Das kriegen wir schon noch hin..

Nächste Runde. Wie ist die Situation danach?


Drücke auf einem Zweitrechner bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument:

2013-06-02 22:30 - 2013-06-09 22:40 - 00001128 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2211236486-4210627768-2744985528-1001UA.job
2013-06-02 22:30 - 2013-06-09 22:40 - 00001076 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2211236486-4210627768-2744985528-1001Core.job
S1 25572341; C:\Windows\System32\DRIVERS\25572341.sys [128016 2009-09-25] (Kaspersky Lab)
S0 25572342; C:\Windows\System32\DRIVERS\25572342.sys [37392 2009-10-22] (Kaspersky Lab)
S1 setup_9.0.0.722_16.10.2012_06-06drv; C:\Windows\System32\DRIVERS\2557234.sys [311312 2009-10-09] (Kaspersky Lab)
C:\Users\Luxshan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\setup_9.0.0.722_16.10.2012_06-06.lnk
C:\Users\Luxshan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Product Registration.lnk
         

Speichere dieses dann bitte unter dem Dateinamen Fixlist.txt auf deinen USB Stick neben FRST.

• Schliesse den USB Stick wieder an den infizierten Rechner an.
• Starte deinen Rechner erneut in die Reparaturoptionen.
• Starte nun wiederum FRST, aber klicke dieses Mal auf den Fix Button.

Das Tool erstellt eine Datei Fixlog.txt auf deinem USB Stick. Poste deren Inhalt bitte hier.

Danke für die Unterstützung Leon
Aber auch nach diesem Versuch,komme Ich weder in den abgesicherten Modus als auch in den normalen Modus (sperrbildschirm erscheint immer noch)

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 09-06-2013
Ran by SYSTEM at 2013-06-11 00:28:29 Run:4
Running from G:\
Boot Mode: Recovery

==============================================

C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2211236486-4210627768-2744985528-1001UA.job => Moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2211236486-4210627768-2744985528-1001Core.job => Moved successfully.
25572341 => Service deleted successfully.
25572342 => Service deleted successfully.
setup_9.0.0.722_16.10.2012_06-06drv => Service deleted successfully.
C:\Users\Luxshan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\setup_9.0.0.722_16.10.2012_06-06.lnk => Moved successfully.
C:\Users\Luxshan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Product Registration.lnk => Moved successfully.

==== End of Fixlog ====
         

Ok, dann brauchen wir mal einen anderen Blick auf die Sache:


Mit einem sauberen 2. Rechner eine OTLPE-CD erstellen und den infizierten Rechner dann von dieser CD booten:

Falls Du kein Brennprogramm installiert hast, lade dir bitte ISOBurner herunter. Das Programm wird Dir erlauben, OTLPE auf eine CD zu brennen und sie bootfähig zu machen. Du brauchst das Tool nur zu installieren, der Rest läuft automatisch => Wie brenne ich eine ISO Datei auf CD/DVD.


Lade OTLPENet.exe von OldTimer herunter und speichere sie auf Deinem Desktop. Anmerkung: Die Datei ist ca. 120 MB groß und es wird bei langsamer Internet-Verbindung ein wenig dauern, bis Du sie runtergeladen hast.

• Wenn der Download fertig ist, mache einen Doppelklick auf die Datei und beantworte die Frage "Do you want to burn the CD?" mit Yes.
• Lege eine leere CD in Deinen Brenner.
• ImgBurn (oder Dein Brennprogramm) wird das Archiv extrahieren und OTLPE Network auf die CD brennen.
• Wenn der Brenn-Vorgang abgeschlossen ist, wirst Du eine Dialogbox sehen => "Operation successfully completed".
• Du kannst nun die Fenster des Brennprogramms schließen.

Nun boote von der OTLPE CD. Hinweis: Wie boote ich von CD


Bebilderte Anleitung: OTLpe-Scan

• Dein System sollte nach einigen Minuten den REATOGO-X-PE Desktop anzeigen.
• Mache einen Doppelklick auf das OTLPE Icon.
• Hinweis: Damit OTLPE auch das richtige installierte Windows scant, musst du den Windows-Ordner des auf der Platte installierten Windows auswählen, einfach nur C: auswählen gibt einen Fehler!
• Wenn Du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
• Wenn Du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
• Vergewissere Dich, dass die Box "Automatically Load All Remaining Users" gewählt ist und drücke OK.
• OTLpe sollte nun starten.
• Drücke Run Scan, um den Scan zu starten.
• Wenn der Scan fertig ist, werden die Dateien C:\OTL.Txt und C:\Extras.Txt erstellt
• Kopiere diese Datei auf Deinen USB-Stick, wenn Du keine Internetverbindung auf diesem System hast.
• Bitte poste den Inhalt von C:\OTL.txt und Extras.txt.

Danke Leon,bin gerade dabei die schritte auszuführen,aber den schritt verstehe ich nicht :/

Hinweis: Damit OTLPE auch das richtige installierte Windows scant, musst du den Windows-Ordner des auf der Platte installierten Windows auswählen, einfach nur C: auswählen gibt einen Fehler!
         

Hi,
beachte diesen einen Punkt einfach nicht und geh zum nächsten.

Hi,aber dann kann ich ja nicht fortfahren.Soll ich einfach den Windows ordner anklicken? Ist das richtig?

Ach so, die Abfrage kommt wirklich..
Ja, den Windows-Ordner auswählen.

Hm,nun wurde bei mir nur eine OTL.txt erstellt,und hab jetzt meinen pc ausschalten wollen,und jetzt ist der bildschirm gefreezt.Was nun? :/

Ja, es wird nur die OTL.txt erstellt, das ist in Ordnung, mehr brauchen wir nicht.
Aber hast du diese OTL.txt auf dem USB-Stick und kannst sie hier posten?

Ok danke Leon, Ja hab ich

OTL logfile created on: 6/11/2013 3:30:23 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Windows 7 Ultimate Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 88.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 96.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 226.53 Gb Total Space | 102.19 Gb Free Space | 45.11% Space Free | Partition Type: NTFS
Drive D: | 223.00 Gb Total Space | 60.48 Gb Free Space | 27.12% Space Free | Partition Type: NTFS
Drive E: | 7.45 Gb Total Space | 7.45 Gb Free Space | 99.97% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [On_Demand] --  -- (WwanSvc)
SRV - File not found [Auto] --  -- (wlidsvc)
SRV - File not found [On_Demand] --  -- (WbioSrvc)
SRV - File not found [On_Demand] --  -- (wbengine)
SRV - File not found [On_Demand] --  -- (UmRdpService)
SRV - File not found [Auto] --  -- (Themes)
SRV - File not found [On_Demand] --  -- (sppuinotify)
SRV - File not found [Auto] --  -- (sppsvc)
SRV - File not found [Auto] --  -- (SkypeUpdate)
SRV - File not found [On_Demand] --  -- (SensrSvc)
SRV - File not found [Auto] --  -- (RpcEptMapper)
SRV - File not found [Auto] --  -- (Power)
SRV - File not found [On_Demand] --  -- (PNRPsvc)
SRV - File not found [On_Demand] --  -- (PNRPAutoReg)
SRV - File not found [On_Demand] --  -- (PeerDistSvc)
SRV - File not found [On_Demand] --  -- (p2pimsvc)
SRV - File not found [Auto] --  -- (nvUpdatusService)
SRV - File not found [Auto] --  -- (NIS)
SRV - File not found [On_Demand] --  -- (MozillaMaintenance)
SRV - File not found [Auto] --  -- (MBAMService)
SRV - File not found [On_Demand] --  -- (iPod Service)
SRV - File not found [On_Demand] --  -- (HomeGroupProvider)
SRV - File not found [On_Demand] --  -- (HomeGroupListener)
SRV - File not found [Auto] --  -- (FontCache)
SRV - File not found [On_Demand] --  -- (Fax)
SRV - File not found [Auto] --  -- (Dhcp)
SRV - File not found [On_Demand] --  -- (defragsvc)
SRV - File not found [Auto] --  -- (CscService)
SRV - File not found [Auto] --  -- (clr_optimization_v4.0.30319_32)
SRV - File not found [Auto] --  -- (Bonjour Service)
SRV - File not found [On_Demand] --  -- (BDESVC)
SRV - File not found [On_Demand] --  -- (AxInstSV)
SRV - File not found [On_Demand] --  -- (AppMgmt)
SRV - File not found [Auto] --  -- (Apple Mobile Device)
SRV - File not found [On_Demand] --  -- (AppIDSvc)
SRV - [2010/03/25 09:39:22 | 000,490,280 | ---- | M] (Nero AG) [Auto] -- C:\Program Files\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2009/07/13 21:16:13 | 000,021,504 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\seclogon.dll -- (seclogon)
SRV - [2009/07/13 21:16:12 | 000,210,944 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\qwave.dll -- (QWAVE)
SRV - [2008/01/20 22:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Disabled] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (WinUsb)
DRV - File not found [File_System | On_Demand] --  -- (WIMMount)
DRV - File not found [Kernel | System] --  -- (WfpLwf)
DRV - File not found [Kernel | On_Demand] --  -- (vwifibus)
DRV - File not found [Kernel | On_Demand] --  -- (VMBusHID)
DRV - File not found [Kernel | On_Demand] --  -- (vmbus)
DRV - File not found [Kernel | On_Demand] --  -- (vhdmp)
DRV - File not found [Kernel | On_Demand] --  -- (VGPU)
DRV - File not found [Kernel | Boot] --  -- (vdrvroot)
DRV - File not found [Kernel | On_Demand] --  -- (USBAAPL)
DRV - File not found [Kernel | On_Demand] --  -- (tsusbhub)
DRV - File not found [Kernel | On_Demand] --  -- (TsUsbGD)
DRV - File not found [Kernel | On_Demand] --  -- (TsUsbFlt)
DRV - File not found [Kernel | On_Demand] --  -- (terminpt)
DRV - File not found [Kernel | On_Demand] --  -- (Synth3dVsc)
DRV - File not found [Kernel | System] --  -- (SymNetS)
DRV - File not found [Kernel | System] --  -- (SymIRON)
DRV - File not found [File_System | Boot] --  -- (SymEFA)
DRV - File not found [Kernel | Boot] --  -- (SymDS)
DRV - File not found [Kernel | On_Demand] --  -- (storvsc)
DRV - File not found [Kernel | Boot] --  -- (storflt)
DRV - File not found [Kernel | On_Demand] --  -- (stexstor)
DRV - File not found [Kernel | System] --  -- (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV - File not found [File_System | On_Demand] --  -- (SRTSP)
DRV - File not found [Kernel | On_Demand] --  -- (sdbus)
DRV - File not found [Kernel | On_Demand] --  -- (scfilter)
DRV - File not found [Kernel | On_Demand] --  -- (s3cap)
DRV - File not found [Kernel | On_Demand] --  -- (s115obex)
DRV - File not found [Kernel | On_Demand] --  -- (s115mgmt) Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM)
DRV - File not found [Kernel | On_Demand] --  -- (s115mdm)
DRV - File not found [Kernel | On_Demand] --  -- (s115mdfl)
DRV - File not found [Kernel | On_Demand] --  -- (s115bus) Sony Ericsson Device 115 driver (WDM)
DRV - File not found [Kernel | Boot] --  -- (rdyboost)
DRV - File not found [Kernel | On_Demand] --  -- (RdpVideoMiniport)
DRV - File not found [Kernel | System] --  -- (RDPREFMP)
DRV - File not found [Kernel | On_Demand] --  -- (rdpbus)
DRV - File not found [Kernel | On_Demand] --  -- (RasAgileVpn) WAN Miniport (IKEv2)
DRV - File not found [Kernel | Boot] --  -- (pcw)
DRV - File not found [Kernel | On_Demand] --  -- (NdisCap)
DRV - File not found [Kernel | On_Demand] --  -- (NAVEX15)
DRV - File not found [Kernel | On_Demand] --  -- (NAVENG)
DRV - File not found [Kernel | On_Demand] --  -- (MTConfig)
DRV - File not found [Kernel | On_Demand] --  -- (mshidkmdf)
DRV - File not found [File_System | On_Demand] --  -- (MBAMProtector)
DRV - File not found [Kernel | On_Demand] --  -- (LSI_SAS2)
DRV - File not found [Kernel | On_Demand] --  -- (L1E) NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller(NDIS6.20)
DRV - File not found [Kernel | Boot] --  -- (KSecPkg)
DRV - File not found [Kernel | System] --  -- (IDSVix86)
DRV - File not found [Kernel | Boot] --  -- (hwpolicy)
DRV - File not found [Kernel | On_Demand] --  -- (HpSAMD)
DRV - File not found [Kernel | On_Demand] --  -- (HidBatt)
DRV - File not found [Kernel | On_Demand] --  -- (hcw85cir)
DRV - File not found [Kernel | On_Demand] --  -- (GEARAspiWDM)
DRV - File not found [Kernel | Boot] --  -- (fvevol)
DRV - File not found [File_System | On_Demand] --  -- (FsDepends)
DRV - File not found [Kernel | On_Demand] --  -- (EraserUtilRebootDrv)
DRV - File not found [Kernel | On_Demand] --  -- (ebdrv)
DRV - File not found [Kernel | System] --  -- (dtsoftbus01)
DRV - File not found [Kernel | On_Demand] --  -- (dmvsc)
DRV - File not found [Kernel | System] --  -- (discache)
DRV - File not found [Kernel | System] --  -- (CSC)
DRV - File not found [Kernel | On_Demand] --  -- (CompositeBus)
DRV - File not found [Kernel | Boot] --  -- (CNG)
DRV - File not found [Kernel | System] --  -- (BHDrvx86)
DRV - File not found [Kernel | On_Demand] --  -- (b57nd60x)
DRV - File not found [Kernel | On_Demand] --  -- (b06bdrv)
DRV - File not found [Kernel | On_Demand] --  -- (AppID)
DRV - File not found [Kernel | Boot] --  -- (amdxata)
DRV - File not found [Kernel | On_Demand] --  -- (amdsbs)
DRV - File not found [Kernel | On_Demand] --  -- (amdsata)
DRV - File not found [Kernel | On_Demand] --  -- (AmdPPM)
DRV - File not found [Kernel | On_Demand] --  -- (AcpiPmi)
DRV - File not found [Kernel | On_Demand] --  -- (1394ohci)
DRV - [2011/04/08 01:14:00 | 010,690,024 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2011/03/03 11:59:19 | 000,139,368 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)
DRV - [2011/01/05 07:58:14 | 000,371,248 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2011/01/05 07:04:30 | 000,126,512 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2008/04/27 18:29:26 | 003,658,752 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\NETw5v32.sys -- (netw5v32) Intel(R)
DRV - [2008/02/29 03:13:38 | 001,202,560 | ---- | M] (Agere Systems) [Kernel | On_Demand] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
IE - HKU\Luxshan_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
IE - HKU\Luxshan_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\Luxshan_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\Luxshan_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B4 47 35 55 81 76 CD 01  [binary data]
IE - HKU\Luxshan_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\UpdatusUser_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\UpdatusUser_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\UpdatusUser_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = CC 71 6E BC FC 01 CC 01  [binary data]
IE - HKU\UpdatusUser_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0:  File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf:  
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2:  File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2:  File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0:  File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\IPSFFPlgn\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\coFFPlgn\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files\Siber Systems\AI RoboForm\Firefox
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/04/09 09:38:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/04/09 09:38:56 | 000,000,000 | ---D | M]
 
[2013/06/10 09:55:52 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/03/06 08:55:59 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/12/16 11:10:10 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/12/16 11:09:56 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011/03/19 17:35:44 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011/03/19 17:35:44 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011/03/16 15:01:29 | 000,002,198 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google-search.xml
[2011/03/19 17:35:44 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011/03/19 17:35:44 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011/03/19 17:35:44 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
Hosts file not found
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} -  File not found
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -  File not found
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -  File not found
O2 - BHO: (RoboForm Toolbar Helper) - {724d43a9-0d85-11d4-9908-00400523e39a} -  File not found
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -  File not found
O2 - BHO: (Windows Live Messenger Companion Helper) - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -  File not found
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  File not found
O3 - HKLM\..\Toolbar: (&RoboForm Toolbar) - {724d43a0-0d85-11d4-9908-00400523e39a} -  File not found
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  File not found
O3 - HKU\Luxshan_ON_D\..\Toolbar\WebBrowser: (&RoboForm Toolbar) - {724D43A0-0D85-11D4-9908-00400523E39A} -  File not found
O3 - HKU\Luxshan_ON_D\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  File not found
O4 - HKLM..\Run: [Adobe ARM]  File not found
O4 - HKLM..\Run: [Adobe Reader Speed Launcher]  File not found
O4 - HKLM..\Run: [APSDaemon]  File not found
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [EPSON Stylus DX3800 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [iTunesHelper]  File not found
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware]  File not found
O4 - HKLM..\Run: [NBAgent] C:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe (Nero AG)
O4 - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()
O4 - HKLM..\Run: [QuickTime Task]  File not found
O4 - HKU\.DEFAULT..\Run: [ctfmon.exe]  File not found
O4 - HKU\LocalService_ON_D..\Run: [ctfmon.exe]  File not found
O4 - HKU\Luxshan_ON_D..\Run: [Adobe Reader Synchronizer]  File not found
O4 - HKU\Luxshan_ON_D..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKU\Luxshan_ON_D..\Run: [icq]  File not found
O4 - HKU\Luxshan_ON_D..\Run: [RoboForm]  File not found
O4 - HKU\NetworkService_ON_D..\Run: [ctfmon.exe]  File not found
O4 - HKU\LocalService_ON_D..\RunOnce: [mctadmin]  File not found
O4 - HKU\NetworkService_ON_D..\RunOnce: [mctadmin]  File not found
O4 - HKU\UpdatusUser_ON_D..\RunOnce: [mctadmin]  File not found
O4 - Startup: Error locating startup folders.
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O9 - Extra Button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} -  File not found
O9 - Extra Button: Ausfüllen - {320AF880-6646-11D3-ABEE-C5DBF3571F46} -  File not found
O9 - Extra 'Tools' menuitem : RF - Formular ausfüllen - {320AF880-6646-11D3-ABEE-C5DBF3571F46} -  File not found
O9 - Extra Button: Speichern - {320AF880-6646-11D3-ABEE-C5DBF3571F49} -  File not found
O9 - Extra 'Tools' menuitem : RF - Formular speichern - {320AF880-6646-11D3-ABEE-C5DBF3571F49} -  File not found
O9 - Extra Button: Show Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} -  File not found
O9 - Extra 'Tools' menuitem : RF - RoboForm-Leiste ein/aus - {724d43aa-0d85-11d4-9908-00400523e39a} -  File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] -  File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] -  File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] -  File not found
O13 - gopher Prefix: missing
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab (Checkers Class)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/uno1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 10.17.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} -  File not found
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} -  File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O22 - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene -  File not found
O30 - LSA: Security Packages - (pku2u) -  File not found
O30 - LSA: Security Packages - (livessp) -  File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - D:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/06/11 15:29:49 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2013/06/11 07:10:28 | 000,000,000 | ---D | C] -- C:\Program Files\LSoft Technologies
[2013/06/11 07:10:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Active@ ISO Burner
[2009/01/10 19:36:50 | 000,049,152 | ---- | C] ( ) -- C:\Windows\Interop.IWshRuntimeLibrary.dll
[2008/01/20 22:24:21 | 000,371,712 | ---- | C] (Realtek Semiconductor) -- C:\Users\Luxshan\AppData\Local\axopifatufoqiwu.dll
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013/06/11 07:30:00 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/06/11 07:14:11 | 000,663,296 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013/06/11 07:14:11 | 000,624,972 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013/06/11 07:14:11 | 000,142,038 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013/06/11 07:14:11 | 000,116,534 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013/06/11 07:10:29 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Active@ ISO Burner
[2013/06/10 18:34:16 | 000,001,356 | ---- | M] () -- C:\Users\Luxshan\AppData\Local\d3d9caps.dat
[2013/06/10 11:51:31 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013/06/10 11:51:31 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013/06/10 08:33:55 | 000,000,069 | ---- | M] () -- C:\Windows\NeroDigital.ini
[2013/06/10 08:33:53 | 000,084,992 | ---- | M] () -- C:\Users\Luxshan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013/06/10 08:25:57 | 000,003,424 | ---- | M] () -- C:\bootsqm.dat
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013/06/10 08:25:57 | 000,003,424 | ---- | C] () -- C:\bootsqm.dat
[2011/04/17 17:17:10 | 000,000,120 | ---- | C] () -- C:\Users\Luxshan\AppData\Local\Vwozih.dat
[2011/04/17 17:17:10 | 000,000,000 | ---- | C] () -- C:\Users\Luxshan\AppData\Local\Lxuber.bin
[2011/04/09 09:38:35 | 000,000,552 | ---- | C] () -- C:\Users\Luxshan\AppData\Local\d3d8caps.dat
[2011/03/13 14:35:45 | 000,372,736 | ---- | C] () -- C:\Windows\System32\RSLSP.dll
[2011/02/20 11:31:01 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011/01/05 18:14:52 | 000,000,041 | -HS- | C] () -- C:\ProgramData\.zreglib
[2010/12/29 09:41:52 | 000,032,061 | ---- | C] () -- C:\ProgramData\nvModes.001
[2010/12/29 09:41:24 | 000,032,061 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2010/12/27 06:29:28 | 000,001,356 | ---- | C] () -- C:\Users\Luxshan\AppData\Local\d3d9caps.dat
[2010/12/19 15:02:59 | 000,000,025 | ---- | C] () -- C:\Windows\CDE DX3800EFGIPSD.ini
[2010/12/17 11:17:04 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2010/12/17 11:16:43 | 000,084,992 | ---- | C] () -- C:\Users\Luxshan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/12/16 09:49:22 | 000,000,095 | ---- | C] () -- C:\Users\Luxshan\AppData\Local\fusioncache.dat
[2010/12/14 10:47:46 | 000,200,704 | ---- | C] () -- C:\Windows\PLFSetI.exe
[2010/12/14 10:47:46 | 000,009,216 | ---- | C] () -- C:\Windows\usbvideo_reg.exe
[2010/12/14 10:47:46 | 000,000,036 | ---- | C] () -- C:\Windows\PidList.ini
[2010/12/14 10:47:45 | 000,626,688 | ---- | C] () -- C:\Windows\Image.dll
[2010/12/14 10:46:28 | 000,118,784 | ---- | C] () -- C:\Windows\System32\VMC3KAPI.dll
[2009/01/10 19:34:58 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2009/01/10 13:13:08 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIOFM4.dll
[2009/01/10 13:13:08 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIBUN5.dll
[2009/01/10 12:43:02 | 000,487,424 | ---- | C] () -- C:\Windows\System32\INT15.dll
[2009/01/10 12:22:30 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX1.dat
[2009/01/10 12:22:30 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX0.dat
[2009/01/10 12:20:35 | 000,000,008 | ---- | C] () -- C:\Windows\System32\drivers\rtkhdaud.dat
[2009/01/10 11:17:40 | 000,106,605 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009/01/10 11:17:40 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008/01/21 03:15:58 | 000,663,296 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2008/01/21 03:15:58 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2008/01/21 03:15:58 | 000,142,038 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2008/01/21 03:15:58 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2007/11/14 11:17:34 | 000,204,800 | ---- | C] () -- C:\Windows\System32\CogentBioSDK.dll
[2007/01/26 02:32:18 | 000,069,632 | ---- | C] () -- C:\Windows\System32\drivers\int15.sys
[2006/11/02 08:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 08:47:37 | 000,322,736 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 08:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 06:33:01 | 000,624,972 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 06:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 06:33:01 | 000,116,534 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 06:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 06:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 04:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 04:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/02 03:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 03:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2005/02/25 01:15:00 | 000,159,744 | ---- | C] () -- C:\Windows\System32\EPSPTDV.DLL
[2001/12/26 11:12:30 | 000,065,536 | ---- | C] () -- C:\Windows\System32\multiplex_vcd.dll
[2001/09/03 18:46:38 | 000,110,592 | ---- | C] () -- C:\Windows\System32\Hmpg12.dll
[2001/07/30 11:33:56 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC.dll
[2001/07/23 17:04:36 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC_MMX.dll
 
========== LOP Check ==========
 
[2010/12/16 09:40:42 | 000,000,000 | ---D | M] -- C:\Users\Luxshan\AppData\Roaming\Acer
[2009/01/10 12:58:59 | 000,000,000 | ---D | M] -- C:\Users\Luxshan\AppData\Roaming\Acer GameZone Console
[2010/12/29 09:10:25 | 000,000,000 | ---D | M] -- C:\Users\Luxshan\AppData\Roaming\DAEMON Tools Lite
[2011/04/05 10:27:19 | 000,000,000 | ---D | M] -- C:\Users\Luxshan\AppData\Roaming\de.3m5.wendel.flcd.FLCDB.4E7DF207D694E815646D9C9DD7DC91A41EB7FD23.1
[2011/04/22 10:17:04 | 000,000,000 | ---D | M] -- C:\Users\Luxshan\AppData\Roaming\DeepBurner
[2010/12/24 08:56:34 | 000,000,000 | ---D | M] -- C:\Users\Luxshan\AppData\Roaming\DVDVideoSoftIEHelpers
[2010/12/22 11:30:50 | 000,000,000 | ---D | M] -- C:\Users\Luxshan\AppData\Roaming\Local
[2011/04/18 16:01:48 | 000,000,000 | ---D | M] -- C:\Users\Luxshan\AppData\Roaming\MyPhoneExplorer
[2010/12/19 14:30:16 | 000,000,000 | ---D | M] -- C:\Users\Luxshan\AppData\Roaming\OpenOffice.org
[2010/12/16 09:46:19 | 000,000,000 | ---D | M] -- C:\Users\Luxshan\AppData\Roaming\T-Online
[2011/02/24 15:43:58 | 000,000,000 | ---D | M] -- C:\Users\Luxshan\AppData\Roaming\TeamViewer
[2011/02/02 11:11:26 | 000,000,000 | ---D | M] -- C:\Users\Luxshan\AppData\Roaming\Tific
[2010/12/16 09:37:17 | 000,000,000 | ---D | M] -- C:\Users\Luxshan\AppData\Roaming\Validity
[2010/12/24 11:17:55 | 000,000,000 | ---D | M] -- C:\Users\Luxshan\AppData\Roaming\XMedia Recode
[2009/01/10 12:58:59 | 000,000,000 | ---D | M] -- C:\ProgramData\Acer GameZone Console
[2010/12/16 09:30:59 | 000,000,000 | -HSD | M] -- C:\ProgramData\Anwendungsdaten
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
[2010/12/29 10:43:38 | 000,000,000 | ---D | M] -- C:\ProgramData\BVRP Software
[2010/12/29 08:34:45 | 000,000,000 | ---D | M] -- C:\ProgramData\DAEMON Tools Lite
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
[2010/12/16 09:30:59 | 000,000,000 | -HSD | M] -- C:\ProgramData\Dokumente
[2010/12/19 15:23:22 | 000,000,000 | ---D | M] -- C:\ProgramData\EPSON
[2009/01/10 13:20:35 | 000,000,000 | ---D | M] -- C:\ProgramData\eSobi
[2010/12/16 09:30:59 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favoriten
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
[2011/02/22 14:46:35 | 000,000,000 | ---D | M] -- C:\ProgramData\LightScribe
[2011/02/20 12:03:23 | 000,000,000 | ---D | M] -- C:\ProgramData\Messenger Plus!
[2010/12/19 15:18:52 | 000,000,000 | ---D | M] -- C:\ProgramData\PC Drivers HeadQuarters
[2011/03/13 10:58:44 | 000,000,000 | ---D | M] -- C:\ProgramData\RapidSolution
[2009/01/10 12:24:43 | 000,000,000 | ---D | M] -- C:\ProgramData\Roaming
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
[2010/12/16 09:30:59 | 000,000,000 | -HSD | M] -- C:\ProgramData\Startmenü
[2010/12/16 09:45:49 | 000,000,000 | ---D | M] -- C:\ProgramData\T-Online
[2010/12/14 10:55:16 | 000,000,000 | ---D | M] -- C:\ProgramData\Temp
[2006/11/02 09:02:04 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
[2011/04/21 17:14:58 | 000,000,000 | ---D | M] -- C:\ProgramData\UAB
[2010/12/16 09:30:59 | 000,000,000 | -HSD | M] -- C:\ProgramData\Vorlagen
[2013/06/10 11:52:03 | 000,031,140 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 24 bytes -> C:\Windows:6050830F09E42604
< End of report >
         

Irgendwas hat da nicht so ganz ganz geklappt. Aber versuchen wir es trotzdem.
Ist der Sperrbildschirm nach folgendem Fix immer noch vorhanden?


Schritt 1

• Starte den infizierten Rechner mit der OTLpe-CD und öffne OTLpe.
• Kopiere nun den folgenden Inhalt aus der Codebox in die Textbox.
  Wichtig: Falls du deinen Benutzernamen im Log unkenntlich gemacht hast (z.B. durch ***), dann mach das hier wieder rückgängig.

:OTL
[2011/04/17 17:17:10 | 000,000,120 | ---- | C] () -- C:\Users\Luxshan\AppData\Local\Vwozih.dat
[2011/04/17 17:17:10 | 000,000,000 | ---- | C] () -- C:\Users\Luxshan\AppData\Local\Lxuber.bin
[2008/01/20 22:24:21 | 000,371,712 | ---- | C] (Realtek Semiconductor) -- C:\Users\Luxshan\AppData\Local\axopifatufoqiwu.dll
         

• Klicke jetzt auf den Fix Button.
• Starte danach neu und versuche wieder in den normalen Modus von Windows zu booten.
• Nach dem Neustart findest du ein Textdokument auf deinem Desktop.
  (Auch zu finden unter C:\OTL\MovedFiles\<time_date.log>)
• Kopiere nun dessen Inhalt hier in deinen Thread.

Bitte poste in deiner nächsten Antwort:

• Fixlog von OTLpe

Danke Leon,aber der Sperrbildschirm erscheint immer noch,wenn ich den Rechner normal starte

========== OTL ==========
C:\Users\Luxshan\AppData\Local\Vwozih.dat moved successfully.
C:\Users\Luxshan\AppData\Local\Lxuber.bin moved successfully.
C:\Users\Luxshan\AppData\Local\axopifatufoqiwu.dll moved successfully.
 
OTLPE by OldTimer - Version 3.1.48.0 log created on 06112013_223738
         

Diese txt ist nach dem Fix rausgekommen.

Versuchen wir, den Sperrbildschirm mit HitmanPro.Kickstart zu entfernen.
Du brauchst hierfür einen USB-Stick. Achtung: Alle Daten darauf werden verloren gehen! Sichere sie zuvor an einen anderen Ort, wenn du sie noch brauchst.

• Bereite deinen USB-Stick vor wie in dieser Anleitung beschrieben: Anleitung: HitmanPro.Kickstart
• Schliesse dann diesen Stick an den infizierten Rechner an und boote ihn vom USB-Stick. (Anleitung: Starten vom USB-Stick)
• Es erscheint ein Bootmenü von HitmanPro - wähle zunächst Methode 1 aus und wenn das nicht klappen sollte, dann Methode 2.
• Windows wird jetzt ganz normal starten. Wenn der Sperrschirm des Trojaners erscheint, warte einfach ab. HitmanPro sollte in wenigen Sekunden gestartet werden (grünes Fenster).
• Klicke jetzt: Weiter -> "Nein, ich möchte nur einen Einmalscan ..." -> Weiter
• Der Computer wird jetzt untersucht, mache in dieser Zeit bitte nichts.
• Klicke dann weiter, um die Funde in die Quarantäne zu verschieben.
• Klicke jetzt unten links auf "Logfile speichern" und lege es auf dem Desktop ab.
• Lasse den Rechner neu starten, berichte ob alles geklappt hat und poste mir hier das Logfile von HitmanPro.

Ok habe nun Hitman laufen lassen un bin jetzt auch fertig,aber ich kann kein logfilfe speichern,ich soll mein exemplar von hitman mit einem produktschlüssel aktivieren. Oder habe ich den Logfile schritt schon ausversehen übersprungen?

Nein, nicht aktivieren. Das mit dem Logfile ist jetzt erstmal auch nicht so wichtig.
Die Frage ist vor allem, ob der Sperrbildschirm noch vorhanden ist..