Trojaner-Board - Online cyber police trojaner!

Fixen mit OTLpe

Starte den unbootbaren Computer erneut mit der OTLPE-CD,
warte bis der Reatogo-X-Pe-Desktop erscheint und doppelklicke das OTLPE-Icon.

Kopiere folgendes Skript in das Textfeld unterhalb von Custom Scans/Fixes:
Sollte das mangels Internet-Verbindung nicht möglich sein,
kopiere den Text aus der folgenden Code-Box und speichere ihn als Fix.txt auf einen USB-Stick.
Schließe den USB-Stick an den Computer an und öffne Fix.txt mit dem Explorer auf dem Reatogo-Desktop.
Kopiere den Inhalt von Fix.txt in das Textfeld unterhalb von Custom Scans/Fixes:

Code:

:OTL

O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO) 

O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.) 

O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\searchqudtx.dll () 

O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - File not found 

O2 - BHO: (uTorrentBar_DE Toolbar) - {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - C:\Program Files\uTorrentBar_DE\prxtbuTor.dll (Conduit Ltd.) 

O2 - BHO: (PHPNukeDE Toolbar) - {c9508125-4747-4733-b048-e4b82dc9716d} - C:\Program Files\PHPNukeDE\prxtbPHPN.dll (Conduit Ltd.) 

O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.) 

O2 - BHO: (Max DE Toolbar) - {e0007d18-baa4-4573-ae78-8bea0958c610} - C:\Program Files\P2P_Max_DE\prxtbP2P2.dll (Conduit Ltd.) 

O2 - BHO: (DVDVideoSoftTB Toolbar) - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Program Files\DVDVideoSoft\tbDVD1.dll (Conduit Ltd.) 

O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.) 

O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.) 

O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\searchqudtx.dll () 

O3 - HKLM\..\Toolbar: (uTorrentBar_DE Toolbar) - {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - C:\Program Files\uTorrentBar_DE\prxtbuTor.dll (Conduit Ltd.) 

O3 - HKLM\..\Toolbar: (PHPNukeDE Toolbar) - {c9508125-4747-4733-b048-e4b82dc9716d} - C:\Program Files\PHPNukeDE\prxtbPHPN.dll (Conduit Ltd.) 

O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.) 

O3 - HKLM\..\Toolbar: (Max DE Toolbar) - {e0007d18-baa4-4573-ae78-8bea0958c610} - C:\Program Files\P2P_Max_DE\prxtbP2P2.dll (Conduit Ltd.) 

O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Program Files\DVDVideoSoft\tbDVD1.dll (Conduit Ltd.) 

O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. 

O3 - HKU\Gast_ON_C\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. 

O3 - HKU\Gast_ON_C\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found. 

O3 - HKU\Gast_ON_C\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Program Files\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.) 

O3 - HKU\Gast_ON_C\..\Toolbar\WebBrowser: (uTorrentBar_DE Toolbar) - {C840E246-6B95-475E-9BD7-CAA1C7ECA9F2} - C:\Program Files\uTorrentBar_DE\prxtbuTor.dll (Conduit Ltd.) 

O3 - HKU\Gast_ON_C\..\Toolbar\WebBrowser: (PHPNukeDE Toolbar) - {C9508125-4747-4733-B048-E4B82DC9716D} - C:\Program Files\PHPNukeDE\prxtbPHPN.dll (Conduit Ltd.) 

O3 - HKU\Gast_ON_C\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.) 

O3 - HKU\Gast_ON_C\..\Toolbar\WebBrowser: (Max DE Toolbar) - {E0007D18-BAA4-4573-AE78-8BEA0958C610} - C:\Program Files\P2P_Max_DE\prxtbP2P2.dll (Conduit Ltd.) 

O3 - HKU\Gast_ON_C\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {E9911EC6-1BCC-40B0-9993-E0EEA7F6953F} - C:\Program Files\DVDVideoSoft\tbDVD1.dll (Conduit Ltd.) 

O3 - HKU\miriam.steu_ON_C\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. 

O3 - HKU\miriam.steu_ON_C\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found. 

O3 - HKU\miriam.steu_ON_C\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Program Files\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.) 

O3 - HKU\miriam.steu_ON_C\..\Toolbar\WebBrowser: (PHPNukeDE Toolbar) - {C9508125-4747-4733-B048-E4B82DC9716D} - C:\Program Files\PHPNukeDE\prxtbPHPN.dll (Conduit Ltd.) 

O3 - HKU\miriam.steu_ON_C\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.) 

O3 - HKU\miriam.steu_ON_C\..\Toolbar\WebBrowser: (Max DE Toolbar) - {E0007D18-BAA4-4573-AE78-8BEA0958C610} - C:\Program Files\P2P_Max_DE\prxtbP2P2.dll (Conduit Ltd.) 

O3 - HKU\miriam.steu_ON_C\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {E9911EC6-1BCC-40B0-9993-E0EEA7F6953F} - C:\Program Files\DVDVideoSoft\tbDVD1.dll (Conduit Ltd.) 

O4 - HKU\miriam.steu_ON_C..\Run: [svdgrcwpsojljrk] C:\ProgramData\svdgrcwp.exe () 

O4 - HKLM..\RunOnce: [InnoSetupRegFile.0000000001] C:\Windows\is-H63S0.exe () 

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 28 

O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - File not found 

O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - File not found 

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - File not found 

O32 - HKLM CDRom: AutoRun - 1 

O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] 

O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ] 

O34 - HKLM BootExecute: (autocheck autochk *) - File not found 

[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] 

Invalid Environment Variable: %USERPROFILE%Local SettingsTemp.exe 

@Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:A8ADE5D8 

@Alternate Data Stream - 121 bytes -> C:\ProgramData\Temp:DFC5A2B2 

[2011/08/22 15:54:51 | 000,000,000 | ---D | M] (Searchqu Toolbar) -- C:\Users\miriam.steu\AppData\Roaming\Mozilla\Firefox\Profiles\n8n2rzf5.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7} 

[2011/08/22 15:54:31 | 000,002,506 | ---- | M] () -- C:\Users\miriam.steu\AppData\Roaming\Mozilla\Firefox\Profiles\n8n2rzf5.default\searchplugins\SearchResults.xml 

[2011/08/06 06:43:46 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\miriam.steu\AppData\Roaming\Mozilla\Firefox\Profiles\n8n2rzf5.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} 

[2011/08/06 06:43:55 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\miriam.steu\AppData\Roaming\Mozilla\Firefox\Profiles\n8n2rzf5.default\extensions\engine@conduit.com 

[2011/06/19 15:24:01 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\miriam.steu\AppData\Roaming\Mozilla\Firefox\Profiles\n8n2rzf5.default\extensions\ffxtlbr@babylon.com 

[2012/05/27 07:07:15 | 000,000,000 | ---D | M] (Bflix extension) -- C:\Users\miriam.steu\AppData\Roaming\Mozilla\Firefox\Profiles\n8n2rzf5.default\extensions\info@thebflix.com 

[2012/05/08 11:32:34 | 000,000,915 | ---- | M] () -- C:\Users\miriam.steu\AppData\Roaming\Mozilla\Firefox\Profiles\n8n2rzf5.default\searchplugins\conduit.xml 

[2012/10/01 08:48:36 | 000,000,000 | ---D | C] -- C:\Users\Gast\AppData\Local\Conduit 

 

[2012/10/01 08:50:14 | 000,000,000 | ---D | C] -- C:\ProgramData\E10E 
 

[2011/09/07 06:22:25 | 000,000,000 | ---D | M] -- C:\Users\miriam.steu\AppData\Roaming\Babylon 

[2011/09/07 06:22:26 | 000,000,000 | ---D | M] -- C:\ProgramData\Babylon 

[2011/08/23 11:49:18 | 000,000,000 | ---D | M] -- C:\ProgramData\boost_interprocess 

[2010/12/16 06:22:10 | 000,000,438 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{234E37C6-337F-4618-82FB-E0C4D042A70B}.job 

:Files

C:\ProgramData\*.exe

C:\ProgramData\TEMP

C:\Users\miriam.steu\*.tmp

C:\Users\miriam.steu\AppData\Local\{*}

C:\Users\miriam.steu\AppData\Local\Temp\*.exe

C:\Users\miriam.steu\AppData\LocalLow\Sun\Java\Deployment\cache

%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk

ipconfig /flushdns /c

:Commands

[emptytemp]

Schließe alle Programme.
Klicke auf den Fix Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere den Inhalt hier in Code-Tags in Deinen Thread.
Nachträglich kannst Du das Logfile hier einsehen => C:\OTLpe\MovedFiles\<datum_nummer.log>
Teste, ob den Computer nun wieder in den normalen Windows-Modus booten kannst und berichte.