|
Polizei-Trojaner Hallo, ich hab mir gestern den bereits mehrfach beschriebenen "Polizei-Trojaner" eingefangen. Im Nornalmodus öffnet sich sofort das Popup-Fenster und es geht garnichts mehr. Der Taskmanager liess sich für ca. 2 Sekunden öffnen, das war´s aber. Ich hab den PC im abgesicherten Modus mit Netzwerk gestartet, Malwarebytes 1.62.0.1300 (das neuste) über eien zweiten PC runtergeladen und installiert .Mit Suchlauf erst mal Quick-Scan durchgeführt. Dabei hab ich 15 einträge erhalten. Danach hab ich den vollständichen Suchlauf durchgeführt und nun hab ich 26 Schädlinge. 1 mal Trojaner.Agent.Gen 1 mal Exploit.Drop.2 24 mal PUP.Dealio.TB Ich hab nachgelsen, Ihr braucht doe OTL.txt und Extras.txt. Hab OTL 3.2.58.1 gefunden, Scan durchlaufen lassen mit - Scanne alle Benutzer - LOP Prüfung - Purity Prüfung Ich würde Euch gerne die Logfiles zukommen lassen, weis aber nicht wie!!! Jetzt bräuchte ich dringend Eure Hilfe um nicht noch mehr Schaden anzurichten. Malwarebytes Anti-Malware (Test) 1.62.0.1300 Malwarebytes : Free anti-malware download Datenbank Version: v2012.07.03.05 Windows XP Service Pack 3 x86 NTFS (Abgesichertenmodus) Internet Explorer 6.0.2900.5512 Administrator :: HOME-PC [Administrator] Schutz: Deaktiviert 21-Aug-2012 01:14:18 mbam-log-2012-08-21 (01-14-18).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 412423 Laufzeit: 1 Stunde(n), 35 Minute(n), 2 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 2 HKCR\TypeLib\{21234BEA-125E-40DB-95EA-6B322E21F59B} (PUP.Dealio.TB) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\Interface\{5F5A840B-359D-46F2-81BF-52470CE866A2} (PUP.Dealio.TB) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 2 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\PROGRAMME\DEALIO\KB127\DEALIO DESKBAR.EXE (PUP.Dealio.TB) -> Daten: 1 -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\PROGRAMME\DEALIO\KB127\DEALIORES409.DLL (PUP.Dealio.TB) -> Daten: 1 -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 7 C:\Programme\Dealio\kb127\Dealio Deskbar.exe (PUP.Dealio.TB) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Programme\Dealio\kb127\DealioRes409.dll (PUP.Dealio.TB) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\System Volume Information\_restore{E8E328A1-481C-4B04-BD5E-6A7F40D93347}\RP1669\A0093615.exe (PUP.Dealio.TB) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\System Volume Information\_restore{E8E328A1-481C-4B04-BD5E-6A7F40D93347}\RP1669\A0093616.dll (PUP.Dealio.TB) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\System Volume Information\_restore{E8E328A1-481C-4B04-BD5E-6A7F40D93347}\RP1669\A0093617.dll (PUP.Dealio.TB) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\0.17694494334791044.exe (Exploit.Drop.2) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Dokumente und Einstellungen\Administrator\0.42704562778487964.exe (Trojan.Agent.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende)OTL Logfile: Code: OTL logfile created on: 21-Aug-2012 22:37:07 - Run 1 |
:hallo: Fixen mit OTL Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).
Code: :OTL
Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden. Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen! |
Hallo t`john, vielen Dank für deine Hilfe. Mein PC scheint erstmal wieder zu laufen. Den letzten Teil mit: "Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread. Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>" hab ich nicht verstanden. Kannst du mir das auch für "PC-Nichtschwimmer" erklären? Muss ich jetzt noch was machen, daß der Polizei-Trojander Vergangenheit ist? Gruß Ramlod |
Schau auf deinem PC hier C:\_OTL\MovedFiles\ da ist ein Log, das bitte hier reinkopieren. |
All processes killed ========== OTL ========== Service WDICA stopped successfully! Service WDICA deleted successfully! File File not found not found. Service PLCMPR5 stopped successfully! Service PLCMPR5 deleted successfully! File C:\WINDOWS\system32\PLCMPR5.SYS File not found not found. Service PDRFRAME stopped successfully! Service PDRFRAME deleted successfully! File File not found not found. Service PDRELI stopped successfully! Service PDRELI deleted successfully! File File not found not found. Service PDFRAME stopped successfully! Service PDFRAME deleted successfully! File File not found not found. Service PDCOMP stopped successfully! Service PDCOMP deleted successfully! File File not found not found. Service PCIDump stopped successfully! Service PCIDump deleted successfully! File File not found not found. Service lbrtfdc stopped successfully! Service lbrtfdc deleted successfully! File File not found not found. Service IntcAzAudAddService stopped successfully! Service IntcAzAudAddService deleted successfully! File system32\drivers\RtkHDAud.sys File not found not found. Service i2omgmt stopped successfully! Service i2omgmt deleted successfully! File File not found not found. Service Changer stopped successfully! Service Changer deleted successfully! File File not found not found. HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully! HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully! Registry value HKEY_USERS\S-1-5-21-1292428093-1592454029-839522115-500\Software\Microsoft\Internet Explorer\URLSearchHooks\\{872b5b88-9db5-4310-bdd0-ac189557e5f5} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\ deleted successfully. C:\Programme\DVDVideoSoftTB\prxtbDVD0.dll moved successfully. Registry value HKEY_USERS\S-1-5-21-1292428093-1592454029-839522115-500\Software\Microsoft\Internet Explorer\URLSearchHooks\\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}\ deleted successfully. C:\Programme\myBabylon_English\prxtbmyB0.dll moved successfully. Registry value HKEY_USERS\S-1-5-21-1292428093-1592454029-839522115-500\Software\Microsoft\Internet Explorer\URLSearchHooks\\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ deleted successfully. C:\Programme\softonic-de3\prxtbsof0.dll moved successfully. Registry value HKEY_USERS\S-1-5-21-1292428093-1592454029-839522115-500\Software\Microsoft\Internet Explorer\URLSearchHooks\\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}\ deleted successfully. C:\Programme\Search Settings\kb127\SearchSettings.dll moved successfully. HKEY_USERS\S-1-5-21-1292428093-1592454029-839522115-500\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully! Registry key HKEY_USERS\S-1-5-21-1292428093-1592454029-839522115-500\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found. HKU\S-1-5-21-1292428093-1592454029-839522115-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully! Prefs.js: "Search the web (Babylon)" removed from browser.search.defaultenginename Prefs.js: "softonic-de3 Customized Web Search" removed from browser.search.defaultthis.engineName Prefs.js: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2431245&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl Prefs.js: "Search the web (Babylon)" removed from browser.search.order.1 Prefs.js: "Google" removed from browser.search.selectedEngine Prefs.js: "" removed from browser.startup.homepage Prefs.js: jqs@sun.com:1.0 removed from extensions.enabledItems Prefs.js: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2431245&q=" removed from keyword.URL Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully. C:\Programme\ConduitEngine\prxConduitEngine.dll moved successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\ not found. File C:\Programme\DVDVideoSoftTB\prxtbDVD0.dll not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}\ not found. File C:\Programme\myBabylon_English\prxtbmyB0.dll not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ not found. File C:\Programme\softonic-de3\prxtbsof0.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{872b5b88-9db5-4310-bdd0-ac189557e5f5} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\ not found. File C:\Programme\DVDVideoSoftTB\prxtbDVD0.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}\ not found. File C:\Programme\myBabylon_English\prxtbmyB0.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ not found. File de3\prxtbsof0.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F}\ deleted successfully. Registry value HKEY_USERS\S-1-5-21-1292428093-1592454029-839522115-500\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{47833539-D0C5-4125-9FA8-0819E2EAAC93} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47833539-D0C5-4125-9FA8-0819E2EAAC93}\ not found. Registry value HKEY_USERS\S-1-5-21-1292428093-1592454029-839522115-500\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F}\ not found. Registry value HKEY_USERS\S-1-5-21-1292428093-1592454029-839522115-500\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{872B5B88-9DB5-4310-BDD0-AC189557E5F5} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}\ not found. File C:\Programme\DVDVideoSoftTB\prxtbDVD0.dll not found. Registry value HKEY_USERS\S-1-5-21-1292428093-1592454029-839522115-500\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{B2E293EE-FD7E-4C71-A714-5F4750D8D7B7} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B2E293EE-FD7E-4C71-A714-5F4750D8D7B7}\ not found. File C:\Programme\myBabylon_English\prxtbmyB0.dll not found. Registry value HKEY_USERS\S-1-5-21-1292428093-1592454029-839522115-500\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}\ not found. File de3\prxtbsof0.dll not found. Registry value HKEY_USERS\S-1-5-21-1292428093-1592454029-839522115-500\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F}\ not found. Registry value HKEY_USERS\S-1-5-21-1292428093-1592454029-839522115-500\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}\ deleted successfully. C:\Programme\Winamp Toolbar\winamptb.dll moved successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\NeroFilterCheck deleted successfully. C:\WINDOWS\system32\NeroCheck.exe moved successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SerExt deleted successfully. C:\WINDOWS\system32\SerExt.exe moved successfully. Registry value HKEY_USERS\S-1-5-21-1292428093-1592454029-839522115-500\Software\Microsoft\Windows\CurrentVersion\Run\\brcwgnbqfifrknh deleted successfully. C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\brcwgnbq.exe moved successfully. Registry value HKEY_USERS\S-1-5-21-1292428093-1592454029-839522115-500\Software\Microsoft\Windows\CurrentVersion\Run\\H/PC Connection Agent deleted successfully. Registry value HKEY_USERS\S-1-5-21-1292428093-1592454029-839522115-500\Software\Microsoft\Windows\CurrentVersion\Run\\TomTomHOME.exe deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HonorAutoRunSetting deleted successfully. Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully. Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found. Registry value HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully. Registry value HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully. Registry value HKEY_USERS\S-1-5-21-1292428093-1592454029-839522115-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully. Registry value HKEY_USERS\S-1-5-21-1292428093-1592454029-839522115-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoCDBurning deleted successfully. Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Ausgewählte Verknüpfungen in Adobe PDF konvertieren\ deleted successfully. Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren\ deleted successfully. Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Auswahl in Adobe PDF konvertieren\ deleted successfully. Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Auswahl in vorhandene PDF-Datei konvertieren\ deleted successfully. Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\In Adobe PDF konvertieren\ deleted successfully. Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\In vorhandene PDF-Datei konvertieren\ deleted successfully. Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Verknüpfungsziel in Adobe PDF konvertieren\ deleted successfully. Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Verknüpfungsziel in vorhandene PDF-Datei konvertieren\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{E908B145-C847-4e85-B315-07E2E70DECF8}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E908B145-C847-4e85-B315-07E2E70DECF8}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{E908B145-C847-4e85-B315-07E2E70DECF8}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E908B145-C847-4e85-B315-07E2E70DECF8}\ not found. Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found. Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} C:\WINDOWS\Downloaded Program Files\erma.inf moved successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found. Starting removal of ActiveX control {CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}\ not found. Starting removal of ActiveX control {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found. Starting removal of ActiveX control {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\ not found. Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully! C:\AUTOEXEC.BAT moved successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8b8c9429-ca71-11dd-829e-001d609bd7c9}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8b8c9429-ca71-11dd-829e-001d609bd7c9}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8b8c9429-ca71-11dd-829e-001d609bd7c9}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8b8c9429-ca71-11dd-829e-001d609bd7c9}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8b8c9429-ca71-11dd-829e-001d609bd7c9}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8b8c9429-ca71-11dd-829e-001d609bd7c9}\ not found. File F:\LaunchU3.exe -a not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b0ea4530-a646-11df-82c8-001d609bd7c9}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b0ea4530-a646-11df-82c8-001d609bd7c9}\ not found. File F:\InstallTomTomHOME.exe not found. C:\WINDOWS\System32\cnm163.tmp deleted successfully. C:\WINDOWS\System32\cnmDC.tmp deleted successfully. C:\WINDOWS\System32\ConduitEngine.tmp deleted successfully. C:\WINDOWS\System32\CONFIG.TMP deleted successfully. C:\WINDOWS\System32\SET1101.tmp deleted successfully. C:\WINDOWS\System32\SET1107.tmp deleted successfully. C:\WINDOWS\System32\SET110A.tmp deleted successfully. C:\WINDOWS\System32\SET1116.tmp deleted successfully. C:\WINDOWS\System32\SET1118.tmp deleted successfully. C:\WINDOWS\System32\SET1123.tmp deleted successfully. C:\WINDOWS\System32\SET1EF.tmp deleted successfully. C:\WINDOWS\System32\SET1F7.tmp deleted successfully. C:\WINDOWS\System32\SET1FA.tmp deleted successfully. C:\WINDOWS\System32\SET1FF.tmp deleted successfully. C:\WINDOWS\System32\SET206.tmp deleted successfully. C:\WINDOWS\System32\SET207.tmp deleted successfully. C:\WINDOWS\System32\SET20F.tmp deleted successfully. C:\WINDOWS\System32\SET210.tmp deleted successfully. C:\WINDOWS\System32\SET211.tmp deleted successfully. C:\WINDOWS\System32\SET212.tmp deleted successfully. C:\WINDOWS\System32\SET214.tmp deleted successfully. C:\WINDOWS\System32\SET217.tmp deleted successfully. C:\WINDOWS\System32\SET219.tmp deleted successfully. C:\WINDOWS\System32\SET228.tmp deleted successfully. C:\WINDOWS\System32\~GLH0006.TMP deleted successfully. File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\brcwgnbq.exe not found. C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore1cc8bfd939ca96a.job moved successfully. C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA1cc8bfd93d5e1da.job moved successfully. C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\kmgwyixcfvyktfi folder moved successfully. C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\histrbzzbmvrguy moved successfully. ========== FILES ========== < ipconfig /flushdns /c > Windows-IP-Konfiguration Der DNS-Auflösungscache wurde geleert. C:\Dokumente und Einstellungen\All Users\Desktop\cmd.bat deleted successfully. C:\Dokumente und Einstellungen\All Users\Desktop\cmd.txt deleted successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Admin ->Temp folder emptied: 277312 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 44251463 bytes ->Flash cache emptied: 456 bytes User: Administrator ->Temp folder emptied: 370002137 bytes ->Temporary Internet Files folder emptied: 353460871 bytes ->Java cache emptied: 135761530 bytes ->FireFox cache emptied: 60140629 bytes ->Flash cache emptied: 1557126 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Gast ->Temp folder emptied: 265571 bytes ->Temporary Internet Files folder emptied: 279610 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 6154407 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 1265676 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 19569 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 75830089 bytes RecycleBin emptied: 18080 bytes Total Files Cleaned = 1.001,00 mb OTL by OldTimer - Version 3.2.58.1 log created on 08222012_171647 Files\Folders moved on Reboot... PendingFileRenameOperations files... Registry entries deleted on Reboot... Gruß Ramlod |
Sehr gut! :daumenhoc Wie laeuft der Rechner? 1. Schritt Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.danach: 2. Schritt Downloade Dir bitte AdwCleaner auf deinen Desktop.
|
# AdwCleaner v1.801 - Logfile created 08/23/2012 at 23:24:16 # Updated 14/08/2012 by Xplode # Operating system : Microsoft Windows XP Service Pack 3 (32 bits) # User : Administrator - HOME-PC # Boot Mode : Normal # Running from : C:\Dokumente und Einstellungen\Administrator\Desktop\adwcleaner.exe # Option [Search] ***** [Services] ***** ***** [Files / Folders] ***** Folder Found : C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Dealio Folder Found : C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\PriceGong Folder Found : C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Search Settings Folder Found : C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Winamp Toolbar Folder Found : C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Dealio Folder Found : C:\Programme\Babylon Folder Found : C:\Programme\Conduit Folder Found : C:\Programme\ConduitEngine Folder Found : C:\Programme\Dealio Folder Found : C:\Programme\DVDVideoSoftTB Folder Found : C:\Programme\myBabylon_English Folder Found : C:\Programme\Search Settings Folder Found : C:\Programme\softonic-de3 Folder Found : C:\Programme\Winamp Toolbar File Found : C:\Programme\Mozilla Firefox\searchplugins\babylon.xml ***** [Registry] ***** [*] Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT1460988[*] Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2269050[*] Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2431245 Key Found : HKCU\Software\Conduit Key Found : HKCU\Software\conduitEngine Key Found : HKCU\Software\conduitEngine Key Found : HKCU\Software\DVDVideoSoftTB Key Found : HKCU\Software\Microsoft\Internet Explorer\MenuExt\compare prices with &dealio Key Found : HKCU\Software\myBabylon_English Key Found : HKCU\Software\PriceGong Key Found : HKCU\Software\Search Settings Key Found : HKCU\Software\Softonic Key Found : HKCU\Software\softonic-de3 Key Found : HKCU\Software\Winamp Toolbar Key Found : HKCU\Toolbar Key Found : HKLM\SOFTWARE\Classes\Conduit.Engine Key Found : HKLM\SOFTWARE\Classes\Dealio.DealioToolbar Key Found : HKLM\SOFTWARE\Classes\Dealio.DealioToolbar.1 Key Found : HKLM\SOFTWARE\Classes\Dealio.DealioToolbarHelper Key Found : HKLM\SOFTWARE\Classes\Dealio.DealioToolbarHelper.1 Key Found : HKLM\SOFTWARE\Classes\Installer\Features\81337C0DA4B761D40A4CB3380F57AE88 Key Found : HKLM\SOFTWARE\Classes\Installer\Features\C8465016C3C0D184C811F194256DBF35 Key Found : HKLM\SOFTWARE\Classes\Installer\Products\81337C0DA4B761D40A4CB3380F57AE88 Key Found : HKLM\SOFTWARE\Classes\Installer\Products\C8465016C3C0D184C811F194256DBF35 Key Found : HKLM\SOFTWARE\Classes\SearchSettings.BHO Key Found : HKLM\SOFTWARE\Classes\SearchSettings.BHO.1 Key Found : HKLM\SOFTWARE\Classes\toolband.eb_explorerbar Key Found : HKLM\SOFTWARE\Classes\toolband.eb_explorerbar.1 Key Found : HKLM\SOFTWARE\Classes\toolband.ipm_printlistitem Key Found : HKLM\SOFTWARE\Classes\toolband.ipm_printlistitem.1 Key Found : HKLM\SOFTWARE\Classes\toolband.pm_launcher Key Found : HKLM\SOFTWARE\Classes\toolband.pm_launcher.1 Key Found : HKLM\SOFTWARE\Classes\toolband.pm_printmanager Key Found : HKLM\SOFTWARE\Classes\toolband.pm_printmanager.1 Key Found : HKLM\SOFTWARE\Classes\toolband.pr_bindstatuscallback Key Found : HKLM\SOFTWARE\Classes\toolband.pr_bindstatuscallback.1 Key Found : HKLM\SOFTWARE\Classes\toolband.pr_cancelbuttoneventhandler Key Found : HKLM\SOFTWARE\Classes\toolband.pr_cancelbuttoneventhandler.1 Key Found : HKLM\SOFTWARE\Classes\toolband.tbtoolband Key Found : HKLM\SOFTWARE\Classes\toolband.tbtoolband.1 Key Found : HKLM\SOFTWARE\Classes\toolband.useroptions Key Found : HKLM\SOFTWARE\Classes\toolband.useroptions.1 Key Found : HKLM\SOFTWARE\Classes\WinampTb.AOLTBSearch Key Found : HKLM\SOFTWARE\Classes\WinampTb.AOLTBSearch.1 Key Found : HKLM\SOFTWARE\Classes\WinampTb.AOLToolBand Key Found : HKLM\SOFTWARE\Classes\WinampTb.AOLToolBand.1 Key Found : HKLM\SOFTWARE\Classes\WinampTb.Downloader Key Found : HKLM\SOFTWARE\Classes\WinampTb.Downloader.1 Key Found : HKLM\SOFTWARE\Classes\WinampTb.ToolbarParams Key Found : HKLM\SOFTWARE\Classes\WinampTb.ToolbarParams.1 Key Found : HKLM\SOFTWARE\Classes\WinampTbServer.AolToolbarHelper Key Found : HKLM\SOFTWARE\Classes\WinampTbServer.AolToolbarHelper.1 Key Found : HKLM\SOFTWARE\Conduit Key Found : HKLM\SOFTWARE\conduitEngine Key Found : HKLM\SOFTWARE\conduitEngine Key Found : HKLM\SOFTWARE\Dealio Key Found : HKLM\SOFTWARE\DVDVideoSoftTB Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\81337C0DA4B761D40A4CB3380F57AE88 Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\C8465016C3C0D184C811F194256DBF35 Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6105648C-0C3C-481D-8C11-1F4952D6FB53} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D0C73318-7B4A-4D16-A0C4-3B83F075EA88} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Conduit Engine Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DVDVideoSoftTB Toolbar Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\myBabylon_English Toolbar Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\softonic-de3 Toolbar Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Winamp Toolbar Key Found : HKLM\SOFTWARE\myBabylon_English Key Found : HKLM\SOFTWARE\Search Settings Key Found : HKLM\SOFTWARE\softonic-de3 Key Found : HKLM\SOFTWARE\Winamp Toolbar Value Found : HKCU\Software\Microsoft\Internet Explorer\Extensions\CmdMapping [{F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478}] Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [SearchSettings] ***** [Registre - GUID] ***** Key Found : HKLM\SOFTWARE\Classes\CLSID\{25CEE8EC-5730-41BC-8B58-22DDC8AB8C20} Key Found : HKLM\SOFTWARE\Classes\CLSID\{57BCA5FA-5DBB-45A2-B558-1755C3F6253B} Key Found : HKLM\SOFTWARE\Classes\CLSID\{841FD004-57A2-4B49-BBDB-5897394619DB} Key Found : HKLM\SOFTWARE\Classes\CLSID\{9F038672-0425-4792-BC9C-36DE3308E8AA} Key Found : HKLM\SOFTWARE\Classes\CLSID\{B38D6EDE-390B-4620-8365-29E16459EBDA} Key Found : HKLM\SOFTWARE\Classes\CLSID\{E1164984-B567-47BD-A7FF-240C2594404A} Key Found : HKLM\SOFTWARE\Classes\CLSID\{F20F11FD-203E-45A9-B7BB-AFC1B4FEA7A6} Key Found : HKLM\SOFTWARE\Classes\CLSID\{FE178B09-C8AA-4734-804D-1849BCCA0C29} Key Found : HKLM\SOFTWARE\Classes\CLSID\{8BDF49FE-4CC2-4195-8CEF-E6637E0AB198} Key Found : HKLM\SOFTWARE\Classes\CLSID\{9ECE9E27-3728-4963-96D0-9041583426ED} Key Found : HKLM\SOFTWARE\Classes\CLSID\{E3AA9FCE-CAA1-45BF-8212-C28F59908E2C} Key Found : HKLM\SOFTWARE\Classes\CLSID\{862B4D11-7CCB-4922-B515-F9EEA513CA6F} Key Found : HKLM\SOFTWARE\Classes\CLSID\{9F84D2B8-78EF-4148-8738-9517E5C4B849} Key Found : HKLM\SOFTWARE\Classes\CLSID\{560FD48E-F369-4F71-90B2-9E6827A62A2B} Key Found : HKLM\SOFTWARE\Classes\CLSID\{88EFD5F4-3EF1-48DE-995E-D0DCF4134B79} Key Found : HKLM\SOFTWARE\Classes\Interface\{2C4470A2-E099-4B9E-ABFE-BBA56D046AFD} Key Found : HKLM\SOFTWARE\Classes\Interface\{391769AE-D8EC-45EC-967D-F5120456E514} Key Found : HKLM\SOFTWARE\Classes\Interface\{39AEF150-C270-4690-AE7D-955E51BC8960} Key Found : HKLM\SOFTWARE\Classes\Interface\{3EDDA953-1C3B-4823-8F25-D075FBB2D2B5} Key Found : HKLM\SOFTWARE\Classes\Interface\{51A971CA-D36E-4D13-A799-2CF0A491D04D} Key Found : HKLM\SOFTWARE\Classes\Interface\{56FBEA9F-EF93-4318-B75F-A96FC7C7BD7B} Key Found : HKLM\SOFTWARE\Classes\Interface\{78B3C85E-44FF-4DC8-B3AD-156F39DC75E5} Key Found : HKLM\SOFTWARE\Classes\Interface\{7C7B253C-967B-4385-901B-06873371B3CF} Key Found : HKLM\SOFTWARE\Classes\Interface\{841FD004-57A2-4B49-BBDB-5897394619DB} Key Found : HKLM\SOFTWARE\Classes\Interface\{9F598C4D-E2FB-455C-9486-6AD3405620F2} Key Found : HKLM\SOFTWARE\Classes\Interface\{B67A4CBA-520A-43DB-B03F-414E539F90EC} Key Found : HKLM\SOFTWARE\Classes\Interface\{CD73B1AB-3403-4E47-B196-517C57BE76A2} Key Found : HKLM\SOFTWARE\Classes\Interface\{D5A1EF9A-7948-435D-8B87-D6A598317288} Key Found : HKLM\SOFTWARE\Classes\Interface\{E1164984-B567-47BD-A7FF-240C2594404A} Key Found : HKLM\SOFTWARE\Classes\Interface\{E19FDA06-5BDF-43C2-B794-BCD8A4C2051F} Key Found : HKLM\SOFTWARE\Classes\Interface\{F9C4F914-CB58-4272-8A3F-F732A1D1E91D} Key Found : HKLM\SOFTWARE\Classes\Interface\{FAB076F5-E4DD-4EA4-AFEE-F18BF972B057} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{538CD77C-BFDD-49B0-9562-77419CAB89D1} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{CD082CCA-086F-4FD8-8FD7-247A0DBBD1CC} Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDA15AF5-786C-4C8A-A6E4-736CFC900145} Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C377E708-2C37-4780-A25E-FC9E1502DC94} Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5A5CFE32-EED8-4CF3-B598-A38EE07ED2E0} Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{05DB6F1A-97AA-4527-8FB0-7E18D02600B0} Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{12B851E9-2069-45D2-95BF-37298D2C287A} Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{899D5489-42E4-4926-BD8D-E3C37D5970DE} Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DA8A20BD-A18D-4EC9-BDA8-444512BD5FB1} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{25CEE8EC-5730-41BC-8B58-22DDC8AB8C20} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{E3AA9FCE-CAA1-45BF-8212-C28F59908E2C} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9F84D2B8-78EF-4148-8738-9517E5C4B849} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{88EFD5F4-3EF1-48DE-995E-D0DCF4134B79} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25CEE8EC-5730-41BC-8B58-22DDC8AB8C20} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E908B145-C847-4E85-B315-07E2E70DECF8} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{872B5B88-9DB5-4310-BDD0-AC189557E5F5} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B2E293EE-FD7E-4C71-A714-5F4750D8D7B7} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}] Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{E312764E-7706-43F1-8DAB-FCDD2B1E416D}] ***** [Internet Browsers] ***** -\\ Internet Explorer v6.0.2900.5512 [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.conduit.com?SearchSource=10&ctid=CT2431245 ************************* AdwCleaner[R1].txt - [11522 octets] - [23/08/2012 23:24:16] ########## EOF - C:\AdwCleaner[R1].txt - [11651 octets] ########## Hi t'john, ganz bin ich die Plagegeister wohl noch nicht los, aber sie verhalten sich momentan ruhig. Mein AntiVir ärgert sich über Malwarebytes und bezeichnet es als Schädling, aber sonst herrscht Friede. Vielen Dank schon mal dafür. Freu mich schon auf deine Antwort Ramlod |
Avira abschalten. Mit MBAM scannen! |
Hi t´john, bin Trojaner-frei. Danke nochmal für deine Hilfe Gruß Ramlod |
Hast du formatiert? |
Fehlende Rückmeldung Gibt es Probleme beim Abarbeiten obiger Anleitung? Um Kapazitäten für andere Hilfesuchende freizumachen, lösche ich dieses Thema aus meinen Benachrichtigungen. Solltest Du weitermachen wollen, schreibe mir eine PN oder eröffne ein neues Thema. http://www.trojaner-board.de/69886-a...-beachten.html Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner sauber ist. |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 15:18 Uhr. |
Copyright ©2000-2025, Trojaner-Board