| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: WIN 7, 64bit wird seit Tagen drastisch langsamerWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
13.08.2012, 23:36
| #4 |
| /// Helfer-Team  |  WIN 7, 64bit wird seit Tagen drastisch langsamer Fixen mit OTL Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).
Code:
ATTFilter :OTL
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=79429a870000000000000024e84211e7&tlver=1.4.19.19&affID=17160
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2229227918-2249241077-3127021880-1001\..\SearchScopes,DefaultScope = {26ED6D5A-7794-488E-934F-39298C7CB221}
IE - HKU\S-1-5-21-2229227918-2249241077-3127021880-1001\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/web/{searchTerms}?babsrc=SP_ss&affID=19948&mntrId=79429a870000000000000002b3314fae
IE - HKU\S-1-5-21-2229227918-2249241077-3127021880-1001\..\SearchScopes\{161F01DF-A40C-475D-BD94-AA6238C05F25}: "URL" = http://go.web.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKU\S-1-5-21-2229227918-2249241077-3127021880-1001\..\SearchScopes\{26ED6D5A-7794-488E-934F-39298C7CB221}: "URL" = http://www.google.de/search?q={searchTerms}
IE - HKU\S-1-5-21-2229227918-2249241077-3127021880-1001\..\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}: "URL" = http://www.mystart.com/search_w.php?type=webblog1_1msch&fr=chr-vmn&q={searchTerms}&ei=UTF-8
IE - HKU\S-1-5-21-2229227918-2249241077-3127021880-1001\..\SearchScopes\{B2CF5C13-6DE0-4053-912D-6FAE4CBB7D48}: "URL" = http://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKU\S-1-5-21-2229227918-2249241077-3127021880-1001\..\SearchScopes\{CE818B34-8583-4F51-942F-8433C145ED13}: "URL" = http://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
IE - HKU\S-1-5-21-2229227918-2249241077-3127021880-1001\..\SearchScopes\{EBEB0280-0221-43D8-A6C8-CEE684F2902F}: "URL" = http://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
IE - HKU\S-1-5-21-2229227918-2249241077-3127021880-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2229227918-2249241077-3127021880-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = http://192.168.0.2;*.local
FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {9AA46F4F-4DC7-4c06-97AF-5035170633FE}:20.1.0.4
FF - prefs.js..network.proxy.ftp_port: 443
FF - prefs.js..network.proxy.gopher_port: 443
FF - prefs.js..network.proxy.http: "193.110.157.154"
FF - prefs.js..network.proxy.http_port: 80
FF - prefs.js..network.proxy.socks_port: 443
FF - prefs.js..network.proxy.ssl_port: 443
FF - prefs.js..network.proxy.type: 0
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_270.dll File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012.07.14 16:52:36 | 000,000,000 | ---D | M]
O3 - HKLM\..\Toolbar: (loadtbs) - {DFEFCDEE-CF1A-4FC8-88AD-129872198372} - C:\Users\User1\AppData\Roaming\loadtbs\toolbar.dll File not found
O3 - HKU\S-1-5-21-2229227918-2249241077-3127021880-1001\..\Toolbar\WebBrowser: (loadtbs) - {DFEFCDEE-CF1A-4FC8-88AD-129872198372} - C:\Users\User1\AppData\Roaming\loadtbs\toolbar.dll File not found
O4 - HKLM..\Run: [] File not found
O4 - HKU\S-1-5-21-2229227918-2249241077-3127021880-1001..\Run: [EPSON P50 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIFFE.EXE /FU "C:\Windows\Temp\E_S3788.tmp" /EF "HKCU" File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O8:64bit: - Extra context menu item: Download with &Media Finder - C:\Program Files (x86)\Media Finder\hook.html File not found
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://E:\OFFICE~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Download with &Media Finder - C:\Program Files (x86)\Media Finder\hook.html File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\OFFICE~1\Office12\EXCEL.EXE/3000 File not found
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx.com/player/DivXBrowserPlugin.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.04.25 17:00:23 | 000,000,000 | ---- | M] () - D:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{eb541f1d-5bae-11df-931d-0024e84211e7}\Shell - "" = AutoRun
O33 - MountPoints2\{eb541f1d-5bae-11df-931d-0024e84211e7}\Shell\AutoRun\command - "" = L:\DTSP_Launcher.exe
O33 - MountPoints2\{f52da481-c867-11df-a809-0024e84211e7}\Shell - "" = AutoRun
O33 - MountPoints2\{f52da481-c867-11df-a809-0024e84211e7}\Shell\AutoRun\command - "" = I:\DTVP_Launcher.exe
[2012.08.13 21:23:01 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.08.13 21:12:02 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.08.13 18:04:04 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.08.12 10:30:31 | 000,000,000 | -HSD | C] -- C:\#GDATA.Trash.Store#
:Files
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]
Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden. Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen! |
| Themen zu WIN 7, 64bit wird seit Tagen drastisch langsamer |
| administrator, anti-malware, autostart, dateien, downloads, eingefangen, erfolgreich, ergebnis, explorer, g-data, gelöscht, infektion, interne, langsamer, minute, quarantäne, rechner, registrierung, speicher, temp, test, version, win, windows, windows 7 |
Baum-Darstellung