Hallo an alle,
habe mir den GVU Trojaner eingefangen und mich schon ein wenig hier durchs Forum gelesen.

Habe bereits mit OTL die Logs erstellt und werde sie jetzt mal hier posten, in der Hoffnung jemand kann mir weiterhelfen.

Gruß ALson

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

• Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
• Starte die OTL.exe.
  Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
• Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:

:OTL

MOD - C:\Dokumente und Einstellungen\Andreas Lambl\Lokale Einstellungen\Temp\fe0_zip.exe () 
SRV - (HidServ) -- %SystemRoot%\System32\hidserv.dll File not found 
SRV - (DCService.exe) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DatacardService\DCService.exe File not found 
SRV - (AppMgmt) -- %SystemRoot%\System32\appmgmts.dll File not found 
DRV - (WDICA) -- File not found 
DRV - (tcpipBM) -- C:\WINDOWS\system32\drivers\tcpipBM.sys File not found 
DRV - (RT73) -- system32\DRIVERS\rt73.sys File not found 
DRV - (PDRFRAME) -- File not found 
DRV - (PDRELI) -- File not found 
DRV - (PDFRAME) -- File not found 
DRV - (PDCOMP) -- File not found 
DRV - (PCIDump) -- File not found 
DRV - (lbrtfdc) -- File not found 
DRV - (i2omgmt) -- File not found 
DRV - (hwusbdev) -- system32\DRIVERS\ewusbdev.sys File not found 
DRV - (hwdatacard) -- system32\DRIVERS\ewusbmdm.sys File not found 
DRV - (gdrv) -- C:\WINDOWS\gdrv.sys File not found 
DRV - (filtertdidriver) -- system32\drivers\ewfiltertdidriver.sys File not found 
DRV - (EagleXNt) -- C:\WINDOWS\system32\drivers\EagleXNt.sys File not found 
DRV - (Changer) -- File not found 
DRV - (BMLoad) -- system32\drivers\BMLoad.sys File not found 
DRV - (av9mkasx) -- File not found 
DRV - (AFGMp50) -- System32\Drivers\AFGMp50.sys File not found 
DRV - (ac10sa0t) -- File not found 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} 
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
FF - prefs.js..browser.search.useDBForOrder: true 
FF - prefs.js..browser.startup.homepage: "www.google.de" 
FF - prefs.js..extensions.enabledItems: 2020Player@2020Technologies.com:4.5.2.0 
O4 - HKLM..\Run: [] File not found 
O4 - HKLM..\Run: [DataCardMonitor] C:\Programme\Telekom\InternetManager_H\DataCardMonitor.exe File not found 
O4 - HKCU..\Run: [HW_OPENEYE_OUC_Telekom Internet Manager] "C:\Programme\Telekom\InternetManager_H\UpdateDog\ouc.exe" File not found 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00 [binary data] 
O32 - HKLM CDRom: AutoRun - 1 
O32 - AutoRun File - [2009.11.30 20:15:40 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] 
O32 - AutoRun File - [2005.11.24 10:34:41 | 000,000,033 | R--- | M] () - F:\AUTORUN.INF -- [ CDFS ] 
O33 - MountPoints2\{0b80e79f-63ea-11e0-acbb-001c4af88fbd}\Shell - "" = AutoRun 
O33 - MountPoints2\{0b80e79f-63ea-11e0-acbb-001c4af88fbd}\Shell\AutoRun - "" = Auto&Play 
O33 - MountPoints2\{0b80e79f-63ea-11e0-acbb-001c4af88fbd}\Shell\AutoRun\command - "" = H:\AutoRun.exe 
O33 - MountPoints2\{27c90212-63ec-11e0-acbc-001c4af88fbd}\Shell - "" = AutoRun 
O33 - MountPoints2\{27c90212-63ec-11e0-acbc-001c4af88fbd}\Shell\AutoRun - "" = Auto&Play 
O33 - MountPoints2\{27c90212-63ec-11e0-acbc-001c4af88fbd}\Shell\AutoRun\command - "" = H:\AutoRun.exe 
O33 - MountPoints2\{27c90215-63ec-11e0-acbc-001c4af88fbd}\Shell - "" = AutoRun 
O33 - MountPoints2\{27c90215-63ec-11e0-acbc-001c4af88fbd}\Shell\AutoRun - "" = Auto&Play 
O33 - MountPoints2\{27c90215-63ec-11e0-acbc-001c4af88fbd}\Shell\AutoRun\command - "" = H:\AutoRun.exe 
O33 - MountPoints2\{55dde66a-61fb-11e0-acb4-001c4af88fbd}\Shell - "" = AutoRun 
O33 - MountPoints2\{55dde66a-61fb-11e0-acb4-001c4af88fbd}\Shell\AutoRun - "" = Auto&Play 
O33 - MountPoints2\{55dde66a-61fb-11e0-acb4-001c4af88fbd}\Shell\AutoRun\command - "" = H:\AutoRun.exe 
O33 - MountPoints2\{55dde66d-61fb-11e0-acb4-001c4af88fbd}\Shell - "" = AutoRun 
O33 - MountPoints2\{55dde66d-61fb-11e0-acb4-001c4af88fbd}\Shell\AutoRun - "" = Auto&Play 
O33 - MountPoints2\{55dde66d-61fb-11e0-acb4-001c4af88fbd}\Shell\AutoRun\command - "" = H:\AutoRun.exe 
O33 - MountPoints2\{632f49d6-6353-11e0-acb9-001c4af88fbd}\Shell - "" = AutoRun 
O33 - MountPoints2\{632f49d6-6353-11e0-acb9-001c4af88fbd}\Shell\AutoRun - "" = Auto&Play 
O33 - MountPoints2\{632f49d6-6353-11e0-acb9-001c4af88fbd}\Shell\AutoRun\command - "" = H:\AutoRun.exe 
O33 - MountPoints2\{6c72caba-6abf-11e0-accf-8eb4b951078e}\Shell - "" = AutoRun 
O33 - MountPoints2\{6c72caba-6abf-11e0-accf-8eb4b951078e}\Shell\AutoRun - "" = Auto&Play 
O33 - MountPoints2\{6c72caba-6abf-11e0-accf-8eb4b951078e}\Shell\AutoRun\command - "" = H:\AutoRun.exe 
O33 - MountPoints2\{6c72cabd-6abf-11e0-accf-8eb4b951078e}\Shell - "" = AutoRun 
O33 - MountPoints2\{6c72cabd-6abf-11e0-accf-8eb4b951078e}\Shell\AutoRun - "" = Auto&Play 
O33 - MountPoints2\{6c72cabd-6abf-11e0-accf-8eb4b951078e}\Shell\AutoRun\command - "" = H:\AutoRun.exe 
O33 - MountPoints2\{749575bc-fb0f-11df-aba2-001c4af88fbd}\Shell\AutoRun\command - "" = APPInst.exe 
O33 - MountPoints2\{7da90591-c80b-11e1-aeaa-00016c68b335}\Shell - "" = AutoRun 
O33 - MountPoints2\{7da90591-c80b-11e1-aeaa-00016c68b335}\Shell\AutoRun - "" = Auto&Play 
O33 - MountPoints2\{7da90591-c80b-11e1-aeaa-00016c68b335}\Shell\AutoRun\command - "" = H:\HTC_Sync_Manager_PC.exe 

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] 
[2012.07.31 23:19:44 | 004,503,728 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\piz_0ef.pad 
[2012.07.31 23:13:45 | 000,001,620 | ---- | M] () -- C:\Dokumente und Einstellungen\Andreas Lambl\Startmenü\Programme\Autostart\ctfmon.lnk 
[2012.07.31 22:47:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job 

:Files

ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]
         

• Schließe alle Programme.
• Klicke auf den Fix Button.
• Wenn OTL einen Neustart verlangt, bitte zulassen.
• Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
  Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

Danke für die schnelle Hilfe,

hier das Log:

All processes killed
========== OTL ==========
Service HidServ stopped successfully!
Service HidServ deleted successfully!
File %SystemRoot%\System32\hidserv.dll File not found not found.
Service DCService.exe stopped successfully!
Service DCService.exe deleted successfully!
File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DatacardService\DCService.exe File not found not found.
Service AppMgmt stopped successfully!
Service AppMgmt deleted successfully!
File %SystemRoot%\System32\appmgmts.dll File not found not found.
Service WDICA stopped successfully!
Service WDICA deleted successfully!
File File not found not found.
Service tcpipBM stopped successfully!
Service tcpipBM deleted successfully!
File C:\WINDOWS\system32\drivers\tcpipBM.sys File not found not found.
Service RT73 stopped successfully!
Service RT73 deleted successfully!
File system32\DRIVERS\rt73.sys File not found not found.
Service PDRFRAME stopped successfully!
Service PDRFRAME deleted successfully!
File File not found not found.
Service PDRELI stopped successfully!
Service PDRELI deleted successfully!
File File not found not found.
Service PDFRAME stopped successfully!
Service PDFRAME deleted successfully!
File File not found not found.
Service PDCOMP stopped successfully!
Service PDCOMP deleted successfully!
File File not found not found.
Service PCIDump stopped successfully!
Service PCIDump deleted successfully!
File File not found not found.
Service lbrtfdc stopped successfully!
Service lbrtfdc deleted successfully!
File File not found not found.
Service i2omgmt stopped successfully!
Service i2omgmt deleted successfully!
File File not found not found.
Service hwusbdev stopped successfully!
Service hwusbdev deleted successfully!
File system32\DRIVERS\ewusbdev.sys File not found not found.
Service hwdatacard stopped successfully!
Service hwdatacard deleted successfully!
File system32\DRIVERS\ewusbmdm.sys File not found not found.
Service gdrv stopped successfully!
Service gdrv deleted successfully!
File C:\WINDOWS\gdrv.sys File not found not found.
Service filtertdidriver stopped successfully!
Service filtertdidriver deleted successfully!
File system32\drivers\ewfiltertdidriver.sys File not found not found.
Service EagleXNt stopped successfully!
Service EagleXNt deleted successfully!
File C:\WINDOWS\system32\drivers\EagleXNt.sys File not found not found.
Service Changer stopped successfully!
Service Changer deleted successfully!
File File not found not found.
Service BMLoad stopped successfully!
Service BMLoad deleted successfully!
File system32\drivers\BMLoad.sys File not found not found.
Error: No service named av9mkasx was found to stop!
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\av9mkasx deleted successfully.
File File not found not found.
Service AFGMp50 stopped successfully!
Service AFGMp50 deleted successfully!
File System32\Drivers\AFGMp50.sys File not found not found.
Error: No service named ac10sa0t was found to stop!
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ac10sa0t deleted successfully.
File File not found not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Prefs.js: true removed from browser.search.useDBForOrder
Prefs.js: "www.google.de" removed from browser.startup.homepage
Prefs.js: 2020Player@2020Technologies.com:4.5.2.0 removed from extensions.enabledItems
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\DataCardMonitor deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\HW_OPENEYE_OUC_Telekom Internet Manager deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HonorAutoRunSetting deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\AUTOEXEC.BAT moved successfully.
File move failed. F:\AUTORUN.INF scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0b80e79f-63ea-11e0-acbb-001c4af88fbd}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0b80e79f-63ea-11e0-acbb-001c4af88fbd}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0b80e79f-63ea-11e0-acbb-001c4af88fbd}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0b80e79f-63ea-11e0-acbb-001c4af88fbd}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0b80e79f-63ea-11e0-acbb-001c4af88fbd}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0b80e79f-63ea-11e0-acbb-001c4af88fbd}\ not found.
File H:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{27c90212-63ec-11e0-acbc-001c4af88fbd}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27c90212-63ec-11e0-acbc-001c4af88fbd}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{27c90212-63ec-11e0-acbc-001c4af88fbd}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27c90212-63ec-11e0-acbc-001c4af88fbd}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{27c90212-63ec-11e0-acbc-001c4af88fbd}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27c90212-63ec-11e0-acbc-001c4af88fbd}\ not found.
File H:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{27c90215-63ec-11e0-acbc-001c4af88fbd}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27c90215-63ec-11e0-acbc-001c4af88fbd}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{27c90215-63ec-11e0-acbc-001c4af88fbd}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27c90215-63ec-11e0-acbc-001c4af88fbd}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{27c90215-63ec-11e0-acbc-001c4af88fbd}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27c90215-63ec-11e0-acbc-001c4af88fbd}\ not found.
File H:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{55dde66a-61fb-11e0-acb4-001c4af88fbd}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{55dde66a-61fb-11e0-acb4-001c4af88fbd}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{55dde66a-61fb-11e0-acb4-001c4af88fbd}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{55dde66a-61fb-11e0-acb4-001c4af88fbd}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{55dde66a-61fb-11e0-acb4-001c4af88fbd}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{55dde66a-61fb-11e0-acb4-001c4af88fbd}\ not found.
File H:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{55dde66d-61fb-11e0-acb4-001c4af88fbd}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{55dde66d-61fb-11e0-acb4-001c4af88fbd}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{55dde66d-61fb-11e0-acb4-001c4af88fbd}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{55dde66d-61fb-11e0-acb4-001c4af88fbd}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{55dde66d-61fb-11e0-acb4-001c4af88fbd}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{55dde66d-61fb-11e0-acb4-001c4af88fbd}\ not found.
File H:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{632f49d6-6353-11e0-acb9-001c4af88fbd}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{632f49d6-6353-11e0-acb9-001c4af88fbd}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{632f49d6-6353-11e0-acb9-001c4af88fbd}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{632f49d6-6353-11e0-acb9-001c4af88fbd}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{632f49d6-6353-11e0-acb9-001c4af88fbd}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{632f49d6-6353-11e0-acb9-001c4af88fbd}\ not found.
File H:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6c72caba-6abf-11e0-accf-8eb4b951078e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6c72caba-6abf-11e0-accf-8eb4b951078e}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6c72caba-6abf-11e0-accf-8eb4b951078e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6c72caba-6abf-11e0-accf-8eb4b951078e}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6c72caba-6abf-11e0-accf-8eb4b951078e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6c72caba-6abf-11e0-accf-8eb4b951078e}\ not found.
File H:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6c72cabd-6abf-11e0-accf-8eb4b951078e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6c72cabd-6abf-11e0-accf-8eb4b951078e}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6c72cabd-6abf-11e0-accf-8eb4b951078e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6c72cabd-6abf-11e0-accf-8eb4b951078e}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6c72cabd-6abf-11e0-accf-8eb4b951078e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6c72cabd-6abf-11e0-accf-8eb4b951078e}\ not found.
File H:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{749575bc-fb0f-11df-aba2-001c4af88fbd}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{749575bc-fb0f-11df-aba2-001c4af88fbd}\ not found.
File APPInst.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7da90591-c80b-11e1-aeaa-00016c68b335}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7da90591-c80b-11e1-aeaa-00016c68b335}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7da90591-c80b-11e1-aeaa-00016c68b335}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7da90591-c80b-11e1-aeaa-00016c68b335}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7da90591-c80b-11e1-aeaa-00016c68b335}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7da90591-c80b-11e1-aeaa-00016c68b335}\ not found.
File H:\HTC_Sync_Manager_PC.exe not found.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\piz_0ef.pad moved successfully.
C:\Dokumente und Einstellungen\Andreas Lambl\Startmenü\Programme\Autostart\ctfmon.lnk moved successfully.
C:\WINDOWS\tasks\Adobe Flash Player Updater.job moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Auflösungscache wurde geleert.
C:\Dokumente und Einstellungen\Andreas Lambl\Desktop\cmd.bat deleted successfully.
C:\Dokumente und Einstellungen\Andreas Lambl\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Andreas Lambl
->Temp folder emptied: 3679493200 bytes
->Temporary Internet Files folder emptied: 5150970 bytes
->Java cache emptied: 36201057 bytes
->FireFox cache emptied: 60954095 bytes
->Flash cache emptied: 607 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2445629 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 25407034 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 3.633,00 mb


[EMPTYFLASH]

User: All Users

User: Andreas Lambl
->Flash cache emptied: 0 bytes

User: Default User

User: LocalService



Darf ich bei den weiteren Schritten den "infizierten" Rechner eigentlich wieder mit dem Internet verbinden?
Falls es nötig ist Tools und ähnliches runterzuladen?

Gruß ALson

Sehr gut!

Wie laeuft der Rechner?

Jetzt darfst du verbinden, aber nicht surfen!

1. Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktualisiere die Datenbank!
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

danach:

2. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Starte die adwcleaner.exe mit einem Doppelklick.
• Klicke auf Search.
• Nach Ende des Suchlaufs öffnet sich eine Textdatei.
• Poste mir den Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

Der Rechner läuft soweit normal.

Schritt 1 ist gerade im Gange, denke das dauert ein Weilchen.....
melde mich danach wieder.

Gruß
ALson

hier der Log:

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.01.05

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Andreas Lambl :: ZOCKERHIMMEL [Administrator]

01.08.2012 18:19:34
mbam-log-2012-08-01 (19-30-04).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|K:\|L:\|N:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 326447
Laufzeit: 43 Minute(n), 48 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 5
C:\Programme\Microsoft Games for Windows - LIVE\Client\GFWLive.exe (Spyware.Agent) -> Keine Aktion durchgeführt.
C:\_OTL\MovedFiles\08012012_175025\C_Dokumente und Einstellungen\Andreas Lambl\Lokale Einstellungen\Temp\fe0_zip.exe (Spyware.Zbot.DG) -> Keine Aktion durchgeführt.
D:\System Volume Information\_restore{555EF88E-B9FA-44D2-B574-DD3D126AEEA3}\RP344\A0083593.exe (Malware.Packer.gen) -> Keine Aktion durchgeführt.
E:\Games\two_worlds2\rld-tw2k.exe (RiskWare.Tool.CK) -> Keine Aktion durchgeführt.
C:\Dokumente und Einstellungen\Andreas Lambl\Startmenü\Programme\Autostart\ctfmon.lnk (Trojan.Ransom.Gen) -> Keine Aktion durchgeführt.

(Ende)




und der Log des adwcleaners:


# AdwCleaner v1.703 - Logfile created 08/01/2012 at 19:34:24
# Updated 20/07/2012 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : Andreas Lambl - ZOCKERHIMMEL
# Running from : C:\Dokumente und Einstellungen\Andreas Lambl\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****


***** [Registry] *****

Key Found : HKLM\SOFTWARE\DT Soft
Key Found : HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43

***** [Registre - GUID] *****

Key Found : HKLM\SOFTWARE\Classes\CLSID\{A3F2A195-0D11-463b-96BB-D2FF1B7490A1}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{ECD0ECC6-DCA4-4013-A915-12355AB70999}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

[OK] Registry is clean.

*************************

AdwCleaner[R1].txt - [964 octets] - [01/08/2012 19:34:24]

########## EOF - C:\AdwCleaner[R1].txt - [1091 octets] ##########



Gruß
ALson

Schritte soweit erledigt......

Danke schonmal für alles, wie gehts jetzt weiter?

Gruß
ALson

Warum hast du die Funde nicht geloescht?

Neues MBAM-Log!

Hab sie gelöscht, habe ich wohl das falsche log gepostet.


Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.01.05

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Andreas Lambl :: ZOCKERHIMMEL [Administrator]

01.08.2012 18:19:34
mbam-log-2012-08-01 (18-19-34).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|K:\|L:\|N:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 326447
Laufzeit: 43 Minute(n), 48 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 5
C:\Programme\Microsoft Games for Windows - LIVE\Client\GFWLive.exe (Spyware.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\08012012_175025\C_Dokumente und Einstellungen\Andreas Lambl\Lokale Einstellungen\Temp\fe0_zip.exe (Spyware.Zbot.DG) -> Erfolgreich gelöscht und in Quarantäne gestellt.
D:\System Volume Information\_restore{555EF88E-B9FA-44D2-B574-DD3D126AEEA3}\RP344\A0083593.exe (Malware.Packer.gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
E:\Games\two_worlds2\rld-tw2k.exe (RiskWare.Tool.CK) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Dokumente und Einstellungen\Andreas Lambl\Startmenü\Programme\Autostart\ctfmon.lnk (Trojan.Ransom.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)


Gruß ALson

Sehr gut!



Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Starte die adwcleaner.exe mit einem Doppelklick.
• Klicke auf Search.
• Nach Ende des Suchlaufs öffnet sich eine Textdatei.
• Poste mir den Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

Den adwcleaner habe ich am Mittwoch auch schonmal laufen lassen und dann in meinem Übereifer auch schon deleted, hab jetzt nochmal die Search laufen lassen. Ich poste dir mal alle logs des adwcleaners.

1. Search

# AdwCleaner v1.703 - Logfile created 08/01/2012 at 19:34:24
# Updated 20/07/2012 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : Andreas Lambl - ZOCKERHIMMEL
# Running from : C:\Dokumente und Einstellungen\Andreas Lambl\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****


***** [Registry] *****

Key Found : HKLM\SOFTWARE\DT Soft
Key Found : HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B 24D43

***** [Registre - GUID] *****

Key Found : HKLM\SOFTWARE\Classes\CLSID\{A3F2A195-0D11-463b-96BB-D2FF1B7490A1}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{ECD0ECC6-DCA4-4013-A915-12355AB70999}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

[OK] Registry is clean.

*************************

AdwCleaner[R1].txt - [964 octets] - [01/08/2012 19:34:24]

########## EOF - C:\AdwCleaner[R1].txt - [1091 octets] ##########




2.Delete

# AdwCleaner v1.703 - Logfile created 08/01/2012 at 21:10:20
# Updated 20/07/2012 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : Andreas Lambl - ZOCKERHIMMEL
# Running from : C:\Dokumente und Einstellungen\Andreas Lambl\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****


***** [Registry] *****

Key Deleted : HKLM\SOFTWARE\DT Soft
Key Deleted : HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43

***** [Registre - GUID] *****

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A3F2A195-0D11-463b-96BB-D2FF1B7490A1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{ECD0ECC6-DCA4-4013-A915-12355AB70999}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

[OK] Registry is clean.

*************************

AdwCleaner[R1].txt - [1092 octets] - [01/08/2012 19:34:24]
AdwCleaner[S1].txt - [1034 octets] - [01/08/2012 21:10:20]

########## EOF - C:\AdwCleaner[S1].txt - [1162 octets] ##########



3.Search

# AdwCleaner v1.703 - Logfile created 08/03/2012 at 05:38:36
# Updated 20/07/2012 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : Andreas Lambl - ZOCKERHIMMEL
# Running from : C:\Dokumente und Einstellungen\Andreas Lambl\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****


***** [Registry] *****

Key Found : HKLM\SOFTWARE\DT Soft

***** [Registre - GUID] *****


***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

[OK] Registry is clean.

*************************

AdwCleaner[R1].txt - [1092 octets] - [01/08/2012 19:34:24]
AdwCleaner[S1].txt - [1163 octets] - [01/08/2012 21:10:20]
AdwCleaner[R2].txt - [723 octets] - [03/08/2012 05:38:36]

########## EOF - C:\AdwCleaner[R2].txt - [850 octets] ##########



Gruß ALson

Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html

emsisoft log:

Emsisoft Anti-Malware - Version 6.6
Letztes Update: 03.08.2012 16:09:46

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\, D:\, E:\
Archiv Scan: An
ADS Scan: An

Scan Beginn: 03.08.2012 16:10:11

c:\microgaming\casino gefunden: Trace.File.ruby fortune casino!E1
c:\microgaming gefunden: Trace.File.ruby fortune casino!E1
Key: hkey_current_user\software\mgs\thumper\casino gefunden: Trace.Registry.casinoaction!E1
C:\System Volume Information\_restore{555EF88E-B9FA-44D2-B574-DD3D126AEEA3}\RP375\A0124715.exe gefunden: Riskware.CasinoOnline!E2
E:\System Volume Information\_restore{555EF88E-B9FA-44D2-B574-DD3D126AEEA3}\RP375\A0124716.exe gefunden: Riskware.CasinoOnline!E2

Gescannt 617694
Gefunden 5

Scan Ende: 03.08.2012 17:34:43
Scan Zeit: 1:24:32

C:\System Volume Information\_restore{555EF88E-B9FA-44D2-B574-DD3D126AEEA3}\RP375\A0124715.exe Quarantäne Riskware.CasinoOnline!E2
E:\System Volume Information\_restore{555EF88E-B9FA-44D2-B574-DD3D126AEEA3}\RP375\A0124716.exe Quarantäne Riskware.CasinoOnline!E2
Key: hkey_current_user\software\mgs\thumper\casino Quarantäne Trace.Registry.casinoaction!E1
c:\microgaming\casino Quarantäne Trace.File.ruby fortune casino!E1
c:\microgaming Quarantäne Trace.File.ruby fortune casino!E1

Quarantäne 5



gruß ALson

Sehr gut!


Deinstalliere:
Emsisoft Anti-Malware


ESET Online Scanner

Vorbereitung

• Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
• Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren.
• Vista/Win7-User: Bitte den Browser unbedingt als Administrator starten.

Los geht's

• Lade und starte Eset Smartinstaller
• Haken setzen bei YES, I accept the Terms of Use.
• Klick auf Start.
• Haken setzen bei Remove found threads und Scan archives.
• Klick auf Start.
• Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Finish drücken.
• Browser schließen.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (manchmal auch C:\Programme\Eset\log.txt) suchen und mit Deinem Editor öffnen.
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Fehlende Rückmeldung

Gibt es Probleme beim Abarbeiten obiger Anleitung?

Um Kapazitäten für andere Hilfesuchende freizumachen, lösche ich dieses Thema aus meinen Benachrichtigungen.

Solltest Du weitermachen wollen, schreibe mir eine PN oder eröffne ein neues Thema.
http://www.trojaner-board.de/69886-a...-beachten.html


Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner sauber ist.