Virus wordslife.com/index.php

MWinni

Hi Arne!

Freu mich riesig über deine Hilfe!

Ich hab das ausgeführt, musste den PC danach neu starten. Das logfile folgt hier unten. Aber weg ist der Virus nicht (auch wenn sich die drittletzte Zeile für mich so liest). Als ich den IE gerade aufgemacht habe um dir hier im Forum das logfile zu posten, hat der Trojaner die Seite umgelinkt und es kam so eine Windows-Fakeseite bei der angeblich mein System geprüft wird und in den Ordnern zig Trojanerfunde angezeigt werden. Wie gehts nun weiter? Ich hoffe, das System ist zu retten? :-( Kann es sein, dass der Virus auf dem Router hockt?

Hier das logfile:

All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\SpybotSD TeaTimer deleted successfully.
C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe moved successfully.
File move failed. G:\Autorun.inf scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4714c7e7-e270-11de-ab05-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4714c7e7-e270-11de-ab05-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4714c7e7-e270-11de-ab05-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4714c7e7-e270-11de-ab05-806e6f6e6963}\ not found.
File move failed. G:\Launcher.exe scheduled to be moved on reboot.
C:\Windows\SysNative\drivers\kgpcpy.cfg moved successfully.
ADS C:\ProgramData\TEMP:F35A93AD deleted successfully.
========== COMMANDS ==========
File move failed. C:\Windows\System32\drivers\etc\Hosts scheduled to be moved on reboot.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Marc
->Temp folder emptied: 21646861 bytes
->Temporary Internet Files folder emptied: 64523477 bytes
->Java cache emptied: 35397015 bytes
->Flash cache emptied: 35190 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 115405 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 63351137 bytes

Total Files Cleaned = 177,00 mb


OTL by OldTimer - Version 3.2.14.1 log created on 09262010_211717

Files\Folders moved on Reboot...
File move failed. G:\Autorun.inf scheduled to be moved on reboot.
File move failed. G:\Launcher.exe scheduled to be moved on reboot.
File move failed. C:\Windows\System32\drivers\etc\Hosts scheduled to be moved on reboot.
C:\Users\Marc\AppData\Local\Temp\Low\Google Toolbar\GoogleToolbarWelcome.log moved successfully.
File\Folder C:\Users\Marc\AppData\Local\Temp\~DFA253.tmp not found!
File\Folder C:\Users\Marc\AppData\Local\Temp\~DFA266.tmp not found!
File\Folder C:\Users\Marc\AppData\Local\Temp\~DFA2C1.tmp not found!
File\Folder C:\Users\Marc\AppData\Local\Temp\~DFA2CC.tmp not found!
File\Folder C:\Users\Marc\AppData\Local\Temp\~DFA30C.tmp not found!
File\Folder C:\Users\Marc\AppData\Local\Temp\~DFA317.tmp not found!
C:\Users\Marc\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WZ621P72\ads[1].htm moved successfully.
C:\Users\Marc\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\L9H09RQK\91140-virus-wordslife-com-index-php-2[1].html moved successfully.
C:\Users\Marc\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\F8C29DXX\ads[1].htm moved successfully.

Registry entries deleted on Reboot...