BKA Trojaner, Ukash

deady95 · 20.07.2012, 12:03

Moin,
ich glaube mein Problem bereits recht bekannt.Wenn ich meinen PC starten moechte, oeffnet sich ein Bildschirm, wo draufsteht, dass mein PC aus gewissen Gruenden gesperrt wurde und ich mich fuer schlappe 100 euro an Ukash wieder freikaufen kann. Im Anhang habe ich schon die Ergebnisse meines OTL Scans. Hoffe ich habe das so bisher richtig gemacht, sonst klaert mich auf. Aber erstmal danke im Vorraus

deady95 · 20.07.2012, 20:12

Sorry wegen Doppelpost aber es wäre echt Super von euch wenn Ihr mir heute helfen könntet, weil ich morgen mit dem Lappi in Urlaub fahren möchte :/ Naja inzwischen war mein Thema auf die dritte Seite gerutscht.

t'john · 27.07.2012, 19:20

1. Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

2. Schritt

Systemscan mit OTL (bebilderte Anleitung)

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden)- Doppelklick auf die OTL.exe
- Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
- Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
- Unter Extra Registry, wähle bitte Use SafeList
- Klicke nun auf Run Scan links oben
- Wenn der Scan beendet wurde werden 2 Logfiles erstellt
- Poste die Logfiles hier in den Thread.

deady95 · 29.07.2012, 22:54

Moin,
also hier habe ich ersteinmal die Dateien hochgeladen.
Gruß Deady

t'john · 30.07.2012, 15:35

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
Starte die OTL.exe.
Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:

Code:

ATTFilter

:OTL
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: File not found 
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll () 
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) 
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) 
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. 
O2 - BHO: (no name) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No CLSID value found. 
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. 
O3 - HKLM\..\Toolbar: (no name) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No CLSID value found. 
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 
O18:64bit: - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - Reg Error: Key error. File not found 
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found 
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found 
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found 
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found 
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found 
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. 
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. 
O32 - HKLM CDRom: AutoRun - 1 
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ] 
O34 - HKLM BootExecute: (autocheck autochk *) - File not found 
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found 
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found 
 
@Alternate Data Stream - 145 bytes -> C:\ProgramData\Temp:AB689DEA 
@Alternate Data Stream - 141 bytes -> C:\ProgramData\Temp:15024E60 
@Alternate Data Stream - 128 bytes -> C:\ProgramData\Temp:4CF61E54 
[2012/04/20 21:54:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml 
[2012/04/20 21:54:08 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml 
[2012/04/20 21:54:08 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml 
[2012/04/20 21:54:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml 
[2012/04/20 21:54:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml 
[2012/04/20 21:54:08 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml 
[2012/07/19 21:43:22 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job 
[2012/07/19 21:19:00 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job 
[2012/07/19 21:15:05 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job 
[2010/06/17 06:16:56 | 000,000,000 | ---D | M] -- C:\ProgramData\Partner 
[2012/07/19 21:36:57 | 000,000,000 | ---D | C] -- C:\ProgramData\ysinwvtwhcnedrm 
[2012/07/19 21:36:50 | 000,000,051 | ---- | C] () -- C:\ProgramData\bkeeparbzpsfcsu 
[2012/07/19 21:36:48 | 000,053,248 | ---- | M] () -- C:\ProgramData\zfofoilo.exe 
:Files
C:\Users\Phillip\AppData\Local\Temp\
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]

Schließe alle Programme.
Klicke auf den Fix Button.
Wenn OTL einen Neustart verlangt, bitte zulassen.
Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

deady95 · 05.08.2012, 19:24

Vielen Dank das BKA lässt mich jetzt in Ruhe!

Nummer 1:

Code:

ATTFilter

========== OTL ==========
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer\ deleted successfully.
File C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll () not found.
Registry key HKEY_LOCAL_MACHINE\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3\ deleted successfully.
File C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) not found.
Registry key HKEY_LOCAL_MACHINE\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9\ deleted successfully.
File C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) not found.
Registry key HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{872b5b88-9db5-4310-bdd0-ac189557e5f5} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\grooveLocalGWS\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88FED34C-F0CA-4636-A375-3CB6248B04CD}\ not found.
File {88FED34C-F0CA-4636-A375-3CB6248B04CD} - Reg Error: Key error. File not found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\livecall\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{828030A1-22C1-4009-854F-8E305202313F}\ not found.
File {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ms-help\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{314111c7-a502-11d2-bbca-00c04f8ec294}\ not found.
File {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msnim\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{828030A1-22C1-4009-854F-8E305202313F}\ not found.
File {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\skype4com\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D}\ not found.
File {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\wlmailhtml\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03C514A3-1EFB-4856-9F99-10D7BE1653C0}\ not found.
File {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found not found.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
File move failed. X:\AUTORUN.INF scheduled to be moved on reboot.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session manager\\BootExecute:autocheck autochk * deleted successfully.
ADS C:\ProgramData\Temp:AB689DEA deleted successfully.
ADS C:\ProgramData\Temp:15024E60 deleted successfully.
ADS C:\ProgramData\Temp:4CF61E54 deleted successfully.
C:\Program Files (x86)\Mozilla Firefox\searchplugins\amazondotcom-de.xml moved successfully.
C:\Program Files (x86)\Mozilla Firefox\searchplugins\bing.xml moved successfully.
C:\Program Files (x86)\Mozilla Firefox\searchplugins\eBay-de.xml moved successfully.
C:\Program Files (x86)\Mozilla Firefox\searchplugins\leo_ende_de.xml moved successfully.
C:\Program Files (x86)\Mozilla Firefox\searchplugins\wikipedia-de.xml moved successfully.
C:\Program Files (x86)\Mozilla Firefox\searchplugins\yahoo-de.xml moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job moved successfully.
C:\Windows\Tasks\Adobe Flash Player Updater.job moved successfully.
C:\ProgramData\Partner folder moved successfully.
C:\ProgramData\ysinwvtwhcnedrm folder moved successfully.
C:\ProgramData\bkeeparbzpsfcsu moved successfully.
File C:\ProgramData\zfofoilo.exe not found.
========== FILES ==========
C:\Users\Phillip\AppData\Local\Temp\{998792EA-72AF-4D7B-A933-D0DC158D8B98}\{918A9082-6287-4D25-9002-5E5D5E4971CB} folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\{998792EA-72AF-4D7B-A933-D0DC158D8B98} folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\{7FDEDA24-7E2C-4C53-A25C-A805C9C4E4F2} folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\{39b58594-af38-4059-9f59-a906a489beaa} folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\WPDNSE folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\VBE folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmpfa0713ba folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmpf600d19e folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmpe7728c14 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmpe3130803 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmpda1a4d0a folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmpd8675ec6 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmpc7af46fe folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmpc6e0347f folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmpc5c53e11 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmpc576ae4b folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmpacc4113d folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmpa35eae26 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmpa2e24338 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmpa1524078 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmp99e36090 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmp970108e5 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmp8bcc6130 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmp86e59497 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmp811016e8 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmp810cf6d8 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmp7f87f0b5 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmp6ffa7a24 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmp6b4ca0bf folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmp68332.WMC folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmp63572.WMC folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmp622b2743 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmp531d7539 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmp4b704d33 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmp489cd887 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmp45209bf9 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmp42150a50 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmp3c716089 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmp3a852098 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmp38b1c7e5 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmp38539946 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmp3247fbc5 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmp2d242887 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmp26628.WMC folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmp2593cd7b folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmp21c1296a folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmp10c79179 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmp07bc0d14 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\tmp05ce8880 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\Temporary Internet Files\Content.IE5\WMVFT6CQ folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\Temporary Internet Files\Content.IE5\W6ZI5XDL folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\Temporary Internet Files\Content.IE5\PNI7KXI5 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\Temporary Internet Files\Content.IE5\B0243KUU folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\Temporary Internet Files\Content.IE5 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\Temporary Internet Files folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\Temp1_MightAndMagicVI_Demo.zip folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\SDIAG_8b391f2b-ade3-446f-a7d7-7ca87135e8f1\result folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\SDIAG_8b391f2b-ade3-446f-a7d7-7ca87135e8f1\de-DE folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\SDIAG_8b391f2b-ade3-446f-a7d7-7ca87135e8f1 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\SDIAG_174f6580-243b-425b-bc68-b48b708c1372\result folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\SDIAG_174f6580-243b-425b-bc68-b48b708c1372\de-DE folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\SDIAG_174f6580-243b-425b-bc68-b48b708c1372 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-9 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-8 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-7 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-61 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-60 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-6 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-59 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-58 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-57 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-56 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-55 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-54 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-53 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-52 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-51 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-50 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-5 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-49 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-48 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-47 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-46 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-45 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-44 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-43 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-42 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-41 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-40 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-4 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-39 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-38 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-37 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-36 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-35 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-34 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-33 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-32 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-31 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-30 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-3 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-29 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-28 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-27 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-26 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-25 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-24 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-23 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-22 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-21 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-20 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-2 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-19 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-18 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-17 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-16 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-15 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-14 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-13 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-12 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-11 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-10 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp-1 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\plugtmp folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\nsbD347.tmp folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\MUI\CyberLink Blu-ray Disc Suite\LabelPrint folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\MUI\CyberLink Blu-ray Disc Suite folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\MUI folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\msohtmlclip1\01 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\msohtmlclip1 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\msohtmlclip folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\msdt folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\mozilla-media-cache folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\MessengerCache\Sounds folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\MessengerCache folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\Low\Windows Live Toolbar folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\Low\Google Toolbar folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\Low folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\hsperfdata_Phillip folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\History\History.IE5 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\History folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\Google Toolbar folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\ge4716\kmz folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\ge4716 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\Cookies folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\comtypes_cache\Dropbox-25 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\comtypes_cache folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\acro_rd_dir folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\9AE8.dir folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp\000A270021B987A0 folder moved successfully.
C:\Users\Phillip\AppData\Local\Temp folder moved successfully.
< ipconfig /flushdns /c >
Windows IP Configuration
An internal error occurred: The system cannot find the file specified.
 
Please contact Microsoft Product Support Services for further help.
Additional information: Unable to open registry key for tcpip.
C:\cmd.bat deleted successfully.
C:\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Default
 
User: Family
 
User: Jani
 
User: Nicki
 
User: Phillip
 
User: Public
 
User: Stefan
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 323584 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 410723104 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 36028471 bytes
 
Total Files Cleaned = 426.00 mb
 
 
[EMPTYFLASH]
 
User: Default
 
User: Family
 
User: Jani
 
User: Nicki
 
User: Phillip
 
User: Public
 
User: Stefan
 
Total Flash Files Cleaned = 0.00 mb
 
 
OTLPE by OldTimer - Version 3.1.48.0 log created on 08052012_224036

Nummer 2:

Code:

ATTFilter

========== OTL ==========
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer\ deleted successfully.
File C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll () not found.
Registry key HKEY_LOCAL_MACHINE\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3\ deleted successfully.
File C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) not found.
Registry key HKEY_LOCAL_MACHINE\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9\ deleted successfully.
File C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) not found.
Registry key HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{872b5b88-9db5-4310-bdd0-ac189557e5f5} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\grooveLocalGWS\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88FED34C-F0CA-4636-A375-3CB6248B04CD}\ not found.
File {88FED34C-F0CA-4636-A375-3CB6248B04CD} - Reg Error: Key error. File not found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\livecall\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{828030A1-22C1-4009-854F-8E305202313F}\ not found.
File {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ms-help\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{314111c7-a502-11d2-bbca-00c04f8ec294}\ not found.
File {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msnim\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{828030A1-22C1-4009-854F-8E305202313F}\ not found.
File {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\skype4com\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D}\ not found.
File {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\wlmailhtml\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03C514A3-1EFB-4856-9F99-10D7BE1653C0}\ not found.
File {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found not found.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
File move failed. X:\AUTORUN.INF scheduled to be moved on reboot.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session manager\\BootExecute:autocheck autochk * deleted successfully.
Unable to delete ADS C:\ProgramData\Temp:AB689DEA .
Unable to delete ADS C:\ProgramData\Temp:15024E60 .
Unable to delete ADS C:\ProgramData\Temp:4CF61E54 .
File C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml not found.
File C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml not found.
File C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml not found.
File C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml not found.
File C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml not found.
File C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml not found.
File C:\Windows\tasks\GoogleUpdateTaskMachineCore.job not found.
File C:\Windows\tasks\GoogleUpdateTaskMachineUA.job not found.
File C:\Windows\tasks\Adobe Flash Player Updater.job not found.
Folder C:\ProgramData\Partner\ not found.
Folder C:\ProgramData\ysinwvtwhcnedrm\ not found.
File C:\ProgramData\bkeeparbzpsfcsu not found.
File C:\ProgramData\zfofoilo.exe not found.
========== FILES ==========
Folder C:\Users\Phillip\AppData\Local\Temp not found.
< ipconfig /flushdns /c >
Windows IP Configuration
An internal error occurred: The system cannot find the file specified.
 
Please contact Microsoft Product Support Services for further help.
Additional information: Unable to open registry key for tcpip.
C:\cmd.bat deleted successfully.
C:\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Default
 
User: Family
 
User: Jani
 
User: Nicki
 
User: Phillip
 
User: Public
 
User: Stefan
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
 
Total Files Cleaned = 0.00 mb
 
 
[EMPTYFLASH]
 
User: Default
 
User: Family
 
User: Jani
 
User: Nicki
 
User: Phillip
 
User: Public
 
User: Stefan
 
Total Flash Files Cleaned = 0.00 mb
 
 
OTLPE by OldTimer - Version 3.1.48.0 log created on 08062012_000429

Sind zwei weil der Rechner beim neustarten irgendwie nicht mehr reagiert hat. Hoffe, dass das nichts schlimmes war. Danke.
Deady95

t'john · 05.08.2012, 20:18

Sehr gut!

1. Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktualisiere die Datenbank!
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

danach:

2. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Search.
Nach Ende des Suchlaufs öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

t'john · 22.08.2012, 01:15

Fehlende Rückmeldung

Gibt es Probleme beim Abarbeiten obiger Anleitung?

Um Kapazitäten für andere Hilfesuchende freizumachen, lösche ich dieses Thema aus meinen Benachrichtigungen.

Solltest Du weitermachen wollen, schreibe mir eine PN oder eröffne ein neues Thema.
http://www.trojaner-board.de/69886-a...-beachten.html

Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner sauber ist.

BKA Trojaner, Ukash

Plagegeister aller Art und deren Bekämpfung: BKA Trojaner, Ukash