winlock- trojaner/ weißer Sperrbildschirm

thewall · 24.03.2013, 15:02

Hallo alle zusammen!

Ich habe mir letzte Woche so einen Trojaner eingefangen. Leider weiß ich nicht wodurch.
Beim surfen auf shortnews.de ist der IE auf einmal weiß geworden und blockiert mir dadurch meinen Laptop. Taskmanager funktioniert auch nicht. Ich habe nur ein Benutzerkonto angelegt und kann somit nichts mit dem PC tun.
Ich hab mitbekommen wie genau man bei euch durch solche Probleme begleitet wird, was ich ansich super finde.
Da mein System allerdings relativ frisch (November 2012) aufgesetzt ist, hab ich ansich nichts dagegen das nochmal zu tun. Mir ginge es nur um 2 größere Ordner die ich gerne gesichert hätte. Gibt es da eine Möglichkeit diese zu sichern; bzw sind die dann überhaupt brauchbar? Also den Sperrbildschirm wegbekommen und sie dann auf eine externe Festplatte sichern. Und danach den PC neu aufsetzen.

Mit Kaspersky Windows Unlocker 10 hab ich (über USB) versucht den weißen Bildschirm weg zu bekommen. Hat aber leider nicht funktioniert.

Ich verwende Win7 Home Premium, 64bit.

Ein OTL.txt habe ich erstellt. Den Code poste ich auch gleich mit.

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 3/24/2013 2:09:09 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
64bit-Windows 7 Home Premium Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000c07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 92.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = E: | %SystemRoot% = E:\Windows | %ProgramFiles% = E:\Program Files (x86)
Drive C: | 100.00 Mb Total Space | 74.30 Mb Free Space | 74.30% Space Free | Partition Type: NTFS
Drive D: | 195.21 Gb Total Space | 163.95 Gb Free Space | 83.98% Space Free | Partition Type: NTFS
Drive E: | 255.45 Gb Total Space | 187.79 Gb Free Space | 73.52% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2013/01/27 06:34:32 | 000,379,360 | ---- | M] (Microsoft Corporation) [On_Demand] -- E:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV:64bit: - [2013/01/27 06:34:32 | 000,022,056 | ---- | M] (Microsoft Corporation) [Auto] -- E:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV:64bit: - [2010/07/07 05:43:14 | 000,048,128 | ---- | M] (Broadcom Corporation) [Auto] -- E:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\WLTRYSVC.EXE -- (wltrysvc)
SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand] -- E:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2013/02/25 11:57:56 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand] -- E:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/01/08 07:55:20 | 000,161,536 | R--- | M] (Skype Technologies) [Auto] -- E:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/12/18 15:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto] -- E:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2010/03/18 08:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- E:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- E:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2013/01/20 10:59:04 | 000,130,008 | ---- | M] (Microsoft Corporation) [Kernel | Auto] -- E:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2012/12/13 08:50:36 | 000,054,784 | ---- | M] (Apple, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011/12/12 22:32:22 | 002,797,056 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\athrx.sys -- (athr)
DRV:64bit: - [2011/05/20 10:12:44 | 000,394,016 | ---- | M] (Marvell) [Kernel | On_Demand] -- E:\Windows\System32\drivers\yk62x64.sys -- (yukonw7)
DRV:64bit: - [2010/11/20 23:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/20 23:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010/07/07 05:43:14 | 000,022,592 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\bcm42rly.sys -- (BCM42RLY)
DRV:64bit: - [2010/02/26 11:32:12 | 000,158,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\Impcd.sys -- (Impcd)
DRV:64bit: - [2009/07/13 20:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV:64bit: - [2009/07/13 20:35:37 | 000,025,088 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\WSDScan.sys -- (WSDScan)
DRV:64bit: - [2009/06/27 01:55:10 | 000,083,488 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2009/06/10 16:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- E:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
IE - HKU\Lukas_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.at/
IE - HKU\Lukas_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://at.msn.com/?ocid=iehp
IE - HKU\Lukas_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-at
IE - HKU\Lukas_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B4 53 30 74 42 BC CD 01  [binary data]
IE - HKU\Lukas_ON_E\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Lukas_ON_E\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: E:\Windows\System32\Macromed\Flash\NPSWF64_11_5_502_110.dll ()
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: E:\Windows\System32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: E:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE:  File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: E:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=:  
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=1.0: E:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: E:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: E:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE:  File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: E:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: E:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: E:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\Adobe Reader: E:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/02/25 11:57:57 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 18.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2013/02/25 11:57:30 | 000,000,000 | ---D | M] (No name found) -- E:\Program Files (x86)\Mozilla Firefox\extensions
[2013/02/25 11:57:57 | 000,262,552 | ---- | M] (Mozilla Foundation) -- E:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/10/24 18:03:12 | 000,001,392 | ---- | M] () -- E:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/10/24 18:03:11 | 000,002,465 | ---- | M] () -- E:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/10/24 18:03:12 | 000,001,153 | ---- | M] () -- E:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012/10/24 18:03:12 | 000,006,805 | ---- | M] () -- E:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/10/24 18:03:12 | 000,001,178 | ---- | M] () -- E:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/10/24 18:03:11 | 000,001,105 | ---- | M] () -- E:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | ---- | M]) - E:\Windows\System32\drivers\etc\hosts
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - E:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - E:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKU\Lukas_ON_E\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - E:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [Broadcom Wireless Manager UI] E:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\WLTRAY.EXE (Broadcom Corporation)
O4:64bit: - HKLM..\Run: [MSC] E:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [NvCplDaemon] E:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] E:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Aimersoft Helper Compact.exe]  File not found
O4 - HKLM..\Run: [APSDaemon] E:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKU\LocalService_ON_E..\Run: [Sidebar] E:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\Lukas_ON_E..\Run: [GoogleDriveSync]  File not found
O4 - HKU\Lukas_ON_E..\Run: [Hobbyist Software VLC Streamer]  File not found
O4 - HKU\Lukas_ON_E..\Run: [iCloudServices] E:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.)
O4 - HKU\Lukas_ON_E..\Run: [msvcrt_]  File not found
O4 - HKU\NetworkService_ON_E..\Run: [Sidebar] E:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_E..\RunOnce: [mctadmin]  File not found
O4 - HKU\NetworkService_ON_E..\RunOnce: [mctadmin]  File not found
O4 - Startup: Error locating startup folders.
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - E:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - E:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.186.211.21 195.34.133.21
O18:64bit: - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - E:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - E:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - E:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKU\Lukas_ON_E Winlogon: Shell - (C:\Users\Lukas\AppData\Roaming\ldr.mcb) - E:\Users\Lukas\AppData\Roaming\ldr.mcb ()
O20 - HKU\Lukas_ON_E Winlogon: Shell - (explorer.exe) - E:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/03/17 15:58:08 | 000,000,000 | ---D | C] -- E:\ProgramData\rydyx
[2013/03/17 11:03:54 | 000,000,000 | ---D | C] -- E:\Users\Lukas\Desktop\James Bond 007 Skyfall
[2013/03/15 05:11:30 | 000,096,768 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\mshtmled.dll
[2013/03/15 05:11:29 | 000,176,640 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\ieui.dll
[2013/03/15 05:11:29 | 000,073,216 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\mshtmled.dll
[2013/03/15 05:11:28 | 000,248,320 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\ieui.dll
[2013/03/15 05:11:28 | 000,231,936 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\url.dll
[2013/03/15 05:11:28 | 000,173,056 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\ieUnatt.exe
[2013/03/15 05:11:28 | 000,142,848 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\ieUnatt.exe
[2013/03/15 05:11:27 | 000,237,056 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\url.dll
[2013/03/15 05:11:26 | 001,494,528 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\inetcpl.cpl
[2013/03/15 05:11:26 | 001,427,968 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\inetcpl.cpl
[2013/03/15 05:11:25 | 002,312,704 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\jscript9.dll
[2013/03/15 05:11:25 | 000,729,088 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\msfeeds.dll
[2013/03/15 05:11:25 | 000,607,744 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\msfeeds.dll
[2013/03/15 05:11:24 | 001,800,704 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\jscript9.dll
[2013/03/15 05:11:24 | 000,717,824 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\jscript.dll
[2013/03/15 05:11:23 | 000,816,640 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\jscript.dll
[2013/03/15 05:11:23 | 000,599,040 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\vbscript.dll
[2013/03/15 05:05:15 | 000,000,000 | ---D | C] -- E:\Users\Lukas\Desktop\Zero.Dark.Thirty.2012.DVDSCR.Xvid.Ac3-ADTRG
[2013/03/07 04:33:56 | 000,262,560 | ---- | C] (Oracle Corporation) -- E:\Windows\SysWow64\javaws.exe
[2013/03/07 04:33:47 | 000,174,496 | ---- | C] (Oracle Corporation) -- E:\Windows\SysWow64\javaw.exe
[2013/03/07 04:33:47 | 000,174,496 | ---- | C] (Oracle Corporation) -- E:\Windows\SysWow64\java.exe
[2013/03/07 04:33:47 | 000,095,648 | ---- | C] (Oracle Corporation) -- E:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/03/07 04:33:38 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\Java
[2013/02/25 11:57:29 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\Mozilla Firefox
[2013/02/24 10:37:25 | 000,000,000 | ---D | C] -- E:\Users\Lukas\Desktop\240213 iphone fotos
[2013/02/24 10:00:31 | 000,000,000 | ---D | C] -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2013/02/24 09:59:23 | 000,000,000 | ---D | C] -- E:\Program Files\iPod
[2013/02/24 09:59:22 | 000,000,000 | ---D | C] -- E:\Program Files\iTunes
[2013/02/24 09:59:22 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\iTunes
[2013/02/24 09:59:22 | 000,000,000 | ---D | C] -- E:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
 
========== Files - Modified Within 30 Days ==========
 
[2013/03/18 12:42:06 | 000,067,584 | --S- | M] () -- E:\Windows\bootstat.dat
[2013/03/18 12:40:56 | 000,001,104 | ---- | M] () -- E:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/03/18 12:40:32 | 3106,111,488 | -HS- | M] () -- E:\hiberfil.sys
[2013/03/18 12:30:10 | 000,001,108 | ---- | M] () -- E:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/03/18 12:14:05 | 000,021,872 | -H-- | M] () -- E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/03/18 12:14:05 | 000,021,872 | -H-- | M] () -- E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/03/18 12:11:28 | 000,654,166 | ---- | M] () -- E:\Windows\System32\perfh007.dat
[2013/03/18 12:11:28 | 000,616,008 | ---- | M] () -- E:\Windows\System32\perfh009.dat
[2013/03/18 12:11:28 | 000,130,006 | ---- | M] () -- E:\Windows\System32\perfc007.dat
[2013/03/18 12:11:28 | 000,106,388 | ---- | M] () -- E:\Windows\System32\perfc009.dat
[2013/03/18 12:06:41 | 000,413,624 | ---- | M] () -- E:\Windows\System32\FNTCACHE.DAT
[2013/03/07 04:41:45 | 000,691,568 | ---- | M] (Adobe Systems Incorporated) -- E:\Windows\SysWow64\FlashPlayerApp.exe
[2013/03/07 04:41:44 | 000,071,024 | ---- | M] (Adobe Systems Incorporated) -- E:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013/03/07 04:33:43 | 000,095,648 | ---- | M] (Oracle Corporation) -- E:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/03/07 04:33:41 | 000,262,560 | ---- | M] (Oracle Corporation) -- E:\Windows\SysWow64\javaws.exe
[2013/03/07 04:33:41 | 000,174,496 | ---- | M] (Oracle Corporation) -- E:\Windows\SysWow64\javaw.exe
[2013/03/07 04:33:40 | 000,861,088 | ---- | M] (Oracle Corporation) -- E:\Windows\SysWow64\npDeployJava1.dll
[2013/03/07 04:33:40 | 000,782,240 | ---- | M] (Oracle Corporation) -- E:\Windows\SysWow64\deployJava1.dll
[2013/03/07 04:33:40 | 000,174,496 | ---- | M] (Oracle Corporation) -- E:\Windows\SysWow64\java.exe
[2013/02/28 14:49:33 | 000,001,912 | ---- | M] () -- E:\Windows\epplauncher.mif
[2013/02/28 14:49:32 | 000,002,117 | ---- | M] () -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
[2013/02/24 10:00:31 | 000,000,000 | ---D | M] -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
 
========== Files Created - No Company Name ==========
 
[2013/03/17 11:04:53 | 1465,027,912 | ---- | C] () -- E:\Users\Lukas\Desktop\The.Impossible.2012.DVDSCR.x264.AAC-FooKaS.mkv
[2013/03/06 15:51:55 | 2022,705,152 | ---- | C] () -- E:\Users\Lukas\Desktop\refill.safe.house.xvid.avi
[2012/11/06 12:58:48 | 000,000,047 | ---- | C] () -- E:\Windows\SysWow64\IsConfig.ini
[2012/05/12 21:36:09 | 000,160,256 | ---- | C] () -- E:\Users\Lukas\AppData\Roaming\ldr.mcb
[2011/02/25 06:11:54 | 000,066,856 | ---- | C] () -- E:\Windows\SysWow64\SynTPEnhPS.dll
[2010/11/20 23:24:49 | 000,252,928 | ---- | C] () -- E:\Windows\SysWow64\DShowRdpFilter.dll
[2009/07/14 01:38:36 | 000,067,584 | --S- | C] () -- E:\Windows\bootstat.dat
[2009/07/13 22:35:51 | 000,000,741 | ---- | C] () -- E:\Windows\SysWow64\NOISE.DAT
[2009/07/13 22:34:42 | 000,215,943 | ---- | C] () -- E:\Windows\SysWow64\dssec.dat
[2009/07/13 20:10:29 | 000,043,131 | ---- | C] () -- E:\Windows\mib.bin
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- E:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 18:25:04 | 000,197,632 | ---- | C] () -- E:\Windows\SysWow64\ir32_32.dll
[2009/07/13 17:03:59 | 000,364,544 | ---- | C] () -- E:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- E:\Windows\SysWow64\mlang.dat
 
========== LOP Check ==========
 
[2013/02/24 10:00:26 | 000,000,000 | ---D | M] -- E:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
[2013/02/10 06:17:08 | 000,000,000 | ---D | M] -- E:\ProgramData\Aimersoft Video Converter Ultimate
[2012/11/06 11:36:00 | 000,000,000 | -HSD | M] -- E:\ProgramData\Anwendungsdaten
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Application Data
[2012/11/07 08:02:43 | 000,000,000 | ---D | M] -- E:\ProgramData\Canneverbe Limited
[2012/12/01 05:48:28 | 000,000,000 | -H-D | M] -- E:\ProgramData\CanonBJ
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Desktop
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Documents
[2012/11/06 11:36:00 | 000,000,000 | -HSD | M] -- E:\ProgramData\Dokumente
[2012/11/06 11:36:00 | 000,000,000 | -HSD | M] -- E:\ProgramData\Favoriten
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Favorites
[2013/03/17 15:58:08 | 000,000,000 | ---D | M] -- E:\ProgramData\rydyx
[2012/12/17 11:45:48 | 000,000,000 | ---D | M] -- E:\ProgramData\SAMSUNG
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Start Menu
[2012/11/06 11:36:00 | 000,000,000 | -HSD | M] -- E:\ProgramData\Startmenü
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Templates
[2012/11/06 11:36:00 | 000,000,000 | -HSD | M] -- E:\ProgramData\Vorlagen
[2013/02/10 06:19:21 | 000,000,000 | ---D | M] -- E:\ProgramData\xml_param
[2013/02/12 06:54:56 | 000,032,632 | ---- | M] () -- E:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
< End of report >

--- --- ---

Also noch mals kurz meine Frage(n):
Bekomme ich den Sperrbildschirm weg, um mir meine Ordner zu sichern um danach neu aufsetzen zu können?
Sind die Ordner nachher brauchbar, oder (vermutlich) total verseucht?
Ist es besser neu aufzusetzen oder kann ich einen Systemwiederherstellungspunkt (November 2012) verwenden?

Danke euch schon mal recht herzlich!

LG Lukas

winlock- trojaner/ weißer Sperrbildschirm

Plagegeister aller Art und deren Bekämpfung: winlock- trojaner/ weißer Sperrbildschirm

winlock- trojaner/ weißer Sperrbildschirm

Ähnliche Themen: winlock- trojaner/ weißer Sperrbildschirm