Trojaner-Board - GVU Mit Webcam Neeeeeein

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - GVU Mit Webcam Neeeeeein (https://www.trojaner-board.de/119245-gvu-webcam-neeeeeein.html)

GVU Mit Webcam Neeeeeein

Mensch ist das Ding aber nervig! Habe es vor ~3 Tagen empfangen. Dachte es sei einfach eine kleine Verarschung nur mit einem Website verbunden, hatte es irgendwie sofort weggekriegt (deswegen dachte ich auch, es sei nur ein URL und nichts anderes), aber nach einem Neustart kam es zurück, und jetzt kriege ich es nicht mehr weg.

Also ich kenne mich nicht besonders gut mit Computer aus, habe jedoch das Forum einfach ein bisschen durchgelesen. Um das Problem zu behandeln und Hilfe zu bekommen, brauche ich erstmal das OTL.txt hochzuladen, korrekt?
Hier, bitte schön! Falls ich noch was hochladen muss, sagen Sie mir einfach Bescheid, und vielen VIELEN dank für Ihre Hilfe. :dankeschoen:

:hallo:

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
Starte die OTL.exe.
Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:

Code:

:OTL

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox 

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox 

IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) 

IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 

FF - prefs.js..network.proxy.type: 0 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll () 

O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. 

O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. 

O4 - HKCU..\Run: [Keadu] C:\Users\Spencer Dunbar\AppData\Roaming\Ifcua\gagu.exe (i-rocks) 

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 

O32 - HKLM CDRom: AutoRun - 1 

O33 - MountPoints2\{3023ddda-b6ce-11e1-8431-c89cdc2ab82c}\Shell - "" = AutoRun 

O33 - MountPoints2\{3023ddda-b6ce-11e1-8431-c89cdc2ab82c}\Shell\AutoRun\command - "" = J:\Startup.exe 

O33 - MountPoints2\{c52af090-2f45-11e1-a594-c89cdc2ab82c}\Shell - "" = AutoRun 

O33 - MountPoints2\{c52af090-2f45-11e1-a594-c89cdc2ab82c}\Shell\AutoRun\command - "" = H:\Startup.exe 

O33 - MountPoints2\{eeeefe52-15dd-11df-9882-806e6f6e6963}\Shell - "" = AutoRun 

O33 - MountPoints2\{eeeefe52-15dd-11df-9882-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Setup.exe -- [2011.09.02 08:52:31 | 000,355,920 | R--- | M] (Valve Corporation) 

[2012.07.12 04:28:40 | 004,503,728 | ---- | M] () -- C:\ProgramData\go_0molg.pad 

[2012.07.07 16:50:03 | 000,001,891 | ---- | M] () -- C:\Users\Spencer Dunbar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk 

[2012.07.07 16:50:03 | 004,503,728 | ---- | C] () -- C:\ProgramData\go_0molg.pad 

[2012.07.07 16:50:03 | 000,001,891 | ---- | C] () -- C:\Users\Spencer Dunbar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk 
 

:Files

J:\Startup.exe

H:\Startup.exe

C:\ProgramData\go_0molg.pad

C:\Users\Spencer Dunbar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
 

:Commands
 

[emptytemp]

[emptyflash]

[resethosts]

Schließe alle Programme.
Klicke auf den Fix Button.
Wenn OTL einen Neustart verlangt, bitte zulassen.
Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

Also Sie haben gerade den Haut eines amerikanischen FBI Agent gerettet! Als Dank für Ihre Hilfe, werde ich President Obama mitteilen, dass es gaar kein Öl in Deutschland zu finden gibt, damit er Ihr Land in ein paar Jahren nicht angreift. Herzlichen Glückwunsch! :dankeschoen:

Übrigens hat OTL mir diesen Bericht gegeben. Ist es wichtig oder beschreibt es nur wie geil Sie sind?

Zitat:

All processes killed
========== OTL ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064}\ deleted successfully.
c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll moved successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Prefs.js: 0 removed from network.proxy.type
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@adobe.com/FlashPlayer\ deleted successfully.
C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll moved successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Keadu deleted successfully.
C:\Users\Spencer Dunbar\AppData\Roaming\Ifcua\gagu.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3023ddda-b6ce-11e1-8431-c89cdc2ab82c}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3023ddda-b6ce-11e1-8431-c89cdc2ab82c}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3023ddda-b6ce-11e1-8431-c89cdc2ab82c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3023ddda-b6ce-11e1-8431-c89cdc2ab82c}\ not found.
File J:\Startup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c52af090-2f45-11e1-a594-c89cdc2ab82c}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c52af090-2f45-11e1-a594-c89cdc2ab82c}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c52af090-2f45-11e1-a594-c89cdc2ab82c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c52af090-2f45-11e1-a594-c89cdc2ab82c}\ not found.
File H:\Startup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{eeeefe52-15dd-11df-9882-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{eeeefe52-15dd-11df-9882-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{eeeefe52-15dd-11df-9882-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{eeeefe52-15dd-11df-9882-806e6f6e6963}\ not found.
File move failed. E:\Setup.exe scheduled to be moved on reboot.
C:\ProgramData\go_0molg.pad moved successfully.
C:\Users\Spencer Dunbar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk moved successfully.
File C:\ProgramData\go_0molg.pad not found.
File C:\Users\Spencer Dunbar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk not found.
========== FILES ==========
File\Folder J:\Startup.exe not found.
File\Folder H:\Startup.exe not found.
File\Folder C:\ProgramData\go_0molg.pad not found.
File\Folder C:\Users\Spencer Dunbar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 321 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

User: Spencer Dunbar
->Temp folder emptied: 145498972 bytes
->Temporary Internet Files folder emptied: 96451617 bytes
->Java cache emptied: 32958702 bytes
->FireFox cache emptied: 1152472004 bytes
->Flash cache emptied: 13207 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 229656287 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 52224 bytes
RecycleBin emptied: 7128605 bytes

Total Files Cleaned = 1.587,00 mb

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

User: Spencer Dunbar
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0,00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.54.0 log created on 07122012_151903

Files\Folders moved on Reboot...
File move failed. E:\Setup.exe scheduled to be moved on reboot.
C:\Users\Spencer Dunbar\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...
[2011.09.02 08:52:31 | 000,355,920 | R--- | M] (Valve Corporation) E:\Setup.exe : MD5=442643390E37D7737BE60E4F2E8B5DBA
File C:\Users\Spencer Dunbar\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!

Registry entries deleted on Reboot...

Sehr gut! :)

Wie laeuft der Rechner?

naechster Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

Zitat:

Zitat von t'john (Beitrag 863234)

Sehr gut! :)

Wie laeuft der Rechner?

naechster Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

Läuft gut!

Zitat:

Malwarebytes Anti-Malware (Trial) 1.62.0.1300
www.malwarebytes.org

Database version: v2012.07.12.12

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
Spencer Dunbar :: MEATWAD [administrator]

Protection: Enabled

13.07.2012 23:01:09
mbam-log-2012-07-13 (23-01-09).txt

Scan type: Full scan (C:\|D:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 375953
Time elapsed: 34 minute(s), 18 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\_OTL\MovedFiles\07122012_151903\C_Users\Spencer Dunbar\AppData\Roaming\Ifcua\gagu.exe (Trojan.Phex.THAGen1) -> Quarantined and deleted successfully.

(end)

Nochmals danke!

Sehr gut! :daumenhoc

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Search.
Nach Ende des Suchlaufs öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

Zitat:

Zitat von t'john (Beitrag 864437)

Sehr gut! :daumenhoc

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Search.
Nach Ende des Suchlaufs öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

Hatte das hier fast vergessen! War die ganze letzte Woche kaum zu Hause.
Hier ist es jetzt:

Zitat:

# AdwCleaner v1.703 - Logfile created 07/24/2012 at 09:31:00
# Updated 20/07/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Spencer Dunbar - MEATWAD
# Running from : C:\Users\Spencer Dunbar\Downloads\adwcleaner.exe
# Option [Search]

***** [Services] *****

***** [Files / Folders] *****

File Found : C:\Users\Public\Desktop\eBay.lnk

***** [Registry] *****

Key Found : HKLM\SOFTWARE\DT Soft

***** [Registre - GUID] *****

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.7601.17514

[OK] Registry is clean.

-\\ Mozilla Firefox v14.0.1 (de)

Profile name : default
File : C:\Users\Spencer Dunbar\AppData\Roaming\Mozilla\Firefox\Profiles\uweuk2sw.default\prefs.js

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [814 octets] - [24/07/2012 09:31:00]

########## EOF - C:\AdwCleaner[R1].txt - [941 octets] ##########

Sehr gut! :daumenhoc

Schließe alle offenen Programme und Browser.
Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Delete.
Bestätige jeweils mit Ok.
Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

danach:

Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html

Fehlende Rückmeldung

Gibt es Probleme beim Abarbeiten obiger Anleitung?

Um Kapazitäten für andere Hilfesuchende freizumachen, lösche ich dieses Thema aus meinen Benachrichtigungen.

Solltest Du weitermachen wollen, schreibe mir eine PN oder eröffne ein neues Thema.
http://www.trojaner-board.de/69886-a...-beachten.html

Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner sauber ist.

Hey sorry, musste in letzter Zeit viele Arztbesuche machen (Beinprobleme, versuche eine neue Prothese zu bekommen, muss etwa weit weg fahren um das Ding zu behandeln) und war ja kaum zu Hause. Bin jetzt wieder da.

Die Log datei von ADWCleaner:

Zitat:

# AdwCleaner v1.703 - Logfile created 08/15/2012 at 15:35:57
# Updated 20/07/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Spencer Dunbar - MEATWAD
# Running from : C:\Users\Spencer Dunbar\Downloads\adwcleaner.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****

File Deleted : C:\Users\Public\Desktop\eBay.lnk

***** [Registry] *****

Key Deleted : HKLM\SOFTWARE\DT Soft

***** [Registre - GUID] *****

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.7601.17514

[OK] Registry is clean.

-\\ Mozilla Firefox v14.0.1 (de)

Profile name : default
File : C:\Users\Spencer Dunbar\AppData\Roaming\Mozilla\Firefox\Profiles\uweuk2sw.default\prefs.js

C:\Users\Spencer Dunbar\AppData\Roaming\Mozilla\Firefox\Profiles\uweuk2sw.default\user.js ... Deleted !

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [941 octets] - [24/07/2012 09:31:00]
AdwCleaner[R2].txt - [1001 octets] - [15/08/2012 15:35:20]
AdwCleaner[S1].txt - [1044 octets] - [15/08/2012 15:35:57]

########## EOF - C:\AdwCleaner[S1].txt - [1172 octets] ##########

Die Logdatei für Emsisoft:

Zitat:

Emsisoft Anti-Malware - Version 6.6
Last update: 15.08.2012 15:47:11

Scan settings:

Scan type: Deep Scan
Objects: Rootkits, Memory, Traces, C:\, D:\
Scan archives: On
ADS Scan: On

Scan start: 15.08.2012 15:48:00

c:\program files (x86)\gamespy arcade detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\cstrike detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\addins detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\cstrike\frontline detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\halflife detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\halflife\action detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\halflife\cstrike detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\halflife\firearms detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\halflife\frontline detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\halflife\gearbox detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\halflife\tfc detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2 detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\aq2 detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\battle detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\chaosdm detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\duel detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\freeze detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\gloom detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\gxmod detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\holywars detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\jail detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\kots detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\lfiredm detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\lithium2 detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\lmctf detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\pball detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\q2comp detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\qpong detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\ra2 detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\requiem detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\sconfig detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\tourney detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\wf detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\wod detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3 detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\alliance detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\beryllium detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\excessive detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\instagib detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\jailbreak detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\matchmod detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\osp detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\q3comp detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\q3f detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\q3ut2 detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\requiem detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\rocketarena3 detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\wfa detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\arena detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\ch detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\ctf detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\ctfb detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\ctfplus detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\dd detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\dm detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\duel detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\fr detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\mt detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\open cal detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\rpg detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\tac detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\ut detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\ut\excessive detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\ut\rocketarena detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\ut\swat detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\images detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\images\icons detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\profiles detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\profiles\(default) detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\images\portraits detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_common detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_demospy detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_fplanet detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_gnews detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_gspyder detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_news detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_support detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\skins detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\skins\(default3) detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\sounds detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\sounds\(default) detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\sounds\classic detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\dat.bmp detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\def_banner.gif detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\4dca9208.dat detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\arcres.dll detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\def_banner.html detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\def_bannerbg.jpg detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\def_loading.gif detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\def_logo.jpg detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\def_news.html detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\fpupdate.exe detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\gamespy arcade help.url detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\gamespy arcade website.url detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\gamespy.com gaming's homepage.url detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\aphex.exe detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\gsapak.exe detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\gsws.dll detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\gslan.dll detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\install.log detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\readme.html detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\pw32.dll detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\register gamespy arcade.url detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\rptcrash.exe detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_news\rsrc.dir detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_news\service_tab.psd detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_support\rsrc.dir detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_news\service_tab+.tga detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_support\service_tab.psd detected: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\ws_default.html detected: Trace.File.gamespy arcade!E1
Value: hkey_current_user\software\gamespy\gamespy arcade --> instdir detected: Trace.Registry.gamespy arcade!E1
Value: hkey_local_machine\software\gamespy\gamespy arcade --> instdir detected: Trace.Registry.gamespy arcade!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\gamespy arcade --> displayname detected: Trace.Registry.gamespy arcade!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\gamespy arcade --> uninstallstring detected: Trace.Registry.gamespy arcade!E1

Scanned 610813
Found 117

Scan end: 15.08.2012 16:13:22
Scan time: 0:25:22

Die Dateien habe ich nicht gelöscht. Was jetzt? Und nochmals danke.

Sehr gut! :daumenhoc

Lasse die Funde loeschen, dann:

Deinstalliere:
Emsisoft Anti-Malware

ESET Online Scanner

Vorbereitung

Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren.
Vista/Win7-User: Bitte den Browser unbedingt als Administrator starten.

Los geht's

Lade und starte Eset Smartinstaller
Haken setzen bei YES, I accept the Terms of Use.
Klick auf Start.
Haken setzen bei Remove found threads und Scan archives.
Klick auf Start.
Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Finish drücken.
Browser schließen.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (manchmal auch C:\Programme\Eset\log.txt) suchen und mit Deinem Editor öffnen.
Logfile hier posten.
Deinstallation: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset