Ich hab den Fix jetzt gemacht. Leider verlinkt google immer noch auf komische Webseiten.

Folgendes Log kam nach neustart des computers:

All processes killed
========== OTL ==========
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Local Page| /E : value set successfully!
HKLM\SOFTWARE\Microsoft\Internet Explorer\Search\\Default_Search_URL| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Prefs.js: "128.151.65.101" removed from network.proxy.backup.ftp
Prefs.js: 3128 removed from network.proxy.backup.ftp_port
Prefs.js: "128.151.65.101" removed from network.proxy.backup.gopher
Prefs.js: 3128 removed from network.proxy.backup.gopher_port
Prefs.js: "128.151.65.101" removed from network.proxy.backup.socks
Prefs.js: 3128 removed from network.proxy.backup.socks_port
Prefs.js: "128.151.65.101" removed from network.proxy.backup.ssl
Prefs.js: 3128 removed from network.proxy.backup.ssl_port
Prefs.js: "128.151.65.101" removed from network.proxy.ftp
Prefs.js: 3128 removed from network.proxy.ftp_port
Prefs.js: "128.151.65.101" removed from network.proxy.gopher
Prefs.js: 3128 removed from network.proxy.gopher_port
Prefs.js: "128.151.65.101" removed from network.proxy.http
Prefs.js: 3128 removed from network.proxy.http_port
Prefs.js: true removed from network.proxy.share_proxy_settings
Prefs.js: "128.151.65.101" removed from network.proxy.socks
Prefs.js: 3128 removed from network.proxy.socks_port
Prefs.js: "128.151.65.101" removed from network.proxy.ssl
Prefs.js: 3128 removed from network.proxy.ssl_port
C:\Program Files\Common Files\rplsp\Rpl\Codecs folder moved successfully.
C:\Program Files\Common Files\rplsp\Rpl folder moved successfully.
C:\Program Files\Common Files\rplsp folder moved successfully.
C:\WINDOWS\system32\CF7975.exe moved successfully.
C:\WINDOWS\system32\attrdsvr.dll moved successfully.
C:\zrpt.xml moved successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
[EMPTYTEMP]
 
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: elephant
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
 
User: Superjinchi
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 24014979 bytes
->FireFox cache emptied: 4717815 bytes
->Flash cache emptied: 1406 bytes
 
User: vvjj
->Temp folder emptied: 4140721 bytes
->Temporary Internet Files folder emptied: 495156 bytes
->Java cache emptied: 94744679 bytes
->FireFox cache emptied: 76800675 bytes
->Flash cache emptied: 192701 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2402044 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 424369 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 198,00 mb
 
 
OTL by OldTimer - Version 3.2.12.0 log created on 09152010_194139

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...
         

Logfile of The Avenger Version 2.0, (c) by Swandog46
hxxp://swandog46.geekstogo.com

Platform:  Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error:  file "c:\windows\system32\winlogon.exe" is whitelisted
File move operation "c:\winlogon.exe|c:\windows\system32\winlogon.exe" failed!
Status: 0xc0000022 (STATUS_ACCESS_DENIED)


Error:  file "c:\windows\explorer.exe" is whitelisted
File move operation "c:\explorer.exe|c:\windows\explorer.exe" failed!
Status: 0xc0000022 (STATUS_ACCESS_DENIED)


Completed script processing.

*******************

Finished!  Terminate.
         

hxxp://www.file-upload.net/download-2823965/backup.zip.html