Trojaner-Board - Polizei Trojaner Einheit 5.2 (Österrech)

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Polizei Trojaner Einheit 5.2 (Österrech) (https://www.trojaner-board.de/119569-polizei-trojaner-einheit-5-2-osterrech.html)

Polizei Trojaner Einheit 5.2 (Österrech)

Hallo,

vorab, ich bin einfacher Anwender und bitte um HILFE!
Bei mir kam heute auf einmal die bekannte Aufforderung der BPD 100€ zu bezahlen.
Habe W-Lan ausgeschaltet und Laptop neu gestartet. Als ich nach dem Neustart den Desktop kurz sah hab ich sofort einen Ordner angeklickt und dann war auf einmal wieder die Sperre aktiv. Über Task Manager hab ich den Ordner ausgewählt und es irgendwie geschafft die Sperre zu unterdrücken. Dann habe ich W-Lan wieder aktiviert und bin nun seit Stunden am suchen wie ich den Trojaner wieder los werde.
Mein Laptop funktioniert ganz normal, sobald ich jedoch neu starte ist die Sperre wieder da.

Im Anhang die OTL Auswertung, hoffe das sind die richtigen.

Danke

:hallo:

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
Starte die OTL.exe.
Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:

Code:

:OTL

PRC - C:\Program Files\Application Updater\ApplicationUpdater.exe (Spigot, Inc.) 

SRV - (Application Updater) -- C:\Program Files\Application Updater\ApplicationUpdater.exe (Spigot, Inc.) 

IE - HKLM\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.) 

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 

IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) 

IE - HKCU\..\URLSearchHook: {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\IE\6.0\pdfforgeToolbarIE.dll (Spigot, Inc.) 

IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.) 

IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC 

IE - HKCU\..\SearchScopes\{A9CB6E3D-2572-471C-B51F-6DD3340EAC8E}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=AVR-3&o=APN10397&src=kw&q={searchTerms}&locale=de_AT&apn_ptnrs=^ABV&apn_dtid=^YYYYYY^YY^AT&apn_uid=bff0b613-041e-4043-af23-992223cacfd2&apn_sauid=C282B1C3-E72F-462A-9D06-9C3838D72E53 

IE - HKCU\..\SearchScopes\{E768FBAC-9BB3-4317-BF27-893460BB5F72}: "URL" = http://at.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=302398&p={searchTerms} 

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local 

FF - prefs.js..extensions.enabledItems: MapShare-status@tomtom.com:1.7.1 

FF - prefs.js..extensions.enabledItems: baseTheme@tomtom.com:1.0.2 

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) 

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) 

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Privat\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) 

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Privat\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) 

O2 - BHO: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\IE\6.0\pdfforgeToolbarIE.dll (Spigot, Inc.) 

O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.) 

O2 - BHO: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) 

O3 - HKLM\..\Toolbar: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\IE\6.0\pdfforgeToolbarIE.dll (Spigot, Inc.) 

O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.) 

O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) 

O3 - HKCU\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.) 

O3 - HKCU\..\Toolbar\WebBrowser: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) 

O4 - HKLM..\Run: [] File not found 

O4 - HKLM..\Run: [AcWin7Hlpr] C:\Program Files\Lenovo\Access Connections\AcTBenabler.exe () 

O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask) 

O4 - HKLM..\Run: [FtpServer.exe] D:\Sharp\Sharpdesk\FtpServer.exe -usedefault File not found 

O4 - HKLM..\Run: [IndexTray] "D:\Sharp\Sharpdesk\IndexTray.exe /n" File not found 

O4 - HKLM..\Run: [SearchSettings] C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.) 

O4 - HKLM..\Run: [SharpTray] D:\Sharp\Sharpdesk\SharpTray.exe File not found 

O4 - HKLM..\Run: [tsnp2uvc] C:\Windows\tsnp2uvc.exe File not found 

O4 - HKLM..\Run: [TypeRegChecker] D:\Sharp\Sharpdesk\TypeRegChecker.exe File not found 

O4 - HKLM..\Run: [Update] C:\Users\Privat\AppData\Roaming\fest0r_ot.exe () 

O4 - HKCU..\Run: [DAEMON Tools Lite] "D:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun File not found 

O4 - HKCU..\Run: [Update] C:\Users\Privat\AppData\Roaming\fest0r_ot.exe () 

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255 

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 

O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} http://www.sibelius.com/download/software/win/ActiveXPlugin.cab (Reg Error: Key error.) 

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) 

O32 - HKLM CDRom: AutoRun - 1 

O33 - MountPoints2\{0a605c94-3fd4-11df-9b6c-005056c00008}\Shell - "" = AutoRun 

O33 - MountPoints2\{0a605c94-3fd4-11df-9b6c-005056c00008}\Shell\AutoRun\command - "" = F:\AutoRun.exe 

O33 - MountPoints2\{0a605cc9-3fd4-11df-9b6c-005056c00008}\Shell - "" = AutoRun 

O33 - MountPoints2\{0a605cc9-3fd4-11df-9b6c-005056c00008}\Shell\AutoRun\command - "" = L:\AutoRun.exe 

O33 - MountPoints2\{0f4bd9f0-3dcc-11df-b5e3-005056c00008}\Shell - "" = AutoRun 

O33 - MountPoints2\{0f4bd9f0-3dcc-11df-b5e3-005056c00008}\Shell\AutoRun\command - "" = G:\AutoRun.exe 

O33 - MountPoints2\{0f4bd9fd-3dcc-11df-b5e3-005056c00008}\Shell - "" = AutoRun 

O33 - MountPoints2\{0f4bd9fd-3dcc-11df-b5e3-005056c00008}\Shell\AutoRun\command - "" = G:\AutoRun.exe 

O33 - MountPoints2\{12070774-3e7e-11df-b5e6-005056c00008}\Shell - "" = AutoRun 

O33 - MountPoints2\{12070774-3e7e-11df-b5e6-005056c00008}\Shell\AutoRun\command - "" = G:\AutoRun.exe 

O33 - MountPoints2\{12070780-3e7e-11df-b5e6-005056c00008}\Shell - "" = AutoRun 

O33 - MountPoints2\{12070780-3e7e-11df-b5e6-005056c00008}\Shell\AutoRun\command - "" = G:\AutoRun.exe 

O33 - MountPoints2\{20debf7c-fbfb-11df-90bc-00242cbe1d98}\Shell - "" = AutoRun 

O33 - MountPoints2\{20debf7c-fbfb-11df-90bc-00242cbe1d98}\Shell\AutoRun\command - "" = D:\AutoRun.exe 

O33 - MountPoints2\{47a256d6-5747-11df-a0fe-0022fae21644}\Shell - "" = AutoRun 

O33 - MountPoints2\{47a256d6-5747-11df-a0fe-0022fae21644}\Shell\AutoRun\command - "" = H:\AutoRun.exe 

O33 - MountPoints2\{750cf803-fbfa-11df-910e-806e6f6e6963}\Shell - "" = AutoRun 

O33 - MountPoints2\{750cf803-fbfa-11df-910e-806e6f6e6963}\Shell\AutoRun\command - "" = D:\AutoRun.exe 

O33 - MountPoints2\{a14fe43a-3dc4-11df-b54f-806e6f6e6963}\Shell - "" = AutoRun 

O33 - MountPoints2\{a14fe43a-3dc4-11df-b54f-806e6f6e6963}\Shell\AutoRun\command - "" = G:\AutoRun.exe 

O33 - MountPoints2\{b4f03daf-f17f-11df-9b35-00242cbe1d98}\Shell - "" = AutoRun 

O33 - MountPoints2\{b4f03daf-f17f-11df-9b35-00242cbe1d98}\Shell\AutoRun\command - "" = D:\AutoRun.exe 

O33 - MountPoints2\{bc19896d-f194-11df-9273-00247e6a4cbf}\Shell - "" = AutoRun 

O33 - MountPoints2\{bc19896d-f194-11df-9273-00247e6a4cbf}\Shell\AutoRun\command - "" = D:\AutoRun.exe 

O33 - MountPoints2\{bf7052e4-0b72-11e1-adaa-00242cbe1d98}\Shell - "" = AutoRun 

O33 - MountPoints2\{bf7052e4-0b72-11e1-adaa-00242cbe1d98}\Shell\AutoRun\command - "" = D:\LaunchU3.exe -a 

O33 - MountPoints2\{f5f6eeb9-43c4-11df-b5cb-806e6f6e6963}\Shell - "" = AutoRun 

O33 - MountPoints2\{f5f6eeb9-43c4-11df-b5cb-806e6f6e6963}\Shell\AutoRun\command - "" = H:\AutoRun.exe 

O33 - MountPoints2\F\Shell - "" = AutoRun 

O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\AutoRun.exe 

O33 - MountPoints2\G\Shell - "" = AutoRun 

O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\AutoRun.exe 

O33 - MountPoints2\L\Shell - "" = AutoRun 

O33 - MountPoints2\L\Shell\AutoRun\command - "" = L:\AutoRun.exe 

[2012.07.15 14:12:52 | 000,000,000 | ---D | C] -- C:\Program Files\Ask.com 

[2012.07.15 14:13:01 | 000,000,000 | ---D | C] -- C:\Users\Privat\AppData\Local\AskToolbar 

[2012.07.02 17:49:33 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Spigot 

[2012.07.02 17:49:33 | 000,000,000 | ---D | C] -- C:\Program Files\pdfforge Toolbar 

[2012.07.02 17:49:33 | 000,000,000 | ---D | C] -- C:\Program Files\Application Updater 

[2012.07.15 18:04:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job 

[2012.07.15 17:27:00 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job 

[2012.07.15 17:26:00 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-905036566-1828708054-3587640490-1000UA.job 

[2012.07.15 16:27:00 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job 

[2012.07.15 14:26:05 | 000,001,072 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-905036566-1828708054-3587640490-1000Core.job 

[2012.07.15 13:29:59 | 000,000,466 | ---- | M] () -- C:\Windows\tasks\SystemToolsDailyTest.job 

[2012.07.15 13:29:59 | 000,000,466 | ---- | M] () -- C:\Windows\Tasks\SystemToolsDailyTest.job 

[2012.06.30 18:07:36 | 000,000,528 | ---- | M] () -- C:\Windows\tasks\PCDoctorBackgroundMonitorTask.job 

[2012.06.30 18:07:36 | 000,000,528 | ---- | M] () -- C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job 

:Files

C:\Program Files\Lenovo\Access Connections\AcTBenabler.exe

C:\Users\Privat\AppData\Roaming\fest0r_ot.exe
 

F:\AutoRun.exe

L:\AutoRun.exe

G:\AutoRun.exe

D:\AutoRun.exe

H:\AutoRun.exe

D:\LaunchU3.exe -a

C:\Program Files\Ask.com

C:\Program Files\Common Files\Spigot

C:\Windows\tasks\Adobe Flash Player Updater.job

C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
 

C:\Windows\Tasks\SystemToolsDailyTest.job

ipconfig /flushdns /c

:Commands

[purity]

[emptytemp]

[emptyflash]

Schließe alle Programme.
Klicke auf den Fix Button.
Wenn OTL einen Neustart verlangt, bitte zulassen.
Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

Hallo,

danke, hier der Code.
Hoffe das funktioniert.

lg

Code:

All processes killed

========== OTL ==========

Process ApplicationUpdater.exe killed successfully!

Service Application Updater stopped successfully!

Service Application Updater deleted successfully!

C:\Program Files\Application Updater\ApplicationUpdater.exe moved successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ deleted successfully.

C:\Program Files\softonic-de3\tbsoft.dll moved successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.

Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{00000000-6E41-4FD3-8538-502F5495E5FC} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}\ deleted successfully.

C:\Program Files\Ask.com\GenericAskToolbar.dll moved successfully.

Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{B922D405-6D13-4A2B-AE89-08A030DA4402} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}\ deleted successfully.

C:\Program Files\pdfforge Toolbar\IE\6.0\pdfforgeToolbarIE.dll moved successfully.

Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ not found.

File C:\Program Files\softonic-de3\tbsoft.dll not found.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A9CB6E3D-2572-471C-B51F-6DD3340EAC8E}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9CB6E3D-2572-471C-B51F-6DD3340EAC8E}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E768FBAC-9BB3-4317-BF27-893460BB5F72}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E768FBAC-9BB3-4317-BF27-893460BB5F72}\ not found.

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!

Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=3\ deleted successfully.

C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=9\ deleted successfully.

File C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll not found.

Registry key HKEY_CURRENT_USER\Software\MozillaPlugins\@tools.google.com/Google Update;version=3\ deleted successfully.

C:\Users\Privat\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll moved successfully.

Registry key HKEY_CURRENT_USER\Software\MozillaPlugins\@tools.google.com/Google Update;version=9\ deleted successfully.

File C:\Users\Privat\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll not found.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}\ not found.

File C:\Program Files\pdfforge Toolbar\IE\6.0\pdfforgeToolbarIE.dll not found.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ not found.

File C:\Program Files\softonic-de3\tbsoft.dll not found.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.

File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{B922D405-6D13-4A2B-AE89-08A030DA4402} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}\ not found.

File C:\Program Files\pdfforge Toolbar\IE\6.0\pdfforgeToolbarIE.dll not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ not found.

File de3\tbsoft.dll not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.

File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}\ not found.

File de3\tbsoft.dll not found.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.

File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\AcWin7Hlpr deleted successfully.

C:\Program Files\Lenovo\Access Connections\AcTBenabler.exe moved successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ApnUpdater deleted successfully.

C:\Program Files\Ask.com\Updater\Updater.exe moved successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\FtpServer.exe deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\IndexTray deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SearchSettings deleted successfully.

C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe moved successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SharpTray deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\tsnp2uvc deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\TypeRegChecker deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Update deleted successfully.

C:\Users\Privat\AppData\Roaming\fest0r_ot.exe moved successfully.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\DAEMON Tools Lite deleted successfully.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Update deleted successfully.

File C:\Users\Privat\AppData\Roaming\fest0r_ot.exe not found.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLUA deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\PromptOnSecureDesktop deleted successfully.

Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.

Starting removal of ActiveX control {A8F2B9BD-A6A0-486A-9744-18920D898429}

C:\Windows\Downloaded Program Files\SETUP.INF moved successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{A8F2B9BD-A6A0-486A-9744-18920D898429}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8F2B9BD-A6A0-486A-9744-18920D898429}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A8F2B9BD-A6A0-486A-9744-18920D898429}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8F2B9BD-A6A0-486A-9744-18920D898429}\ not found.

Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}

C:\Windows\Downloaded Program Files\gp.inf not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a605c94-3fd4-11df-9b6c-005056c00008}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0a605c94-3fd4-11df-9b6c-005056c00008}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a605c94-3fd4-11df-9b6c-005056c00008}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0a605c94-3fd4-11df-9b6c-005056c00008}\ not found.

File F:\AutoRun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a605cc9-3fd4-11df-9b6c-005056c00008}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0a605cc9-3fd4-11df-9b6c-005056c00008}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a605cc9-3fd4-11df-9b6c-005056c00008}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0a605cc9-3fd4-11df-9b6c-005056c00008}\ not found.

File L:\AutoRun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0f4bd9f0-3dcc-11df-b5e3-005056c00008}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f4bd9f0-3dcc-11df-b5e3-005056c00008}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0f4bd9f0-3dcc-11df-b5e3-005056c00008}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f4bd9f0-3dcc-11df-b5e3-005056c00008}\ not found.

File G:\AutoRun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0f4bd9fd-3dcc-11df-b5e3-005056c00008}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f4bd9fd-3dcc-11df-b5e3-005056c00008}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0f4bd9fd-3dcc-11df-b5e3-005056c00008}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f4bd9fd-3dcc-11df-b5e3-005056c00008}\ not found.

File G:\AutoRun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{12070774-3e7e-11df-b5e6-005056c00008}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{12070774-3e7e-11df-b5e6-005056c00008}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{12070774-3e7e-11df-b5e6-005056c00008}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{12070774-3e7e-11df-b5e6-005056c00008}\ not found.

File G:\AutoRun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{12070780-3e7e-11df-b5e6-005056c00008}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{12070780-3e7e-11df-b5e6-005056c00008}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{12070780-3e7e-11df-b5e6-005056c00008}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{12070780-3e7e-11df-b5e6-005056c00008}\ not found.

File G:\AutoRun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{20debf7c-fbfb-11df-90bc-00242cbe1d98}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20debf7c-fbfb-11df-90bc-00242cbe1d98}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{20debf7c-fbfb-11df-90bc-00242cbe1d98}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20debf7c-fbfb-11df-90bc-00242cbe1d98}\ not found.

File D:\AutoRun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{47a256d6-5747-11df-a0fe-0022fae21644}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47a256d6-5747-11df-a0fe-0022fae21644}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{47a256d6-5747-11df-a0fe-0022fae21644}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47a256d6-5747-11df-a0fe-0022fae21644}\ not found.

File H:\AutoRun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{750cf803-fbfa-11df-910e-806e6f6e6963}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{750cf803-fbfa-11df-910e-806e6f6e6963}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{750cf803-fbfa-11df-910e-806e6f6e6963}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{750cf803-fbfa-11df-910e-806e6f6e6963}\ not found.

File D:\AutoRun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a14fe43a-3dc4-11df-b54f-806e6f6e6963}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a14fe43a-3dc4-11df-b54f-806e6f6e6963}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a14fe43a-3dc4-11df-b54f-806e6f6e6963}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a14fe43a-3dc4-11df-b54f-806e6f6e6963}\ not found.

File G:\AutoRun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b4f03daf-f17f-11df-9b35-00242cbe1d98}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b4f03daf-f17f-11df-9b35-00242cbe1d98}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b4f03daf-f17f-11df-9b35-00242cbe1d98}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b4f03daf-f17f-11df-9b35-00242cbe1d98}\ not found.

File D:\AutoRun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bc19896d-f194-11df-9273-00247e6a4cbf}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bc19896d-f194-11df-9273-00247e6a4cbf}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bc19896d-f194-11df-9273-00247e6a4cbf}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bc19896d-f194-11df-9273-00247e6a4cbf}\ not found.

File D:\AutoRun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bf7052e4-0b72-11e1-adaa-00242cbe1d98}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bf7052e4-0b72-11e1-adaa-00242cbe1d98}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bf7052e4-0b72-11e1-adaa-00242cbe1d98}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bf7052e4-0b72-11e1-adaa-00242cbe1d98}\ not found.

File D:\LaunchU3.exe -a not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f5f6eeb9-43c4-11df-b5cb-806e6f6e6963}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f5f6eeb9-43c4-11df-b5cb-806e6f6e6963}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f5f6eeb9-43c4-11df-b5cb-806e6f6e6963}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f5f6eeb9-43c4-11df-b5cb-806e6f6e6963}\ not found.

File H:\AutoRun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\ deleted successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\ not found.

File F:\AutoRun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ deleted successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ not found.

File G:\AutoRun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\L\ deleted successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\L\ not found.

File L:\AutoRun.exe not found.

C:\Program Files\Ask.com\Updater folder moved successfully.

C:\Program Files\Ask.com\assets\oobe folder moved successfully.

C:\Program Files\Ask.com\assets folder moved successfully.

C:\Program Files\Ask.com folder moved successfully.

C:\Users\Privat\AppData\Local\AskToolbar\Downloaded Program Files\temp folder moved successfully.

Folder move failed. C:\Users\Privat\AppData\Local\AskToolbar\Downloaded Program Files scheduled to be moved on reboot.

Folder move failed. C:\Users\Privat\AppData\Local\AskToolbar scheduled to be moved on reboot.

C:\Program Files\Common Files\Spigot\Search Settings\Res folder moved successfully.

C:\Program Files\Common Files\Spigot\Search Settings\Lang folder moved successfully.

C:\Program Files\Common Files\Spigot\Search Settings folder moved successfully.

C:\Program Files\Common Files\Spigot folder moved successfully.

C:\Program Files\pdfforge Toolbar\Res\Lang folder moved successfully.

C:\Program Files\pdfforge Toolbar\Res folder moved successfully.

C:\Program Files\pdfforge Toolbar\IE\6.0 folder moved successfully.

C:\Program Files\pdfforge Toolbar\IE folder moved successfully.

C:\Program Files\pdfforge Toolbar folder moved successfully.

C:\Program Files\Application Updater folder moved successfully.

C:\Windows\Tasks\Adobe Flash Player Updater.job moved successfully.

C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job moved successfully.

C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-905036566-1828708054-3587640490-1000UA.job moved successfully.

C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job moved successfully.

C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-905036566-1828708054-3587640490-1000Core.job moved successfully.

C:\Windows\Tasks\SystemToolsDailyTest.job moved successfully.

File C:\Windows\Tasks\SystemToolsDailyTest.job not found.

C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job moved successfully.

File C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job not found.

========== FILES ==========

File\Folder C:\Program Files\Lenovo\Access Connections\AcTBenabler.exe not found.

File\Folder C:\Users\Privat\AppData\Roaming\fest0r_ot.exe not found.

File\Folder F:\AutoRun.exe not found.

File\Folder L:\AutoRun.exe not found.

File\Folder G:\AutoRun.exe not found.

File\Folder D:\AutoRun.exe not found.

File\Folder H:\AutoRun.exe not found.

File\Folder D:\LaunchU3.exe -a not found.

File\Folder C:\Program Files\Ask.com not found.

File\Folder C:\Program Files\Common Files\Spigot not found.

File\Folder C:\Windows\tasks\Adobe Flash Player Updater.job not found.

File\Folder C:\Windows\tasks\GoogleUpdateTaskMachineUA.job not found.

File\Folder C:\Windows\Tasks\SystemToolsDailyTest.job not found.
 < ipconfig /flushdns /c >

Windows-IP-Konfiguration

Der DNS-Aufl”sungscache wurde geleert.

C:\Users\Privat\Desktop\cmd.bat deleted successfully.

C:\Users\Privat\Desktop\cmd.txt deleted successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Flash cache emptied: 56475 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: Privat

->Temp folder emptied: 635630786 bytes

->Temporary Internet Files folder emptied: 1110007850 bytes

->Java cache emptied: 8446670 bytes

->Google Chrome cache emptied: 6438172 bytes

->Flash cache emptied: 15232006 bytes

 

User: Public

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 630989 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 321991113 bytes

%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67698 bytes

%systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 741 bytes

RecycleBin emptied: 3190847 bytes

 

Total Files Cleaned = 2.004,00 mb

 

 

[EMPTYFLASH]

 

User: All Users

 

User: Default

->Flash cache emptied: 0 bytes

 

User: Default User

->Flash cache emptied: 0 bytes

 

User: Privat

->Flash cache emptied: 0 bytes

 

User: Public

 

Total Flash Files Cleaned = 0,00 mb

 

 

OTL by OldTimer - Version 3.2.54.0 log created on 07152012_200315
 

Files\Folders moved on Reboot...

C:\Users\Privat\AppData\Local\AskToolbar\Downloaded Program Files folder moved successfully.

C:\Users\Privat\AppData\Local\AskToolbar folder moved successfully.

C:\Users\Privat\AppData\Local\Temp\Ask73CD.tmp.png moved successfully.

C:\Users\Privat\AppData\Local\Temp\AskC93E.tmp.png moved successfully.

C:\Users\Privat\AppData\Local\Temp\AskF08.tmp.png moved successfully.

C:\Users\Privat\AppData\Local\Temp\AskF1EE.tmp.png moved successfully.

C:\Users\Privat\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.

C:\Users\Privat\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V9TJJFM8\119513-polizei-trojaner-osterreich[1].htm moved successfully.

C:\Users\Privat\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V9TJJFM8\119569-polizei-trojaner-einheit-5-2-osterrech[1].htm moved successfully.

C:\Users\Privat\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V9TJJFM8\search[5].htm moved successfully.

C:\Users\Privat\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PWCJN0I4\ads[11].htm moved successfully.

C:\Users\Privat\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PWCJN0I4\google_at[1].htm moved successfully.

C:\Users\Privat\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E6O0HZAR\ads[1].htm moved successfully.
 

PendingFileRenameOperations files...

File C:\Users\Privat\AppData\Local\AskToolbar\Downloaded Program Files not found!

File C:\Users\Privat\AppData\Local\AskToolbar not found!

File C:\Users\Privat\AppData\Local\Temp\Ask73CD.tmp.png not found!

File C:\Users\Privat\AppData\Local\Temp\AskC93E.tmp.png not found!

File C:\Users\Privat\AppData\Local\Temp\AskF08.tmp.png not found!

File C:\Users\Privat\AppData\Local\Temp\AskF1EE.tmp.png not found!

File C:\Users\Privat\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat not found!

File C:\Users\Privat\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V9TJJFM8\119513-polizei-trojaner-osterreich[1].htm not found!

File C:\Users\Privat\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V9TJJFM8\119569-polizei-trojaner-einheit-5-2-osterrech[1].htm not found!

File C:\Users\Privat\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V9TJJFM8\search[5].htm not found!

File C:\Users\Privat\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PWCJN0I4\ads[11].htm not found!

File C:\Users\Privat\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PWCJN0I4\google_at[1].htm not found!

File C:\Users\Privat\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E6O0HZAR\ads[1].htm not found!
 

Registry entries deleted on Reboot...

Sehr gut! :daumenhoc

Wie laeuft der Rechner?

1. Schritt

Neue Version! Bitte neu runterladen!

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Search.
Nach Ende des Suchlaufs öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

Hallo,

danke für die tolle Hilfe.

Hier der Report von Malware:

Code:

Malwarebytes Anti-Malware (Test) 1.62.0.1300

www.malwarebytes.org
 

Datenbank Version: v2012.07.15.09
 

Windows 7 Service Pack 1 x86 NTFS

Internet Explorer 9.0.8112.16421

Privat :: G536FADH0506 [Administrator]
 

Schutz: Aktiviert
 

15.07.2012 20:45:35

mbam-log-2012-07-15 (20-45-35).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 421991

Laufzeit: 1 Stunde(n), 43 Minute(n), 37 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 1

C:\_OTL\MovedFiles\07152012_200315\C_Users\Privat\AppData\Roaming\fest0r_ot.exe (Trojan.Agent.3D) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

Code:

# AdwCleaner v1.702 - Logfile created 07/15/2012 at 22:33:58

# Updated 13/07/2012 by Xplode

# Operating system : Windows 7 Enterprise Service Pack 1 (32 bits)

# User : Privat - G536FADH0506

# Running from : C:\Users\Privat\Desktop\adwcleaner.exe

# Option [Search]
 
 

***** [Services] *****
 
 

***** [Files / Folders] *****
 

Folder Found : C:\Users\Privat\AppData\Local\APN

Folder Found : C:\Users\Privat\AppData\LocalLow\AskToolbar

Folder Found : C:\Users\Privat\AppData\LocalLow\Conduit

Folder Found : C:\Users\Privat\AppData\LocalLow\pdfforge

Folder Found : C:\Users\Privat\AppData\LocalLow\Search Settings

Folder Found : C:\Users\Privat\AppData\Roaming\pdfforge

Folder Found : C:\Program Files\Conduit

Folder Found : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
 

***** [Registry] *****

[*] Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2431245

Key Found : HKCU\Software\APN

Key Found : HKCU\Software\AppDataLow\Software\AskToolbar

Key Found : HKCU\Software\AppDataLow\Software\Conduit

Key Found : HKCU\Software\AppDataLow\Software\pdfforge

Key Found : HKCU\Software\AppDataLow\Software\Search Settings

Key Found : HKCU\Software\AppDataLow\Toolbar

Key Found : HKCU\Software\Ask.com

Key Found : HKCU\Software\AskToolbar

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}

Key Found : HKCU\Software\pdfforge

Key Found : HKCU\Software\Search Settings

Key Found : HKCU\Software\Softonic

Key Found : HKLM\SOFTWARE\APN

Key Found : HKLM\SOFTWARE\Application Updater

Key Found : HKLM\SOFTWARE\AskToolbar

Key Found : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL

Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd

Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1

Key Found : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF

Key Found : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF

Key Found : HKLM\SOFTWARE\Classes\S

Key Found : HKLM\SOFTWARE\Conduit

Key Found : HKLM\SOFTWARE\DT Soft

Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

Key Found : HKLM\SOFTWARE\pdfforge

Key Found : HKLM\SOFTWARE\Search Settings
 

***** [Registre - GUID] *****
 

Key Found : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Key Found : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

Key Found : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

Key Found : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

Key Found : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}

Key Found : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{B922D405-6D13-4A2B-AE89-08A030DA4402}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B922D405-6D13-4A2B-AE89-08A030DA4402}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
 

***** [Internet Browsers] *****
 

-\\ Internet Explorer v9.0.8112.16421
 

[OK] Registry is clean.
 

-\\ Google Chrome v20.0.1132.57
 

File : C:\Users\Privat\AppData\Local\Google\Chrome\User Data\Default\Preferences
 

[OK] File is clean.
 

*************************
 

AdwCleaner[R1].txt - [4312 octets] - [15/07/2012 22:33:58]
 

########## EOF - C:\AdwCleaner[R1].txt - [4440 octets] ##########

Sehr gut! :daumenhoc

Schließe alle offenen Programme und Browser.
Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Delete.
Bestätige jeweils mit Ok.
Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

danach:

Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html

OK, habe alles wie gewünscht ausgeführt.

Hier die beiden Berichte:

Code:

# AdwCleaner v1.702 - Logfile created 07/16/2012 at 08:08:55

# Updated 13/07/2012 by Xplode

# Operating system : Windows 7 Enterprise Service Pack 1 (32 bits)

# User : Privat - G536FADH0506

# Running from : C:\Users\Privat\Desktop\adwcleaner.exe

# Option [Delete]
 
 

***** [Services] *****
 
 

***** [Files / Folders] *****
 
 

***** [Registry] *****
 
 

***** [Registre - GUID] *****
 
 

***** [Internet Browsers] *****
 

-\\ Internet Explorer v9.0.8112.16421
 

[OK] Registry is clean.
 

-\\ Google Chrome v20.0.1132.57
 

File : C:\Users\Privat\AppData\Local\Google\Chrome\User Data\Default\Preferences
 

[OK] File is clean.
 

*************************
 

AdwCleaner[R1].txt - [4441 octets] - [15/07/2012 22:33:58]

AdwCleaner[R2].txt - [3838 octets] - [15/07/2012 22:49:09]

AdwCleaner[S1].txt - [3868 octets] - [15/07/2012 22:49:17]

AdwCleaner[R3].txt - [1102 octets] - [16/07/2012 08:07:30]

AdwCleaner[S2].txt - [914 octets] - [16/07/2012 08:08:55]
 

########## EOF - C:\AdwCleaner[S2].txt - [1041 octets] ##########

Code:

Emsisoft Anti-Malware - Version 6.6

Letztes Update: 16.07.2012 08:31:02
 

Scan Einstellungen:
 

Scan Methode: Detail Scan

Objekte: Rootkits, Speicher, Traces, C:\

Archiv Scan: An

ADS Scan: An
 

Scan Beginn:        16.07.2012 08:32:13
 
 

Gescannt        438591

Gefunden        0
 

Scan Ende:        16.07.2012 08:33:48

Scan Zeit:        0:01:35

Sehr gut! :daumenhoc

damit bist Du sauber und entlassen! :)

Deinstalliere:
Emsisoft Anti-Malware

Tool-Bereinigung mit OTL

Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.

Bitte lade Dir (falls noch nicht vorhanden) OTL von OldTimer herunter.
Speichere es auf Deinem Desktop.
Doppelklick auf OTL.exe um das Programm auszuführen.
Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
Klicke auf den Button "Bereinigung"
OTL fragt eventuell nach einem Neustart.
Sollte es dies tun, so lasse dies bitte zu.

Anmerkung: Nach dem Neustart werden OTL und andere Helferprogramme, die Du im Laufe der Bereinigung heruntergeladen hast, nicht mehr vorhanden sein. Sie wurden entfernt. Es ist daher Ok, wenn diese Programme nicht mehr vorhanden sind. Sollten noch welche übrig geblieben sein, lösche sie manuell.

Lektuere zum abarbeiten:
http://www.trojaner-board.de/90880-d...tallation.html
http://www.trojaner-board.de/105213-...tellungen.html
PluginCheck
http://www.trojaner-board.de/96344-a...-rechners.html
Secunia Online Software Inspector
http://www.trojaner-board.de/71715-k...iendungen.html
http://www.trojaner-board.de/83238-a...sschalten.html

Ich Danke vielmals für die kompetente Hilfe.
Alles perfekt.

lg