347d08b28d16a1c858f15-4dda9021002b6c4077fe60294b0ad61d9441fe9a&lang=en&ds=yu012&pr=sa&d=2012-08-14 15:54:10&v=12.1.0.20&sap=hp",
Found [l.1764] : homepage = "hxxps://isearch.avg.com/?cid={123DB6E3-65D0-4739-BE8A-6F30961BFD49}&mid=796bcf77900347d08b28d16a1c858f15-4dda9021002b6c4077fe60294b0ad61d9441fe9a&lang=en&ds=yu012&pr=sa&d=2012-08-14 15:54:10&v=12.1.0.20&sap=hp",

*************************

AdwCleaner[R1].txt - [20972 octets] - [04/10/2012 17:56:18]

########## EOF - C:\AdwCleaner[R1].txt - [21033 octets] ##########

• Schließe alle offenen Programme und Browser.
• Starte die adwcleaner.exe mit einem Doppelklick.
• Klicke auf Löschen.
• Bestätige jeweils mit Ok.
• Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
• Poste mir den Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

Und jetzt versuch bitte nochmal OTL, lad aber eine neue Version.

Ok, hier ist das:

# AdwCleaner v2.003 - Logfile created 10/04/2012 at 19:49:58
# Updated 23/09/2012 by Xplode
# Operating system : Windows 7 Home Premium (32 bits)
# User : Janis - JANIS-PC
# Boot Mode : Normal
# Running from : C:\Users\Janis\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Deleted on reboot : C:\ProgramData\Premium
File Deleted : C:\Program Files\Mozilla Firefox\defaults\pref\all-iminent.js
File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml
File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\SearchTheWeb.xml
File Deleted : C:\Users\Janis\AppData\Roaming\Mozilla\Firefox\Profiles\bw776v5k.default\searchplugins\SearchTheWeb.xml
Folder Deleted : C:\Program Files\AVG Secure Search
Folder Deleted : C:\ProgramData\Babylon
Folder Deleted : C:\ProgramData\boost_interprocess
Folder Deleted : C:\ProgramData\Iminent
Folder Deleted : C:\ProgramData\InstallMate
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Iminent
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Finder
Folder Deleted : C:\Users\Janis\AppData\LocalLow\BabylonToolbar
Folder Deleted : C:\Users\Janis\AppData\Roaming\Iminent
Folder Deleted : C:\Users\Janis\AppData\Roaming\Media Finder
Folder Deleted : C:\Users\Janis\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\gencrawler@some.com
Folder Deleted : C:\Users\Janis\AppData\Roaming\Mozilla\Firefox\Profiles\bw776v5k.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}

***** [Registry] *****

Key Deleted : HKCU\Software\IGearSettings
Key Deleted : HKCU\Software\Iminent
Key Deleted : HKCU\Software\MediaFinder
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\MenuExt\Download with &Media Finder
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{BFFED5CA-8BDF-47CC-AED0-23F4E6D77732}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{CA4520F3-AE13-4FB1-A513-58E23991C86D}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CA4520F3-AE13-4FB1-A513-58E23991C86D}
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKLM\Software\Babylon
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{01994268-3C10-4044-A1EA-7A9C1B739A11}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\Iminent.WebBooster.InternetExplorer.DLL
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{01A602A0-D0B9-445B-8081-719E4177C4A7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02C9C7B0-C7C8-4AAC-A9E4-55295BF60F8F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{0398B101-6DA7-473F-A290-17D2FBC88CC0}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{0CC36196-8589-4B80-A771-D659411D7F90}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{143D96F9-EB64-48B3-B192-91C2C41A1F43}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{14F7D91F-F669-45C9-9F42-BACBFDB86EAD}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{187A6488-6E71-4A2A-B118-7BEFBFE58257}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{26C9BBE4-6D45-4AB6-A5B4-E068C9F5EF6D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2D065204-A024-4C39-8A38-EE7078EC7ACF}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{30F5476C-677B-4DB0-B397-51F5BFD86840}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{351798B1-C1D2-45AB-92B4-4D6C2D6AB5AF}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3AEA1BEF-6195-46F4-ACA2-0ED14F7EFA1B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3D7F9AC3-BAC3-4E51-81D7-D121D79E550A}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4498C5E9-93C6-4142-B6BE-F0C6DC48B77A}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{479BF2D6-E362-4A99-B1AB-BC764D7B97AE}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{492A108F-51D0-4BD8-899D-AD4AB2893064}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4B6D6E60-FBD2-4E79-BF4B-886BC98F1797}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5C176BA0-6FC0-4EBD-8ACF-24AC592506B6}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{60893E02-2E5B-43F9-A93A-BAD60C2DF6EF}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6D39931F-451E-4BDD-BAF4-37FB96DBBA5D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{76C684D2-C35D-4284-976A-D862F53ADB81}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{796D822A-C3F9-4A97-BAAB-42FE7628EA63}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{79EF3691-EC1A-4705-A01A-D2E36EC11758}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{82F41418-8E64-47EB-A7F1-4702A974D289}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{85D920CE-63A7-46DC-8992-41D1D2E07FAD}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{895ED5E8-ABB4-40C3-A0CA-2571964268E2}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{8AAC123A-1959-4A45-BFC5-E2D50783098A}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A07956CD-81F8-4A03-B524-5D87E690DC83}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B5E3B26B-6E5C-4865-A63D-58D04B10E245}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B84D2DC5-42B2-4E5E-BF61-7B48152FF8EF}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B89D5309-0367-4494-A92F-3D4C94F88307}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C014EBF8-8854-448B-B5A4-557C4090EDCE}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C31191DB-2F64-464C-B97C-6AC81ACB7AAC}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C342C7A7-F622-4EF3-8B7F-ABB9FBE73F14}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C4765B07-BC2F-477B-925C-B2BF24887823}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C875C0A1-09E3-48D5-9F8E-BD337796FD14}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CA4520F3-AE13-4FB1-A513-58E23991C86D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CD126DA6-FF5B-4181-AC13-54A62240D2FA}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D8F01233-2DE6-4EE7-8988-37263F00651B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DD438708-AAB4-422D-A322-B619589F5680}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E812AE43-7799-4E67-8CF8-4104297A2D16}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F0BAAEC7-9AE0-49FF-9C4B-86E774FF397F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F92193FD-2243-4401-9ACC-49FF30885898}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FD21B8A2-910B-45AC-9C10-45E6A8B84984}
Key Deleted : HKLM\SOFTWARE\Classes\gencrawler_gc.GenCrawler
Key Deleted : HKLM\SOFTWARE\Classes\Iminent
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Business.Tinyfying.DownloadArgs
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Business.Tinyfying.LinkToPromoteArgs
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Business.Tinyfying.RawDataArgs
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Business.Tinyfying.TinyUrlArgs
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Business.Tinyfying.ViralLinkArgs
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.ClientCallback
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.ContractBase
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.AddToUserContentCommand
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.CheckLoginStatusCommand
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.CleanCacheCommand
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GameOverCallback
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetCreditCommand
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetInstallationContextCommand
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetLoginStatusCommand
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetLoginStatusResult
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetVariableCommand
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetVariableResult
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.InstallationContextResult
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.LoadContentCommand
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.LoadContentCommandResult
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.LoginCommand
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.LoginStatusChangedCallback
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.LogoutCommand
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.MergeIdentityCommand
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.MyAccountCommand
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.PlayContentCommand
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.PostContentCallback
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.RecycleViewsCommand
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.SetVariableCommand
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.ShowBrowserWindowCommand
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.ShowControlCenterCommand
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.ShowPluginWindowCommand
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.UserContentChangedCallback
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.VariableChangedCallback
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.WarmUpCommand
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.WelcomeCommand
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.ServerCommand
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.ServerResult
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.LightContent
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.LightUri
Key Deleted : HKLM\SOFTWARE\Classes\Iminent.Mediator.MediatorServiceProxy
Key Deleted : HKLM\SOFTWARE\Classes\IminentWebBooster.ActiveContentHandle.1
Key Deleted : HKLM\SOFTWARE\Classes\IminentWebBooster.ActiveContentHandler
Key Deleted : HKLM\SOFTWARE\Classes\IminentWebBooster.BrowserHelperObject
Key Deleted : HKLM\SOFTWARE\Classes\IminentWebBooster.BrowserHelperObject.1
Key Deleted : HKLM\SOFTWARE\Classes\IminentWebBooster.ScriptExtender
Key Deleted : HKLM\SOFTWARE\Classes\IminentWebBooster.ScriptExtender.1
Key Deleted : HKLM\SOFTWARE\Classes\IminentWebBooster.TinyUrlHandler
Key Deleted : HKLM\SOFTWARE\Classes\IminentWebBooster.TinyUrlHandler.1
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{ACA608DB-A210-4253-B799-3FD24E9A7BF5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C58D664A-3DBC-4925-AE74-0382007DF113}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C776D7F4-BA85-4B75-AAFC-3A0A11FE6E36}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Key Deleted : HKLM\SOFTWARE\Classes\MF
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{A9CAF365-EA35-45DA-BD8B-2EFA09D374AC}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\igdhbblpcellaljokkpfhcjlagemhgjl
Key Deleted : HKLM\Software\Iminent
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0AF350D9-3916-454B-AC53-0B0B65F41301}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BFFED5CA-8BDF-47CC-AED0-23F4E6D77732}
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA4520F3-AE13-4FB1-A513-58E23991C86D}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F7CF0E9A-D48B-4942-9537-259ED0568DF4}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP
Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [webbooster@iminent.com]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

Restored : [HKCU\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Restored : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Restored : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Restored : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxps://isearch.avg.com/?cid={123DB6E3-65D0-4739-BE8A-6F30961BFD49}&mid=796bcf77900347d08b28d16a1c858f15-4dda9021002b6c4077fe60294b0ad61d9441fe9a&lang=en&ds=yu012&pr=sa&d=2012-08-14 15:54:10&v=12.1.0.20&sap=hp --> hxxp://www.google.com

-\\ Mozilla Firefox v13.0.1 (de)

Profile name : default
File : C:\Users\Janis\AppData\Roaming\Mozilla\Firefox\Profiles\bw776v5k.default\prefs.js

C:\Users\Janis\AppData\Roaming\Mozilla\Firefox\Profiles\bw776v5k.default\user.js ... Deleted !

Deleted : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com");
Deleted : user_pref("browser.search.defaultenginename", "AVG Secure Search");
Deleted : user_pref("browser.search.order.1", "Search the web (Babylon)");
Deleted : user_pref("browser.startup.homepage", "hxxp://search.iminent.com/?appId=f4539de6-f4fd-40fe-9b84-0c6e[...]
Deleted : user_pref("extensions.BabylonToolbar_i.aflt", "babsst");
Deleted : user_pref("extensions.BabylonToolbar_i.babExt", "");
Deleted : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=112555&tt=060612_5_");
Deleted : user_pref("extensions.BabylonToolbar_i.hardId", "70fd172f00000000000000235a6166e6");
Deleted : user_pref("extensions.BabylonToolbar_i.id", "70fd172f00000000000000235a6166e6");
Deleted : user_pref("extensions.BabylonToolbar_i.instlDay", "15511");
Deleted : user_pref("extensions.BabylonToolbar_i.instlRef", "sst");
Deleted : user_pref("extensions.BabylonToolbar_i.newTab", true);
Deleted : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?affID=112555&tt=06061[...]
Deleted : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");
Deleted : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");
Deleted : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Deleted : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Deleted : user_pref("extensions.BabylonToolbar_i.tlbrId", "base");
Deleted : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");
Deleted : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1720:56:43");
Deleted : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");
Deleted : user_pref("greasemonkey.scriptvals.71f8f12556abe601d230ac099af2e207/Sharecash survey bypasser, metho[...]
Deleted : user_pref("keyword.URL", "hxxps://isearch.avg.com/search?cid={123DB6E3-65D0-4739-BE8A-6F30961BFD49}&[...]

-\\ Google Chrome v22.0.1229.79

File : C:\Users\Janis\AppData\Local\Google\Chrome\User Data\Default\Preferences

Deleted [l.12] : homepage = "hxxps://isearch.avg.com/?cid={123DB6E3-65D0-4739-BE8A-6F30961BFD49}&mid=796bcf77900347d08b28d16a1c858f15-4dda9021002b6c4077fe60294b0ad61d9441fe9a&lang=en&ds=yu012&pr=sa&d=2012-08-14 15:54:10&v=12.1.0.20&sap=hp",
Deleted [l.1764] : homepage = "hxxps://isearch.avg.com/?cid={123DB6E3-65D0-4739-BE8A-6F30961BFD49}&mid=796bcf77900347d08b28d16a1c858f15-4dda9021002b6c4077fe60294b0ad61d9441fe9a&lang=en&ds=yu012&pr=sa&d=2012-08-14 15:54:10&v=12.1.0.20&sap=hp",

*************************

AdwCleaner[R1].txt - [21103 octets] - [04/10/2012 17:56:18]
AdwCleaner[S1].txt - [21534 octets] - [04/10/2012 19:49:58]

########## EOF - C:\AdwCleaner[S1].txt - [21595 octets] ##########

Und OTL? Geht es jetzt?

OTL geht jetzt, ja

Hier ist der Log:OTL Logfile:
--- --- ---

Bestehen noch Probleme?

Nein,

Also die Dateien werden jetz nicht mehr erstellt. Bis jetzt zumindest. Also es hat auf jede Fall geholfen.
Danke nochmal dafür :dankeschoen:

Hat das jetz alle Viren gelöscht oder nur die in dem Roaming Ordner?

AdwCleaner öffnen > Uninstall

Windows-Taste+R > Combofix /Uninstall > Enter drücken



Tool-Bereinigung mit OTC
Bitte lade Dir OTC von OldTimer herunter.

• Speichere es auf Deinem Desktop.
• Doppelklick auf OTC.exe um das Programm auszuführen.
• Eine Datei* sollte nun heruntergeladen werden.
  *Das ist eine Datei mit einer Liste von Helferprogrammen, die dann automatisch von Deinem System entfernt werden.
• OTC fragt eventuell nach einem Neustart.
  Sollte es dies tun, so lasse dies bitte zu.

Anmerkung: Nach dem Neustart werden OTC und andere Helferprogramme, die Du im Laufe der Bereinigung heruntergeladen hast, nicht mehr vorhanden sein. Sie wurden entfernt. Es ist daher Ok, wenn diese Programme nicht mehr vorhanden sind.





Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

• Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
• Windows Updates
  • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
  • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
• Gehe sicher das die automatischen Updates aktiviert sind.
• Software Updates
  Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
  Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

• Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

• MalwareBytes Anti Malware
  Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
  Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
  Ein Tutorial zur Verwendung findest Du hier.
• WinPatrol
  Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

• SpywareBlaster
  Eine kurze Einführung findest du Hier
• MVPs hosts file
  Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
• WOT (Web of trust)
  Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

• Opera
• Mozilla Firefox.
  • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
  • NoScript
    Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    
  • AdblockPlus
    Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
    Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts

• Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
• verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
• Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
• Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Die Dateien sind wieder erstellt worden :headbang:

Wann genau? Was hast Du gemacht?

Es sind zwei Dateien erstellt worden.
Und zwar beide am 05.10.2012 um 22.10
Ich habe gar nichts gemacht außer sie bei den Prozessen wieder zu beenden.
aus dem Roaming Ordner habe ich sie nicht gelöscht

Poste mal ein frisches OTL Logfile bitte.

Habs nochmal gemacht:OTL Logfile:
--- --- ---

Das machen wir jetzt mal ganz anders.


Downloade dir bitte Farbar Recovery Scan Tool 32-Bit und speichere diese auf einen USB Stick.

Schließe den USB Stick an das infizierte System an

Du musst das System nun in die System Reparatur Option booten.

Über den Boot Manager

• Starte den Rechner neu auf.
• Während dem Hochfahren drücke mehrmals die F8 Taste
• Wähle nun Computer reparieren.
• Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Mit Windows CD/DVD

• Lege die Windows CD in dein Laufwerk.
• Starte den Rechner neu auf und starte von der CD
• Wähle die Spracheinstellungen und klicke "Weiter".
• Klicke auf Computerreparaturoptionen !!
• Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Wähle in den Reparaturoptionen Eingabeaufforderung

• Gib nun bitte notepad ein und drücke Enter.
• Im öffnenden Textdokument --> Datei --> Speichern unter und wähle Computer
  Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt.
• Schließe Notepad wieder
• Gib nun bitte folgenden Befehl ein.
  e:\frst.exe
  Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks. Gegebenfalls anpassen.
• Akzeptiere den Disclaimer mit Yes und klicke Scan

Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-10-2012
Ran by SYSTEM at 08-10-2012 16:58:47
Running from D:\
Windows 7 Home Premium (X86) OS Language: English(US)
The current controlset is ControlSet001

==================== Registry (Whitelisted) ===================

HKLM\...\Run: [IJNetworkScanUtility] C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe [136544 2009-05-19] (CANON INC.)
HKLM\...\Run: [S6000Mnt] Rundll32.exe S6000Rmv.dll ,WinMainRmv /StartStillMnt [x]
HKLM\...\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s [11487848 2011-12-13] (Realtek Semiconductor)
HKLM\...\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming [1387288 2011-10-07] (Logitech, Inc.)
HKLM\...\Run: [Broadcom Wireless Manager UI] C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\WLTRAY.exe [6475264 2012-03-06] (Broadcom Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [446392 2012-04-03] (Adobe Systems Incorporated)
HKLM\...\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM\...\Run: [AdobeCS6ServiceManager] "C:\Program Files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [252848 2012-07-02] (Sun Microsystems, Inc.)
HKLM\...\Run: [Skype Recorder] "C:\Program Files\Skype Recorder\Skype Recorder.exe" [720896 2012-09-09] (ExtraLabs Software)
HKU\Cinema 4D\...\Run: [MicroUpdate] C:\Users\Cinema 4D\Documents\MSDCSC\msdcsc.exe [x]
HKU\Janis\...\Run: [MP3 Skype Recorder] C:\Program Files\MP3 Skype Recorder\MP3 Skype Recorder.exe [1975296 2011-11-17] (Alexander Nikiforov)
HKU\Janis\...\Run: [Fztitn] C:\Users\Janis\AppData\Roaming\Fztitn.exe [195072 2012-10-08] (Microsoft Corporation)
HKU\Janis\...\Run: [WINSXS32] C:\Users\Janis\AppData\Roaming\BCAD.exe [342016 2012-10-06] (Ufasoft)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [X]
Tcpip\Parameters: [DhcpNameServer] 82.212.62.62 192.168.0.1
Startup: C:\Users\All Users\Start Menu\Programs\Startup\Hama Wireless LAN Utility.lnk
ShortcutTarget: Hama Wireless LAN Utility.lnk -> C:\Program Files\Hama\Common\RaUI.exe (Hama GmbH & Co KG)
Startup: C:\Users\Janis\Start Menu\Programs\Startup\explorer.exe (Microsoft Corporation)

==================== Services (Whitelisted) ===================

2 KMService; C:\Windows\system32\srvany.exe [8192 2012-03-20] ()
2 RalinkRegistryWriter; C:\Program Files\Hama\Common\RaRegistry.exe [185632 2009-12-10] (Ralink Technology, Corp.)
2 wltrysvc; "C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\WLTRYSVC.EXE" "C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\bcmwltry.exe" [5186048 2012-03-06] (Broadcom Corporation)
2 AVGIDSAgent; "c:\Program Files\AVG\AVG2012\avgidsagent.exe" [x]
2 avgwd; "c:\Program Files\AVG\AVG2012\avgwdsvc.exe" [x]

==================== Drivers (Whitelisted) ====================

3 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [139856 2011-12-23] (AVG Technologies CZ, s.r.o. )
3 AVGIDSFilter; C:\Windows\System32\DRIVERS\avgidsfilterx.sys [24144 2011-12-23] (AVG Technologies CZ, s.r.o. )
0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [24896 2012-04-18] (AVG Technologies CZ, s.r.o. )
3 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [17232 2011-12-23] (AVG Technologies CZ, s.r.o. )
1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [235216 2012-02-21] (AVG Technologies CZ, s.r.o.)
1 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [41040 2011-12-23] (AVG Technologies CZ, s.r.o.)
0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [31952 2012-01-30] (AVG Technologies CZ, s.r.o.)
1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [301248 2012-03-18] (AVG Technologies CZ, s.r.o.)
3 BCM42RLY; C:\Windows\System32\drivers\BCM42RLY.sys [18496 2012-03-06] (Broadcom Corporation)
3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
3 L1E; C:\Windows\System32\DRIVERS\L1E62x86.sys [55848 2010-03-29] (Atheros Communications, Inc.)
3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [39192 2011-09-01] (Logitech, Inc.)
3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [30360 2011-09-01] (Logitech, Inc.)
3 PortTalk; C:\Windows\System32\Drivers\PortTalk.sys [3567 2009-01-18] (Beyond Logic hxxp://www.beyondlogic.org)
3 S6000KNT; C:\Windows\System32\Drivers\S6000KNT.sys [167576 2010-08-05] (Windows (R) Win 7 DDK provider)
3 SCREAMINGBDRIVER; C:\Windows\System32\drivers\ScreamingBAudio.sys [34896 2010-07-01] (Screaming Bee LLC)
3 catchme; \??\C:\Users\Janis\AppData\Local\Temp\catchme.sys [x]
3 EraserUtilDrv11113; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11113.sys [x]
3 EraserUtilDrv11122; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11122.sys [x]
3 NLNdisMP; C:\Windows\System32\DRIVERS\nlndis.sys [x]
3 NLNdisPT; C:\Windows\System32\DRIVERS\nlndis.sys [x]
3 WinRing0_1_2_0; \??\C:\Program Files\IObit\Game Booster 3\Driver\WinRing0.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2012-10-08 06:46 - 2012-10-07 02:37 - 00905954 ____A (Farbar) C:\Users\Janis\Desktop\FRST.exe
2012-10-08 06:43 - 2012-10-08 06:43 - 00195072 ___AH (Microsoft Corporation) C:\Users\Janis\AppData\Roaming\Fztitn.exe
2012-10-07 12:19 - 2012-10-07 12:29 - 00000063 ____A C:\Users\Janis\Desktop\test.bat
2012-10-06 06:03 - 2012-10-06 06:03 - 00342016 ____A (Ufasoft) C:\Users\Janis\AppData\Roaming\BCAD.exe
2012-10-05 12:10 - 2012-10-05 12:10 - 00342016 ____A (Ufasoft) C:\Users\Janis\AppData\Roaming\A303.exe
2012-10-05 12:06 - 2012-10-05 12:06 - 00001237 ____A C:\AdwCleaner[S2].txt
2012-10-05 12:05 - 2012-10-05 12:06 - 00001107 ____A C:\AdwCleaner[R2].txt
2012-10-05 12:04 - 2012-10-05 12:04 - 00000000 ____D C:\32788R22FWJFW
2012-10-04 13:28 - 2012-10-04 13:28 - 00004096 ____A C:\Windows\d3dx.dat
2012-10-04 13:23 - 2012-10-05 12:20 - 00002107 ____A C:\Users\Janis\Desktop\Gothic II - Die Nacht des Raben.lnk
2012-10-04 13:23 - 2012-10-04 13:23 - 00063770 ____A C:\Users\Janis\Desktop\Extras.Txt
2012-10-04 13:23 - 2012-10-04 13:23 - 00002091 ____A C:\Users\Cinema 4D\Desktop\Gothic II - Die Nacht des Raben.lnk
2012-10-04 13:19 - 2012-10-07 11:02 - 00108070 ____A C:\Users\Janis\Desktop\OTL.Txt
2012-10-04 12:25 - 2012-10-04 12:55 - 00000000 ____D C:\ComboFix
2012-10-04 09:54 - 2012-10-04 09:54 - 00021665 ____A C:\Users\Janis\Desktop\AdwCleaner[S1].txt
2012-10-04 09:49 - 2012-10-04 09:50 - 00021665 ____A C:\AdwCleaner[S1].txt
2012-10-04 08:31 - 2012-10-04 08:31 - 00000000 ____D C:\Program Files\JoWooD
2012-10-04 07:56 - 2012-10-04 07:56 - 00021103 ____A C:\AdwCleaner[R1].txt
2012-10-04 07:54 - 2012-10-04 07:54 - 00513501 ____A C:\Users\Janis\Desktop\adwcleaner.exe
2012-10-03 11:16 - 2012-10-03 11:16 - 00019187 ____A C:\Users\Janis\Desktop\ComboFix.txt
2012-10-03 09:00 - 2012-10-03 09:07 - 00000000 ____D C:\Users\Janis\Desktop\Hannah Montana Forever - The Complete Season 4 [WEB-DL]-RDF
2012-10-03 03:19 - 2012-10-03 06:26 - 00000000 ____D C:\Users\Janis\Desktop\Gothic 2Soundtrack
2012-10-03 02:19 - 2012-10-03 06:26 - 00000000 ____D C:\Users\Janis\Desktop\GOTHIC 1+2+3 Original Soundtrack
2012-10-03 01:28 - 2011-06-25 22:45 - 00256000 ____A C:\Windows\PEV.exe
2012-10-03 01:28 - 2010-11-07 09:20 - 00208896 ____A C:\Windows\MBR.exe
2012-10-03 01:28 - 2009-04-19 20:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2012-10-03 01:28 - 2000-08-30 16:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2012-10-03 01:28 - 2000-08-30 16:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2012-10-03 01:28 - 2000-08-30 16:00 - 00098816 ____A C:\Windows\sed.exe
2012-10-03 01:28 - 2000-08-30 16:00 - 00080412 ____A C:\Windows\grep.exe
2012-10-03 01:28 - 2000-08-30 16:00 - 00068096 ____A C:\Windows\zip.exe
2012-10-03 01:21 - 2012-10-04 11:56 - 00000000 ____D C:\Qoobox
2012-10-03 01:20 - 2012-10-03 01:57 - 00000000 ____D C:\Windows\erdnt
2012-10-03 01:19 - 2012-10-04 11:54 - 04762471 ____R (Swearware) C:\Users\Janis\Desktop\ComboFix.exe
2012-10-02 12:06 - 2012-10-02 12:17 - 00003954 ____A C:\Users\Janis\Desktop\Attach.txt
2012-10-02 12:04 - 2012-10-02 12:17 - 00019095 ____A C:\Users\Janis\Desktop\DDS.txt
2012-10-02 07:34 - 2012-10-01 17:26 - 00600064 ____A (OldTimer Tools) C:\Users\Janis\Desktop\OTL.exe
2012-10-01 11:29 - 2012-10-05 12:09 - 00000358 ___AH C:\Windows\Tasks\GBoxUpdaterTask{BB9A370B-C90C-4552-A89E-FF2EBE445C96}.job
2012-10-01 11:29 - 2012-10-01 11:29 - 00000000 ____D C:\Program Files\SProtector
2012-10-01 11:29 - 2012-10-01 11:29 - 00000000 ____D C:\Program Files\GadgetBox
2012-10-01 11:25 - 2012-10-01 11:25 - 00108243 ____A C:\Users\Janis\Documents\Unbenannt.wma
2012-10-01 07:00 - 2012-10-01 07:01 - 00342736 ____A C:\Windows\Minidump\100112-23041-01.dmp
2012-09-30 09:12 - 2012-09-30 09:12 - 00001901 ____A C:\Users\Janis\Desktop\PS3Emu.lnk
2012-09-30 09:11 - 2012-09-30 09:11 - 00000000 ____D C:\Program Files\ps3emu
2012-09-30 09:07 - 2012-09-30 09:10 - 71786357 ____A C:\Users\Janis\Downloads\PS3 emulator WORKING! ps3emu ver. 0.0.0.2 Sony Playstation games ROMs emulation.exe
2012-09-29 12:54 - 2012-09-29 12:52 - 00000229 ____A C:\Users\Janis\Desktop\PSN Codes Generator (1).txt
2012-09-29 12:38 - 2012-09-29 12:38 - 00000000 ____D C:\Users\Janis\Downloads\Vangelis - [Chariots Of Fire][OST] [www.pctorrent.com]
2012-09-29 12:38 - 2012-09-29 12:38 - 00000000 ____D C:\Users\Janis\Desktop\Chariots of Fire
2012-09-29 12:37 - 2012-09-29 12:37 - 00000073 ____A C:\Users\Janis\Downloads\Rapget.txt
2012-09-26 12:48 - 2012-09-26 13:10 - 00441673 ____A C:\Users\Janis\Desktop\m4xfps logo keks.ai
2012-09-22 01:32 - 2012-09-22 01:33 - 00342592 ____A C:\Windows\Minidump\092212-28142-01.dmp
2012-09-20 13:18 - 2012-09-20 13:18 - 00000000 ____D C:\Users\Cinema 4D\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2012-09-20 13:10 - 2012-09-20 13:10 - 00000000 ____D C:\Users\Cinema 4D\AppData\Roaming\MAXON
2012-09-20 13:01 - 2012-09-20 13:01 - 00112400 ____A C:\Users\Cinema 4D\AppData\Local\GDIPFONTCACHEV1.DAT
2012-09-20 13:01 - 2012-09-20 13:01 - 00000000 ____D C:\Users\Cinema 4D\AppData\Roaming\Logitech
2012-09-20 13:00 - 2012-09-20 13:17 - 00000000 ____D C:\Users\Cinema 4D\AppData\Roaming\Adobe
2012-09-20 13:00 - 2012-09-20 13:16 - 00000000 ____D C:\Users\Cinema 4D\AppData\Local\Adobe
2012-09-20 12:59 - 2012-10-03 07:48 - 00000000 __SHD C:\Users\Cinema 4D\Documents\MSDCSC
2012-09-20 12:59 - 2012-09-20 13:00 - 00000000 ____D C:\users\Cinema 4D
2012-09-20 12:59 - 2012-09-20 12:59 - 00000020 __ASH C:\Users\Cinema 4D\ntuser.ini
2012-09-20 12:59 - 2012-03-07 15:54 - 00000000 ____D C:\Users\Cinema 4D\AppData\Roaming\Macromedia
2012-09-18 12:05 - 2012-09-18 12:05 - 00048463 ____A C:\energyreport.html
2012-09-18 11:40 - 2012-09-18 11:40 - 00000000 ____D C:\Windows\Sun
2012-09-17 07:10 - 2012-09-17 07:11 - 00000000 ____D C:\Users\Janis\2012-09-16 time 13_15_46 Outgoing Peer-to-Peer Call killakeks97_data
2012-09-14 08:31 - 2012-09-14 08:31 - 00003033 ____A C:\Users\Janis\Desktop\MP3 Skype Recorder.lnk
2012-09-14 06:57 - 2012-09-14 06:57 - 00000000 ____D C:\Users\Janis\flash-disinfector-
2012-09-13 10:54 - 2012-09-13 10:55 - 01553408 ____A (home-hacks.info) C:\Users\Janis\Downloads\FileIce Sharecash Premium Downloader.exe
2012-09-12 07:53 - 2012-09-12 07:54 - 00000000 ____D C:\Users\Janis\Desktop\Virtual Dub
2012-09-10 10:58 - 2012-06-05 05:13 - 00999999 ____A C:\Users\Janis\Desktop\patch_mp.ff
2012-09-10 10:23 - 2012-09-10 10:23 - 00000000 ____D C:\Users\All Users\ALM
2012-09-10 10:01 - 2012-09-10 10:25 - 00000000 ____D C:\Users\Janis\crack il
2012-09-10 08:14 - 2012-09-10 08:15 - 00000000 ____D C:\Users\Janis\stick musik
2012-09-10 06:48 - 2012-09-26 11:34 - 00000000 ____D C:\Users\All Users\Ralink
2012-09-10 06:45 - 2012-09-10 06:45 - 00000000 ____D C:\Users\All Users\RalinkRT7x Driver
2012-09-10 06:45 - 2010-02-24 05:06 - 00562464 ____A (Ralink Technology, Corp.) C:\Windows\System32\Drivers\netr73.sys
2012-09-10 06:45 - 2010-02-24 04:07 - 00226592 ____A (Ralink Technology, Inc.) C:\Windows\System32\RaCoInst.dll
2012-09-10 06:43 - 2012-09-10 06:43 - 00000000 ____D C:\Program Files\Hama
2012-09-10 06:43 - 2009-12-10 02:16 - 01590560 ____A (Ralink Technology, Corp.) C:\Windows\System32\RaCertMgr.dll
2012-09-10 06:43 - 2009-12-10 02:16 - 00776480 ____A (Ralink Technology, Corp.) C:\Windows\System32\RAIHV.dll
2012-09-10 06:43 - 2009-12-10 02:16 - 00102688 ____A (Ralink Technology, Corp.) C:\Windows\System32\RAEXTUI.dll
2012-09-09 08:03 - 2012-09-09 08:03 - 00001272 ____A C:\Users\Janis\praktikum.txt
2012-09-09 04:16 - 2012-09-09 09:33 - 00000000 ____D C:\Users\Janis\Documents\Skype Call Recordings
2012-09-09 04:12 - 2012-09-20 13:00 - 00000000 ____D C:\Program Files\Skype Recorder
2012-09-09 04:05 - 2012-09-09 04:10 - 02807665 ____A C:\Users\Janis\Downloads\Skype Recorder incl.patch.rar
2012-09-09 04:02 - 2012-09-09 04:02 - 00000153 ____A C:\Users\Janis\settings.bin
2012-09-09 03:59 - 2012-09-09 04:00 - 01750220 ____A C:\Users\Janis\Downloads\MX_Skype_Recorder_3.4___Keygen.rar
2012-09-09 03:56 - 2012-09-09 03:56 - 00000000 ____D C:\Users\Janis\Downloads\Call Recorder for Skype-v2.3.21-Resented
2012-09-08 02:36 - 2012-09-08 02:36 - 08018917 ____A C:\Users\Janis\c scan 1.jdr


==================== 3 Months Modified Files ==================

2012-10-08 06:55 - 2012-03-06 12:49 - 01553716 ____A C:\Windows\WindowsUpdate.log
2012-10-08 06:52 - 2012-03-06 05:33 - 00001068 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2531966209-3547886753-3818554424-1000Core.job
2012-10-08 06:51 - 2012-04-11 15:57 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2012-10-08 06:43 - 2012-10-08 06:43 - 00195072 ___AH (Microsoft Corporation) C:\Users\Janis\AppData\Roaming\Fztitn.exe
2012-10-08 06:43 - 2012-04-16 15:50 - 00001096 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2012-10-08 06:43 - 2012-03-06 05:33 - 00001120 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2531966209-3547886753-3818554424-1000UA.job
2012-10-07 12:29 - 2012-10-07 12:19 - 00000063 ____A C:\Users\Janis\Desktop\test.bat
2012-10-07 11:02 - 2012-10-04 13:19 - 00108070 ____A C:\Users\Janis\Desktop\OTL.Txt
2012-10-07 07:12 - 2012-04-16 15:50 - 00001092 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2012-10-07 05:08 - 2009-07-13 20:39 - 00071339 ____A C:\Windows\setupact.log
2012-10-07 02:37 - 2012-10-08 06:46 - 00905954 ____A (Farbar) C:\Users\Janis\Desktop\FRST.exe
2012-10-06 06:03 - 2012-10-06 06:03 - 00342016 ____A (Ufasoft) C:\Users\Janis\AppData\Roaming\BCAD.exe
2012-10-05 12:20 - 2012-10-04 13:23 - 00002107 ____A C:\Users\Janis\Desktop\Gothic II - Die Nacht des Raben.lnk
2012-10-05 12:14 - 2009-07-13 20:34 - 00014336 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2012-10-05 12:14 - 2009-07-13 20:34 - 00014336 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2012-10-05 12:10 - 2012-10-05 12:10 - 00342016 ____A (Ufasoft) C:\Users\Janis\AppData\Roaming\A303.exe
2012-10-05 12:09 - 2012-10-01 11:29 - 00000358 ___AH C:\Windows\Tasks\GBoxUpdaterTask{BB9A370B-C90C-4552-A89E-FF2EBE445C96}.job
2012-10-05 12:09 - 2009-07-13 20:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2012-10-05 12:08 - 2012-03-07 07:47 - 00726434 ____A C:\Windows\PFRO.log
2012-10-05 12:06 - 2012-10-05 12:06 - 00001237 ____A C:\AdwCleaner[S2].txt
2012-10-05 12:06 - 2012-10-05 12:05 - 00001107 ____A C:\AdwCleaner[R2].txt
2012-10-04 13:28 - 2012-10-04 13:28 - 00004096 ____A C:\Windows\d3dx.dat
2012-10-04 13:23 - 2012-10-04 13:23 - 00063770 ____A C:\Users\Janis\Desktop\Extras.Txt
2012-10-04 13:23 - 2012-10-04 13:23 - 00002091 ____A C:\Users\Cinema 4D\Desktop\Gothic II - Die Nacht des Raben.lnk
2012-10-04 12:50 - 2009-07-13 18:04 - 00000215 ____A C:\Windows\system.ini
2012-10-04 11:54 - 2012-10-03 01:19 - 04762471 ____R (Swearware) C:\Users\Janis\Desktop\ComboFix.exe
2012-10-04 09:54 - 2012-10-04 09:54 - 00021665 ____A C:\Users\Janis\Desktop\AdwCleaner[S1].txt
2012-10-04 09:50 - 2012-10-04 09:49 - 00021665 ____A C:\AdwCleaner[S1].txt
2012-10-04 07:56 - 2012-10-04 07:56 - 00021103 ____A C:\AdwCleaner[R1].txt
2012-10-04 07:54 - 2012-10-04 07:54 - 00513501 ____A C:\Users\Janis\Desktop\adwcleaner.exe
2012-10-03 11:16 - 2012-10-03 11:16 - 00019187 ____A C:\Users\Janis\Desktop\ComboFix.txt
2012-10-02 12:17 - 2012-10-02 12:06 - 00003954 ____A C:\Users\Janis\Desktop\Attach.txt
2012-10-02 12:17 - 2012-10-02 12:04 - 00019095 ____A C:\Users\Janis\Desktop\DDS.txt
2012-10-01 17:26 - 2012-10-02 07:34 - 00600064 ____A (OldTimer Tools) C:\Users\Janis\Desktop\OTL.exe
2012-10-01 11:25 - 2012-10-01 11:25 - 00108243 ____A C:\Users\Janis\Documents\Unbenannt.wma
2012-10-01 07:01 - 2012-10-01 07:00 - 00342736 ____A C:\Windows\Minidump\100112-23041-01.dmp
2012-09-30 09:12 - 2012-09-30 09:12 - 00001901 ____A C:\Users\Janis\Desktop\PS3Emu.lnk
2012-09-30 09:10 - 2012-09-30 09:07 - 71786357 ____A C:\Users\Janis\Downloads\PS3 emulator WORKING! ps3emu ver. 0.0.0.2 Sony Playstation games ROMs emulation.exe
2012-09-29 12:52 - 2012-09-29 12:54 - 00000229 ____A C:\Users\Janis\Desktop\PSN Codes Generator (1).txt
2012-09-29 12:37 - 2012-09-29 12:37 - 00000073 ____A C:\Users\Janis\Downloads\Rapget.txt
2012-09-26 13:10 - 2012-09-26 12:48 - 00441673 ____A C:\Users\Janis\Desktop\m4xfps logo keks.ai
2012-09-26 10:28 - 2009-07-13 20:33 - 03812128 ____A C:\Windows\System32\FNTCACHE.DAT
2012-09-23 10:45 - 2012-03-06 04:21 - 00112408 ____A C:\Users\Janis\AppData\Local\GDIPFONTCACHEV1.DAT
2012-09-22 01:33 - 2012-09-22 01:32 - 00342592 ____A C:\Windows\Minidump\092212-28142-01.dmp
2012-09-21 12:51 - 2012-04-11 15:57 - 00696240 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2012-09-21 12:51 - 2012-04-11 15:57 - 00073136 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2012-09-20 13:01 - 2012-09-20 13:01 - 00112400 ____A C:\Users\Cinema 4D\AppData\Local\GDIPFONTCACHEV1.DAT
2012-09-20 12:59 - 2012-09-20 12:59 - 00000020 __ASH C:\Users\Cinema 4D\ntuser.ini
2012-09-18 12:05 - 2012-09-18 12:05 - 00048463 ____A C:\energyreport.html
2012-09-14 08:31 - 2012-09-14 08:31 - 00003033 ____A C:\Users\Janis\Desktop\MP3 Skype Recorder.lnk
2012-09-13 13:03 - 2012-03-06 04:10 - 01616098 ____A C:\Windows\System32\PerfStringBackup.INI
2012-09-13 10:55 - 2012-09-13 10:54 - 01553408 ____A (home-hacks.info) C:\Users\Janis\Downloads\FileIce Sharecash Premium Downloader.exe
2012-09-09 08:03 - 2012-09-09 08:03 - 00001272 ____A C:\Users\Janis\praktikum.txt
2012-09-09 04:10 - 2012-09-09 04:05 - 02807665 ____A C:\Users\Janis\Downloads\Skype Recorder incl.patch.rar
2012-09-09 04:02 - 2012-09-09 04:02 - 00000153 ____A C:\Users\Janis\settings.bin
2012-09-09 04:00 - 2012-09-09 03:59 - 01750220 ____A C:\Users\Janis\Downloads\MX_Skype_Recorder_3.4___Keygen.rar
2012-09-08 02:36 - 2012-09-08 02:36 - 08018917 ____A C:\Users\Janis\c scan 1.jdr
2012-09-07 07:56 - 2012-09-07 07:56 - 00001765 ____A C:\Users\Janis\Tunatic.lnk
2012-09-04 00:11 - 2012-09-04 00:13 - 00246760 ____A (Oracle Corporation) C:\Windows\System32\javaws.exe
2012-09-04 00:11 - 2012-09-04 00:12 - 00174056 ____A (Oracle Corporation) C:\Windows\System32\javaw.exe
2012-09-04 00:11 - 2012-09-04 00:12 - 00174056 ____A (Oracle Corporation) C:\Windows\System32\java.exe
2012-09-04 00:11 - 2012-09-04 00:12 - 00093672 ____A (Oracle Corporation) C:\Windows\System32\WindowsAccessBridge.dll
2012-09-04 00:11 - 2012-03-06 05:59 - 00821736 ____A (Oracle Corporation) C:\Windows\System32\npdeployJava1.dll
2012-09-04 00:11 - 2012-03-06 05:59 - 00746984 ____A (Oracle Corporation) C:\Windows\System32\deployJava1.dll
2012-09-02 09:28 - 2012-09-02 09:27 - 00342592 ____A C:\Windows\Minidump\090212-22682-01.dmp
2012-08-28 13:51 - 2012-08-28 13:51 - 00007618 ____A C:\Users\Janis\AppData\Local\Resmon.ResmonCfg
2012-08-28 08:28 - 2012-08-28 08:28 - 00001896 ____A C:\Users\Janis\Stronghold_Crusader_Extreme.exe - Verknüpfung.lnk
2012-08-28 08:28 - 2012-08-28 08:28 - 00001824 ____A C:\Users\Janis\Stronghold Crusader.exe - Verknüpfung.lnk
2012-08-24 02:16 - 2009-07-13 20:53 - 00032620 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2012-08-21 09:41 - 2012-08-20 13:57 - 171380715 ____A C:\Users\Janis\Desktop\music mix.yt.wmv
2012-08-20 05:54 - 2012-08-20 05:54 - 00001254 ____A C:\Users\Janis\Desktop\Führerschein-Trainer 2007.lnk
2012-07-16 07:44 - 2012-07-16 07:44 - 00762368 __ASH (Microsoft Corp.) C:\Users\Janis\Desktop\teamspeak-3.exe
2012-07-16 07:44 - 2012-07-16 07:44 - 00762368 __ASH (Microsoft Corp.) C:\Users\Janis\Desktop\teamspeak 3.exe
2012-07-11 12:12 - 2012-06-28 07:26 - 00000025 ____A C:\Windows\popcinfot.dat
2012-07-11 06:06 - 2012-07-11 06:04 - 00418496 ____A C:\Windows\Minidump\071112-29530-01.dmp


==================== Known DLLs (Whitelisted) =================


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2012-10-04 13:05:12
Restore point made on: 2012-10-07 10:55:01

==================== Memory info ===========================

Percentage of memory in use: 35%
Total physical RAM: 1013.95 MB
Available physical RAM: 651.9 MB
Total Pagefile: 1013.95 MB
Available Pagefile: 651.75 MB
Total Virtual: 2047.88 MB
Available Virtual: 1968.7 MB

==================== Partitions =============================

1 Drive c: () (Fixed) (Total:113.64 GB) (Free:13.47 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
2 Drive d: () (Removable) (Total:1.88 GB) (Free:0.66 GB) FAT32
3 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 149 GB 2048 KB
Disk 1 Online 1928 MB 0 B

Partitions of Disk 0:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 OEM 6149 MB 31 KB
Partition 2 Primary 113 GB 6150 MB
Partition 0 Extended 29 GB 119 GB
Partition 5 Logical 8 GB 119 GB
Partition 6 Logical 1012 MB 128 GB
Partition 3 Logical 18 GB 129 GB
Partition 4 Logical 1013 MB 148 GB

=========================================================

Disk: 0
Partition 1
Type : 12
Hidden: Yes
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 PQSERVICE NTFS Partition 6149 MB Healthy Hidden

=========================================================

Disk: 0
Partition 2
Type : 07
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 0 C NTFS Partition 113 GB Healthy

=========================================================

Disk: 0
Partition 5
Type : 83
Hidden: Yes
Active: No

There is no volume associated with this partition.

=========================================================

Disk: 0
Partition 6
Type : 82
Hidden: Yes
Active: No

There is no volume associated with this partition.

=========================================================

Disk: 0
Partition 3
Type : 83
Hidden: Yes
Active: No

There is no volume associated with this partition.

=========================================================

Disk: 0
Partition 4
Type : 82
Hidden: Yes
Active: No

There is no volume associated with this partition.

=========================================================

Partitions of Disk 1:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
* Partition 1 Primary 1928 MB 0 B

=========================================================

Disk: 1
There is no partition selected.

There is no partition selected.
Please select a partition and try again.

=========================================================

Last Boot: 2012-10-06 05:56

==================== End Of Log ============================

Wofür mach ich mir eigentlich die ganze Arbeit.....

Wieso? Soll ich das jetzt löschen oder was?

Hier gehts weiter, lies mal:

http://www.trojaner-board.de/95394-c...-software.html

Aber an dem Virus ist doch nicht der Keygen schuld oder?

Weiss man nicht, ist aber auch nur sekundär. Wir dürfen bei Keygen-Funden nicht weiter supporten, da wir uns dann durch dulden des Keygens mit strafbar machen.

Aber in aller regel sind die Keygens durch die Bank verseucht.