Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

:OTL
FF - user.js - File not found
O3 - HKU\S-1-5-21-2481159537-603020181-2360157200-1000\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O4 - HKU\S-1-5-21-2481159537-603020181-2360157200-1000..\Run: [zASRockInstantBoot]  File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{29d8434d-bd36-11e1-b136-806e6f6e6963}\Shell - "" = AutoRun
 O33 - MountPoints2\{29d8434d-bd36-11e1-b136-806e6f6e6963}\Shell\AutoRun\command - "" = D:\Autorun.exe -- [2010.10.13 15:19:47 | 004,991,312 | R--- | M] (Ubisoft)
O33 - MountPoints2\{464294f3-bd66-11e1-9d2c-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{464294f3-bd66-11e1-9d2c-806e6f6e6963}\Shell\AutoRun\command - "" = D:\ASRSetup.exe
:Files
C:\d2c8991fb3ffdd3c8fded6
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[resethosts]
         

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

hier ist der report nach dem fix

All processes killed
========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-2481159537-603020181-2360157200-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}\ not found.
Registry value HKEY_USERS\S-1-5-21-2481159537-603020181-2360157200-1000\Software\Microsoft\Windows\CurrentVersion\Run\\zASRockInstantBoot deleted successfully.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{29d8434d-bd36-11e1-b136-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{29d8434d-bd36-11e1-b136-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{29d8434d-bd36-11e1-b136-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{29d8434d-bd36-11e1-b136-806e6f6e6963}\ not found.
File move failed. D:\Autorun.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{464294f3-bd66-11e1-9d2c-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{464294f3-bd66-11e1-9d2c-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{464294f3-bd66-11e1-9d2c-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{464294f3-bd66-11e1-9d2c-806e6f6e6963}\ not found.
File D:\ASRSetup.exe not found.
========== FILES ==========
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\zh-tw folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\zh-hk folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\zh-cn folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\uk-ua folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\tr-tr folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\th-th folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\sv-se folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\sr-latn-cs folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\sl-si folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\sk-sk folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\ru-ru folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\ro-ro folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\pt-pt folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\pt-br folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\pl-pl folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\nl-nl folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\nb-no folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\lv-lv folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\lt-lt folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\ko-kr folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\ja-jp folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\it-it folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\hu-hu folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\hr-hr folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\he-il folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\fr-fr folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\fi-fi folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\et-ee folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\es-es folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\en-us folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\el-gr folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\de-de folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\da-dk folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\cs-cz folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\bg-bg folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f\ar-sa folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6\13f7a0365bd6254cbc6ef62f folder moved successfully.
C:\d2c8991fb3ffdd3c8fded6 folder moved successfully.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\***\Desktop\cmd.bat deleted successfully.
C:\Users\***\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: ***
->Temp folder emptied: 5238970 bytes
->Temporary Internet Files folder emptied: 1749556 bytes
->Java cache emptied: 51393 bytes
->FireFox cache emptied: 66684338 bytes
->Flash cache emptied: 506 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 94656 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1084086 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 46424587 bytes
RecycleBin emptied: 40863 bytes
 
Total Files Cleaned = 116,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.59.1 log created on 09142012_171838

Files\Folders moved on Reboot...
File move failed. D:\Autorun.exe scheduled to be moved on reboot.
C:\Users\***\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Windows\SysNative\WPRO_41_2001woem.tmp moved successfully.
C:\Windows\temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Windows\temp\FXSTIFFDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
         

ist dann soweit alles wieder klar oder muss ich noch etwas machen?

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition ( meistens Laufwerk C: ) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!