Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.
All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{8dcb7100-df86-4384-8842-8fa844297b3f} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8dcb7100-df86-4384-8842-8fa844297b3f}\ deleted successfully.
C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Registry value HKEY_USERS\S-1-5-21-336442205-827502387-1674173946-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDesktop deleted successfully.
ADS C:\ProgramData\Temp:0FF263E8 deleted successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Public
User: suser
->Temp folder emptied: 460010743 bytes
->Temporary Internet Files folder emptied: 361096525 bytes
->Java cache emptied: 151317 bytes
->FireFox cache emptied: 602367964 bytes
->Flash cache emptied: 23618 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 470730236 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes
RecycleBin emptied: 17235022 bytes
Total Files Cleaned = 1,823.00 mb
[EMPTYFLASH]
User: All Users
User: Default
User: Default User
User: Public
User: suser
->Flash cache emptied: 0 bytes
Total Flash Files Cleaned = 0.00 mb
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
OTL by OldTimer - Version 3.2.49.0 log created on 06182012_185340
Files\Folders moved on Reboot...
File\Folder C:\Users\suser\AppData\Local\Temp\{BBE10BDA-44F3-4175-9DB8-3971DBA9C4B8}\fpb.tmp not found!
C:\Users\suser\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File\Folder C:\Users\suser\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\SYXVQIHD\ads[4].htm not found!
File\Folder C:\Users\suser\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PVSJ17FL\google_ads[1].js not found!
File\Folder C:\Users\suser\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PBSJKZNG\si[1].htm not found!
File\Folder C:\Users\suser\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PBSJKZNG\si[2].htm not found!
File\Folder C:\Users\suser\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PBSJKZNG\si[3].htm not found!
File\Folder C:\Users\suser\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LZZ4IQLF\ads[2].js not found!
File\Folder C:\Users\suser\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LZZ4IQLF\ads[3].js not found!
File\Folder C:\Users\suser\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\E4CE9QT2\ads[5].htm not found!
File\Folder C:\Users\suser\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\E4CE9QT2\ads[6].htm not found!
File\Folder C:\Users\suser\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\E4CE9QT2\brand[1].js not found!
File\Folder C:\Users\suser\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\E4CE9QT2\show_ads[1].js not found!
Registry entries deleted on Reboot...
derzeit ist der Bildschirmhintergrund wie zuvor gesperrt und der Zugriff auf das Nutzerspezifische Profil (c:\Benutzer\suser) nicht möglich. Im Explorer wird der Ordner als gesperrt angezeigt (mit so nem Schloss am Symbol).
Grüße,
Jens
Themen zu Trojan-Ransom.Win32.Gimemo.rmo desktop gesperrt
18.06.2012, 18:58
Hybrid-Darstellung
