GVU Trojaner mit webcam, System blockiert, WIN 7 32-bit

chia · 28.07.2012, 14:59

Hallo!

ich habe mir heute (28.07.2012) diesen GVU Trojaner mit dem BSI-Logo und der webcam eingefangen.
Ich arbeite noch nicht lange mit windows und kenne mich auch gar nicht in Sachen Viren entfernen aus! Ich habe den Rechner noch nicht ausgeschaltet, sondern nur versucht mich nei anzumelden (nur ein Benutzerkonto), wie vermutet blockiert der Trojaner alles...

Daher konnte ich die schritte unter Punkt 2 wie sie hier stehen: http://www.trojaner-board.de/69886-a...-beachten.html
noch nicht ausführen... Kann mir da bitte jemand helfen?
Wie gesagt ich habe keine Ahnung wie ich das machen soll!

Vielen Dank im Voraus!

Gruß

chia

t'john · 28.07.2012, 15:40

Mit einem sauberen 2. Rechner eine OTLPE-CD erstellen und den infizierten Rechner dann von dieser CD booten:

Falls Du kein Brennprogramm installiert hast, lade dir bitte ISOBurner herunter. Das Programm wird Dir erlauben, OTLPE auf eine CD zu brennen und sie bootfähig zu machen. Du brauchst das Tool nur zu installieren, der Rest läuft automatisch => Wie brenne ich eine ISO Datei auf CD/DVD.

Lade OTLPENet.exe von OldTimer herunter und speichere sie auf Deinem Desktop. Anmerkung: Die Datei ist ca. 120 MB groß und es wird bei langsamer Internet-Verbindung ein wenig dauern, bis Du sie runtergeladen hast.
Wenn der Download fertig ist, mache einen Doppelklick auf die Datei und beantworte die Frage "Do you want to burn the CD?" mit Yes.
Lege eine leere CD in Deinen Brenner.
ImgBurn (oder Dein Brennprogramm) wird das Archiv extrahieren und OTLPE Network auf die CD brennen.
Wenn der Brenn-Vorgang abgeschlossen ist, wirst Du eine Dialogbox sehen => "Operation successfully completed".
Du kannst nun die Fenster des Brennprogramms schließen.

Nun boote von der OTLPE CD. Hinweis: Wie boote ich von CD

Dein System sollte nach einigen Minuten den REATOGO-X-PE Desktop anzeigen.
Mache einen Doppelklick auf das OTLPE Icon.
Hinweis: Damit OTLPE auch das richtige installierte Windows scant, musst du den Windows-Ordner des auf der Platte installierten Windows auswählen, einfach nur C: auswählen gibt einen Fehler!
Wenn Du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
Wenn Du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
Vergewissere Dich, dass die Box "Automatically Load All Remaining Users" gewählt ist und drücke OK.
OTLpe sollte nun starten.
Drücke Run Scan, um den Scan zu starten.
Wenn der Scan fertig ist, werden die Dateien C:\OTL.Txt und C:\Extras.Txt erstellt
Kopiere diese Datei auf Deinen USB-Stick, wenn Du keine Internetverbindung auf diesem System hast.
Bitte poste den Inhalt von C:\OTL.Txt und Extras.Txt.

chia · 28.07.2012, 19:45

Hallo,
ich habe ein Problem beim booten von CD...Beim Sart habe ich F2 gedrückt und komme dann zu BIOS Setup Utility, dann habe ich "Boot" gewählt. Dort kann ich ua "Boot Device Priority" auswählen:
1st Boot Device: [SATA: PM-Hitachi HT]
2st boot Device: [Removable Dev.]
3st Boot Device: [USB: TEAC DV-28E-V]
Normalerweise sollte beim 2st Boot device doch irgendwas mit CD/DVD stehen, oder?
Ist mit Removable Device mein externes Laufwerk gemeint in das ich die OTLPE-CD eingelegt habe? (Ich habe ein Netbook ohne integriertes Laufwerk) Ich bin mir nicht sicher deswegen frage ich lieber nach...

rajo · 28.07.2012, 20:42

Zitat:

Zitat von chia

Hallo,

Normalerweise sollte beim 2st Boot device doch irgendwas mit CD/DVD stehen, oder?
Ist mit Removable Device mein externes Laufwerk gemeint in das ich die OTLPE-CD eingelegt habe? (Ich habe ein Netbook ohne integriertes Laufwerk) Ich bin mir nicht sicher deswegen frage ich lieber nach...

dies hier :

[USB: TEAC DV-28E-V]

ist dein CD / DVD external via USB - also die nr 3 ist deine Wahl

So ich nur ganz kurz

den Rest macht der gute t john weiter

Rajo

t'john · 28.07.2012, 20:46

wie der gute rajo sagt, TEAC waehlen!

chia · 28.07.2012, 21:31

Danke, Rajo! (Eigentlich logisch das mit dem USB, ich bin zu nervös!)

Der Scan lief ohne Probleme, allerdings wurde ich nicht

Zitat:

Do you wish to load the remote registry?

gefragt und es wurde ken Extra.txt erstellt!

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 7/28/2012 11:07:58 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Windows 7 Home Premium Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 84.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 96.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 100.00 Gb Total Space | 47.72 Gb Free Space | 47.72% Space Free | Partition Type: NTFS
Drive D: | 122.87 Gb Total Space | 122.78 Gb Free Space | 99.93% Space Free | Partition Type: NTFS
Drive E: | 3.72 Gb Total Space | 1.55 Gb Free Space | 41.65% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012/06/21 12:02:21 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/05/03 02:31:10 | 000,158,856 | R--- | M] (Skype Technologies) [Auto] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/03/26 11:03:40 | 000,214,952 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV - [2012/03/26 11:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2011/09/08 11:48:34 | 005,554,552 | ---- | M] (Wacom Technology, Corp.) [Auto] -- C:\Program Files\Tablet\Pen\Pen_Tablet.exe -- (TabletServicePen)
SRV - [2011/09/08 11:48:34 | 000,451,960 | ---- | M] (Wacom Technology, Corp.) [Auto] -- C:\Program Files\Tablet\Pen\Pen_TouchService.exe -- (TouchServicePen)
SRV - [2011/09/02 09:02:16 | 000,867,080 | ---- | M] (Acresso Software Inc.) [On_Demand] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011/04/01 05:14:30 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand] -- C:\Program Files\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011/03/28 05:21:16 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE -- (SeaPort)
SRV - [2010/03/08 09:47:06 | 005,010,288 | ---- | M] (Wacom Technology, Corp.) [Auto] -- C:\Windows\System32\Wacom_Tablet.exe -- (TabletServiceWacom)
SRV - [2009/10/08 23:45:56 | 000,169,312 | ---- | M] (Adobe Systems Incorporated) [Auto] -- C:\Program Files\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor8.0)
SRV - [2009/08/18 20:35:56 | 000,219,136 | ---- | M] () [Auto] -- C:\Windows\System32\AsusService.exe -- (AsusService)
SRV - [2009/07/13 21:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 21:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (btwrchid)
DRV - File not found [Kernel | On_Demand] --  -- (btwl2cap)
DRV - File not found [Kernel | On_Demand] --  -- (btwavdt)
DRV - File not found [Kernel | On_Demand] --  -- (btwaudio)
DRV - [2012/03/20 14:44:12 | 000,074,112 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2011/09/08 11:49:36 | 000,010,752 | ---- | M] (Wacom Technology) [Kernel | On_Demand] -- C:\Windows\System32\drivers\wacmoumonitor.sys -- (wacmoumonitor)
DRV - [2011/02/09 09:03:00 | 000,011,832 | ---- | M] () [Kernel | System] -- C:\Windows\System32\drivers\AsUpIO.sys -- (AsUpIO)
DRV - [2010/11/20 06:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 05:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2009/12/18 07:37:44 | 000,790,408 | ---- | M] (DiBcom SA) [Kernel | On_Demand] -- C:\Windows\System32\drivers\mod7700.sys -- (mod7700)
DRV - [2009/12/18 07:37:44 | 000,020,488 | ---- | M] (DiBcom S.A.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\modrc.sys -- (MODRC)
DRV - [2009/10/05 12:31:50 | 001,221,632 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2009/09/21 09:29:22 | 000,014,120 | ---- | M] (Wacom Technology) [Kernel | On_Demand] -- C:\Windows\System32\drivers\wacomvhid.sys -- (wacomvhid)
DRV - [2009/07/27 03:06:45 | 000,051,712 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\L1C62x86.sys -- (L1C) NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20)
DRV - [2009/07/20 05:29:40 | 000,013,880 | ---- | M] ( ) [Kernel | On_Demand] -- C:\Windows\System32\drivers\kbfiltr.sys -- (kbfiltr)
DRV - [2009/07/13 19:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
DRV - [2007/02/16 04:12:36 | 000,011,312 | ---- | M] (Wacom Technology) [Kernel | On_Demand] -- C:\Windows\System32\drivers\wacommousefilter.sys -- (wacommousefilter)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Chiara_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com
IE - HKU\Chiara_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://eeepc.asus.com [binary data]
IE - HKU\Chiara_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.searchnu.com/406
IE - HKU\Chiara_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Chiara_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
 
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Search Results"
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..browser.search.selectedEngine: "Search Results"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "hxxp://dts.search-results.com/sr?src=ffb&appid=394&systemid=406&sr=0&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\System32\Macromed\Flash\NPSWF32_11_3_300_257.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\Program Files\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.10: C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.3: C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wtPlugin,version=2.0.0.1: C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\wacom.com/WacomTabletPlugin: C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/06/21 12:02:27 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/04/14 05:30:19 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/06/21 12:02:27 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/04/14 05:30:19 | 000,000,000 | ---D | M]
 
[2012/07/03 15:58:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Chiara\AppData\Roaming\Mozilla\Extensions
[2012/07/19 16:26:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions
[2012/07/03 15:58:34 | 000,000,000 | ---D | M] (Searchqu Toolbar) -- C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}
[2012/06/14 12:05:48 | 000,000,000 | ---D | M] ("Xmarks") -- C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\foxmarks@kei.com
[2012/07/19 16:26:07 | 000,000,000 | ---D | M] (Yontoo) -- C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\plugin@yontoo.com
[2012/07/03 15:58:07 | 000,002,519 | ---- | M] () -- C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\searchplugins\Search_Results.xml
[2012/07/03 15:58:58 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
File not found (No name found) -- 
[2012/06/21 12:02:26 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/03/05 17:57:22 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012/02/12 11:39:57 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/02/12 11:39:57 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/02/12 11:39:57 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012/02/12 11:39:57 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/07/03 15:58:07 | 000,002,519 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml
[2012/02/12 11:39:57 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/02/12 11:39:57 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009/06/10 17:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (CmjBrowserHelperObject Object) - {6FE6A929-59D1-4763-91AD-29B61CFFB35B} - C:\Program Files\Mindjet\MindManager 8\Mm8InternetExplorer.dll (Mindjet)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
O2 - BHO: (DataMngr) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\Program Files\Searchqu Toolbar\Datamngr\BrowserConnection.dll (Bandoo Media, inc)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Yontoo) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files\Yontoo\YontooIEClient.dll (Yontoo LLC)
O3 - HKLM\..\Toolbar: (no name) -  - No CLSID value found.
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\Chiara_ON_C\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O4 - HKLM..\Run: [BambooCore] C:\Program Files\Bamboo Dock\BambooCore.exe ()
O4 - HKLM..\Run: [DATAMNGR] C:\Program Files\Searchqu Toolbar\Datamngr\datamngrUI.exe (Bandoo Media, inc)
O4 - HKLM..\Run: [Eee Docking] C:\Program Files\ASUS\Eee Docking\Eee Docking.exe ()
O4 - HKLM..\Run: [EeeStorageBackup] C:\Program Files\ASUS\Asus WebStorage\BackupService.exe (ECAREME)
O4 - HKLM..\Run: [HotKeyMon] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [HotkeyService] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [LiveUpdate] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [MMReminderService] C:\Program Files\Mindjet\MindManager 8\MmReminderService.exe (Mindjet)
O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [SuperHybridEngine] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [SynAsusAcpi] C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe (Synaptics Incorporated)
O4 - HKU\LocalService_ON_C..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_C..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Chiara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk ()
O4 - Startup: C:\Users\Chiara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ()
O4 - Startup: C:\Users\Chiara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\Chiara_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: An OneNote s&enden - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: An Mindjet MindManager senden - {2F72393D-2472-4F82-B600-ED77F354B7FF} - C:\Program Files\Mindjet\MindManager 8\Mm8InternetExplorer.dll (Mindjet)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - AppInit_DLLs: (C:\PROGRA~1\SEARCH~1\Datamngr\datamngr.dll) - C:\Program Files\Searchqu Toolbar\Datamngr\datamngr.dll (Bandoo Media, inc)
O20 - AppInit_DLLs: (C:\PROGRA~1\SEARCH~1\Datamngr\IEBHO.dll) - C:\Program Files\Searchqu Toolbar\Datamngr\IEBHO.dll (Bandoo Media, inc)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012/03/24 20:04:12 | 000,000,000 | ---D | M] - C:\Autodesk -- [ NTFS ]
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{fe8d4e18-6f23-11df-be5c-e0cb4e5d3656}\Shell - "" = AutoRun
O33 - MountPoints2\{fe8d4e18-6f23-11df-be5c-e0cb4e5d3656}\Shell\AutoRun\command - "" = E:\reatogoMenu.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/07/28 07:28:00 | 000,000,000 | ---D | C] -- C:\Users\Chiara\Desktop\Comics
[2012/07/28 07:21:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Comical
[2012/07/28 07:21:18 | 000,000,000 | ---D | C] -- C:\Program Files\Comical
[2012/07/23 18:19:48 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012/07/23 12:17:07 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{EA892A6D-C537-4AEF-A28A-2B0AE3925DE1}
[2012/07/23 12:16:51 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{FA5A0DBA-B8A8-422D-8201-CCDE62B96053}
[2012/07/22 06:45:22 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{09948269-86A9-4BE6-A839-6150C06A4566}
[2012/07/22 06:44:50 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{A700ABFA-42D7-4060-A5D4-6335077EA494}
[2012/07/21 18:25:25 | 000,000,000 | ---D | C] -- C:\Users\Chiara\Documents\MyPaint
[2012/07/21 17:20:33 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{E039B01A-717A-4FCC-968E-DE94E9E07E36}
[2012/07/21 17:19:56 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{B94B81EF-51BC-4F00-968A-E98C11007111}
[2012/07/21 05:19:15 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{4E110308-6991-4B05-8F0C-4F4A270AB143}
[2012/07/21 05:18:48 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{953C54D2-0F05-4846-99FF-FFE4545A3F08}
[2012/07/20 11:33:07 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{21B0B7D1-CD08-409B-80D0-21232122E606}
[2012/07/20 11:32:39 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{C8176B49-F268-4DC9-AE42-C768ADF94A89}
[2012/07/19 16:28:43 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Roaming\Weaverslave
[2012/07/19 16:27:42 | 000,000,000 | ---D | C] -- C:\Program Files\Weaverslave
[2012/07/19 16:26:27 | 000,000,000 | ---D | C] -- C:\Program Files\v-Grabber
[2012/07/19 16:25:53 | 000,000,000 | ---D | C] -- C:\Program Files\Yontoo
[2012/07/19 16:25:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Tarma Installer
[2012/07/19 11:52:08 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{1708DA77-E2B6-4227-BAC1-EF1D064C1886}
[2012/07/19 11:51:40 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{26DC2D97-2073-42F6-84C9-D802FECC41C3}
[2012/07/19 03:12:17 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{707F5DCD-B5D1-4C35-B10E-328850AD3409}
[2012/07/19 03:11:52 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{7657B687-5A44-496A-B6A5-B4AC4B90EC9B}
[2012/07/18 13:33:58 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{47A4A027-C5C3-4942-9C7C-1075EA9822E3}
[2012/07/18 13:33:35 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{6071C35D-5376-4C50-AA9E-AC54CDA3B4FD}
[2012/07/17 15:04:53 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{FD07347F-040F-43C7-BB90-86C6C7E4A8A3}
[2012/07/17 15:04:29 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{8E8C3F4D-3DB5-4B5C-870D-76F15CBE412C}
[2012/07/16 12:30:59 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{904CE6CC-752F-4061-92E3-8AFC53362FDC}
[2012/07/16 12:30:34 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{33F819DB-35A6-4544-8917-83A113676FAA}
[2012/07/15 06:18:39 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{2B464BFE-E785-4AB8-A72E-09C062444729}
[2012/07/15 06:18:02 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{7DE2F303-2D18-44E8-9D82-86F0827D66FA}
[2012/07/14 05:40:51 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{8CEDA057-6649-4D40-8784-11D98CDC268B}
[2012/07/14 05:40:29 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{A80CF8E0-A373-4F13-9044-14E57E74C029}
[2012/07/13 12:58:28 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{AE713F93-EB69-4D4D-A3D2-AF8D2E1435DE}
[2012/07/13 12:58:13 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{4F952EB5-FFEF-40F8-BBF5-724E4DA8009F}
[2012/07/12 12:50:40 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{8EDB8DC7-2E1F-45DF-B370-D93476D8CD9F}
[2012/07/12 12:50:11 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{CDA5D384-B676-4668-990B-DE2FFF8F611C}
[2012/07/11 15:08:27 | 002,345,984 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\win32k.sys
[2012/07/11 12:01:04 | 000,219,136 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ncrypt.dll
[2012/07/11 12:00:53 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msxml3r.dll
[2012/07/11 12:00:50 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\cdosys.dll
[2012/07/11 11:57:30 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{7B25ED64-B564-4BC6-8460-7D8FF11745B1}
[2012/07/11 11:57:02 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{FD0EC20F-F0A4-46E9-91F4-157BB173F577}
[2012/07/10 12:47:59 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{0AF15AC9-7EB9-444F-B81A-6933B8516754}
[2012/07/10 12:47:21 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{8105FFF6-00E4-4612-BA58-968DDEE9C599}
[2012/07/09 11:47:34 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{FB40A348-1009-469F-8BA7-35869F7A45FC}
[2012/07/09 11:47:10 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{BD957484-CEEB-4B6B-99DB-65D31CCA0EF0}
[2012/07/08 06:30:39 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{1572E635-F3BF-4245-B792-C7659CA42797}
[2012/07/08 06:30:12 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{AECBEE27-0B88-4346-BFA9-607056CC5106}
[2012/07/07 06:02:29 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{1E4F0B33-76DE-4B36-A1F9-81BDDFD09A9F}
[2012/07/07 06:02:05 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{68CCA33D-A5D4-4F37-B9EA-F5977E620057}
[2012/07/06 12:34:15 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{CEB268B4-8E49-4456-AB43-6CA741274BCB}
[2012/07/06 12:33:49 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{FB51D69A-FC90-4467-BA9D-DAD4FAA0D94A}
[2012/07/05 12:44:09 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{A670069A-966E-47AB-8E1F-BDD07F7BDC3F}
[2012/07/05 12:43:46 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{9064BA18-F157-4953-8840-702A6BB38E79}
[2012/07/04 11:52:54 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{26A56922-0428-4B78-A2FE-75B04B1C5728}
[2012/07/04 11:52:21 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{0F53D3E0-DE2B-4B81-A691-C847F6BC97C1}
[2012/07/04 11:49:14 | 000,000,000 | ---D | C] -- C:\ProgramData\boost_interprocess
[2012/07/03 16:05:02 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\Ilivid Player
[2012/07/03 15:58:06 | 000,000,000 | ---D | C] -- C:\Program Files\Searchqu Toolbar
[2012/07/03 12:41:16 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{2F099194-7024-4309-A759-28CAB1383576}
[2012/07/03 12:40:13 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{AFDAEFF1-4E3B-4E72-9A85-58A07E737FDC}
[2012/07/02 12:15:32 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{EB4125D6-5930-418D-AF8E-D504A34634C2}
[2012/07/02 12:15:19 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{EFFD27C0-C21C-427C-A27E-45B66F706637}
[2012/07/01 07:12:35 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{DEF88F64-2D7B-456E-9DD3-CECB7E224E99}
[2012/07/01 07:12:10 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{B62B35E9-7776-4503-B598-3FA2A61E13A3}
[2012/06/30 08:19:58 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{22F4C30B-B0F2-4A7F-A7B0-2B98A651FA26}
[2012/06/29 11:54:57 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{394AD5EC-4539-4B47-9421-664CB6BC1452}
[2012/06/29 11:54:32 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{751A8E76-E0D8-470B-B493-C060A209E3D7}
[2009/10/06 09:08:27 | 000,013,880 | ---- | C] ( ) -- C:\windows\System32\drivers\kbfiltr.sys
[2 C:\Users\Chiara\Desktop\*.tmp files -> C:\Users\Chiara\Desktop\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/07/28 15:47:28 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2012/07/28 15:46:02 | 1602,691,072 | -HS- | M] () -- C:\hiberfil.sys
[2012/07/28 14:31:48 | 000,009,696 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/07/28 14:31:48 | 000,009,696 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/07/28 13:28:22 | 004,503,728 | ---- | M] () -- C:\ProgramData\zak_lo0i7g.pad
[2012/07/28 08:16:44 | 000,001,887 | ---- | M] () -- C:\Users\Chiara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012/07/28 07:21:20 | 000,000,899 | ---- | M] () -- C:\Users\Chiara\Desktop\Comical.lnk
[2012/07/28 07:21:20 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Comical
[2012/07/23 18:15:52 | 000,000,761 | ---- | M] () -- C:\Users\Chiara\AppData\Local\recently-used.xbel
[2012/07/16 14:41:49 | 000,660,716 | ---- | M] () -- C:\windows\System32\perfh007.dat
[2012/07/16 14:41:49 | 000,632,888 | ---- | M] () -- C:\windows\System32\perfh009.dat
[2012/07/16 14:41:49 | 000,135,264 | ---- | M] () -- C:\windows\System32\perfc007.dat
[2012/07/16 14:41:49 | 000,112,112 | ---- | M] () -- C:\windows\System32\perfc009.dat
[2012/07/12 03:09:45 | 000,380,856 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT
[2 C:\Users\Chiara\Desktop\*.tmp files -> C:\Users\Chiara\Desktop\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/07/28 08:16:44 | 000,001,887 | ---- | C] () -- C:\Users\Chiara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012/07/28 08:16:43 | 004,503,728 | ---- | C] () -- C:\ProgramData\zak_lo0i7g.pad
[2012/07/28 07:21:20 | 000,000,899 | ---- | C] () -- C:\Users\Chiara\Desktop\Comical.lnk
[2012/07/23 18:15:52 | 000,000,761 | ---- | C] () -- C:\Users\Chiara\AppData\Local\recently-used.xbel
[2011/06/21 06:05:39 | 000,252,928 | ---- | C] () -- C:\windows\System32\DShowRdpFilter.dll
[2010/05/11 17:48:42 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010/05/11 17:26:35 | 000,006,144 | ---- | C] () -- C:\windows\System32\drivers\ASUSHWIO.SYS
[2009/10/08 20:09:48 | 000,011,832 | ---- | C] () -- C:\windows\System32\drivers\AsUpIO.sys
[2009/10/08 20:09:34 | 000,001,769 | ---- | C] () -- C:\windows\Language_trs.ini
[2009/10/08 19:45:00 | 000,219,136 | ---- | C] () -- C:\windows\System32\AsusService.exe
[2009/10/08 19:45:00 | 000,021,864 | ---- | C] () -- C:\windows\AsAcpiSvrLang.ini
[2009/10/08 19:42:03 | 000,451,072 | ---- | C] () -- C:\windows\System32\ISSRemoveSP.exe
[2009/10/08 19:41:36 | 000,013,931 | ---- | C] () -- C:\windows\System32\RaCoInst.dat
[2009/10/08 19:37:32 | 000,004,692 | ---- | C] () -- C:\windows\System32\drivers\SamSfPa.dat
[2009/10/08 19:37:14 | 000,013,020 | ---- | C] () -- C:\windows\System32\lpgun.ini
[2009/07/26 18:01:28 | 000,660,716 | ---- | C] () -- C:\windows\System32\perfh007.dat
[2009/07/26 18:01:28 | 000,295,922 | ---- | C] () -- C:\windows\System32\perfi007.dat
[2009/07/26 18:01:28 | 000,135,264 | ---- | C] () -- C:\windows\System32\perfc007.dat
[2009/07/26 18:01:28 | 000,038,104 | ---- | C] () -- C:\windows\System32\perfd007.dat
[2009/07/14 00:57:37 | 000,067,584 | --S- | C] () -- C:\windows\bootstat.dat
[2009/07/14 00:33:53 | 000,380,856 | ---- | C] () -- C:\windows\System32\FNTCACHE.DAT
[2009/07/13 22:05:48 | 000,632,888 | ---- | C] () -- C:\windows\System32\perfh009.dat
[2009/07/13 22:05:48 | 000,291,294 | ---- | C] () -- C:\windows\System32\perfi009.dat
[2009/07/13 22:05:48 | 000,112,112 | ---- | C] () -- C:\windows\System32\perfc009.dat
[2009/07/13 22:05:48 | 000,031,548 | ---- | C] () -- C:\windows\System32\perfd009.dat
[2009/07/13 22:05:05 | 000,000,741 | ---- | C] () -- C:\windows\System32\NOISE.DAT
[2009/07/13 22:04:11 | 000,215,943 | ---- | C] () -- C:\windows\System32\dssec.dat
[2009/07/13 19:55:01 | 000,043,131 | ---- | C] () -- C:\windows\mib.bin
[2009/07/13 19:51:43 | 000,073,728 | ---- | C] () -- C:\windows\System32\BthpanContextHandler.dll
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- C:\windows\System32\BWContextHandler.dll
[2009/07/01 04:10:50 | 000,000,176 | ---- | C] () -- C:\windows\explorer.exe.config
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- C:\windows\System32\mlang.dat
[1999/07/06 20:00:00 | 000,000,006 | RHS- | C] () -- C:\ProgramData\D81EDBF9-D167-4011-B77D-211DF920EB80
 
========== LOP Check ==========
 
[2009/10/08 20:11:59 | 000,000,000 | ---D | M] -- C:\Users\Chiara\AppData\Roaming\Asus WebStorage
[2012/03/24 20:12:07 | 000,000,000 | ---D | M] -- C:\Users\Chiara\AppData\Roaming\Autodesk
[2012/04/29 15:00:18 | 000,000,000 | ---D | M] -- C:\Users\Chiara\AppData\Roaming\BitZipper
[2012/07/28 13:23:20 | 000,000,000 | ---D | M] -- C:\Users\Chiara\AppData\Roaming\Dropbox
[2010/09/12 16:07:57 | 000,000,000 | ---D | M] -- C:\Users\Chiara\AppData\Roaming\Sony
[2010/05/18 07:38:17 | 000,000,000 | ---D | M] -- C:\Users\Chiara\AppData\Roaming\SYSTEMAX Software Development
[2011/10/15 05:49:02 | 000,000,000 | ---D | M] -- C:\Users\Chiara\AppData\Roaming\Wacom
[2011/10/15 05:52:35 | 000,000,000 | ---D | M] -- C:\Users\Chiara\AppData\Roaming\wacomid-desktop-launcher.DCFD4B89A63EE70BC162777F06D4B93B6397AEC7.1
[2012/07/19 16:28:43 | 000,000,000 | ---D | M] -- C:\Users\Chiara\AppData\Roaming\Weaverslave
[2011/09/20 15:02:51 | 000,000,000 | ---D | M] -- C:\Users\Chiara\AppData\Roaming\Windows Live Writer
[2012/03/24 20:09:17 | 000,000,000 | ---D | M] -- C:\ProgramData\Alias
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
[2012/07/04 11:49:14 | 000,000,000 | ---D | M] -- C:\ProgramData\boost_interprocess
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
[2012/04/10 10:46:35 | 000,000,000 | ---D | M] -- C:\ProgramData\fOi16635kNgJe16635
[2011/03/08 11:37:00 | 000,000,000 | ---D | M] -- C:\ProgramData\Mindjet
[2009/10/08 19:41:35 | 000,000,000 | ---D | M] -- C:\ProgramData\Ralink Driver
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
[2010/05/18 07:38:17 | 000,000,000 | ---D | M] -- C:\ProgramData\SYSTEMAX Software Development
[2012/07/19 16:25:38 | 000,000,000 | ---D | M] -- C:\ProgramData\Tarma Installer
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
[2011/10/15 05:52:37 | 000,000,000 | ---D | M] -- C:\ProgramData\Wacom
[2010/08/03 09:19:48 | 000,000,000 | ---D | M] -- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2012/05/23 04:35:56 | 000,032,632 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
< End of report >

--- --- ---

t'john · 29.07.2012, 14:00

Fixen mit OTLpe

Starte den unbootbaren Computer erneut mit der OTLPE-CD,
warte bis der Reatogo-X-Pe-Desktop erscheint und doppelklicke das OTLPE-Icon.

Kopiere folgendes Skript in das Textfeld unterhalb von Custom Scans/Fixes:
Sollte das mangels Internet-Verbindung nicht möglich sein,
kopiere den Text aus der folgenden Code-Box und speichere ihn als Fix.txt auf einen USB-Stick.
Schließe den USB-Stick an den Computer an und öffne Fix.txt mit dem Explorer auf dem Reatogo-Desktop.
Kopiere den Inhalt von Fix.txt in das Textfeld unterhalb von Custom Scans/Fixes:

Code:

ATTFilter

:OTL
DRV - File not found [Kernel | On_Demand] -- -- (btwrchid) 
DRV - File not found [Kernel | On_Demand] -- -- (btwl2cap) 
DRV - File not found [Kernel | On_Demand] -- -- (btwavdt) 
DRV - File not found [Kernel | On_Demand] -- -- (btwaudio) 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\Chiara_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\Chiara_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local 
FF - prefs.js..browser.search.defaultenginename: "Search Results" 
FF - prefs.js..browser.search.order.1: "Search Results" 
FF - prefs.js..browser.search.selectedEngine: "Search Results" 
FF - prefs.js..browser.startup.homepage: "http://www.google.de" 
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 
FF - prefs.js..keyword.URL: "http://dts.search-results.com/sr?src=ffb&appid=394&systemid=406&sr=0&q=" 
File not found (No name found) -- 
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll () 
O2 - BHO: (DataMngr) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\Program Files\Searchqu Toolbar\Datamngr\BrowserConnection.dll (Bandoo Media, inc) 
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found. 
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll () 
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. 
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. 
O3 - HKU\Chiara_ON_C\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. 
O4 - HKLM..\Run: [BambooCore] C:\Program Files\Bamboo Dock\BambooCore.exe () 
O4 - HKU\LocalService_ON_C..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) 
O4 - HKU\NetworkService_ON_C..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) 
O4 - Startup: C:\Users\Chiara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk () 
O4 - Startup: C:\Users\Chiara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk () 
O4 - Startup: C:\Users\Chiara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk () 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 
O7 - HKU\Chiara_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 
O20 - AppInit_DLLs: (C:\PROGRA~1\SEARCH~1\Datamngr\datamngr.dll) - C:\Program Files\Searchqu Toolbar\Datamngr\datamngr.dll (Bandoo Media, inc) 
O20 - AppInit_DLLs: (C:\PROGRA~1\SEARCH~1\Datamngr\IEBHO.dll) - C:\Program Files\Searchqu Toolbar\Datamngr\IEBHO.dll (Bandoo Media, inc) 
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. 
O32 - HKLM CDRom: AutoRun - 1 
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] 
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ] 
O33 - MountPoints2\{fe8d4e18-6f23-11df-be5c-e0cb4e5d3656}\Shell - "" = AutoRun 
O33 - MountPoints2\{fe8d4e18-6f23-11df-be5c-e0cb4e5d3656}\Shell\AutoRun\command - "" = E:\reatogoMenu.exe 
O34 - HKLM BootExecute: (autocheck autochk *) - File not found 
[2012/07/28 08:16:44 | 000,001,887 | ---- | M] () -- C:\Users\Chiara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk 
[1999/07/06 20:00:00 | 000,000,006 | RHS- | C] () -- C:\ProgramData\D81EDBF9-D167-4011-B77D-211DF920EB80 
[2012/07/03 15:58:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Chiara\AppData\Roaming\Mozilla\Extensions 
[2012/07/03 15:58:34 | 000,000,000 | ---D | M] (Searchqu Toolbar) -- C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7} 
[2012/07/03 15:58:07 | 000,002,519 | ---- | M] () -- C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\searchplugins\Search_Results.xml 

[2012/07/03 15:58:06 | 000,000,000 | ---D | C] -- C:\Program Files\Searchqu Toolbar 

[2012/07/04 11:49:14 | 000,000,000 | ---D | C] -- C:\ProgramData\boost_interprocess 
[2012/07/28 13:28:22 | 004,503,728 | ---- | M] () -- C:\ProgramData\zak_lo0i7g.pad 
:Files

ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]

Schließe alle Programme.
Klicke auf den Fix Button.
Klick auf .
Kopiere den Inhalt hier in Code-Tags in Deinen Thread.
Nachträglich kannst Du das Logfile hier einsehen => C:\OTLpe\MovedFiles\<datum_nummer.log>
Teste, ob den Computer nun wieder in den normalen Windows-Modus booten kannst und berichte.

chia · 29.07.2012, 15:46

Ok, habe alles so gemacht wie beschrieben! Am Ende wurde ich

Zitat:

The system requires a reboot to finish removing files. Do you wish to reboot now?

gefragt und ich habe mal "Yes" geklickt, soweit ich das beurteilen kann ist aber nichts passiert...?

Ich habe den PC normal gestartet, nach der Anmeldung taucht ein Fenster mit dem Logfile auf. Ansonsten läuft alles ganz normal!

Hier erstmal das Logfile

Code:

ATTFilter

========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\btwrchid deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\btwl2cap deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\btwavdt deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\btwaudio deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\Chiara_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\Chiara_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Prefs.js: "Search Results" removed from browser.search.defaultenginename
Prefs.js: "Search Results" removed from browser.search.order.1
Prefs.js: "Search Results" removed from browser.search.selectedEngine
Prefs.js: "hxxp://www.google.de" removed from browser.startup.homepage
Prefs.js: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 removed from extensions.enabledItems
Prefs.js: "hxxp://dts.search-results.com/sr?src=ffb&appid=394&systemid=406&sr=0&q=" removed from keyword.URL
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079a25-328f-4bd4-be04-00955acaa0a7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}\ deleted successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D717F81-9148-4f12-8568-69135F087DB0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9D717F81-9148-4f12-8568-69135F087DB0}\ deleted successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\BrowserConnection.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{99079a25-328f-4bd4-be04-00955acaa0a7} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}\ not found.
File C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\10 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_USERS\Chiara_ON_C\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\BambooCore deleted successfully.
C:\Program Files\Bamboo Dock\BambooCore.exe moved successfully.
Registry value HKEY_USERS\LocalService_ON_C\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
C:\Windows\System32\mctadmin.exe moved successfully.
Registry value HKEY_USERS\NetworkService_ON_C\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
File C:\Windows\System32\mctadmin.exe not found.
C:\Users\Chiara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk moved successfully.
C:\Users\Chiara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk moved successfully.
C:\Users\Chiara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Registry value HKEY_USERS\Chiara_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:C:\PROGRA~1\SEARCH~1\Datamngr\datamngr.dll deleted successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\datamngr.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:C:\PROGRA~1\SEARCH~1\Datamngr\IEBHO.dll deleted successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\IEBHO.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
File move failed. X:\AUTORUN.INF scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fe8d4e18-6f23-11df-be5c-e0cb4e5d3656}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fe8d4e18-6f23-11df-be5c-e0cb4e5d3656}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fe8d4e18-6f23-11df-be5c-e0cb4e5d3656}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fe8d4e18-6f23-11df-be5c-e0cb4e5d3656}\ not found.
File E:\reatogoMenu.exe not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session manager\\BootExecute:autocheck autochk * deleted successfully.
File C:\Users\Chiara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk not found.
C:\ProgramData\D81EDBF9-D167-4011-B77D-211DF920EB80 moved successfully.
C:\Users\Chiara\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} folder moved successfully.
C:\Users\Chiara\AppData\Roaming\Mozilla\Extensions folder moved successfully.
C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\components folder moved successfully.
C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\searchbar folder moved successfully.
C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\options folder moved successfully.
C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\weatherbutton\panels\images folder moved successfully.
C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\weatherbutton\panels folder moved successfully.
C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\weatherbutton\icons folder moved successfully.
C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\weatherbutton folder moved successfully.
C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\uwa folder moved successfully.
C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\radio\images folder moved successfully.
C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\radio\css folder moved successfully.
C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\radio folder moved successfully.
C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\panels\images folder moved successfully.
C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\panels\default\scripts folder moved successfully.
C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\panels\default\images folder moved successfully.
C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\panels\default\css folder moved successfully.
C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\panels\default folder moved successfully.
C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\panels\css folder moved successfully.
C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\panels folder moved successfully.
C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib folder moved successfully.
C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin folder moved successfully.
C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets folder moved successfully.
C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\modules folder moved successfully.
C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\lib folder moved successfully.
C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\data\search folder moved successfully.
C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\data folder moved successfully.
C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content folder moved successfully.
C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome folder moved successfully.
C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7} folder moved successfully.
C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\searchplugins\Search_Results.xml moved successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\components folder moved successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\searchbar folder moved successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\options folder moved successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\lib\weatherbutton\panels\images folder moved successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\lib\weatherbutton\panels folder moved successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\lib\weatherbutton\icons folder moved successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\lib\weatherbutton folder moved successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\lib\uwa folder moved successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\lib\radio\images folder moved successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\lib\radio\css folder moved successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\lib\radio folder moved successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\lib\panels\images folder moved successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\lib\panels\default\scripts folder moved successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\lib\panels\default\images folder moved successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\lib\panels\default\css folder moved successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\lib\panels\default folder moved successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\lib\panels\css folder moved successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\lib\panels folder moved successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\lib folder moved successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\chrome\skin folder moved successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\chrome\content\widgets folder moved successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\chrome\content\modules folder moved successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\chrome\content\lib folder moved successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\chrome\content\data\search folder moved successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\chrome\content\data folder moved successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\chrome\content folder moved successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\chrome folder moved successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar folder moved successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\FirefoxExtension\content folder moved successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\FirefoxExtension\components folder moved successfully.
C:\Program Files\Searchqu Toolbar\Datamngr\FirefoxExtension folder moved successfully.
C:\Program Files\Searchqu Toolbar\Datamngr folder moved successfully.
C:\Program Files\Searchqu Toolbar folder moved successfully.
C:\ProgramData\boost_interprocess\BEBC5945FC59CD01 folder moved successfully.
C:\ProgramData\boost_interprocess folder moved successfully.
C:\ProgramData\zak_lo0i7g.pad moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
C:\cmd.bat deleted successfully.
C:\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrator
 
User: All Users
 
User: Chiara
->Temp folder emptied: 1369484873 bytes
->Temporary Internet Files folder emptied: 243249834 bytes
->Java cache emptied: 263623 bytes
->FireFox cache emptied: 55101092 bytes
->Flash cache emptied: 57151 bytes
 
User: Default
->Temp folder emptied: 121064 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56796 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 158420083 bytes
 
Total Files Cleaned = 1,742.00 mb
 
 
[EMPTYFLASH]
 
User: Administrator
 
User: All Users
 
User: Chiara
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Public
 
Total Flash Files Cleaned = 0.00 mb
 
 
OTLPE by OldTimer - Version 3.1.48.0 log created on 07292012_165203

Ist jetzt alles behoben, oder gibt es noch etwas zu tun?

Vielen Dank für die Hilfe!

Grüße

chia

t'john · 29.07.2012, 18:32

Sehr gut!

Wie laeuft der Rechner?

1. Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

danach:

2. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Search.
Nach Ende des Suchlaufs öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

chia · 29.07.2012, 21:38

Hallo,
der Rechner läuft soweit ohne Probleme!

Das ist das Ergebnis vom Malwarebytes-Scan:

Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.29.09

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 8.0.7601.17514
Chiara :: CHIARA-PC [Administrator]

Schutz: Aktiviert

29.07.2012 20:08:58
mbam-log-2012-07-29 (22-15-45).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 305683
Laufzeit: 2 Stunde(n), 6 Minute(n),

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations|bak_Application (Hijacker.Application) -> Daten: hxxp://go.microsoft.com/fwlink/?LinkId=57426&Ext=%s -> Keine Aktion durchgeführt.

Infizierte Dateiobjekte der Registrierung: 1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations|Application (Hijacker.Application) -> Bösartig: (hxxp://www.helpmeopen.com/?n=app&ext=%s) Gut: (hxxp://shell.windows.com/fileassoc/%04x/xml/redir.asp?Ext=%s) -> Keine Aktion durchgeführt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Users\Chiara\Downloads\SoftonicDownloader_fuer_winrar.exe (PUP.ToolbarDownloader) -> Keine Aktion durchgeführt.

(Ende)

und das Ergebnis vom adwcleaner:

# AdwCleaner v1.703 - Logfile created 07/29/2012 at 22:19:18
# Updated 20/07/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (32 bits)
# User : Chiara - CHIARA-PC
# Running from : C:\Users\Chiara\Desktop\adwcleaner.exe
# Option [Search]

***** [Services] *****

***** [Files / Folders] *****

Folder Found : C:\Users\Chiara\AppData\Local\Ilivid Player
Folder Found : C:\Users\Chiara\AppData\LocalLow\Searchqutoolbar
Folder Found : C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\Searchqutoolbar
Folder Found : C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\plugin@yontoo.com
Folder Found : C:\ProgramData\Tarma Installer
Folder Found : C:\Program Files\v-Grabber
Folder Found : C:\Program Files\Yontoo
File Found : C:\Program Files\Mozilla FireFox\searchplugins\Search_Results.xml

***** [Registry] *****

Key Found : HKCU\Software\DataMngr
Key Found : HKCU\Software\DataMngr_Toolbar
Key Found : HKCU\Software\Softonic
Key Found : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL
Key Found : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard
Key Found : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard.1
Key Found : HKLM\SOFTWARE\Classes\YontooIEClient.Api
Key Found : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1
Key Found : HKLM\SOFTWARE\Classes\YontooIEClient.Layers
Key Found : HKLM\SOFTWARE\Classes\YontooIEClient.Layers.1
Key Found : HKLM\SOFTWARE\DataMngr
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Searchqu Toolbar
Key Found : HKLM\SOFTWARE\SearchquMediabarTb
Key Found : HKLM\SOFTWARE\Tarma Installer
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [DataMngr]

***** [Registre - GUID] *****

Key Found : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{FEFD3AF5-A346-4451-AA23-A3AD54915515}
Key Found : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Found : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{5B4144E1-B61D-495A-9A50-CD1A95D86D15}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{841D5A49-E48D-413C-9C28-EB3D9081D705}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9D717F81-9148-4F12-8568-69135F087DB0}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9D717F81-9148-4F12-8568-69135F087DB0}

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.7601.17514

[HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://www.searchnu.com/406

-\\ Mozilla Firefox v13.0.1 (de)

Profile name : default
File : C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\prefs.js

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [5154 octets] - [29/07/2012 22:19:18]

########## EOF - C:\AdwCleaner[R1].txt - [5282 octets] ##########

Die beiden hijacker.applications habe ich gelöscht nachdem ich das Log gespeichert habe!

Danke für die schnelle Hilfe!!

chia

t'john · 30.07.2012, 15:52

Sehr gut!

Schließe alle offenen Programme und Browser.
Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Delete.
Bestätige jeweils mit Ok.
Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

danach:

Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html

chia · 30.07.2012, 23:03

Hi,
Bisher läuft alles wie geschmiert, hier ist das logfile vom adwcleaner

# AdwCleaner v1.703 - Logfile created 07/30/2012 at 21:26:53
# Updated 20/07/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (32 bits)
# User : Chiara - CHIARA-PC
# Running from : C:\Users\Chiara\Desktop\adwcleaner.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****

Folder Deleted : C:\Users\Chiara\AppData\Local\Ilivid Player
Folder Deleted : C:\Users\Chiara\AppData\LocalLow\Searchqutoolbar
Folder Deleted : C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\Searchqutoolbar
Folder Deleted : C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\plugin@yontoo.com
Folder Deleted : C:\ProgramData\Tarma Installer
Folder Deleted : C:\Program Files\v-Grabber
Folder Deleted : C:\Program Files\Yontoo
File Deleted : C:\Program Files\Mozilla FireFox\searchplugins\Search_Results.xml

***** [Registry] *****

Key Deleted : HKCU\Software\DataMngr
Key Deleted : HKCU\Software\DataMngr_Toolbar
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL
Key Deleted : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard
Key Deleted : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard.1
Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api
Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1
Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Layers
Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Layers.1
Key Deleted : HKLM\SOFTWARE\DataMngr
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Searchqu Toolbar
Key Deleted : HKLM\SOFTWARE\SearchquMediabarTb
Key Deleted : HKLM\SOFTWARE\Tarma Installer
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [DataMngr]

***** [Registre - GUID] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FEFD3AF5-A346-4451-AA23-A3AD54915515}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{5B4144E1-B61D-495A-9A50-CD1A95D86D15}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{841D5A49-E48D-413C-9C28-EB3D9081D705}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9D717F81-9148-4F12-8568-69135F087DB0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9D717F81-9148-4F12-8568-69135F087DB0}

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.7601.17514

Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://www.searchnu.com/406 --> hxxp://www.google.com

-\\ Mozilla Firefox v13.0.1 (de)

Profile name : default
File : C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\prefs.js

C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\user.js ... Deleted !

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [5283 octets] - [29/07/2012 22:19:18]
AdwCleaner[R2].txt - [5343 octets] - [29/07/2012 22:22:07]
AdwCleaner[S1].txt - [5522 octets] - [30/07/2012 21:26:53]

########## EOF - C:\AdwCleaner[S1].txt - [5650 octets] ##########

...und der Bericht von Emisoft Anit-Malware:

Emsisoft Anti-Malware - Version 6.6
Letztes Update: 7/30/2012 9:53:20 PM

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\, D:\
Archiv Scan: An
ADS Scan: An

Scan Beginn: 7/30/2012 9:54:00 PM

C:\_OTL\MovedFiles\07292012_165203\C_Program Files\Searchqu Toolbar\Datamngr\IEBHO.dll gefunden: Riskware.Win32.Toolbar.SearchSuite.AMN!E1
C:\_OTL\MovedFiles\07292012_165203\C_Program Files\Searchqu Toolbar\Datamngr\datamngr.dll gefunden: Riskware.Win32.Toolbar.SearchSuite.AMN!E1
C:\_OTL\MovedFiles\07292012_165203\C_Program Files\Searchqu Toolbar\Datamngr\DnsBHO.dll gefunden: Riskware.Win32.Toolbar.SearchSuite.AMN!E1
C:\$Recycle.Bin\S-1-5-21-622671541-3566325536-2871970421-1000\$RU8KFY4.exe gefunden: Riskware.WebToolbar.Win32.InstallCore.AMN!E1

Gescannt 553104
Gefunden 4

Scan Ende: 7/30/2012 11:29:59 PM
Scan Zeit: 1:35:59

C:\$Recycle.Bin\S-1-5-21-622671541-3566325536-2871970421-1000\$RU8KFY4.exe Quarantäne Riskware.WebToolbar.Win32.InstallCore.AMN!E1
C:\_OTL\MovedFiles\07292012_165203\C_Program Files\Searchqu Toolbar\Datamngr\IEBHO.dll Quarantäne Riskware.Win32.Toolbar.SearchSuite.AMN!E1
C:\_OTL\MovedFiles\07292012_165203\C_Program Files\Searchqu Toolbar\Datamngr\datamngr.dll Quarantäne Riskware.Win32.Toolbar.SearchSuite.AMN!E1
C:\_OTL\MovedFiles\07292012_165203\C_Program Files\Searchqu Toolbar\Datamngr\DnsBHO.dll Quarantäne Riskware.Win32.Toolbar.SearchSuite.AMN!E1

Quarantäne 4

Liebe Grüße,

chia

t'john · 30.07.2012, 23:29

Sehr gut!

Deinstalliere:
Emsisoft Anti-Malware

ESET Online Scanner

Vorbereitung

Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren.
Vista/Win7-User: Bitte den Browser unbedingt als Administrator starten.

Los geht's

Lade und starte Eset Smartinstaller
Haken setzen bei YES, I accept the Terms of Use.
Klick auf Start.
Haken setzen bei Remove found threads und Scan archives.
Klick auf Start.
Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Finish drücken.
Browser schließen.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (manchmal auch C:\Programme\Eset\log.txt) suchen und mit Deinem Editor öffnen.
Logfile hier posten.
Deinstallation: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

chia · 05.08.2012, 13:43

Hallo!

Hat etwas gedauert, aber hier ist das logfile von Eset Smartinstaller:

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=36f799775a6e8a448ddf2965ca6329e7
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-08-04 05:57:16
# local_time=2012-08-04 07:57:16 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 66 85 30492457 95725300 0 0
# compatibility_mode=8192 67108863 100 0 342 342 0 0
# scanned=122404
# found=0
# cleaned=0
# scan_time=8928

Gruß

chia

t'john · 05.08.2012, 13:55

Java aktualisieren

Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.

Downloade dir bitte die neueste Java-Version von hier
Speichere die jxpiinstall.exe
Schließe alle laufenden Programme. Speziell deinen Browser.
Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 5 ) herunter laden.
Wenn die Installation beendet wurde
Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.

Nach dem Neustart

Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
Klicke auf Dateien löschen....
Gehe sicher das überall ein Hacken gesetzt ist und klicke OK.
Klicke erneut OK.

Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html

28.07.2012, 20:46	#5
t'john /// Helfer-Team	GVU Trojaner mit webcam, System blockiert, WIN 7 32-bit wie der gute rajo sagt, TEAC waehlen! __________________ Mfg, t'john Das TB unterstützen

GVU Trojaner mit webcam, System blockiert, WIN 7 32-bit

Plagegeister aller Art und deren Bekämpfung: GVU Trojaner mit webcam, System blockiert, WIN 7 32-bit