schwarzer bildschirm mit roter schrift und einer zahlungs aufforderung von 50 euro
 

heut morgen gegen 10 uhr beim surfen im netz wurde mein bildschirm auf einmal schwarze und in roter schrift stand: aus sicherheits gründen wurde ihr windows gesperrt. darunter ein button herunterladen/bezahlen. für angeblich 50 euro würde ich wieder zugang zu meinem PC bekommen.

ich zog den stecker und nach ein paar versuchen landete ich im abgesicherten modus mit nerzwerk anbindung und jetzt bin ich hier.
ich hab mir schon einige berichte angesehn aber bis jetzt noch nichts unternommen.

ich nutze vista 64 home edition

PS die beschreibungen bitte so einfach wie möglich halten, ich habe nicht sehr viel ahnung von PCs

neustart, f8 drücken, abgesicherter modus mit netzwerk wählen, im betroffenen konto anmelden, internet verbindung herstellen.
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

• Starte bitte die
  OTL.exe
  .
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Kopiere nun den Inhalt in die http://larusso.trojaner-board.de/Images/otlfix.jpg
  Textbox.

• Schliesse bitte nun alle Programme. (Wichtig)
• Klicke nun bitte auf den Quick Scan Button.
• Kopiere
  nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

OTL Logfile:
OTL EXTRAS Logfile:
--- --- ---

--- --- ---


OTL Extras logfile created on: 20.03.2012 14:41:31 - Run 1
OTL by OldTimer - Version 3.2.39.1 Folder = C:\Users\Vista\Downloads
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

8,00 Gb Total Physical Memory | 6,95 Gb Available Physical Memory | 86,83% Memory free
16,05 Gb Paging File | 15,31 Gb Available in Paging File | 95,44% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,76 Gb Total Space | 97,49 Gb Free Space | 20,93% Space Free | Partition Type: NTFS
Drive D: | 128,53 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive E: | 341,80 Gb Total Space | 223,75 Gb Free Space | 65,46% Space Free | Partition Type: NTFS
Drive F: | 356,84 Gb Total Space | 147,90 Gb Free Space | 41,45% Space Free | Partition Type: NTFS

Computer Name: VISTA-PC | User Name: Vista | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = 9F 9E 16 8C DC 5B C8 01 [binary data]
"VistaSp2" = A0 03 AD 25 AB E3 CB 01 [binary data]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"oobe_av" = 1

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0618D720-59DE-4F17-8F97-AC372EDE0353}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\deus ex - human revolution\dxhr.exe |
"{09377B0F-C677-4D9C-B152-0F9F29380868}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{0A5419BF-7306-4CF0-8A40-6BE5D0B7D7E7}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\storm - frontline nation\storm.exe |
"{0D1E8CC0-F809-41F8-AE21-78EFE3396372}" = protocol=17 | dir=in | app=c:\spiele\neverwinter nights 2\nwupdate.exe |
"{0E12D60E-1316-42BA-8C75-A95877D803BB}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{0F98D29B-9B3B-4B3E-9DFB-02B55B734161}" = protocol=17 | dir=in | app=c:\spiele\neverwinter nights 2\nwn2main.exe |
"{170F030B-FAA3-4FB9-BBA0-D1933BAF179D}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\rage\rage.exe |
"{171D09D2-51BA-4563-A0FB-AEEDC61D8C34}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{1F27A4EB-D3D6-4EE0-9E5E-154E3A9BBCFD}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{20047A16-2E2C-4872-B2D2-D92ED21E32B0}" = protocol=6 | dir=in | app=c:\spiele\company of heroes\relicdownloader\relicdownloader.exe |
"{2B8F4AEE-2D71-4C79-AD9A-26578EB3235E}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\fallout new vegas\falloutnvlauncher.exe |
"{2E384F75-21F3-4845-B4A0-3DD675046B97}" = protocol=17 | dir=in | app=c:\spiele\company of heroes\relicdownloader\relicdownloader.exe |
"{3C4A4505-7E36-4F29-B32C-1D9A19A4D986}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\deus ex - human revolution\dxhr.exe |
"{43950018-E114-47F8-9FC2-7FCDE856190A}" = protocol=17 | dir=in | app=c:\spiele\crysis\bin32\crysisdedicatedserver.exe |
"{458E4321-0CD2-4EE7-A87E-10DF141EB880}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{4D929992-A298-403C-9D58-824BE1C998B3}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{4FEE1E05-E1D0-4B54-99A6-663941B0F0F5}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\fallout new vegas\falloutnvlauncher.exe |
"{54618F63-16C5-4A2D-B67E-FF2420C496DB}" = protocol=17 | dir=in | app=c:\spiele\neverwinter nights 2\nwn2main_amdxp.exe |
"{5715166D-B6CC-4ED6-AFB5-DB27BA412864}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{5B162C14-6A8A-4D70-8266-D6E4BCF117EA}" = protocol=6 | dir=in | app=c:\spiele\company of heroes\reliccoh.exe |
"{5C244777-632B-478B-B837-31E4606BCC73}" = protocol=17 | dir=in | app=c:\spiele\crysis\bin64\crysis.exe |
"{601A1CF4-6A50-43B8-982D-4A0BFAADAC5D}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\skyrim\skyrimlauncher.exe |
"{67D147CA-D46A-4AFE-8D77-8DBAC37ED090}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{70FDCDDF-1CFF-45AD-8A19-18BE4999C72E}" = protocol=17 | dir=in | app=c:\spiele\crysis\bin32\crysis.exe |
"{89BCFBFF-8F77-49DB-971B-8877A5EEAD84}" = protocol=6 | dir=in | app=c:\spiele\crysis\bin32\crysis.exe |
"{8CA729E9-567B-4685-BCC3-E447F8C1DB05}" = protocol=6 | dir=in | app=c:\spiele\crysis\bin64\crysis.exe |
"{93F717B2-992B-4E5C-A635-924B34CCE5A2}" = protocol=17 | dir=in | app=c:\spiele\company of heroes\reliccoh.exe |
"{9DA58DEE-29CD-4FCB-BF6C-A6B41591B9D8}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{A020DD06-5726-48BE-A43F-EE362B796758}" = protocol=6 | dir=in | app=c:\spiele\neverwinter nights 2\nwn2main.exe |
"{A5DF5187-EC4E-4948-A6A0-E8C33FF92527}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\skyrim\skyrimlauncher.exe |
"{AB6CB47B-CF7F-4539-8187-D74C93324CCE}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\jabia\jaggedalliancebia.exe |
"{AC68CE09-2BA0-4056-B00F-EAA89AFFD27D}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe |
"{AF5B4189-C558-4A2C-A268-5024131B3EA3}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\jabia\jaggedalliancebia.exe |
"{B64067C5-18B2-48F9-AAC7-7C7F6A356B48}" = protocol=6 | dir=in | app=c:\spiele\neverwinter nights 2\nwn2server.exe |
"{BA178FAA-DF6C-4972-AC0E-0A4F735CE73F}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{BAA51FBA-2AF1-4A02-BB69-B21059BE4841}" = protocol=6 | dir=in | app=c:\spiele\crysis\bin64\crysisdedicatedserver.exe |
"{BEFA6381-4C0A-4CB9-81FA-E8A490A12C17}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\storm - frontline nation\storm.exe |
"{BEFDD156-EDE9-41A6-AFE3-E3F29758F57E}" = protocol=17 | dir=in | app=c:\spiele\neverwinter nights 2\nwn2server.exe |
"{CC807A26-0C21-442C-BCF1-6D35D08FFBBC}" = protocol=6 | dir=in | app=c:\spiele\neverwinter nights 2\nwupdate.exe |
"{D76BA845-48B0-43F3-BF2B-1E517E8C8A3D}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe |
"{E1A3FB4B-49C7-4FD9-99E4-5F3BA3545ADE}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe |
"{E385BF2B-9FEC-42F7-B275-63F11699EFF5}" = protocol=17 | dir=in | app=c:\spiele\crysis\bin64\crysisdedicatedserver.exe |
"{E9C2A086-0E6E-498E-B922-EC46BEC0B0AF}" = protocol=6 | dir=in | app=c:\spiele\neverwinter nights 2\nwn2main_amdxp.exe |
"{EF9019B1-0934-4F9B-98F4-510AAD72EB88}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe |
"{EFA19B02-7B3C-4E25-BE6C-B1999EE42B52}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\rage\rage.exe |
"{F091F4A6-C7B4-48B3-A0FD-1A092E352E91}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{F9D7DF77-CC19-4FC3-91FF-0370D91E1262}" = protocol=6 | dir=in | app=c:\spiele\crysis\bin32\crysisdedicatedserver.exe |
"TCP Query User{16227C5A-AB84-4DFF-BAFD-8C3BB451E405}C:\program files (x86)\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe |
"TCP Query User{1A775E8A-70DA-452A-9994-2DF0A6785B41}C:\users\vista\appdata\roaming\oconxy\opafg.exe" = protocol=6 | dir=in | app=c:\users\vista\appdata\roaming\oconxy\opafg.exe |
"TCP Query User{48DA4434-8CC8-400A-BD33-F900BEFA0B9F}F:\equilator\equilator.exe" = protocol=6 | dir=in | app=f:\equilator\equilator.exe |
"TCP Query User{4E720AAA-B4B8-4A92-84FC-86FEA77B8CC9}C:\spiele\world of tanks\world_of_tanks\wotlauncher.exe" = protocol=6 | dir=in | app=c:\spiele\world of tanks\world_of_tanks\wotlauncher.exe |
"TCP Query User{5CEC2C04-8DA2-4893-AA58-DE6C8801F913}C:\users\vista\appdata\roaming\microsoft\internet explorer\report.exe" = protocol=6 | dir=in | app=c:\users\vista\appdata\roaming\microsoft\internet explorer\report.exe |
"TCP Query User{6C152E37-8E6D-4236-9427-11F80E24F4B6}C:\spiele\the witcher 2\bin\witcher2.exe" = protocol=6 | dir=in | app=c:\spiele\the witcher 2\bin\witcher2.exe |
"TCP Query User{6DD8BDEF-A0BA-49C1-A64D-BA57ACFA2AE6}C:\program files (x86)\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\java.exe |
"TCP Query User{6DECAD62-F889-45DB-9A7D-BDDFA9F5301A}C:\spiele\splinter cell\scda-offline\system\splintercell4.exe" = protocol=6 | dir=in | app=c:\spiele\splinter cell\scda-offline\system\splintercell4.exe |
"TCP Query User{7CDD4EA7-F5D7-49C8-8C64-6879FA31D2E3}C:\users\vista\appdata\roaming\oconxy\opafg.exe" = protocol=6 | dir=in | app=c:\users\vista\appdata\roaming\oconxy\opafg.exe |
"TCP Query User{8DFD0BD4-30B2-459D-B2A9-4C09933E773A}C:\spiele\world of tanks\world_of_tanks\worldoftanks.exe" = protocol=6 | dir=in | app=c:\spiele\world of tanks\world_of_tanks\worldoftanks.exe |
"TCP Query User{A142A334-5279-4301-AF85-AD257897203B}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe |
"TCP Query User{BD751001-B8B4-47FB-B438-CCF103D30533}C:\alle daten von der alten festplatte\equilator\equilator.exe" = protocol=6 | dir=in | app=c:\alle daten von der alten festplatte\equilator\equilator.exe |
"TCP Query User{DAFDF6A2-4013-48F4-8C23-EA66ACB1ADEB}C:\users\vista\appdata\roaming\microsoft\internet explorer\report.exe" = protocol=6 | dir=in | app=c:\users\vista\appdata\roaming\microsoft\internet explorer\report.exe |
"TCP Query User{FEB095AD-2FD9-4F6C-BD99-2E18DBBAC16D}C:\users\vista\appdata\local\temp\f716667a5ea44a44ad08ac6c76ec96d8\relicdownloader.exe" = protocol=6 | dir=in | app=c:\users\vista\appdata\local\temp\f716667a5ea44a44ad08ac6c76ec96d8\relicdownloader.exe |
"UDP Query User{0576A8C2-4A85-4DFC-9157-9B51AF81C4CB}C:\users\vista\appdata\local\temp\f716667a5ea44a44ad08ac6c76ec96d8\relicdownloader.exe" = protocol=17 | dir=in | app=c:\users\vista\appdata\local\temp\f716667a5ea44a44ad08ac6c76ec96d8\relicdownloader.exe |
"UDP Query User{09FEDABD-D813-4C9F-BB3D-38E8FE6A33E0}C:\spiele\the witcher 2\bin\witcher2.exe" = protocol=17 | dir=in | app=c:\spiele\the witcher 2\bin\witcher2.exe |
"UDP Query User{521B0296-12E8-465D-B04A-F2595305C071}C:\spiele\world of tanks\world_of_tanks\worldoftanks.exe" = protocol=17 | dir=in | app=c:\spiele\world of tanks\world_of_tanks\worldoftanks.exe |
"UDP Query User{5DB5DB2E-B5D3-439F-924F-54222260DDBB}C:\users\vista\appdata\roaming\microsoft\internet explorer\report.exe" = protocol=17 | dir=in | app=c:\users\vista\appdata\roaming\microsoft\internet explorer\report.exe |
"UDP Query User{6525F332-9C54-4A96-A827-F86972008609}C:\spiele\world of tanks\world_of_tanks\wotlauncher.exe" = protocol=17 | dir=in | app=c:\spiele\world of tanks\world_of_tanks\wotlauncher.exe |
"UDP Query User{7A473CFE-228B-4759-B8A6-D7B7B39D7696}C:\alle daten von der alten festplatte\equilator\equilator.exe" = protocol=17 | dir=in | app=c:\alle daten von der alten festplatte\equilator\equilator.exe |
"UDP Query User{7BBF6771-9F28-4884-AB6B-A933DCA529AA}C:\users\vista\appdata\roaming\oconxy\opafg.exe" = protocol=17 | dir=in | app=c:\users\vista\appdata\roaming\oconxy\opafg.exe |
"UDP Query User{86D8FFE6-9BDA-4564-A7B3-832D17AA0834}C:\users\vista\appdata\roaming\oconxy\opafg.exe" = protocol=17 | dir=in | app=c:\users\vista\appdata\roaming\oconxy\opafg.exe |
"UDP Query User{8B9E8DC2-6C9D-47EE-9C97-3ACD457180DF}C:\spiele\splinter cell\scda-offline\system\splintercell4.exe" = protocol=17 | dir=in | app=c:\spiele\splinter cell\scda-offline\system\splintercell4.exe |
"UDP Query User{9AA3C5F4-4EFC-482F-8CC5-4E0BC6B37D1B}C:\program files (x86)\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\java.exe |
"UDP Query User{C8734122-2C99-4406-894B-78BA92947EBB}C:\program files (x86)\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe |
"UDP Query User{F36497B3-F069-4F86-AC0D-74893804C7E5}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe |
"UDP Query User{F3CF7DDF-2798-435B-ACC3-9F3C5D7CFC0B}C:\users\vista\appdata\roaming\microsoft\internet explorer\report.exe" = protocol=17 | dir=in | app=c:\users\vista\appdata\roaming\microsoft\internet explorer\report.exe |
"UDP Query User{FBA258F8-21D6-4CF5-A103-2E8CE05E57BB}F:\equilator\equilator.exe" = protocol=17 | dir=in | app=f:\equilator\equilator.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 266.58
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 266.58
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 266.58
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.10.0514
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.1.13.1
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"WinRAR archiver" = WinRAR

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{000E79B7-E725-4F01-870A-C12942B7F8E4}" = Crysis(R)
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0B5154C0-8F00-4616-B0AB-6240AE80D9CE}" = SimCity™ Societies
"{0B6A9773-F8F8-4D3F-BCF0-029D2B87DB8A}" = Deus Ex - Invisible War
"{14574B7F-75D1-4718-B7F2-EBF6E2862A35}" = Company of Heroes - FAKEMSI
"{199E6632-EB28-4F73-AECB-3E192EB92D18}" = Company of Heroes - FAKEMSI
"{1EAC1D02-C6AC-4FA6-9A44-96258C37C812}_is1" = World of Tanks v.0.6.4
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{25724802-CC14-4B90-9F3B-3D6955EE27B1}" = Company of Heroes - FAKEMSI
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 30
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver
"{32C4A4EB-C97D-414E-99C5-38F8DFD31D5D}" = Company of Heroes - FAKEMSI
"{35CB6715-41F8-4F99-8881-6FC75BF054B0}" = Oblivion
"{3F0D0ABE-CDAF-431A-00BC-CBBE018EA74E}" = SimCity 4 Deluxe
"{412B69AF-C352-4F6F-A318-B92B3CB9ACC6}" = Titan Quest
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{50193078-F553-4EBA-AA77-64C9FAA12F98}" = Company of Heroes - FAKEMSI
"{51D718D1-DA81-4FAD-919F-5C1CE3C33379}" = Company of Heroes - FAKEMSI
"{538E852C-1064-46EF-9B24-6EC9B1494792}" = Steuersparer 2011
"{587178E7-B1DF-494E-9838-FA4DD36E873C}" = ASUSUpdate
"{5AFAF1D1-E0E9-4534-8AF8-000360A99A6F}_is1" = RAFOO - Dungeonmaster
"{5BDAA2F7-8E48-4AFF-AA92-B559D0CDF1AD}" = Serious Sam: The Second Encounter
"{639555DF-952A-4161-97F6-AB9807E421D7}" = UFO Aftershock
"{66F78C51-D108-4F0C-A93C-1CBE74CE338F}" = Company of Heroes - FAKEMSI
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7AF9D464-6627-4FB9-AEF9-15D6C972CA84}_is1" = Minecraft Beta Version 1.7.3
"{7CBA7A5E-45BF-4500-998C-DF540FE1703A}" = Casino Verite Blackjack V5.5
"{7F4B1592-222F-4E5F-A100-E5AFD61A0BB3}" = Company of Heroes - FAKEMSI
"{80D03817-7943-4839-8E96-B9F924C5E67D}" = Company of Heroes - FAKEMSI
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{89661B04-C646-4412-B6D3-5E19F02F1F37}" = EAX4 Unified Redist
"{8EE00D0D-5119-4930-B250-04A72C573280}_is1" = RAFOO Complete Main Data
"{8F6A80C6-7C43-4ABD-A9E8-BE2267ADDEB2}_is1" = Oblivion Mod Manager
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.SingleImage_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0407-1000-0000000FF1CE}_Office14.SingleImage_{594128C9-2CDF-43CE-8103-DC100CF013B6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.SingleImage_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.SingleImage_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{97E5205F-EA4F-438F-B211-F1846419F1C1}" = Company of Heroes - FAKEMSI
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{99A7722D-9ACB-43F3-A222-ABC7133F159E}" = Company of Heroes - FAKEMSI
"{99AD9D6D-A456-49EE-8360-F22EE7AA1272}" = Express Gate
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B0F9788-3141-4009-846E-52E59843E963}" = SimCity™ Societies
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.5 - Deutsch
"{B823632F-3B72-4514-8861-B961CE263224}" = PostgreSQL 8.3
"{B83F7FA5-3191-4E39-A1F2-8A9038BD0B04}" = Turbo Key
"{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}" = NVIDIA PhysX
"{BA801B94-C28D-46EE-B806-E1E021A3D519}" = Company of Heroes - FAKEMSI
"{C0698BDA-0D29-40EE-8570-A31106DF9AB1}" = Medieval II Total War
"{CAD1691A-FA24-4B95-9009-3257B8440ECC}" = Tom Clancy's Splinter Cell Double Agent
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240C1}" = WinZip 15.0
"{CEDDEE73-3D36-41C2-AA40-29355D9FBD63}" = Medieval II Total War : Kingdoms : Britannia
"{D1C7BB12-BE01-11DC-AAC9-EEBA55D89593}" = SimCity™ Societies Reisewelten
"{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}" = Full Tilt Poker
"{D4D244D1-05E0-4D24-86A2-B2433C435671}" = Company of Heroes - FAKEMSI
"{EAF636A9-F664-4703-A659-85A894DA264F}" = Company of Heroes - FAKEMSI
"{F0A209B7-7F85-4BDD-8F1F-B98EEAD9E04B}" = The Witcher 2
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F20C1251-1D0A-4944-B2AE-678581B33B19}" = Neverwinter Nights 2
"{F7311566-7EA9-4213-A7F8-E0C237EFAD16}" = UFO Extraterrestrials Gold
"{F7338FA3-DAB5-49B2-900D-0AFB5760C166}" = PC Probe II
"{FB686487-C637-4EEF-BCB1-C92463F2CC05}" = Atheros Ethernet Utility
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"888poker" = 888poker
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Advanced Strategic Command" = Advanced Strategic Command 2.4.0.0
"ALchemy" = Creative ALchemy
"Ashampoo WinOptimizer 6_is1" = Ashampoo WinOptimizer 6.60
"AudioCS" = Creative Audio-Systemsteuerung
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Battle for Wesnoth 1.9.9" = Battle for Wesnoth 1.9.9
"bwin Poker_is1" = bwin Poker
"CDCE6956-DD16-4F82-ACA0-E4C7BAD6B26A_is1" = Divinity II - DKS
"Company of Heroes" = Company of Heroes
"Console Launcher" = Creative Konsole Starter
"Creative Software AutoUpdate" = Creative Software AutoUpdate
"Creative Sound Blaster Properties x64 Edition" = Creative Sound Blaster Properties x64 Edition
"DAEMON Tools Lite" = DAEMON Tools Lite
"DivX Setup" = DivX-Setup
"Elemental: War of Magic_is1" = Elemental: War of Magic
"facemoods" = Facemoods Toolbar
"Jagged Alliance 2" = Jagged Alliance 2
"JDownloader" = JDownloader
"Mount&Blade Warband" = Mount&Blade Warband
"Mount&Blade With Fire and Sword" = Mount&Blade With Fire and Sword
"Mozilla Firefox 11.0 (x86 de)" = Mozilla Firefox 11.0 (x86 de)
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Office14.SingleImage" = Microsoft Office Home and Student 2010
"OpenAL" = OpenAL
"OpenTTD" = OpenTTD 1.0.5
"Panzer Corps_is1" = Panzer Corps version 1.0
"Panzer Corps1.00" = Panzer Corps
"Panzer General 3D" = Panzer General 3D
"PartyPoker" = PartyPoker
"PKR" = PKR
"PokerStars" = PokerStars
"PokerTracker3" = PokerTracker 3 (remove only)
"PunkBusterSvc" = PunkBuster Services
"RAFOO - Natural Enviromment_is1" = RAFOO - Natural Enviromment
"Steam App 10180" = Call of Duty: Modern Warfare 2
"Steam App 10190" = Call of Duty: Modern Warfare 2 - Multiplayer
"Steam App 22380" = Fallout: New Vegas
"Steam App 28050" = Deus Ex: Human Revolution
"Steam App 57740" = Jagged Alliance - Back in Action
"Steam App 72850" = The Elder Scrolls V: Skyrim
"Steam App 9200" = RAGE
"Steam App 98510" = STORM: Frontline Nation
"Sword of Damocles: Warlords" = Sword of Damocles: Warlords 3.92
"UFO:Alien Invasion" = UFO:AI 2.3.1
"X3-Reunion2.0.02DE_is1" = X3: Reunion v2.0.02

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Third Age - Total War 2.0 (Part1of2)" = Third Age - Total War 2.0 (Part1of2)
"Third Age - Total War 2.0 (Part2of2)" = Third Age - Total War 2.0 (Part2of2)

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

hi

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.


• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.





• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!



Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + E Taste.

• Öffne dein Systemlaufwerk ( meistens C: )
• Suche nun
  folgenden Ordner: _OTL und öffne diesen.
• Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner
• 
  Dies wird eine Movedfiles.zip Datei in _OTL erstellen
• Lade diese bitte in unseren Uploadchannel
  hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )

Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus :)

All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\SkypePM deleted successfully.
C:\Users\Vista\AppData\Local\Skype\SkypePM.exe moved successfully.
C:\Users\Vista\AppData\Roaming\UFOAI\2.3.1\base\save folder moved successfully.
C:\Users\Vista\AppData\Roaming\UFOAI\2.3.1\base folder moved successfully.
C:\Users\Vista\AppData\Roaming\UFOAI\2.3.1 folder moved successfully.
C:\Users\Vista\AppData\Roaming\UFOAI folder moved successfully.
C:\Users\Vista\AppData\Roaming\Oconxy folder moved successfully.
C:\Users\Vista\AppData\Roaming\5054\components folder moved successfully.
C:\Users\Vista\AppData\Roaming\5054 folder moved successfully.
C:\Users\Vista\AppData\Roaming\5053\components folder moved successfully.
C:\Users\Vista\AppData\Roaming\5053 folder moved successfully.
========== COMMANDS ==========

[EMPTYFLASH]

User: Administrator

User: All Users

User: Default

User: Default User

User: Denis
->Flash cache emptied: 814 bytes

User: postgres

User: postgres.Vista-PC

User: Public

User: Vista
->Flash cache emptied: 7794 bytes

Total Flash Files Cleaned = 0,00 mb


[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 286122 bytes
->Temporary Internet Files folder emptied: 63958 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 4256269 bytes

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Denis
->Temp folder emptied: 22896669 bytes
->Temporary Internet Files folder emptied: 31432774 bytes
->FireFox cache emptied: 76183095 bytes
->Flash cache emptied: 0 bytes

User: postgres
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: postgres.Vista-PC
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Public

User: Vista
->Temp folder emptied: 59885693 bytes
->Temporary Internet Files folder emptied: 19918959 bytes
->Java cache emptied: 737051 bytes
->FireFox cache emptied: 1135773887 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 200704 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 169527 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 17671516 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 211677 bytes
%systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 753 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 810372149 bytes

Total Files Cleaned = 2.079,00 mb


OTL by OldTimer - Version 3.2.39.1 log created on 03202012_162337

Files\Folders moved on Reboot...
File move failed. C:\Windows\SysNative\SET379B.tmp scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\SETA815.tmp scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\SETDDF3.tmp scheduled to be moved on reboot.

Registry entries deleted on Reboot...


zum upload:
Datei: MovedFiles.zip_1 empfangen

Vorgang erfolgreich abgeschlossen.

hat soweit alles problemlos geklappt. vielen dank!!!

sollte ich jetzt meine PWs ändern ? und könnt ihr mir ein sicheren schutz fürs netz empfehlen damit sich das nicht wiederholt ?!

hi,
danke erst mal.
nutzt du den pc für onlinebanking, einkäufe, sonstige zahlungsabwicklungen, oder ähnlich wichtiges, wie berufliches?

ja für so ziemlich alles

bank bitte anrufen, du hast den trojaner tr.banker. und benötigst neue zugangsdaten.
der pc muss neu aufgesetzt und dann abgesichert werden
1. Datenrettung:

• deaktiviere Autorun: http://www.trojaner-board.de/83238-a...sschalten.html
• dann sichere Daten auf einen externen Datenträger (USB-Platte): http://www.trojaner-board.de/82533-d...ted-magic.html
  Bider, Dokumente, Musik, Videos (persönliches) http://www.trojaner-board.de/71715-k...iendungen.html

2. Formatieren, Windows neuinstallieren:

• nutzt du eine Windows CD: http://www.trojaner-board.de/51262-a...sicherung.html
• Recovery CD oder Recovery Partition?
• falls dies ein Fertig-PC ist, nenne Hersteller + Typ.
• Keine Windows 7 DVD? http://www.trojaner-board.de/100776-...-download.html

3. PC absichern: http://www.trojaner-board.de/96344-a...-rechners.html
4. alle Passwörter ändern!
5. nach PC Absicherung, die gesicherten Daten prüfen und falls sauber: zurückspielen.
6. werde ich dann noch was zum absichern von Onlinebanking mit Chip Card Reader + Star Money sagen.

muss mir dann erst eine externe festplatte besorgen, das wird vor morgen nichts mehr.
wie schauts mit den PWs zb für poker software aus, da liegt auch etwas geld rum und macht es sinn diese PWs jetzt ( von DIESEM rechner ) zu ändern?

und ich würde euch gerne mit einer spende unterstützen! damit sollte ich dann wohl auch besser warten bis der rechner neu aufgesetzt is ?!

hi,
spenden ist nett, aber nicht mit dem system, erst wenns neu gemacht ist. passwörter ebenfalls endern von dem neu gemachten pc