Trojaner-Board - ordner in externer festplatte nur verknüpfungen?! Windows cannot find `K: RECYCLER/ 470a1245. hilfe!

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - ordner in externer festplatte nur verknüpfungen?! Windows cannot find `K: RECYCLER/ 470a1245. hilfe! (https://www.trojaner-board.de/106285-ordner-externer-festplatte-nur-verknuepfungen-windows-cannot-find-k-recycler-470a1245-hilfe.html)

ordner in externer festplatte nur verknüpfungen?! Windows cannot find `K: RECYCLER/ 470a1245. hilfe!

Hallo leute es geht um folgendes ich habe letztens auf meinem pc einen virus bekommen den mit der bka bundespolizei , gut daraufhin habe ich wollte ich die daten retten die drauf waren weil meine prüfung / arbeit drauf war , so bin irendwie aufn desktop und habe meine externe festplatte angeschlossen zu kurz gedacht und ich idiot die daten reingezogen so am nächsten tag hatte ich den pc formatiert neues windows draufgespielt und dann steck ich meine meine externe festplatte an und bam nur verknüpfungen. was kann ich machen ich brauch die daten sehr schnell weil 30 stunden arbeit dahinter stecken da meine prüfung drauf ist und sonstige wichtige daten. ich habe windows 7 englisch sprache und wenn ich aufm ordner klick steht dann da

Windows cannot find `K: RECYCLER/ 470a1245.exe. Make shure that you typed the name correktly than try again ? ? bitte hilft mir ich bin am verzweifeln

Bitte nun routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

also das ist jez rausgekommen bei dem durchforsten von antimaleware, hat ziemlich viel zeit in anspruch genommen , gerade lass ich eset durchlaufen schon seit 2 stunden.

Code:

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org
 

Datenbank Version: 8379
 

Windows 6.1.7600

Internet Explorer 8.0.7600.16385
 

16.12.2011 17:39:28

mbam-log-2011-12-16 (17-39-24).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|K:\|)

Durchsuchte Objekte: 805283

Laufzeit: 2 Stunde(n), 43 Minute(n), 57 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 2

Infizierte Dateien: 4
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

c:\Washer2.rar (Trojan.SpyEyes) -> No action taken.

c:\Recycle.Bin (Trojan.Spyeyes) -> No action taken.
 

Infizierte Dateien:

c:\Windows.old\Users\Shpend\downloads\musik old\setupcasino_de279e.exe (PUP.Casino) -> No action taken.

c:\Windows.old\Users\Shpend\downloads\musik old\setupcasino_ec1b71.exe (PUP.Casino) -> No action taken.

c:\Washer2.rar\config.bin (Trojan.SpyEyes) -> No action taken.

c:\Recycle.Bin\config.bin (Trojan.Spyeyes) -> No action taken.

also eset hab ich jez auch komplett durchlaufen lassen das ist dabei rausgekommen

Code:

 ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=8caba0c5dd31594c95f51f6a601873a3

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-12-16 09:28:28

# local_time=2011-12-16 10:28:28 (+0100, Central European Standard Time)

# country="Germany"

# lang=1033

# osver=6.1.7600 NT 

# compatibility_mode=1797 16775165 100 94 163962 60585687 169761 0

# compatibility_mode=5893 16776573 100 94 14576 76503957 0 0

# compatibility_mode=8192 67108863 100 0 3846 3846 0 0

# scanned=978114

# found=125

# cleaned=0

# scan_time=17084

C:\$Recycle.Bin\S-1-5-21-2523981450-3798237560-2714984033-1000\$R4JZ6OB.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

C:\$Recycle.Bin\S-1-5-21-2523981450-3798237560-2714984033-1000\$RTWJPJ8.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Documents and Settings\Shpend\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43\556445eb-283e1193        probably a variant of Win32/Agent.DYXWUMY trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Documents and Settings\Shpend\Downloads\musik old\SoftonicDownloader48196.exe        a variant of Win32/SoftonicDownloader.A application (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Users\Shpend\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43\556445eb-283e1193        probably a variant of Win32/Agent.DYXWUMY trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Users\Shpend\Downloads\musik old\SoftonicDownloader48196.exe        a variant of Win32/SoftonicDownloader.A application (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9YQ3YT8E\4f40b[1].pdf        JS/Exploit.Pdfka.OXB.Gen trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47\18c2096f-1cff29e3        a variant of Java/TrojanDownloader.OpenStream.NCC trojan (unable to clean)        00000000000000000000000000000000        I

D:\Users\boss\AppData\Local\Mozilla\Firefox\Profiles\6wt3ctp1.default\Cache\8\2E\F4EE2d01        JS/Kryptik.BI trojan (unable to clean)        00000000000000000000000000000000        I

D:\Users\boss\AppData\Local\Mozilla\Firefox\Profiles\6wt3ctp1.default\Cache\9\8D\67ACFd01        JS/Kryptik.BI trojan (unable to clean)        00000000000000000000000000000000        I

D:\Users\boss\AppData\Local\Mozilla\Firefox\Profiles\6wt3ctp1.default\Cache\E\8B\A7D23d01        JS/TrojanClicker.Agent.NCI.Gen trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\ProgramData\49012472.exe        a variant of Win32/Kryptik.NOG trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\ProgramData\trwKcwHFGPMgtX.exe        a variant of Win32/Kryptik.NOG trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\update.exe        a variant of Win32/Injector.FYX trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\ojufaxawiroziliz.dll        Win32/Cimag.ET trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\rsposqlb.dll        a variant of Win32/Kryptik.NQE trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\03XQAM0D\controlesbrasil_com_br[1].htm        HTML/Iframe.B.Gen virus (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\0.06158802471372238.exe        a variant of Win32/Kryptik.NPS trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\4B93.tmp        Win32/Olmarik.AQE trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\6A98.tmp        a variant of Win32/Olmarik.AOM trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\982.tmp        a variant of Win32/Olmarik.APB trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\Adobe_Flash_Player.exe        Win32/Olmasco.Gen trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\jar_cache469182182734140194.tmp        a variant of Java/TrojanDownloader.OpenStream.NBV trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\ldr9208.tmp        Win32/Olmasco.Gen trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmp05efa6e1.exe        a variant of Win32/Kryptik.LWF trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmp0d6bb711.exe        a variant of Win32/Kryptik.LHD trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmp12535f7a.exe        a variant of Win32/Kryptik.LWF trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmp1e47863a.exe        Win32/Spy.Zbot.YW trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmp297acfdf.exe        probably a variant of Win32/Spy.Agent.DGNNSAP trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmp2ae0f582.exe        a variant of Win32/Kryptik.LWF trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmp31cfa342.exe        a variant of Win32/Kryptik.LHD trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmp3427fe5d.exe        a variant of Win32/Kryptik.MYM trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmp3a2b9823.exe        a variant of Win32/Kryptik.LHD trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmp3bccabbf.exe        a variant of Win32/Kryptik.LWF trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmp3c6d1103.exe        a variant of Win32/Kryptik.LHD trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmp3d7c58fb.exe        Win32/Spy.Zbot.YW trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmp3ecab729.exe        a variant of Win32/Kryptik.LPD trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmp4880e04f.exe        Win32/Spy.Zbot.YW trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmp4bf8a37b.exe        Win32/Spy.Zbot.YW trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmp54068c89.exe        a variant of Win32/Kryptik.LHD trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmp5ce6b464.exe        a variant of Win32/Kryptik.LWF trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmp6bd0eb9a.exe        a variant of Win32/Kryptik.LWF trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmp7085be1c.exe        a variant of Win32/Kryptik.MCF trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmp71721885.exe        a variant of Win32/Kryptik.LYM trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmp84f3f281.exe        Win32/Spy.Zbot.YW trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmp8D57.tmp        a variant of Win32/Kryptik.NOG trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmp965fd47e.exe        a variant of Win32/Kryptik.LHD trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmp98801552.exe        a variant of Win32/Injector.FJS trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmp9a80f407.exe        a variant of Win32/Kryptik.LWF trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmpa787c44d.exe        Win32/Spy.Zbot.YW trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmpaafdad50.exe        a variant of Win32/Kryptik.LWF trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmpab120891.exe        Win32/Spy.Zbot.ZR trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmpb6f6ab09.exe        a variant of Win32/Kryptik.MFC trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmpb9872afb.exe        a variant of Win32/Kryptik.LWF trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmpce69ee66.exe        a variant of Win32/Kryptik.LHD trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmpd05dc386.exe        a variant of Win32/Kryptik.LWF trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmpd09c3535.exe        a variant of Win32/Kryptik.LHD trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmpd0d8da35.exe        a variant of Win32/Kryptik.MCF trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmpdc7fa913.exe        a variant of Win32/Injector.FJS trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmpdd055c36.exe        Win32/Spy.Zbot.YW trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmpe0443a38.exe        Win32/Spy.Zbot.YW trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmpe41aaa01.exe        Win32/Spy.Zbot.YW trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmpe72820f1.exe        a variant of Win32/Kryptik.LPD trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmpe7285ec9.exe        a variant of Win32/Kryptik.LWF trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmpe9fbec26.exe        a variant of Win32/Kryptik.LWF trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmpea1ee1b6.exe        Win32/Spy.Zbot.YW trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmped11a13c.exe        a variant of Win32/Kryptik.LWF trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmpf15b2745.exe        a variant of Win32/Kryptik.LWF trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmpf200047d.exe        a variant of Win32/Kryptik.LHD trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmpf38d6990.exe        a variant of Win32/Kryptik.LPD trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmpf5b3e959.exe        a variant of Win32/Kryptik.LWF trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmpf5f6a9e7.exe        a variant of Win32/Kryptik.LJO trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmpfb5552f8.exe        a variant of Win32/Kryptik.LWF trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Local\Temp\tmpffc36c0e.exe        Win32/Spy.Zbot.YW trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10\162f094a-6bcc59d0        multiple threats (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12\3cc664c-424fb8e0        a variant of Java/Exploit.CVE-2010-4452.A trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\34a824d0-1f9e498d        a variant of Java/TrojanDownloader.OpenStream.NCE trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\34a824d0-1fb56861        a variant of Java/TrojanDownloader.OpenStream.NCE trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\34a824d0-36dee7c8        a variant of Java/TrojanDownloader.OpenStream.NCE trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\34a824d0-40448b3a        a variant of Java/TrojanDownloader.OpenStream.NCE trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\34a824d0-4ebb2908        a variant of Java/TrojanDownloader.OpenStream.NCE trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\34a824d0-71ab0fd7        a variant of Java/TrojanDownloader.OpenStream.NCE trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19\2efed813-196654fc        multiple threats (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27\5b0c76db-7cfb74a0        multiple threats (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\5d2a95df-237de18e        multiple threats (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\61c8d1f-7e41526b        Java/TrojanDownloader.OpenStream.NBX trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4\436f3604-69c13803        multiple threats (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41\23e31529-77600e04        a variant of Win32/Kryptik.NPS trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46\426662e-2a5726a2        probably a variant of Java/TrojanDownloader.OpenStream.NCC trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47\156c0daf-632a35ab        multiple threats (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47\25760daf-60f7d491        multiple threats (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\2d9ce531-5fafcb4a        multiple threats (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50\56b61132-42c2da4c        Java/TrojanDownloader.OpenStream.NBV trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51\60c371b3-6365ea61        multiple threats (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\d731ab5-43a1d7d9        multiple threats (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7\53ab71c7-3e8d8a0f        multiple threats (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\7be78a09-57feb48f        probably a variant of Java/TrojanDownloader.OpenStream.NCC trojan (unable to clean)        00000000000000000000000000000000        I

D:\Windows.old.000\Users\^\AppData\Roaming\Duif\aman.exe        a variant of Win32/Kryptik.MFC trojan (unable to clean)        00000000000000000000000000000000        I

K:\BMW.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\endri.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\HP.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\foto nks.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\Musik.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\filme.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\Eigene Scans.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\albanian_rap_playlist.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\new_playlist.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\old_playlist.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\Fotot e families.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\i phone fotos.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\$RECYCLE.BIN.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\Dasma erzenit + Urlaub 2010.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\Fotos von Diamant.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\fotot e letes.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\fotot e penit.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\Fotot e popit.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\Dokumentet e families.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\fotot e vjetera.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\Hanna.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\Recycled.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\SHPEND-PC.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\dasma letes.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\Tallava 2010.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\System Volume Information.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\$RECYCLE.BIN\$RPSZZ1Y.zip        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

Zitat:

c:\Recycle.Bin\config.bin (Trojan.Spyeyes)

Wenn du auch noch andere Dinge erledigen willst als nur Zocken oder Solitär spielen wie zB E-Mails abrufen oder alles was Logins erfordert dann solltest du deine Daten sichern, den Rechner komplett plätten und eine Neuinstallation von Windows durchführen.
Anschließend auch sämtliche Passwörter ändern!!!

Mit komplett plätten wird gemeint: alle Partitionen auflösen, neu erstellen und formatieren. Helfen kann dabei ein Tool wie DBAN oder die Laufwerksverwaltung in einem Ubuntu im Ausprobiermodus.

Praktischerweise kann man mit diesem Live-Linux auch ziemlich gefahrlos all seine wichtigen Daten auf eine externe Platte sichern.
kopiere nur persönliche Dateien, Musik, Videos, etc. auf die Backupplatte, KEINE ausführbaren Dateien wie Programme/Spiele/Setups!!

hallo cosinus, ich habe mich über das spyeeyes schon informiert scheint net so toll zu sein, wie soll ich das jez m achen soll ich zuerst meine festplatte von pc formatieren und dannach mich um meine externe festplatte kümmern ( laufwerk K ) oder andersrum ? ? ?

und kann ich jez einfach sooo dann die bilder und musik auf diese " angesteckte " externe festplatte kopieren ( ich hab keine andere momentan) ? ?

also hab jez mein windows 7 neu aufgespielt, also alte partitionen gelöscht , formatiert so jez lass ich mal nochmal esset durchlaufen ?! , ich habe die bilder und musik alles auf meine " angesteckte" festplatte kopiert weil ich keine andere hatte soo sobald eset durchgelaufen ist log ist das hier hin

soll ich anti maleware auch durchlaufen lassen ?

soo jez habe ich antimaleware mal durchlaufen lassen mit und ohne festplatte ergebnis : kein fund

und ich hab eset laufen lassen mit externer " angesteckter" festplatte das ist dabei rausgekommen

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=264541c60ead3b48adbb63de4546b207

# end=stopped

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-12-18 12:07:15

# local_time=2011-12-18 01:07:15 (+0100, W. Europe Standard Time)

# country="Germany"

# lang=1033

# osver=6.1.7600 NT 

# compatibility_mode=5893 16776573 100 94 4733 76659840 0 0

# compatibility_mode=8192 67108863 100 0 3768 3768 0 0

# scanned=40941

# found=0

# cleaned=0

# scan_time=328

ESETSmartInstaller@High as downloader log:

all ok

esets_scanner_update returned -1 esets_gle=53251

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=264541c60ead3b48adbb63de4546b207

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-12-18 12:49:43

# local_time=2011-12-18 01:49:43 (+0100, W. Europe Standard Time)

# country="Germany"

# lang=1033

# osver=6.1.7600 NT 

# compatibility_mode=5893 16776573 100 94 6126 76661233 0 0

# compatibility_mode=8192 67108863 100 0 5161 5161 0 0

# scanned=98182

# found=27

# cleaned=0

# scan_time=1483

K:\BMW.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\endri.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\HP.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\foto nks.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\Musik.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\filme.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\Eigene Scans.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\albanian_rap_playlist.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\new_playlist.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\old_playlist.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\Fotot e families.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\i phone fotos.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\$RECYCLE.BIN.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\Dasma erzenit + Urlaub 2010.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\Fotos von Diamant.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\fotot e letes.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\fotot e penit.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\Fotot e popit.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\Dokumentet e families.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\fotot e vjetera.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\Hanna.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\Recycled.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\SHPEND-PC.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\dasma letes.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\Tallava 2010.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\System Volume Information.lnk        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

K:\$RECYCLE.BIN\$RPSZZ1Y.zip        Win32/Dorkbot.D worm (unable to clean)        00000000000000000000000000000000        I

soo wie geht es jezt weiter kann ich jezt dem vertrauen das kein spyeye mehr auf meiner festplatte drauf ist? , mfg nino

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":Files" muss mitkopiert werden!!!)

Die externe Platte K: muss aktiv sein!!

Code:

:Files

K:\*.lnk

K:\$RECYCLE.BIN\$RPSZZ1Y.zip

:Commands

[emptytemp]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Code:

All processes killed

========== FILES ==========

K:\BMW.lnk moved successfully.

K:\endri.lnk moved successfully.

K:\HP.lnk moved successfully.

K:\foto nks.lnk moved successfully.

K:\Musik.lnk moved successfully.

K:\filme.lnk moved successfully.

K:\Eigene Scans.lnk moved successfully.

K:\albanian_rap_playlist.lnk moved successfully.

K:\new_playlist.lnk moved successfully.

K:\old_playlist.lnk moved successfully.

K:\Fotot e families.lnk moved successfully.

K:\i phone fotos.lnk moved successfully.

K:\$RECYCLE.BIN.lnk moved successfully.

K:\Dasma erzenit + Urlaub 2010.lnk moved successfully.

K:\Fotos von Diamant.lnk moved successfully.

K:\fotot e letes.lnk moved successfully.

K:\fotot e penit.lnk moved successfully.

K:\Fotot e popit.lnk moved successfully.

K:\Dokumentet e families.lnk moved successfully.

K:\fotot e vjetera.lnk moved successfully.

K:\Fejesa e zenit dhe hanes 21.03.2010.lnk moved successfully.

K:\Hanna.lnk moved successfully.

K:\Recycled.lnk moved successfully.

K:\SHPEND-PC.lnk moved successfully.

K:\dasma letes.lnk moved successfully.

K:\Tallava 2010.lnk moved successfully.

K:\System Volume Information.lnk moved successfully.

K:\$RECYCLE.BIN\$RPSZZ1Y.zip moved successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: peni

->Temp folder emptied: 4041680 bytes

->Temporary Internet Files folder emptied: 36861682 bytes

->FireFox cache emptied: 100960949 bytes

->Flash cache emptied: 823 bytes

 

User: Public

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 3617250 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 139,00 mb

 

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.31.0 log created on 12182011_142101
 

Files\Folders moved on Reboot...

C:\Users\peni\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

File\Folder C:\Users\peni\AppData\Local\Temp\~DF1999D3AD1E0F5347.TMP not found!

File\Folder C:\Users\peni\AppData\Local\Temp\~DF3749C9E75A6BEC47.TMP not found!

File\Folder C:\Users\peni\AppData\Local\Temp\~DF45F19C93BBED7771.TMP not found!

File\Folder C:\Users\peni\AppData\Local\Temp\~DF4EB28B8B3FF365BF.TMP not found!

File\Folder C:\Users\peni\AppData\Local\Temp\~DF6F09DC530B83BEA8.TMP not found!

File\Folder C:\Users\peni\AppData\Local\Temp\~DF779CBF6500846A86.TMP not found!

File\Folder C:\Users\peni\AppData\Local\Temp\~DF9BC825C51B594233.TMP not found!

File\Folder C:\Users\peni\AppData\Local\Temp\~DFCA9AE7990564B895.TMP not found!

C:\Users\peni\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LFG99INJ\106285-ordner-externer-festplatte-nur-verknuepfungen-windows-cannot-find-k-recycler-470a1245-hilfe[1].html moved successfully.

C:\Users\peni\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LFG99INJ\ads[1].htm moved successfully.

C:\Users\peni\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LFG99INJ\si[1].htm moved successfully.

C:\Users\peni\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\JIELXGEW\ads[1].htm moved successfully.

C:\Users\peni\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\JIELXGEW\si[1].htm moved successfully.

C:\Users\peni\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BG81910N\ads[1].htm moved successfully.

C:\Users\peni\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BG81910N\si[1].htm moved successfully.

C:\Users\peni\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BG81910N\si[2].htm moved successfully.

C:\Users\peni\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.
 

Registry entries deleted on Reboot...

hmm gut soweit wäre ich , hab jez mal auf meine festplatte draufgeschaut da ist nixmehr drinnen wo kann ich dann die dateien finden oder gehts jez iwie weiter?

Lass dir zuerst mal alle Dateien anzeigen => http://www.trojaner-board.de/59624-a...-sichtbar.html
Danach sollte auch alle Ordner wieder angezeigt werden - halbtransparent, da sie noch die Atrribute "versteckt" und "system" tragen

Starte anschließend die Eingabeaufforderung über Start, Alle Programme, Zubehör

Musst in der Eingabeauforderung jeweils für jeden versteckten Ordner diesen Befehl ausführen:

Code:

attrib -s -h "x:\ordner" /s /d

x: => Muss angepasst werden, den passenden Buchstaben verwenden
"ordner" muss dann der jew. richtige Ordnername sein

Vgl. diesen Strang => http://www.trojaner-board.de/102950-...traeger-2.html

hmm ok gut die sind jez transparent sichtbar , aber das klappt blos nicht mit der eingabeaufforderung ich gebe das so ein bzw es sieht dann so aus auf der eingabeaufforderung

C:/users/peni>attrib -s -h "x:/BMW" /s /d

auch ohne apostroph klappt es nicht das steht dann

( ordner BMW )

Du musst ja auch den Laufwerksbuchstaben anpassen!
Steht doch da extra, ich versuche so allgemeingültige Antowrten wir nu möglich zu verfassen, da kann ich mich nicht auf einen Laufwerksbuchstaben fixieren.

okay , ich bedanke mich Vorerst du hast mir echt super weitergeholfen ! hab alle daten wieder das ist schon mal das wichtigste kann somit mit meiner prüfung weitermachen .

mfg nino