hier der FIX Logfile:
Zitat:
All processes killed
========== OTL ==========
File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\A4cHG1xjEsvMYi not found.
File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~A4cHG1xjEsvMYi not found.
File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~A4cHG1xjEsvMYir not found.
File C:\Dokumente und Einstellungen\Markus\Desktop\System Restore.lnk not found.
Unable to delete ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:B0A96209 .
Unable to delete ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP FC5A2B2 .
========== FILES ==========
File\Folder c:\dokumente und einstellungen\Markus\Desktop\0*.exe not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Administrator.MARKUS-33DAF62D
->Temporary Internet Files folder emptied: 0 bytes
User: Administrator.MARKUS-33DAF62D.000
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 62447 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: elephant
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: guelle
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: knoffhoff
->Temporary Internet Files folder emptied: 0 bytes
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: Markus
->Temp folder emptied: 2100334 bytes
->Temporary Internet Files folder emptied: 62944485 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 81498185 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 2243 bytes
User: Markus.MARKUS-33DAF62D
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 140,00 mb
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
OTL by OldTimer - Version 3.2.31.0 log created on 11162011_094536
Files\Folders moved on Reboot...
File\Folder C:\Dokumente und Einstellungen\Markus\Lokale Einstellungen\Temporary Internet Files\Content.IE5\UTBKSI03\CA2VGLA3.htm not found!
C:\Dokumente und Einstellungen\Markus\Lokale Einstellungen\Temporary Internet Files\Content.IE5\UTBKSI03\CAJC1L70.php moved successfully.
File\Folder C:\Dokumente und Einstellungen\Markus\Lokale Einstellungen\Temporary Internet Files\Content.IE5\UTBKSI03\CAXD9FUQ.htm not found!
C:\Dokumente und Einstellungen\Markus\Lokale Einstellungen\Temporary Internet Files\Content.IE5\IHQ3KTQV\CAEH0VKB.htm moved successfully.
C:\Dokumente und Einstellungen\Markus\Lokale Einstellungen\Temporary Internet Files\Content.IE5\IHQ3KTQV\khloe-kardashian-kendall-jenner-sweet-16-birthday-34-580x384[1] moved successfully.
C:\Dokumente und Einstellungen\Markus\Lokale Einstellungen\Temporary Internet Files\Content.IE5\IHQ3KTQV\si[1].htm moved successfully.
C:\Dokumente und Einstellungen\Markus\Lokale Einstellungen\Temporary Internet Files\Content.IE5\IHQ3KTQV\tradegothicltstd-bdcn20-webfont[1].eot moved successfully.
C:\Dokumente und Einstellungen\Markus\Lokale Einstellungen\Temporary Internet Files\Content.IE5\IHQ3KTQV\trade_gothic_condensed_18-webfont[1].eot moved successfully.
C:\Dokumente und Einstellungen\Markus\Lokale Einstellungen\Temporary Internet Files\Content.IE5\7Z69JLLD\khloe-kardashian-kendall-jenner-sweet-16-birthday-34-580x384[1] moved successfully.
C:\Dokumente und Einstellungen\Markus\Lokale Einstellungen\Temporary Internet Files\Content.IE5\7Z69JLLD\sh68[1].htm moved successfully.
Registry entries deleted on Reboot...
|
Unten neben "START" erscheint noch ein icon mit "System Restore" in der leiste - die 0.40....exe datei ist vom Desktop verschwunden.
16.11.2011, 09:55
![EXP/Pidief.hdi [EXPLOIT] Problem - Standard](images/icons/icon1.gif){kind=icon}
![EXP/Pidief.hdi [EXPLOIT] Problem](iconimages/log-analyse-auswertung/exp-pidief-hdi-exploit-problem_ltr.gif)
Baum-Darstellung