Trojaner-Board - Weisser Bildschirm - Please wait while the connection is beeing established

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Weisser Bildschirm - Please wait while the connection is beeing established (https://www.trojaner-board.de/113848-weisser-bildschirm-please-wait-while-the-connection-is-beeing-established.html)

Weisser Bildschirm - Please wait while the connection is beeing established

Schönen guten Tag,

auf dem PC eines Freundes tritt folgendes Problem auf (Windows 7 Starter):

Nach der Benutzeranmeldung ist der Bildschirm weiß und es steht in Englisch und Deutsch "Please wait while the connection is beeing established" bzw "Bitte warten Sie während die Verbindung hergestellt wird". Der Taskmanager lässt sich nicht öffnen. :headbang:

Im Anhang das Logfile vom OTL Scan!

Vielen Dank im Voraus!

LG Jalal

hi
auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort
rein:

Code:

:OTL

O4 - HKU\Chefin_ON_C..\Run: [5kS43ADO0bzprWo] C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe (QRPU)

O4 - HKU\Chef_ON_C..\Run: [yiSNUTyakcfEQv.exe] C:\ProgramData\yiSNUTyakcfEQv.exe ()

O4 - HKU\AssistentIn_ON_C..\Run: [HPADVISOR]  File not found

O4 - HKU\Chef_ON_C..\Run: [5kS43ADO0bzprWo] C:\Users\Chef\AppData\Roaming\soundblaster_fx648.exe (QRPU)

O4 - HKLM..\Run: [5kS43ADO0bzprWo] C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe (QRPU)

O7 - HKU\Chef_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1

O7 - HKU\Chef_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1

O7 - HKU\Chef_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1

O7 - HKU\Chefin_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1

O7 - HKU\Chefin_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1

O7 - HKU\Chefin_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1

O20 - HKLM Winlogon: Shell - (C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe) - C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe (QRPU)

O20 - HKLM Winlogon: UserInit - (C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe) - C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe (QRPU)

O20 - HKU\Chef_ON_C Winlogon: Shell - (C:\Users\Chef\AppData\Roaming\soundblaster_fx648.exe) - C:\Users\Chef\AppData\Roaming\soundblaster_fx648.exe (QRPU)

O20 - HKU\Chef_ON_C Winlogon: UserInit - (C:\Users\Chef\AppData\Roaming\soundblaster_fx648.exe) - C:\Users\Chef\AppData\Roaming\soundblaster_fx648.exe (QRPU)

O20 - HKU\Chefin_ON_C Winlogon: Shell - (C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe) - C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe (QRPU)

O20 - HKU\Chefin_ON_C Winlogon: UserInit - (C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe) - C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe (QRPU)
 

:Files

C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe

C:\ProgramData\yiSNUTyakcfEQv.exe

c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache

c:\Users\Chefin\AppData\LocalLow\Sun\Java\Deployment\cache

:Commands

[Reboot]

dieses speicherst du auf nem usb stick als fix.txt
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist.
• Klicke nun bitte auf den Fix Button.
es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick.
wenn dies nicht funktioniert, bitte den fix manuell eintragen.
dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen,
log posten bitte.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!

Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + E Taste.

Öffne dein Systemlaufwerk ( meistens C: )
Suche nun
folgenden Ordner: _OTL und öffne diesen.
Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner
Dies wird eine Movedfiles.zip Datei in _OTL erstellen
Lade diese bitte in unseren Uploadchannel
hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )

Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus :)

Hallo,

vielen Dank für deine Antwort!
Ich habe den fix ausgeführt jedoch kommt beim Neustart nach dem Anmeldefenster nur ein blauer Bildschirm mit dem Mauszeiger (ohne Symbole). Einen Rechtsklick nimmt er nicht an und den Task-Manager kann ich auch nicht starten ("Der Task-Manager wurde durch den Administrator deaktiviert.")

Nach dem Fix, folgender Log:

========== OTL ==========
Registry value HKEY_USERS\Chefin_ON_C\Software\Microsoft\Windows\CurrentVersion\Run\\5kS43ADO0bzprWo deleted successfully.
C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe moved successfully.
Registry value HKEY_USERS\Chef_ON_C\Software\Microsoft\Windows\CurrentVersion\Run\\yiSNUTyakcfEQv.exe deleted successfully.
C:\ProgramData\yiSNUTyakcfEQv.exe moved successfully.
Registry value HKEY_USERS\AssistentIn_ON_C\Software\Microsoft\Windows\CurrentVersion\Run\\HPADVISOR deleted successfully.
Registry value HKEY_USERS\Chef_ON_C\Software\Microsoft\Windows\CurrentVersion\Run\\5kS43ADO0bzprWo deleted successfully.
C:\Users\Chef\AppData\Roaming\soundblaster_fx648.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\5kS43ADO0bzprWo deleted successfully.
File C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe not found.
Registry value HKEY_USERS\Chef_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDesktop deleted successfully.
Registry value HKEY_USERS\Chef_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableRegistryTools deleted successfully.
Registry value HKEY_USERS\Chefin_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDesktop deleted successfully.
Registry value HKEY_USERS\Chefin_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableTaskMgr deleted successfully.
Registry value HKEY_USERS\Chefin_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableRegistryTools deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe deleted successfully.
File C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit:C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe deleted successfully.
File C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe not found.
Registry value HKEY_USERS\Chef_ON_C\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Users\Chef\AppData\Roaming\soundblaster_fx648.exe deleted successfully.
File C:\Users\Chef\AppData\Roaming\soundblaster_fx648.exe not found.
Registry value HKEY_USERS\Chef_ON_C\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit:C:\Users\Chef\AppData\Roaming\soundblaster_fx648.exe deleted successfully.
File C:\Users\Chef\AppData\Roaming\soundblaster_fx648.exe not found.
Registry value HKEY_USERS\Chefin_ON_C\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe deleted successfully.
File C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe not found.
Registry value HKEY_USERS\Chefin_ON_C\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit:C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe deleted successfully.
File C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe not found.
========== FILES ==========
File\Folder C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe not found.
File\Folder C:\ProgramData\yiSNUTyakcfEQv.exe not found.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\tmp folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 folder moved successfully.
c:\Users\Chef\AppData\LocalLow\Sun\Java\Deployment\cache folder moved successfully.
File\Folder c:\Users\Chefin\AppData\LocalLow\Sun\Java\Deployment\cache not found.
Error: Unable to interpret <:Commands
[Reboot]> in the current context!

OTLPE by OldTimer - Version 3.1.48.0 log created on 04202012_163809

Vielen Dank für deine Hilfe!

hi
dann erstelle noch mal ein neues otl log bitte und poste es

Hallo,
als user habe ich "systemprofile" ausgewählt.
Danke!

auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort
rein:

Code:

:OTL

O4 - HKLM..\Run: [5kS43ADO0bzprWo]  File not found

O4 - HKU\Chef_ON_C..\Run: [5kS43ADO0bzprWo]  File not found

O4 - HKU\Chef_ON_C..\Run: [yiSNUTyakcfEQv.exe]  File not found

O4 - HKU\Chefin_ON_C..\Run: [5kS43ADO0bzprWo]  File not found

O7 - HKU\Chef_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1

O7 - HKU\Chef_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1

O7 - HKU\Chef_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1

O7 - HKU\Chefin_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1

O7 - HKU\Chefin_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1

O7 - HKU\Chefin_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1

O20 - HKLM Winlogon: Shell - (C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe) -  File not found

O20 - HKLM Winlogon: UserInit - (C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe) -  File not found

O20 - HKU\Chef_ON_C Winlogon: Shell - (C:\Users\Chef\AppData\Roaming\soundblaster_fx648.exe) -  File not found

O20 - HKU\Chef_ON_C Winlogon: UserInit - (C:\Users\Chef\AppData\Roaming\soundblaster_fx648.exe) -  File not found

O20 - HKU\Chefin_ON_C Winlogon: Shell - (C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe) -  File not found

O20 - HKU\Chefin_ON_C Winlogon: UserInit - (C:\Users\Chefin\AppData\Roaming\soundblaster_fx648.exe) -  File not found

:Files

:Commands

[Reboot]

dieses speicherst du auf nem usb stick als fix.txt
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist.
• Klicke nun bitte auf den Fix Button.
es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick.
wenn dies nicht funktioniert, bitte den fix manuell eintragen.
dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen,
log posten bitte.

wenn es keine desktop symbole gibt, und rechtsklick nicht funktioniert, teste außerdem ob der taskmanager geht

Hallo,

ist unverändert, taskmanager geht leider auch nicht.

Danke!

kannst du mal trotzdem moved files packen und hochladen?

soeben hochgeladen :)

ok.
teste mal folgendes, starte neu, drücke f8 wähle abgesicherter modus mit eingabeaufforderung.
wenn der funktioniert, kopierst du combofix auf nen stick, steckst den stick in das infizierte gerät
schreibe:
d:\combofix.exe
enter
falls das nicht klappt.
e:\combofix.exe
enter
bis du das richtige laufwerk hast
falls nen aktieves av angezeigt wird, mit ok überspringen.
durchlaufen lassen, in den normal modus starten log posten

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Danke, Danke, Danke, Danke!! Funktioniert wieder!

ich werde euch was spenden!

Logfile:

ComboFix 12-04-20.03 - Chef 21.04.2012 3:50:25.1.2 - x86 MINIMAL
MicrosoftÆ Windows Vistaô Home Premium 6.0.6002.2.1252.43.1031.18.3069.2612 [GMT 2:00]
ausgef¸hrt von:: F:\ComboFix.exe
AV: AntiVir Desktop *Enabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Enabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

(((((((((((((((((((((((((((((((((((( Weitere Lˆschungen ))))))))))))))))))))))))))))))))))))))))))))))))

C:\Windows\security\Database\tmp.edb

danke, aber das log ist unvollständig, hänge es mal als txt hier an

Hallo,
hier das Logfile, glaub es is vollständig...
Danke

führe es noch mal aus bitte.

:)

Combofix Logfile:

Code:

ComboFix 12-04-20.03 - Chef 23.04.2012   2:37.1.2 - x86

MicrosoftÆ Windows Vistaô Home Premium   6.0.6002.2.1252.43.1031.18.3069.1882 [GMT 2:00]

ausgef¸hrt von:: F:\ComboFix.exe

AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}

SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Lˆschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

---- Vorheriger Suchlauf -------

.

c:\windows\security\Database\tmp.edb

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-03-23 bis 2012-04-23  ))))))))))))))))))))))))))))))

.

.

2012-04-23 00:46 . 2012-04-23 00:46        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-04-23 00:46 . 2012-04-23 00:46        --------        d-----w-        c:\users\Chef\AppData\Local\temp

2012-04-23 00:46 . 2012-04-23 00:46        --------        d-----w-        c:\users\AssistentIn\AppData\Local\temp

2012-04-19 01:55 . 2011-07-13 02:55        2237440        ----a-r-        C:\OTLPE.exe

2012-04-19 01:55 . 2012-04-21 06:38        --------        d-----w-        C:\_OTL

2012-04-17 15:41 . 2012-04-19 01:48        --------        d-----w-        c:\users\Chefin

2012-04-17 08:08 . 2012-03-14 02:15        6582328        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{FBA631C4-4D49-4648-8BD8-CDEE02201F57}\mpengine.dll

2012-04-12 08:12 . 2012-02-29 15:11        5120        ----a-w-        c:\windows\system32\wmi.dll

2012-04-12 08:12 . 2012-02-29 15:11        172032        ----a-w-        c:\windows\system32\wintrust.dll

2012-04-12 08:12 . 2012-02-29 15:09        157696        ----a-w-        c:\windows\system32\imagehlp.dll

2012-04-12 08:12 . 2012-02-29 13:32        12800        ----a-w-        c:\windows\system32\drivers\fs_rec.sys

2012-04-12 08:11 . 2012-03-06 06:39        3602816        ----a-w-        c:\windows\system32\ntkrnlpa.exe

2012-04-12 08:11 . 2012-03-06 06:39        3550080        ----a-w-        c:\windows\system32\ntoskrnl.exe

2012-04-11 08:51 . 2012-03-01 11:01        2409784        ----a-w-        c:\program files\Windows Mail\OESpamFilter.dat

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-03-09 11:58 . 2012-03-09 11:58        161792        ----a-w-        c:\windows\system32\msls31.dll

2012-03-09 11:58 . 2012-03-09 11:58        86528        ----a-w-        c:\windows\system32\iesysprep.dll

2012-03-09 11:58 . 2012-03-09 11:58        76800        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe

2012-03-09 11:58 . 2012-03-09 11:58        74752        ----a-w-        c:\windows\system32\RegisterIEPKEYs.exe

2012-03-09 11:58 . 2012-03-09 11:58        48640        ----a-w-        c:\windows\system32\mshtmler.dll

2012-03-09 11:58 . 2012-03-09 11:58        63488        ----a-w-        c:\windows\system32\tdc.ocx

2012-03-09 11:58 . 2012-03-09 11:58        367104        ----a-w-        c:\windows\system32\html.iec

2012-03-09 11:58 . 2012-03-09 11:58        74752        ----a-w-        c:\windows\system32\iesetup.dll

2012-03-09 11:58 . 2012-03-09 11:58        420864        ----a-w-        c:\windows\system32\vbscript.dll

2012-03-09 11:58 . 2012-03-09 11:58        23552        ----a-w-        c:\windows\system32\licmgr10.dll

2012-03-09 11:58 . 2012-03-09 11:58        152064        ----a-w-        c:\windows\system32\wextract.exe

2012-03-09 11:58 . 2012-03-09 11:58        150528        ----a-w-        c:\windows\system32\iexpress.exe

2012-03-09 11:58 . 2012-03-09 11:58        142848        ----a-w-        c:\windows\system32\ieUnatt.exe

2012-03-09 11:58 . 2012-03-09 11:58        11776        ----a-w-        c:\windows\system32\mshta.exe

2012-03-09 11:58 . 2012-03-09 11:58        101888        ----a-w-        c:\windows\system32\admparse.dll

2012-03-09 11:58 . 2012-03-09 11:58        35840        ----a-w-        c:\windows\system32\imgutil.dll

2012-03-09 11:58 . 2012-03-09 11:58        110592        ----a-w-        c:\windows\system32\IEAdvpack.dll

2012-02-23 08:18 . 2009-10-08 12:32        237072        ------w-        c:\windows\system32\MpSigStub.exe

2012-02-14 15:45 . 2012-03-14 09:58        219648        ----a-w-        c:\windows\system32\d3d10_1core.dll

2012-02-14 15:45 . 2012-03-14 09:58        160768        ----a-w-        c:\windows\system32\d3d10_1.dll

2012-02-14 10:09 . 2012-02-14 10:09        1070352        ----a-w-        c:\windows\system32\MSCOMCTL.OCX

2012-02-13 14:12 . 2012-03-14 09:58        1172480        ----a-w-        c:\windows\system32\d3d10warp.dll

2012-02-13 13:47 . 2012-03-14 09:58        683008        ----a-w-        c:\windows\system32\d2d1.dll

2012-02-13 13:44 . 2012-03-14 09:58        1068544        ----a-w-        c:\windows\system32\DWrite.dll

2012-02-02 15:16 . 2012-03-14 09:58        2044416        ----a-w-        c:\windows\system32\win32k.sys

2009-11-17 13:01 . 2010-08-17 14:06        1456640        ----a-w-        c:\program files\Common Files\Falk Navi-Manager.msi

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Eintr‰ge & legitime Standardeintr‰ge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-01-03 1514152]

.

[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]

2012-01-03 15:31        1514152        ----a-w-        c:\program files\Ask.com\GenericAskToolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-01-03 1514152]

.

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-01-03 1514152]

.

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12        94208        ----a-w-        c:\users\Chef\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12        94208        ----a-w-        c:\users\Chef\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12        94208        ----a-w-        c:\users\Chef\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12        94208        ----a-w-        c:\users\Chef\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

"Akamai NetSession Interface"="c:\users\Chef\AppData\Local\Akamai\netsession_win.exe" [2012-03-13 3331872]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]

"KBD"="c:\program files\Hewlett-Packard\KBD\KbdStub.EXE" [2008-07-21 12288]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-15 13539872]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-15 92704]

"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]

"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-13 210216]

"UpdatePDIRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-06-13 210216]

"UpdatePSTShortCut"="c:\program files\CyberLink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe" [2008-09-11 210216]

"TSMAgent"="c:\program files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe" [2008-10-17 1152296]

"CLMLServer for HP TouchSmart"="c:\program files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe" [2008-10-17 189736]

"SmartMenu"="c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [2008-09-23 912688]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2008-01-21 215552]

"DVDAgent"="c:\program files\Hewlett-Packard\Media\DVD\DVDAgent.exe" [2009-09-09 1148200]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]

"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-01-12 49208]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]

"ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe" [2012-01-03 1391272]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]

.

c:\users\Chef\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\Chef\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-2-15 24246216]

OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-12-15 384000]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12        REG_MULTI_SZ           Pml Driver HPZ12 Net Driver HPZ12

HPService        REG_MULTI_SZ           HPSLPSVC

hpdevmgmt        REG_MULTI_SZ           hpqcxs08 hpqddsvc

WindowsMobile        REG_MULTI_SZ           wcescomm rapimgr

LocalServiceRestricted        REG_MULTI_SZ           WcesComm RapiMgr

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache

Akamai        REG_MULTI_SZ           Akamai

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

ezSharedSvc

.

Inhalt des "geplante Tasks" Ordners

.

2012-04-16 c:\windows\Tasks\HPCeeScheduleForChef.job

- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2008-12-23 10:12]

.

2012-04-18 c:\windows\Tasks\PCDRScheduledMaintenance.job

- c:\program files\PC-Doctor for Windows\pcdr5cuiw32.exe [2008-09-10 14:43]

.

.

------- Zus‰tzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.at/

uDefault_Search_URL = hxxp://www.google.com/ie

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_at&c=91&bd=Pavilion&pf=cndt

uInternet Settings,ProxyServer = 213.168.187.130:3128

uInternet Settings,ProxyOverride = 127.0.0.1:9421;<local>

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: &AOL Toolbar-Suche - c:\programdata\AOL\ieToolbar\resources\de-AT\local\search.html

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.1.1

FF - ProfilePath - c:\users\Chef\AppData\Roaming\Mozilla\Firefox\Profiles\9xvefvf3.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.at/

FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=ORJ&o=100000027&locale=de_US&apn_uid=D7835F87-90C6-4A19-8417-848742F93F45&apn_ptnrs=U3&apn_sauid=2A3B1E6A-DA7C-450F-84C9-E7D22ED48970&apn_dtid=OSJ000SSAT&&q=

FF - prefs.js: network.proxy.type - 0

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - user.js: network.cookie.cookieBehavior - 0

FF - user.js: privacy.clearOnShutdown.cookies - false

FF - user.js: security.warn_viewing_mixed - false

FF - user.js: security.warn_viewing_mixed.show_once - false

FF - user.js: security.warn_submit_insecure - false

FF - user.js: security.warn_submit_insecure.show_once - false

.

.

------- Dateityp-Verkn¸pfung -------

.

.scr=AutoCADScriptFile

.

- - - - Entfernte verwaiste Registrierungseintr‰ge - - - -

.

HKCU-Run-5kS43ADO0bzprWo - c:\users\Chef\AppData\Roaming\soundblaster_fx648.exe

HKCU-Run-yiSNUTyakcfEQv.exe - c:\programdata\yiSNUTyakcfEQv.exe

HKLM-Run-5kS43ADO0bzprWo - c:\users\Chefin\AppData\Roaming\soundblaster_fx648.exe

AddRemove-AutoCAD 2010 - English - c:\program files\AutoCAD 2010\Setup\Setup.exe

AddRemove-sp44626 - c:\hp\Softpaq\sp44626\sp44626.exe

AddRemove-{5783F2D7-8001-0000-0002-0060B0CE6BBA} - c:\program files\AutoCAD 2010\Setup\Setup.exe

.

.

.

**************************************************************************

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteintr‰ge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Norton Internet Security]

"ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll\" /prefetch:1"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Akamai]

"ServiceDll"="c:\program files\common files\akamai/netsession_win_6c825ce.dll"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\PCD5SRVC{BD6912E3-AC9D80E8-05040000}]

"ImagePath"="\??\c:\progra~1\PC-DOC~1\PCD5SRVC.pkms"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'Explorer.exe'(2828)

c:\users\Chef\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

Zeit der Fertigstellung: 2012-04-23  02:52:44

ComboFix-quarantined-files.txt  2012-04-23 00:52

.

Vor Suchlauf: 16 Verzeichnis(se), 479.278.313.472 Bytes frei

Nach Suchlauf: 17 Verzeichnis(se), 481.699.848.192 Bytes frei

.

- - End Of File - - 1E781A56CB81FA5788E229067171FFED

--- --- ---