Entfernen des Mediashifting Problems was kann ich tun?

DJ Thomas

Hallo Leute,

tja mir isses nun auch passiert....

hab ein bissl rumgelsen und führe grad ein scan mit dem eset online scanner durch... läuft noch... schon ne stunde und 10 minuten...

schon 20 funde...

helft mir...

danke schonmal...

gruß
thomas

mittlerweile 37

ich brauch die daten, die sich auf diesen rechner befinden... mist mist

keiner da um mir zu helfen???

C:\hr.exe a variant of MSIL/Injector.QA trojan
C:\$Recycle.Bin\S-1-5-21-2072944156-1722260082-2352646905-1001\$RG068LS.exe a variant of MSIL/Injector.QA trojan
C:\Program Files (x86)\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll a variant of Win32/Adware.Toolbar.Dealio application
C:\Program Files (x86)\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.5 a variant of Win32/Adware.Toolbar.Dealio application
C:\Program Files (x86)\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.6 a variant of Win32/Adware.Toolbar.Dealio application
C:\Program Files (x86)\Windows iLivid Toolbar\Datamngr\BrowserConnection.dll Win32/Toolbar.SearchSuite application
C:\Program Files (x86)\Windows iLivid Toolbar\Datamngr\datamngr.dll a variant of Win32/Toolbar.SearchSuite application
C:\Program Files (x86)\Windows iLivid Toolbar\Datamngr\datamngrUI.exe a variant of Win32/Toolbar.SearchSuite application
C:\Program Files (x86)\Windows iLivid Toolbar\Datamngr\DnsBHO.dll probably a variant of Win32/Toolbar.SearchSuite application
C:\Program Files (x86)\Windows iLivid Toolbar\Datamngr\IEBHO.dll probably a variant of Win32/Toolbar.SearchSuite application
C:\Program Files (x86)\Windows iLivid Toolbar\Datamngr\x64\BrowserConnection.dll Win64/Toolbar.SearchSuite application
C:\Program Files (x86)\Windows iLivid Toolbar\Datamngr\x64\datamngr.dll Win64/Toolbar.SearchSuite application
C:\Program Files (x86)\Windows iLivid Toolbar\Datamngr\x64\datamngrUI.exe Win64/Toolbar.SearchSuite application
C:\Program Files (x86)\Windows iLivid Toolbar\Datamngr\x64\DnsBHO.dll Win64/Toolbar.SearchSuite application
C:\Program Files (x86)\Windows iLivid Toolbar\Datamngr\x64\IEBHO.dll Win64/Toolbar.SearchSuite application
C:\Program Files (x86)\YouTube Downloader Toolbar\IE\4.6\youtubedownloaderToolbarIE.dll a variant of Win32/Adware.Toolbar.Dealio application
C:\Users\RgwdVP.exe a variant of MSIL/Injector.QA trojan
C:\Users\Thomas Müller\AppData\Local\bcf4546e\X Win64/Sirefef.Q trojan
C:\Users\Thomas Müller\AppData\Local\bcf4546e\U\800000cb.@ Win64/Sirefef.M trojan
C:\Users\Thomas Müller\AppData\Local\bcf4546e\U\800000cf.@ Win64/Sirefef.U trojan
C:\Users\Thomas Müller\AppData\Local\Temp\firefox a variant of MSIL/Injector.PZ trojan
C:\Users\Thomas Müller\AppData\Local\Temp\hr.exe a variant of MSIL/Injector.QA trojan
C:\Users\Thomas Müller\AppData\Local\Temp\jar_cache1034482044683385733.tmp Java/TrojanDownloader.OpenStream.NCP trojan
C:\Users\Thomas Müller\AppData\Local\Temp\jar_cache1269496273037550456.tmp Java/TrojanDownloader.OpenStream.NCP trojan
C:\Users\Thomas Müller\AppData\Local\Temp\jar_cache2420560901564793400.tmp Java/TrojanDownloader.OpenStream.NCP trojan
C:\Users\Thomas Müller\AppData\Local\Temp\jar_cache4924036918643691106.tmp Java/TrojanDownloader.OpenStream.NCP trojan
C:\Users\Thomas Müller\AppData\Local\Temp\jar_cache549357594371242092.tmp Java/TrojanDownloader.OpenStream.NCP trojan
C:\Users\Thomas Müller\AppData\Local\Temp\jar_cache6004839121968335053.tmp a variant of Win32/Kryptik.TKD trojan
C:\Users\Thomas Müller\AppData\Local\Temp\jar_cache6269446164212469448.tmp Java/TrojanDownloader.OpenStream.NCP trojan
C:\Users\Thomas Müller\AppData\Local\Temp\jar_cache915438334708078847.tmp Java/TrojanDownloader.OpenStream.NCP trojan
C:\Users\Thomas Müller\AppData\Local\Temp\mCjVbAmEnFgExQnTbKpLsQeIwYrAfMhReByVjQnYpRoNcQpJhDcUuCqXvXrSmQySpMbVcPsDuUaKhP.exe a variant of MSIL/Injector.PZ trojan
C:\Users\Thomas Müller\AppData\Local\Temp\SetupDataMngr_Searchqu.exe a variant of Win32/Toolbar.SearchSuite application
C:\Users\Thomas Müller\AppData\Local\Temp\vstuz2q1\yyvajf5y.exe a variant of MSIL/Injector.OK trojan
C:\Users\Thomas Müller\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26\79b38c5a-359024d8 Java/Exploit.CVE-2011-3544.AC trojan
C:\Users\Thomas Müller\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44\3921516c-21393be7 a variant of Java/TrojanDownloader.OpenStream.NCP trojan
C:\Users\Thomas Müller\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44\4ba1196c-2a1cc55c a variant of Java/Agent.BR trojan
C:\Users\Thomas Müller\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8\6f6518c8-1a5b8e9d Java/TrojanDownloader.OpenStream.NCP trojan
C:\Users\Thomas Müller\AppData\Roaming\Microsoft\Windows\Start Menu\Programsexplorer.exe a variant of MSIL/Injector.QA trojan
C:\Windows\Installer\1329c.msi a variant of Win32/Adware.Toolbar.Dealio application
Operating memory multiple threats

das oben hat der eset scanner berichtet.... und nun???

hier mal was ich mit aswmbr rausgefunden habe:

aswMBR version 0.9.9.1532 Copyright(c) 2011 AVAST Software
Run date: 2012-01-28 04:44:44
-----------------------------
04:44:44.496 OS Version: Windows x64 6.1.7601 Service Pack 1
04:44:44.496 Number of processors: 4 586 0x1707
04:44:44.497 ComputerName: THOMASMÜLLER-PC UserName: Thomas Müller
04:44:46.040 Initialize success
04:50:32.371 AVAST engine defs: 12012701
04:50:51.452 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000056
04:50:51.454 Disk 0 Vendor: WDC_WD10 01.0 Size: 953869MB BusType: 3
04:50:51.465 Disk 0 MBR read successfully
04:50:51.468 Disk 0 MBR scan
04:50:51.510 Disk 0 Windows 7 default MBR code
04:50:51.532 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
04:50:51.552 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 953767 MB offset 206848
04:50:51.558 Service scanning
04:50:55.765 Modules scanning
04:50:55.769 Disk 0 trace - called modules:
04:50:55.798 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys storport.sys hal.dll nvstor64.sys
04:50:55.803 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004a22060]
04:50:55.807 3 CLASSPNP.SYS[fffff8800198443f] -> nt!IofCallDriver -> [0xfffffa80043b76b0]
04:50:55.813 5 ACPI.sys[fffff88000f947a1] -> nt!IofCallDriver -> \Device\00000056[0xfffffa80043b89c0]
04:50:57.234 AVAST engine scan C:\Windows
04:51:00.710 AVAST engine scan C:\Windows\system32
04:58:58.603 AVAST engine scan C:\Windows\system32\drivers
04:59:20.095 AVAST engine scan C:\Users\Thomas Müller
04:59:27.584 File: C:\Users\Thomas Müller\AppData\Local\bcf4546e\U\800000cb.@ **INFECTED** Win32:Malware-gen
04:59:27.629 File: C:\Users\Thomas Müller\AppData\Local\bcf4546e\U\800000cf.@ **INFECTED** Win32:Malware-gen
04:59:27.697 File: C:\Users\Thomas Müller\AppData\Local\bcf4546e\X **INFECTED** Win32:Sirefef-IX [Trj]
04:59:54.860 Verifying
05:00:04.906 Disk 0 Windows 601 MBR fixed successfully
05:00:20.306 Disk 0 MBR has been saved successfully to "C:\Users\Thomas Müller\Desktop\MBR.dat"
05:00:20.314 The log file has been saved successfully to "C:\Users\Thomas Müller\Desktop\aswMBR.txt"