![]() |
|
Plagegeister aller Art und deren Bekämpfung: Beiträge bei Wordpress teilen mit dem Facebook ButtonWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
![]() | #13 |
![]() ![]() | ![]() Beiträge bei Wordpress teilen mit dem Facebook Button so nun bin ich soweit: All processes killed ========== OTL ========== HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Page| /E : value set successfully! HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully! Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully. Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{81017EA9-9AA8-4A6A-9734-7AF40E7D593F} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}\ deleted successfully. C:\Programme\Yahoo!\Companion\Installs\cpn0\YTNavAssist.dll moved successfully. Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{855F3B16-6D32-4fe6-8A56-BBB695989046} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ deleted successfully. C:\Programme\ICQ6Toolbar\ICQToolBar.dll moved successfully. HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully! HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully! Prefs.js: "ICQ Search" removed from browser.search.defaultenginename Prefs.js: "ICQ Search" removed from browser.search.selectedEngine Prefs.js: "hxxp://sammeln.shop.ebay.de/Originale-/8863/i.html?_trkparms=65%253A12%257C66%253A2%257C39%253A1%257C72%253A1229&_dmd=1&_dmpt=Reklame_Werbung&_mdo=Sammeln-Seltenes&_mspp=&_pcats=100074%2C8861%2C19823%2C1&_trksid=p3286.c0.m14&_sop=10&_sc=1" removed from browser.startup.homepage Prefs.js: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.9&q=" removed from keyword.URL C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\lhmml72m.default\searchplugins\icqplugin-1.xml moved successfully. C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\lhmml72m.default\searchplugins\icqplugin-10.xml moved successfully. C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\lhmml72m.default\searchplugins\icqplugin-2.xml moved successfully. C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\lhmml72m.default\searchplugins\icqplugin-3.xml moved successfully. C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\lhmml72m.default\searchplugins\icqplugin-4.xml moved successfully. C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\lhmml72m.default\searchplugins\icqplugin-5.xml moved successfully. C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\lhmml72m.default\searchplugins\icqplugin-6.xml moved successfully. C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\lhmml72m.default\searchplugins\icqplugin-7.xml moved successfully. C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\lhmml72m.default\searchplugins\icqplugin-8.xml moved successfully. C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\lhmml72m.default\searchplugins\icqplugin-9.xml moved successfully. C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\lhmml72m.default\searchplugins\icqplugin.xml moved successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully. C:\Programme\Yahoo!\Companion\Installs\cpn0\yt.dll moved successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}\ deleted successfully. C:\Programme\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll moved successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{855F3B16-6D32-4FE6-8A56-BBB695989046} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}\ not found. File C:\Programme\ICQ6Toolbar\ICQToolBar.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{EE5D279F-081B-4404-994D-C6B60AAEBA6D} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EE5D279F-081B-4404-994D-C6B60AAEBA6D}\ deleted successfully. File To-Page\EPSON Web-To-Page.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ deleted successfully. File C:\Programme\Yahoo!\Companion\Installs\cpn0\yt.dll not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EE5D279F-081B-4404-994D-C6B60AAEBA6D} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EE5D279F-081B-4404-994D-C6B60AAEBA6D}\ not found. File To-Page\EPSON Web-To-Page.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Wise-FTP Scheduler deleted successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\MP4 Player deleted successfully. C:\Programme\MP4 Player\Mp4Player.exe moved successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Search Protection deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully! C:\AUTOEXEC.BAT moved successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8e651080-a041-11de-b69a-00123f954a14}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8e651080-a041-11de-b69a-00123f954a14}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8e651080-a041-11de-b69a-00123f954a14}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8e651080-a041-11de-b69a-00123f954a14}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8e651080-a041-11de-b69a-00123f954a14}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8e651080-a041-11de-b69a-00123f954a14}\ not found. File E:\preinst.exe not found. C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Bicygi folder moved successfully. C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Rougyd folder moved successfully. C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\aewc folder moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Admin ->Temp folder emptied: 3930835152 bytes ->Temporary Internet Files folder emptied: 867021598 bytes ->Java cache emptied: 35489334 bytes ->FireFox cache emptied: 152820117 bytes ->Google Chrome cache emptied: 37400174 bytes ->Flash cache emptied: 141994 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: LocalService ->Temp folder emptied: 66016 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 50419565 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 2134333 bytes %systemroot%\System32 .tmp files removed: 4528519 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 142850383 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 4.982,00 mb C:\WINDOWS\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully OTL by OldTimer - Version 3.2.31.0 log created on 11042011_125204 Files\Folders moved on Reboot... File\Folder C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\G53SL22B\xG397dIZNTE09PVdTaWj7lnMXPoj7PvgOwB9B2Z4Ng0yJW6yn1zg9cK3snwTioP3DLdwauRL3zDhiWq7HJflZU62yvItvrXm75hZ1z8H5_8Ua1b3jXyGznVll80 iVf1VtpW8uegrYTBpf8lKiVAyliWmSmUV65CtpG5xCB28d16VI[1].png not found! Registry entries deleted on Reboot... Danke für deine Geduld |
Themen zu Beiträge bei Wordpress teilen mit dem Facebook Button |
andere, automatisch, beitrag, beiträge, button, englische, englischen, gehackt, gepostet, gestern, inhalte, klicke, maleware, nutze, original, plugin, problem, profile, seite, seiten, server, teile, teilen, this, veränderungen, wordpress |