Schönen guten Tag,

auf dem PC eines Freundes tritt folgendes Problem auf (Windows 7 Starter):

Nach der Benutzeranmeldung ist der Bildschirm weiß und es steht in Englisch und Deutsch "Please wait while the connection is beeing established" bzw "Bitte warten Sie während die Verbindung hergestellt wird". Der Taskmanager lässt sich nicht öffnen.

Im Anhang das Logfile vom OTL Scan!

Vielen Dank im Voraus!

LG Jalal

hi
auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort
rein:

:OTL
O4 - HKU\Chefin_ON_C..\Run: [5kS43ADO0bzprWo] C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe (QRPU)
O4 - HKU\Chef_ON_C..\Run: [yiSNUTyakcfEQv.exe] C:\ProgramData\yiSNUTyakcfEQv.exe ()
O4 - HKU\AssistentIn_ON_C..\Run: [HPADVISOR]  File not found
O4 - HKU\Chef_ON_C..\Run: [5kS43ADO0bzprWo] C:\Users\Chef\AppData\Roaming\soundblaster_fx648.exe (QRPU)
O4 - HKLM..\Run: [5kS43ADO0bzprWo] C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe (QRPU)
O7 - HKU\Chef_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\Chef_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\Chef_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O7 - HKU\Chefin_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\Chefin_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\Chefin_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O20 - HKLM Winlogon: Shell - (C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe) - C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe (QRPU)
O20 - HKLM Winlogon: UserInit - (C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe) - C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe (QRPU)
O20 - HKU\Chef_ON_C Winlogon: Shell - (C:\Users\Chef\AppData\Roaming\soundblaster_fx648.exe) - C:\Users\Chef\AppData\Roaming\soundblaster_fx648.exe (QRPU)
O20 - HKU\Chef_ON_C Winlogon: UserInit - (C:\Users\Chef\AppData\Roaming\soundblaster_fx648.exe) - C:\Users\Chef\AppData\Roaming\soundblaster_fx648.exe (QRPU)
O20 - HKU\Chefin_ON_C Winlogon: Shell - (C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe) - C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe (QRPU)
O20 - HKU\Chefin_ON_C Winlogon: UserInit - (C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe) - C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe (QRPU)

:Files
C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe
C:\ProgramData\yiSNUTyakcfEQv.exe
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache
c:\Users\Chefin\AppData\LocalLow\Sun\Java\Deployment\cache
:Commands
[Reboot]
         

dieses speicherst du auf nem usb stick als fix.txt
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist.
• Klicke nun bitte auf den Fix Button.
es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick.
wenn dies nicht funktioniert, bitte den fix manuell eintragen.
dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen,
log posten bitte.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!



Drücke bitte die + E Taste.

• Öffne dein Systemlaufwerk ( meistens C: )
• Suche nun
  folgenden Ordner: _OTL und öffne diesen.
• Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner
• 
  Dies wird eine Movedfiles.zip Datei in _OTL erstellen
• Lade diese bitte in unseren Uploadchannel
  hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )

Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus

Hallo,

vielen Dank für deine Antwort!
Ich habe den fix ausgeführt jedoch kommt beim Neustart nach dem Anmeldefenster nur ein blauer Bildschirm mit dem Mauszeiger (ohne Symbole). Einen Rechtsklick nimmt er nicht an und den Task-Manager kann ich auch nicht starten ("Der Task-Manager wurde durch den Administrator deaktiviert.")

Nach dem Fix, folgender Log:


========== OTL ==========
Registry value HKEY_USERS\Chefin_ON_C\Software\Microsoft\Windows\CurrentVersion\Run\\5kS43ADO0bzprWo deleted successfully.
C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe moved successfully.
Registry value HKEY_USERS\Chef_ON_C\Software\Microsoft\Windows\CurrentVersion\Run\\yiSNUTyakcfEQv.exe deleted successfully.
C:\ProgramData\yiSNUTyakcfEQv.exe moved successfully.
Registry value HKEY_USERS\AssistentIn_ON_C\Software\Microsoft\Windows\CurrentVersion\Run\\HPADVISOR deleted successfully.
Registry value HKEY_USERS\Chef_ON_C\Software\Microsoft\Windows\CurrentVersion\Run\\5kS43ADO0bzprWo deleted successfully.
C:\Users\Chef\AppData\Roaming\soundblaster_fx648.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\5kS43ADO0bzprWo deleted successfully.
File C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe not found.
Registry value HKEY_USERS\Chef_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDesktop deleted successfully.
Registry value HKEY_USERS\Chef_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableRegistryTools deleted successfully.
Registry value HKEY_USERS\Chefin_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDesktop deleted successfully.
Registry value HKEY_USERS\Chefin_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableTaskMgr deleted successfully.
Registry value HKEY_USERS\Chefin_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableRegistryTools deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe deleted successfully.
File C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit:C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe deleted successfully.
File C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe not found.
Registry value HKEY_USERS\Chef_ON_C\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Users\Chef\AppData\Roaming\soundblaster_fx648.exe deleted successfully.
File C:\Users\Chef\AppData\Roaming\soundblaster_fx648.exe not found.
Registry value HKEY_USERS\Chef_ON_C\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit:C:\Users\Chef\AppData\Roaming\soundblaster_fx648.exe deleted successfully.
File C:\Users\Chef\AppData\Roaming\soundblaster_fx648.exe not found.
Registry value HKEY_USERS\Chefin_ON_C\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe deleted successfully.
File C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe not found.
Registry value HKEY_USERS\Chefin_ON_C\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit:C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe deleted successfully.
File C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe not found.
========== FILES ==========
File\Folder C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe not found.
File\Folder C:\ProgramData\yiSNUTyakcfEQv.exe not found.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\tmp folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache folder moved successfully.
File\Folder c:\Users\Chefin\AppData\LocalLow\Sun\Java\Deployment\cache not found.
Error: Unable to interpret <:Commands
[Reboot]> in the current context!

OTLPE by OldTimer - Version 3.1.48.0 log created on 04202012_163809


Vielen Dank für deine Hilfe!

hi
dann erstelle noch mal ein neues otl log bitte und poste es

Hallo,
als user habe ich "systemprofile" ausgewählt.
Danke!

auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort
rein:

:OTL
O4 - HKLM..\Run: [5kS43ADO0bzprWo]  File not found
O4 - HKU\Chef_ON_C..\Run: [5kS43ADO0bzprWo]  File not found
O4 - HKU\Chef_ON_C..\Run: [yiSNUTyakcfEQv.exe]  File not found
O4 - HKU\Chefin_ON_C..\Run: [5kS43ADO0bzprWo]  File not found
O7 - HKU\Chef_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\Chef_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\Chef_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O7 - HKU\Chefin_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\Chefin_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\Chefin_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O20 - HKLM Winlogon: Shell - (C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe) -  File not found
O20 - HKLM Winlogon: UserInit - (C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe) -  File not found
O20 - HKU\Chef_ON_C Winlogon: Shell - (C:\Users\Chef\AppData\Roaming\soundblaster_fx648.exe) -  File not found
O20 - HKU\Chef_ON_C Winlogon: UserInit - (C:\Users\Chef\AppData\Roaming\soundblaster_fx648.exe) -  File not found
O20 - HKU\Chefin_ON_C Winlogon: Shell - (C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe) -  File not found
O20 - HKU\Chefin_ON_C Winlogon: UserInit - (C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe) -  File not found
:Files
:Commands
[Reboot]
         

dieses speicherst du auf nem usb stick als fix.txt
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist.
• Klicke nun bitte auf den Fix Button.
es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick.
wenn dies nicht funktioniert, bitte den fix manuell eintragen.
dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen,
log posten bitte.



wenn es keine desktop symbole gibt, und rechtsklick nicht funktioniert, teste außerdem ob der taskmanager geht

Hallo,

ist unverändert, taskmanager geht leider auch nicht.

Danke!

kannst du mal trotzdem moved files packen und hochladen?

soeben hochgeladen

ok.
teste mal folgendes, starte neu, drücke f8 wähle abgesicherter modus mit eingabeaufforderung.
wenn der funktioniert, kopierst du combofix auf nen stick, steckst den stick in das infizierte gerät
schreibe:
d:\combofix.exe
enter
falls das nicht klappt.
e:\combofix.exe
enter
bis du das richtige laufwerk hast
falls nen aktieves av angezeigt wird, mit ok überspringen.
durchlaufen lassen, in den normal modus starten log posten

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2


WICHTIG - Speichere Combofix auf deinem Desktop

• Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Danke, Danke, Danke, Danke!! Funktioniert wieder!

ich werde euch was spenden!

Logfile:

ComboFix 12-04-20.03 - Chef 21.04.2012 3:50:25.1.2 - x86 MINIMAL
MicrosoftÆ Windows Vistaô Home Premium 6.0.6002.2.1252.43.1031.18.3069.2612 [GMT 2:00]
ausgef¸hrt von:: F:\ComboFix.exe
AV: AntiVir Desktop *Enabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Enabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}


(((((((((((((((((((((((((((((((((((( Weitere Lˆschungen ))))))))))))))))))))))))))))))))))))))))))))))))


C:\Windows\security\Database\tmp.edb

danke, aber das log ist unvollständig, hänge es mal als txt hier an

Hallo,
hier das Logfile, glaub es is vollständig...
Danke

führe es noch mal aus bitte.

Combofix Logfile:

ComboFix 12-04-20.03 - Chef 23.04.2012   2:37.1.2 - x86
MicrosoftÆ Windows Vistaô Home Premium   6.0.6002.2.1252.43.1031.18.3069.1882 [GMT 2:00]
ausgef¸hrt von:: F:\ComboFix.exe
AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Lˆschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Vorheriger Suchlauf -------
.
c:\windows\security\Database\tmp.edb
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-03-23 bis 2012-04-23  ))))))))))))))))))))))))))))))
.
.
2012-04-23 00:46 . 2012-04-23 00:46	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-04-23 00:46 . 2012-04-23 00:46	--------	d-----w-	c:\users\Chef\AppData\Local\temp
2012-04-23 00:46 . 2012-04-23 00:46	--------	d-----w-	c:\users\AssistentIn\AppData\Local\temp
2012-04-19 01:55 . 2011-07-13 02:55	2237440	----a-r-	C:\OTLPE.exe
2012-04-19 01:55 . 2012-04-21 06:38	--------	d-----w-	C:\_OTL
2012-04-17 15:41 . 2012-04-19 01:48	--------	d-----w-	c:\users\Chefin
2012-04-17 08:08 . 2012-03-14 02:15	6582328	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{FBA631C4-4D49-4648-8BD8-CDEE02201F57}\mpengine.dll
2012-04-12 08:12 . 2012-02-29 15:11	5120	----a-w-	c:\windows\system32\wmi.dll
2012-04-12 08:12 . 2012-02-29 15:11	172032	----a-w-	c:\windows\system32\wintrust.dll
2012-04-12 08:12 . 2012-02-29 15:09	157696	----a-w-	c:\windows\system32\imagehlp.dll
2012-04-12 08:12 . 2012-02-29 13:32	12800	----a-w-	c:\windows\system32\drivers\fs_rec.sys
2012-04-12 08:11 . 2012-03-06 06:39	3602816	----a-w-	c:\windows\system32\ntkrnlpa.exe
2012-04-12 08:11 . 2012-03-06 06:39	3550080	----a-w-	c:\windows\system32\ntoskrnl.exe
2012-04-11 08:51 . 2012-03-01 11:01	2409784	----a-w-	c:\program files\Windows Mail\OESpamFilter.dat
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-09 11:58 . 2012-03-09 11:58	161792	----a-w-	c:\windows\system32\msls31.dll
2012-03-09 11:58 . 2012-03-09 11:58	86528	----a-w-	c:\windows\system32\iesysprep.dll
2012-03-09 11:58 . 2012-03-09 11:58	76800	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2012-03-09 11:58 . 2012-03-09 11:58	74752	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2012-03-09 11:58 . 2012-03-09 11:58	48640	----a-w-	c:\windows\system32\mshtmler.dll
2012-03-09 11:58 . 2012-03-09 11:58	63488	----a-w-	c:\windows\system32\tdc.ocx
2012-03-09 11:58 . 2012-03-09 11:58	367104	----a-w-	c:\windows\system32\html.iec
2012-03-09 11:58 . 2012-03-09 11:58	74752	----a-w-	c:\windows\system32\iesetup.dll
2012-03-09 11:58 . 2012-03-09 11:58	420864	----a-w-	c:\windows\system32\vbscript.dll
2012-03-09 11:58 . 2012-03-09 11:58	23552	----a-w-	c:\windows\system32\licmgr10.dll
2012-03-09 11:58 . 2012-03-09 11:58	152064	----a-w-	c:\windows\system32\wextract.exe
2012-03-09 11:58 . 2012-03-09 11:58	150528	----a-w-	c:\windows\system32\iexpress.exe
2012-03-09 11:58 . 2012-03-09 11:58	142848	----a-w-	c:\windows\system32\ieUnatt.exe
2012-03-09 11:58 . 2012-03-09 11:58	11776	----a-w-	c:\windows\system32\mshta.exe
2012-03-09 11:58 . 2012-03-09 11:58	101888	----a-w-	c:\windows\system32\admparse.dll
2012-03-09 11:58 . 2012-03-09 11:58	35840	----a-w-	c:\windows\system32\imgutil.dll
2012-03-09 11:58 . 2012-03-09 11:58	110592	----a-w-	c:\windows\system32\IEAdvpack.dll
2012-02-23 08:18 . 2009-10-08 12:32	237072	------w-	c:\windows\system32\MpSigStub.exe
2012-02-14 15:45 . 2012-03-14 09:58	219648	----a-w-	c:\windows\system32\d3d10_1core.dll
2012-02-14 15:45 . 2012-03-14 09:58	160768	----a-w-	c:\windows\system32\d3d10_1.dll
2012-02-14 10:09 . 2012-02-14 10:09	1070352	----a-w-	c:\windows\system32\MSCOMCTL.OCX
2012-02-13 14:12 . 2012-03-14 09:58	1172480	----a-w-	c:\windows\system32\d3d10warp.dll
2012-02-13 13:47 . 2012-03-14 09:58	683008	----a-w-	c:\windows\system32\d2d1.dll
2012-02-13 13:44 . 2012-03-14 09:58	1068544	----a-w-	c:\windows\system32\DWrite.dll
2012-02-02 15:16 . 2012-03-14 09:58	2044416	----a-w-	c:\windows\system32\win32k.sys
2009-11-17 13:01 . 2010-08-17 14:06	1456640	----a-w-	c:\program files\Common Files\Falk Navi-Manager.msi
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Eintr‰ge & legitime Standardeintr‰ge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-01-03 1514152]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2012-01-03 15:31	1514152	----a-w-	c:\program files\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-01-03 1514152]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-01-03 1514152]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	----a-w-	c:\users\Chef\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	----a-w-	c:\users\Chef\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	----a-w-	c:\users\Chef\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	----a-w-	c:\users\Chef\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"Akamai NetSession Interface"="c:\users\Chef\AppData\Local\Akamai\netsession_win.exe" [2012-03-13 3331872]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]
"KBD"="c:\program files\Hewlett-Packard\KBD\KbdStub.EXE" [2008-07-21 12288]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-15 13539872]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-15 92704]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]
"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-13 210216]
"UpdatePDIRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-06-13 210216]
"UpdatePSTShortCut"="c:\program files\CyberLink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe" [2008-09-11 210216]
"TSMAgent"="c:\program files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe" [2008-10-17 1152296]
"CLMLServer for HP TouchSmart"="c:\program files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe" [2008-10-17 189736]
"SmartMenu"="c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [2008-09-23 912688]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2008-01-21 215552]
"DVDAgent"="c:\program files\Hewlett-Packard\Media\DVD\DVDAgent.exe" [2009-09-09 1148200]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-01-12 49208]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]
"ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe" [2012-01-03 1391272]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
.
c:\users\Chef\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Chef\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-2-15 24246216]
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-12-15 384000]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
HPService	REG_MULTI_SZ   	HPSLPSVC
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc
WindowsMobile	REG_MULTI_SZ   	wcescomm rapimgr
LocalServiceRestricted	REG_MULTI_SZ   	WcesComm RapiMgr
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
Akamai	REG_MULTI_SZ   	Akamai
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
ezSharedSvc
.
Inhalt des "geplante Tasks" Ordners
.
2012-04-16 c:\windows\Tasks\HPCeeScheduleForChef.job
- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2008-12-23 10:12]
.
2012-04-18 c:\windows\Tasks\PCDRScheduledMaintenance.job
- c:\program files\PC-Doctor for Windows\pcdr5cuiw32.exe [2008-09-10 14:43]
.
.
------- Zus‰tzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.at/
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_at&c=91&bd=Pavilion&pf=cndt
uInternet Settings,ProxyServer = 213.168.187.130:3128
uInternet Settings,ProxyOverride = 127.0.0.1:9421;<local>
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &AOL Toolbar-Suche - c:\programdata\AOL\ieToolbar\resources\de-AT\local\search.html
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Chef\AppData\Roaming\Mozilla\Firefox\Profiles\9xvefvf3.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.at/
FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=ORJ&o=100000027&locale=de_US&apn_uid=D7835F87-90C6-4A19-8417-848742F93F45&apn_ptnrs=U3&apn_sauid=2A3B1E6A-DA7C-450F-84C9-E7D22ED48970&apn_dtid=OSJ000SSAT&&q=
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
.
------- Dateityp-Verkn¸pfung -------
.
.scr=AutoCADScriptFile
.
- - - - Entfernte verwaiste Registrierungseintr‰ge - - - -
.
HKCU-Run-5kS43ADO0bzprWo - c:\users\Chef\AppData\Roaming\soundblaster_fx648.exe
HKCU-Run-yiSNUTyakcfEQv.exe - c:\programdata\yiSNUTyakcfEQv.exe
HKLM-Run-5kS43ADO0bzprWo - c:\users\Chefin\AppData\Roaming\soundblaster_fx648.exe
AddRemove-AutoCAD 2010 - English - c:\program files\AutoCAD 2010\Setup\Setup.exe
AddRemove-sp44626 - c:\hp\Softpaq\sp44626\sp44626.exe
AddRemove-{5783F2D7-8001-0000-0002-0060B0CE6BBA} - c:\program files\AutoCAD 2010\Setup\Setup.exe
.
.
.
**************************************************************************
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteintr‰ge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll\" /prefetch:1"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Akamai]
"ServiceDll"="c:\program files\common files\akamai/netsession_win_6c825ce.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\PCD5SRVC{BD6912E3-AC9D80E8-05040000}]
"ImagePath"="\??\c:\progra~1\PC-DOC~1\PCD5SRVC.pkms"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(2828)
c:\users\Chef\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
Zeit der Fertigstellung: 2012-04-23  02:52:44
ComboFix-quarantined-files.txt  2012-04-23 00:52
.
Vor Suchlauf: 16 Verzeichnis(se), 479.278.313.472 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 481.699.848.192 Bytes frei
.
- - End Of File - - 1E781A56CB81FA5788E229067171FFED
         

--- --- ---