SUISA-Virus auf Windows Vista

bluerider · 09.05.2012, 07:48

Liebe Spezialisten
Um es gleich vorne weg zu nehmen: nachdem ich diesen Virus, über den hier schon einiges geschrieben wurde, entdeckt habe, war mein erster Gedanke, mit der Kiste zum Computerladen zu fahren und den Fachleuten das Problem zu überlassen. Doch dann bin ich auf dieses Forum gestossen, und ich komme aus dem Staunen fast gar nicht mehr heraus. So viel Wissen! Davon kann ich nur träumen... Vielleicht könnt Ihr ja auch einer Banause wie mir helfen? Wenn jemand die Nerven aufbringt um mir zu helfen würde mich das riesig freuen!

Also: Der Virus scheint ja wirklich gut bekannt zu sein. Ich habe aber keinen Beitrag gefunden, wo Vista betroffen ist. Ich habe aber gelesen, dass jedes Problem wieder anders ist und man nicht einfach "abschauen" soll. Was ich jedoch bereits probiert habe:
- Computer "abwürgen": geht nicht, startet automatisch wieder
- irgendwelche F-Tasten dücken: passiert nichts,
- was ich auch drücke: Die Meldung füllt den ganzen Bildschirm aus und ist nicht weg zu bekommen

Meine Ressourcen: ein unabhängigen Laptop mit CD-Brenner, CD's und USB-Stick. Keine Spezialkenntnisse, bin aber sonst grundsätzlich lernfähig.

Möchte mir jemand helfen?
Vielen Dank!
Simone

cosinus · 11.05.2012, 11:19

Funktioniert noch der abgesicherte Modus mit Netzwerktreibern? Mit Internetverbindung?

Abgesicherter Modus zur Bereinigung

Windows mit F8-Taste beim Start in den abgesicherten Modus bringen.
Starte den Rechner in den abgesicherten Modus mit Netzwerktreibern:

bluerider · 11.05.2012, 13:11

Danke erst mal.
Habe wie beschrieben gestartet, PC häng nun mit der Meldung "Bitte warten bis Verbindung hergestellt ist"

cosinus · 11.05.2012, 13:14

Mit einem sauberen 2. Rechner eine OTLPE-CD erstellen und den infizierten Rechner dann von dieser CD booten:

Falls Du kein Brennprogramm installiert hast, lade dir bitte ISOBurner herunter. Das Programm wird Dir erlauben, OTLPE auf eine CD zu brennen und sie bootfähig zu machen. Du brauchst das Tool nur zu installieren, der Rest läuft automatisch => Wie brenne ich eine ISO Datei auf CD/DVD.

Lade OTLPENet.exe von OldTimer herunter und speichere sie auf Deinem Desktop. Anmerkung: Die Datei ist ca. 120 MB groß und es wird bei langsamer Internet-Verbindung ein wenig dauern, bis Du sie runtergeladen hast.
Wenn der Download fertig ist, mache einen Doppelklick auf die Datei und beantworte die Frage "Do you want to burn the CD?" mit Yes.
Lege eine leere CD in Deinen Brenner.
ImgBurn (oder Dein Brennprogramm) wird das Archiv extrahieren und OTLPE Network auf die CD brennen.
Wenn der Brenn-Vorgang abgeschlossen ist, wirst Du eine Dialogbox sehen => "Operation successfully completed".
Du kannst nun die Fenster des Brennprogramms schließen.

Nun boote von der OTLPE CD. Hinweis: Wie boote ich von CD

Dein System sollte nach einigen Minuten den REATOGO-X-PE Desktop anzeigen.
Mache einen Doppelklick auf das OTLPE Icon.
Hinweis: Damit OTLPE auch das richtige installierte Windows scant, musst du den Windows-Ordner des auf der Platte installierten Windows auswählen, einfach nur C: auswählen gibt einen Fehler!
Wenn Du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
Wenn Du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
Vergewissere Dich, dass die Box "Automatically Load All Remaining Users" gewählt ist und drücke OK.
OTLpe sollte nun starten.
Drücke Run Scan, um den Scan zu starten.
Wenn der Scan fertig ist, werden die Dateien C:\OTL.Txt und C:\Extras.Txt erstellt
Kopiere diese Datei auf Deinen USB-Stick, wenn Du keine Internetverbindung auf diesem System hast.
Bitte poste den Inhalt von C:\OTL.Txt und Extras.Txt.

bluerider · 11.05.2012, 18:38

Hallo Arno

Also ich bin bis zu dem Punkt gekommen, wo ich das OTLPE doppelklicken muss und ich deb Windwos Order auswählen muss. Ich habe Vista (C

ausgewählt (weil ja Vista darauf installiert war/ist?), aber dann kommt die Meldung "Target ist not windows 2000 or later" und nichts geht mehr. Wie weiter?

Tschuldigung: Arne!

cosinus · 11.05.2012, 21:36

Ja du musst auch den Windows-Ordner auswählen
Steht auch so in der Anleitung

bluerider · 12.05.2012, 07:32

O.k. habs auch noch kapiert. Der Scan ist gelaufen, und ich habe dien OLT.Txt gefunden. Aber keine Datei Extras.Txt / aber ich suche noch weiter. Hier mal der Inhalt von OLT.Txt>OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 5/12/2012 9:25:57 AM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Windows Vista (TM) Home Premium Service Pack 2 (Version = 6.0.6002) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000807 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 90.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 97.66 Gb Total Space | 0.17 Gb Free Space | 0.17% Space Free | Partition Type: NTFS
Drive I: | 498.51 Gb Total Space | 467.95 Gb Free Space | 93.87% Space Free | Partition Type: NTFS
Drive J: | 1.88 Gb Total Space | 1.88 Gb Free Space | 99.95% Space Free | Partition Type: FAT
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012/01/03 09:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011/11/04 02:51:30 | 000,487,312 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Windows\Downloaded Program Files\DMService.exe -- (DMService)
SRV - [2011/08/04 00:18:43 | 000,126,400 | R--- | M] (Symantec Corporation) [Auto] -- C:\Program Files\Norton 360\Engine\4.4.0.12\ccSvcHst.exe -- (N360)
SRV - [2010/11/25 07:05:00 | 000,150,928 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Microsoft Forefront UAG\Endpoint Components\3.1.0\uagqecsvc.exe -- (uagqecsvc)
SRV - [2010/01/15 08:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2008/01/20 22:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/06/15 07:57:42 | 000,145,504 | ---- | M] (B.H.A Corporation) [Auto] -- C:\Windows\System32\bgsvcgen.exe -- (bgsvcgen)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand] --  -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand] --  -- (IpInIp)
DRV - [2011/11/14 15:28:02 | 000,819,320 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20111114.002\BHDrvx86.sys -- (BHDrvx86)
DRV - [2011/11/09 08:18:03 | 001,576,312 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20111119.016\NAVEX15.SYS -- (NAVEX15)
DRV - [2011/11/09 08:18:03 | 000,086,136 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20111119.016\NAVENG.SYS -- (NAVENG)
DRV - [2011/11/09 03:55:51 | 000,374,392 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2011/08/22 18:17:32 | 000,368,248 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20111118.030\IDSvix86.sys -- (IDSVix86)
DRV - [2011/08/21 22:53:36 | 000,340,088 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Windows\System32\Drivers\N360\0404000.00C\SYMTDIV.SYS -- (SYMTDIv)
DRV - [2011/08/21 22:53:35 | 000,173,176 | ---- | M] (Symantec Corporation) [File_System | Boot] -- C:\Windows\System32\drivers\N360\0404000.00C\symefa.sys -- (SymEFA)
DRV - [2011/08/04 00:19:30 | 000,485,512 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Windows\system32\drivers\N360\0404000.00C\ccHPx86.sys -- (ccHP)
DRV - [2011/04/03 02:15:58 | 000,097,792 | ---- | M] (Protect Software GmbH) [Kernel | Auto] -- C:\Windows\System32\drivers\ACEDRV05.sys -- (ACEDRV05)
DRV - [2010/11/20 03:12:34 | 000,124,976 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2010/07/10 00:37:00 | 011,008,040 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2010/04/29 01:03:51 | 000,116,784 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Windows\system32\drivers\N360\0404000.00C\Ironx86.SYS -- (SymIRON)
DRV - [2010/04/21 22:29:50 | 000,325,680 | ---- | M] (Symantec Corporation) [File_System | On_Demand] -- C:\Windows\System32\Drivers\N360\0404000.00C\SRTSP.SYS -- (SRTSP)
DRV - [2010/04/21 22:29:50 | 000,043,696 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Windows\system32\drivers\N360\0404000.00C\SRTSPX.SYS -- (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV - [2009/10/14 23:50:05 | 000,328,752 | R--- | M] (Symantec Corporation) [Kernel | Boot] -- C:\Windows\System32\drivers\N360\0404000.00C\symds.sys -- (SymDS)
DRV - [2008/07/03 04:55:36 | 000,224,384 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\e1y6032.sys -- (e1yexpress) Intel(R)
DRV - [2008/07/03 04:53:44 | 000,040,832 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\HECI.sys -- (HECI) Intel(R)
DRV - [2008/02/20 16:19:56 | 000,030,816 | ---- | M] (Intel Corporation ) [Kernel | On_Demand] -- C:\Windows\System32\drivers\iqvw32.sys -- (NAL)
DRV - [2008/01/20 22:23:25 | 000,220,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.stegcomputer.ch
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
IE - HKU\Marco_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.stegcomputer.ch
IE - HKU\Marco_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Upgrade to Google Chrome
IE - HKU\Marco_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = Google
IE - HKU\Marco_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = Babylon Search
IE - HKU\Marco_ON_C\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = Upgrade to Google Chrome
IE - HKU\Marco_ON_C\Software\Microsoft\Internet Explorer\Search,SearchAssistant = Upgrade to Google Chrome
IE - HKU\Marco_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Marco_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\IPSFFPlgn\ [2011/07/21 08:06:09 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\coFFPlgn_2010_9_0_6 [2012/05/09 21:33:43 | 000,000,000 | ---D | M]
 
 
O1 HOSTS File: ([2006/09/18 17:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (I Want This) - {11111111-1111-1111-1111-110011221158} - C:\Program Files\I Want This\I Want This.dll (215 Apps)
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\4.4.0.12\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\4.4.0.12\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
O2 - BHO: (DataMngr) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\Program Files\Windows iLivid Toolbar\Datamngr\BrowserConnection.dll (Bandoo Media, inc)
O2 - BHO: (DealPly) - {A6174F27-1FFF-E1D6-A93F-BA48AD5DD448} - C:\Program Files\DealPly\DealPlyIE.dll (DealPly Technologies Ltd)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\4.4.0.12\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKU\Marco_ON_C\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\4.4.0.12\coieplg.dll (Symantec Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [c9798u3A8Yxm3bS] C:\Users\Marco\AppData\Roaming\DNS_Servicex86.exe ()
O4 - HKLM..\Run: [DATAMNGR] C:\Program Files\Windows iLivid Toolbar\Datamngr\datamngrUI.exe (Bandoo Media, inc)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\Marco_ON_C..\Run: [c9798u3A8Yxm3bS] C:\Users\Marco\AppData\Roaming\DNS_Servicex86.exe ()
O4 - HKU\Marco_ON_C..\Run: [RegistryBooster] C:\Program Files\Uniblue\RegistryBooster\launcher.exe (Uniblue Systems Limited)
O4 - HKU\NetworkService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\Marco_ON_C..\RunOnce: [Application Restart #0] C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
O4 - HKU\Marco_ON_C..\RunOnce: [FlashPlayerUpdate] C:\Windows\System32\Macromed\Flash\FlashUtil10v_ActiveX.exe (Adobe Systems, Inc.)
O4 - Startup: Error locating startup folders.
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKU\Marco_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKU\Marco_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\Marco_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\Marco_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {48580E34-E37A-454A-8EC4-FC7598B01D77} hxxp://chkr-web.ifolor.net/app_support/1/ActiveX/IfolorUploader_chkr.cab (IfolorUploader Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {8D9563A9-8D5F-459B-87F2-BA842255CB9A} https://www.kssgnet.ch/InternalSite/WhlCompMgr.cab (Forefront UAG client components)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O20 - AppInit_DLLs: (C:\PROGRA~1\WI371A~1\Datamngr\datamngr.dll) - C:\Program Files\Windows iLivid Toolbar\Datamngr\datamngr.dll (Bandoo Media, inc)
O20 - AppInit_DLLs: (C:\PROGRA~1\WI371A~1\Datamngr\IEBHO.dll) - C:\Program Files\Windows iLivid Toolbar\Datamngr\IEBHO.dll (Bandoo Media, inc)
O20 - HKLM Winlogon: Shell - (C:\Users\Marco\AppData\Roaming\DNS_Servicex86.exe) - C:\Users\Marco\AppData\Roaming\DNS_Servicex86.exe ()
O20 - HKLM Winlogon: UserInit - (C:\Users\Marco\AppData\Roaming\DNS_Servicex86.exe) - C:\Users\Marco\AppData\Roaming\DNS_Servicex86.exe ()
O20 - HKU\Marco_ON_C Winlogon: Shell - (C:\Users\Marco\AppData\Roaming\DNS_Servicex86.exe) - C:\Users\Marco\AppData\Roaming\DNS_Servicex86.exe ()
O20 - HKU\Marco_ON_C Winlogon: UserInit - (C:\Users\Marco\AppData\Roaming\DNS_Servicex86.exe) - C:\Users\Marco\AppData\Roaming\DNS_Servicex86.exe ()
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/05/09 21:05:21 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012/05/09 17:08:38 | 001,069,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll
[2012/05/09 17:08:38 | 000,219,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll
[2012/05/09 17:08:37 | 001,172,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll
[2012/05/09 17:08:36 | 000,683,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll
[2012/05/09 17:08:36 | 000,160,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll
[2012/05/09 17:08:33 | 003,602,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2012/05/09 17:08:33 | 003,550,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2012/05/09 17:08:33 | 002,044,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012/04/22 09:30:12 | 000,000,000 | ---D | C] -- C:\Users\Marco\AppData\Roaming\.minecraft
[2012/04/16 14:09:14 | 000,000,000 | ---D | C] -- C:\Users\Marco\AppData\Roaming\.Nitrous
[2012/04/13 14:57:06 | 000,000,000 | ---D | C] -- C:\Users\Marco\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Uncompressor
[2012/04/13 14:57:05 | 000,000,000 | ---D | C] -- C:\Program Files\Uncompressor
[2012/04/13 14:55:12 | 000,000,000 | ---D | C] -- C:\Users\Marco\AppData\Local\I Want This
[2012/04/13 14:55:10 | 000,000,000 | ---D | C] -- C:\Program Files\I Want This
[2012/04/13 14:55:01 | 000,000,000 | ---D | C] -- C:\Program Files\DealPly
[2012/04/13 14:54:28 | 000,000,000 | ---D | C] -- C:\Program Files\FoxTabPDFReader
 
========== Files - Modified Within 30 Days ==========
 
[2012/05/11 07:17:14 | 000,631,266 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012/05/11 07:17:14 | 000,598,290 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/05/11 07:17:14 | 000,126,880 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012/05/11 07:17:14 | 000,104,304 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/05/11 07:12:52 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/05/11 06:37:00 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/05/11 05:37:00 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/05/11 05:32:49 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/05/11 05:32:49 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/05/10 09:02:16 | 000,000,264 | ---- | M] () -- C:\Windows\tasks\RegClean Pro_DEFAULT.job
[2012/05/09 21:34:40 | 000,001,374 | ---- | M] () -- C:\Users\Marco\Pictures\Desktop\Registry kostenlos entrümpeln!.lnk
[2012/05/09 21:33:11 | 000,000,332 | ---- | M] () -- C:\Windows\tasks\RegistryBooster.job
[2012/05/09 21:32:51 | 000,093,509 | ---- | M] () -- C:\ProgramData\nvModes.001
[2012/05/09 21:32:48 | 000,389,696 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/05/09 21:01:50 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2012/05/09 11:58:06 | 000,000,272 | ---- | M] () -- C:\Windows\tasks\RegClean Pro_UPDATES.job
[2012/05/06 08:12:21 | 000,271,360 | ---- | M] () -- C:\Users\Marco\AppData\Roaming\DNS_Servicex86.exe
[2012/05/03 14:39:50 | 000,093,509 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2012/05/01 05:43:01 | 000,001,976 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2012/04/22 09:55:50 | 039,225,864 | ---- | M] () -- C:\Users\Marco\Pictures\Desktop\Misa412.zip
[2012/04/22 07:15:29 | 000,053,318 | ---- | M] () -- C:\Users\Marco\Pictures\Desktop\TooManyItems2012_04_07_1.2.5.zip
[2012/04/16 14:00:35 | 000,233,234 | ---- | M] () -- C:\Users\Marco\Pictures\Desktop\OptiFine_1.2.5_HD_A2.zip
[2012/04/15 12:48:52 | 000,002,451 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2012/04/14 09:06:50 | 001,488,305 | ---- | M] () -- C:\Users\Marco\Pictures\Desktop\mcpatcher-2.3.5_01.exe
[2012/04/14 08:50:15 | 000,000,865 | ---- | M] () -- C:\Users\Marco\Pictures\Desktop\Uncompressor.lnk
[2012/04/13 14:54:40 | 000,010,479 | ---- | M] () -- C:\user.js
[2012/04/13 14:54:28 | 000,000,876 | ---- | M] () -- C:\Users\Marco\Pictures\Desktop\FoxTab PDF Reader.lnk
[2012/04/13 04:53:17 | 000,000,881 | ---- | M] () -- C:\Users\Marco\Pictures\Desktop\certificate.cer
 
========== Files Created - No Company Name ==========
 
[2012/05/06 08:12:22 | 000,271,360 | ---- | C] () -- C:\Users\Marco\AppData\Roaming\DNS_Servicex86.exe
[2012/04/22 09:54:32 | 039,225,864 | ---- | C] () -- C:\Users\Marco\Pictures\Desktop\Misa412.zip
[2012/04/16 14:00:34 | 000,233,234 | ---- | C] () -- C:\Users\Marco\Pictures\Desktop\OptiFine_1.2.5_HD_A2.zip
[2012/04/14 09:06:50 | 001,488,305 | ---- | C] () -- C:\Users\Marco\Pictures\Desktop\mcpatcher-2.3.5_01.exe
[2012/04/13 14:57:05 | 000,000,865 | ---- | C] () -- C:\Users\Marco\Pictures\Desktop\Uncompressor.lnk
[2012/04/13 14:54:28 | 000,000,876 | ---- | C] () -- C:\Users\Marco\Pictures\Desktop\FoxTab PDF Reader.lnk
[2012/04/13 04:53:17 | 000,000,881 | ---- | C] () -- C:\Users\Marco\Pictures\Desktop\certificate.cer
[2011/12/10 12:55:56 | 000,098,304 | ---- | C] () -- C:\Windows\System32\redmonnt.dll
[2011/01/22 12:51:10 | 000,006,656 | ---- | C] () -- C:\Users\Marco\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/22 05:54:52 | 000,000,059 | ---- | C] () -- C:\Windows\iPlayer.INI
[2011/01/22 05:27:00 | 000,020,992 | ---- | C] () -- C:\Windows\jestertb.dll
[2011/01/01 12:09:53 | 000,130,700 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat
[2010/11/20 03:06:31 | 000,000,211 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2010/11/20 03:06:31 | 000,000,163 | ---- | C] () -- C:\Windows\ODBC.INI
[2010/11/20 03:06:31 | 000,000,120 | ---- | C] () -- C:\Windows\MSMAIL32.INI
[2010/11/17 12:30:13 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2010/11/17 12:30:12 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2010/11/17 11:28:33 | 000,093,509 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2010/11/17 11:28:33 | 000,093,509 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009/08/03 10:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009/08/03 10:07:42 | 000,230,768 | ---- | C] () -- C:\Windows\System32\OGAEXEC.exe
[2008/10/17 04:16:09 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008/10/07 04:13:30 | 000,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll
[2008/10/07 04:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll
[2008/01/21 03:15:58 | 000,631,266 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2008/01/21 03:15:58 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2008/01/21 03:15:58 | 000,126,880 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2008/01/21 03:15:58 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006/11/02 08:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 08:47:37 | 000,389,696 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 08:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 06:33:01 | 000,598,290 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 06:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 06:33:01 | 000,104,304 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 06:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 06:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 04:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 04:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/02 03:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 03:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[1998/04/06 19:00:00 | 000,024,576 | ---- | C] () -- C:\Windows\System32\ODBCMON.DLL
[1998/04/06 19:00:00 | 000,022,016 | ---- | C] () -- C:\Windows\System32\ODBCSTF.DLL
[1998/04/06 19:00:00 | 000,022,016 | ---- | C] () -- C:\Windows\System32\DOCOBJ.DLL
[1998/04/06 19:00:00 | 000,012,288 | ---- | C] () -- C:\Windows\System32\HLINKPRX.DLL
 
========== LOP Check ==========
 
[2012/04/22 09:56:59 | 000,000,000 | ---D | M] -- C:\Users\Marco\AppData\Roaming\.minecraft
[2012/04/16 14:09:14 | 000,000,000 | ---D | M] -- C:\Users\Marco\AppData\Roaming\.Nitrous
[2011/12/10 12:55:45 | 000,000,000 | ---D | M] -- C:\Users\Marco\AppData\Roaming\Babylon
[2011/03/28 13:05:22 | 000,000,000 | ---D | M] -- C:\Users\Marco\AppData\Roaming\bookfactory.ch
[2011/09/13 13:13:27 | 000,000,000 | ---D | M] -- C:\Users\Marco\AppData\Roaming\ifolor
[2012/01/04 10:08:42 | 000,000,000 | ---D | M] -- C:\Users\Marco\AppData\Roaming\Reviversoft
[2011/12/10 12:58:30 | 000,000,000 | ---D | M] -- C:\Users\Marco\AppData\Roaming\Systweak
[2010/12/05 13:51:49 | 000,000,000 | ---D | M] -- C:\Users\Marco\AppData\Roaming\Tific
[2011/03/29 01:20:07 | 000,000,000 | ---D | M] -- C:\Users\Marco\AppData\Roaming\Uniblue
[2010/11/17 10:03:07 | 000,000,000 | -HSD | M] -- C:\ProgramData\Anwendungsdaten
[2011/12/10 12:55:45 | 000,000,000 | ---D | M] -- C:\ProgramData\Babylon
[2010/12/21 02:41:43 | 000,000,000 | ---D | M] -- C:\ProgramData\bookfactory.ch
[2011/12/28 11:01:14 | 000,000,000 | ---D | M] -- C:\ProgramData\boost_interprocess
[2011/03/30 13:24:27 | 000,000,000 | ---D | M] -- C:\ProgramData\Clarus
[2010/11/17 10:03:07 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2010/11/17 10:03:07 | 000,000,000 | -HSD | M] -- C:\ProgramData\Dokumente
[2010/11/17 10:03:07 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favoriten
[2011/09/13 13:13:24 | 000,000,000 | ---D | M] -- C:\ProgramData\ifolor
[2011/05/31 07:15:04 | 000,000,000 | ---D | M] -- C:\ProgramData\mquadr.at
[2010/12/11 11:50:51 | 000,000,000 | ---D | M] -- C:\ProgramData\Panasonic
[2010/11/17 10:03:07 | 000,000,000 | -HSD | M] -- C:\ProgramData\Startmenü
[2010/11/17 10:03:07 | 000,000,000 | -HSD | M] -- C:\ProgramData\Vorlagen
[2011/01/16 13:35:39 | 000,000,000 | ---D | M] -- C:\ProgramData\WindowsSearch
[2011/07/30 13:29:13 | 000,000,000 | -H-D | M] -- C:\ProgramData\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}
[2011/01/01 05:14:14 | 000,000,000 | ---D | M] -- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011/12/28 11:01:36 | 000,000,000 | -H-D | M] -- C:\ProgramData\{B49A644A-1076-4A3D-B124-DAA7862F2318}
[2012/05/10 09:02:16 | 000,000,264 | ---- | M] () -- C:\Windows\Tasks\RegClean Pro_DEFAULT.job
[2012/05/09 11:58:06 | 000,000,272 | ---- | M] () -- C:\Windows\Tasks\RegClean Pro_UPDATES.job
[2012/05/09 21:33:11 | 000,000,332 | ---- | M] () -- C:\Windows\Tasks\RegistryBooster.job
[2012/05/09 21:30:38 | 000,032,538 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
< End of report >

--- --- ---

cosinus · 12.05.2012, 20:17

Mach einen OTL-Fix über OTLPE, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

ATTFilter

:OTL
O2 - BHO: (I Want This) - {11111111-1111-1111-1111-110011221158} - C:\Program Files\I Want This\I Want This.dll (215 Apps)
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
O2 - BHO: (DataMngr) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\Program Files\Windows iLivid Toolbar\Datamngr\BrowserConnection.dll (Bandoo Media, inc)
O2 - BHO: (DealPly) - {A6174F27-1FFF-E1D6-A93F-BA48AD5DD448} - C:\Program Files\DealPly\DealPlyIE.dll (DealPly Technologies Ltd)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\4.4.0.12\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKU\Marco_ON_C\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\4.4.0.12\coieplg.dll (Symantec Corporation)
O4 - HKLM..\Run: [c9798u3A8Yxm3bS] C:\Users\Marco\AppData\Roaming\DNS_Servicex86.exe ()
O4 - HKLM..\Run: [DATAMNGR] C:\Program Files\Windows iLivid Toolbar\Datamngr\datamngrUI.exe (Bandoo Media, inc)
O4 - HKU\Marco_ON_C..\Run: [c9798u3A8Yxm3bS] C:\Users\Marco\AppData\Roaming\DNS_Servicex86.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKU\Marco_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKU\Marco_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\Marco_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\Marco_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O20 - AppInit_DLLs: (C:\PROGRA~1\WI371A~1\Datamngr\datamngr.dll) - C:\Program Files\Windows iLivid Toolbar\Datamngr\datamngr.dll (Bandoo Media, inc)
O20 - AppInit_DLLs: (C:\PROGRA~1\WI371A~1\Datamngr\IEBHO.dll) - C:\Program Files\Windows iLivid Toolbar\Datamngr\IEBHO.dll (Bandoo Media, inc)
O20 - HKLM Winlogon: Shell - (C:\Users\Marco\AppData\Roaming\DNS_Servicex86.exe) - C:\Users\Marco\AppData\Roaming\DNS_Servicex86.exe ()
O20 - HKLM Winlogon: UserInit - (C:\Users\Marco\AppData\Roaming\DNS_Servicex86.exe) - C:\Users\Marco\AppData\Roaming\DNS_Servicex86.exe ()
O20 - HKU\Marco_ON_C Winlogon: Shell - (C:\Users\Marco\AppData\Roaming\DNS_Servicex86.exe) - C:\Users\Marco\AppData\Roaming\DNS_Servicex86.exe ()
O20 - HKU\Marco_ON_C Winlogon: UserInit - (C:\Users\Marco\AppData\Roaming\DNS_Servicex86.exe) - C:\Users\Marco\AppData\Roaming\DNS_Servicex86.exe ()
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
[2012/04/13 14:55:12 | 000,000,000 | ---D | C] -- C:\Users\Marco\AppData\Local\I Want This
[2012/04/13 14:55:10 | 000,000,000 | ---D | C] -- C:\Program Files\I Want This
[2012/04/13 14:55:01 | 000,000,000 | ---D | C] -- C:\Program Files\DealPly
[2012/04/14 09:06:50 | 001,488,305 | ---- | M] () -- C:\Users\Marco\Pictures\Desktop\mcpatcher-2.3.5_01.exe
[2012/04/14 08:50:15 | 000,000,865 | ---- | M] () -- C:\Users\Marco\Pictures\Desktop\Uncompressor.lnk
[2012/04/13 14:54:40 | 000,010,479 | ---- | M] () -- C:\user.js
[2012/04/16 14:00:34 | 000,233,234 | ---- | C] () -- C:\Users\Marco\Pictures\Desktop\OptiFine_1.2.5_HD_A2.zip
[2011/01/22 05:54:52 | 000,000,059 | ---- | C] () -- C:\Windows\iPlayer.INI
[2011/01/22 05:27:00 | 000,020,992 | ---- | C] () -- C:\Windows\jestertb.dll
:Files
C:\Users\Marco\AppData\Roaming\DNS_Servicex86.exe
C:\Users\Marco\AppData\Roaming\Babylon
C:\ProgramData\Babylon
C:\Windows\Tasks\RegClean Pro_DEFAULT.job
C:\Windows\Tasks\RegClean Pro_UPDATES.job
C:\Windows\Tasks\RegistryBooster.job
:Commands
[purity]
[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Danach sollte Windows wieder normal starten - stell uns bitte den Quarantäneordner von OTL zur Verfügung. Dabei bitte so vorgehen:

1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf das Packen nicht beeinträchtigen!
2.) Ordner movedfiles in C:\_OTL in eine Datei zippen
3.) Die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html
4.) Wenns erfolgreich war Bescheid sagen
5.) Erst dann wieder den Virenscanner einschalten

bluerider · 13.05.2012, 18:15

Hallo Arne

Hatte ein paar Probeme mit dieser Seite, die nicht gestartet werden konnte. Ich bin ein Stück weiter (wobei ich überhaupt eine Ahnung habe was ich da gemacht habe...). Also: Ich konnte das FIX-Dings machen, und das da kam raus:
========= OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser
Helper Objects\{11111111-1111-1111-1111-110011221158}\ deleted successfully.
Registry key
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110011221158}\ deleted successfully.
C:\Program
Files\I Want This\I Want This.dll moved successfully.
Registry key
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6- 146BF802613B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EECD738-5844-4a99-B4B6-
146BF802613B}\ deleted successfully.
C:\Program Files\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll
moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079a25-328f-4bd4-be04-00955acaa0a7}\ deleted successfully.
Registry key
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}\ deleted successfully.
C:\Program
Files\Windows iLivid Toolbar\Datamngr\ToolBar\searchqudtx.dll moved successfully.
Registry key
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D717F81-9148-4f12-8568- 69135F087DB0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9D717F81-9148-4f12-8568-
69135F087DB0}\ deleted successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\BrowserConnection.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\
{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}\ deleted successfully.
C:\Program Files\DealPly\DealPlyIE.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{7FEBEFE3-6B19-4349-98D2-
FFB09D4B49CA} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FEBEFE3-6B19-4349-98D2-
FFB09D4B49CA}\ deleted successfully.
C:\Program Files\Norton 360\Engine\4.4.0.12\coieplg.dll moved successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{98889811-442D-49dd-99D7-DC866BE87DBC}
deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98889811-442D-49dd-99D7-DC866BE87DBC}\
deleted successfully.
C:\Program Files\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{99079a25-328f-4bd4-be04-
00955acaa0a7} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-
00955acaa0a7}\ not found.
File C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\searchqudtx.dll not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\10 deleted successfully.
Registry value
HKEY_USERS\Marco_ON_C\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}
deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}\
not found.
File C:\Program Files\Norton 360\Engine\4.4.0.12\coieplg.dll not found.
Registry value
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\c9798u3A8Yxm3bS deleted successfully.
C:
\Users\Marco\AppData\Roaming\DNS_Servicex86.exe moved successfully.
Registry value
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\DATAMNGR deleted successfully.
C:\Program
Files\Windows iLivid Toolbar\Datamngr\datamngrUI.exe moved successfully.
Registry value
HKEY_USERS\Marco_ON_C\Software\Microsoft\Windows\CurrentVersion\Run\\c9798u3A8Yxm3bS deleted successfully.
File C:
\Users\Marco\AppData\Roaming\DNS_Servicex86.exe not found.
Registry value
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLUA deleted successfully.
Registry
value HKEY_USERS\Marco_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value
HKEY_USERS\Marco_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDesktop deleted successfully.

Registry value HKEY_USERS\Marco_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableTaskMgr deleted successfully.
Registry value
HKEY_USERS\Marco_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableRegistryTools deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:C:
\PROGRA~1\WI371A~1\Datamngr\datamngr.dll deleted successfully.
C:\Program Files\Windows iLivid
Toolbar\Datamngr\datamngr.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Windows\\AppInit_Dlls:C:\PROGRA~1\WI371A~1\Datamngr\IEBHO.dll deleted successfully.
C:\Program
Files\Windows iLivid Toolbar\Datamngr\IEBHO.dll moved successfully.
Registry value
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:
\Users\Marco\AppData\Roaming\DNS_Servicex86.exe deleted successfully.
File C:
\Users\Marco\AppData\Roaming\DNS_Servicex86.exe not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\\UserInit:C:\Users\Marco\AppData\Roaming\DNS_Servicex86.exe deleted successfully.
File C:
\Users\Marco\AppData\Roaming\DNS_Servicex86.exe not found.
Registry value
HKEY_USERS\Marco_ON_C\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:
\Users\Marco\AppData\Roaming\DNS_Servicex86.exe deleted successfully.
File C:
\Users\Marco\AppData\Roaming\DNS_Servicex86.exe not found.
Registry value
HKEY_USERS\Marco_ON_C\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit:C:
\Users\Marco\AppData\Roaming\DNS_Servicex86.exe deleted successfully.
File C:
\Users\Marco\AppData\Roaming\DNS_Servicex86.exe not found.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat
moved successfully.
C:\Users\Marco\AppData\Local\I Want This\Chrome folder moved successfully.
C:
\Users\Marco\AppData\Local\I Want This folder moved successfully.
C:\Program Files\I Want This folder moved successfully.
C:\Program Files\DealPly folder moved successfully.
C:\Users\Marco\Pictures\Desktop\mcpatcher-2.3.5_01.
exe moved successfully.
C:\Users\Marco\Pictures\Desktop\Uncompressor.lnk moved successfully.
C:\user.js moved
successfully.
C:\Users\Marco\Pictures\Desktop\OptiFine_1.2.5_HD_A2.zip moved successfully.
C:\Windows\iPlayer.INI moved
successfully.
C:\Windows\jestertb.dll moved successfully.
========== COMMANDS ==========
C:
\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTLPE by OldTimer - Version
3.1.48.0 log created on 05122012_224431

----Ursprüngliche Nachricht----
Von: simone-gasser@bluewin.ch
Datum:
12.05.2012 21:41
An: <simone-gasser@bluewin.ch>
Betreff:

:OTL

O2 - BHO: (I Want This) - {11111111-1111-1111-1111-
110011221158} -
C:\Program Files\I Want This\I Want This.dll (215 Apps)

O2 - BHO: (Babylon toolbar helper) - {2EECD738-
5844-4a99-B4B6-146BF802613B}
- C:\Program
Files\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon

BHO)

O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} -
C:\Program Files\Windows iLivid
Toolbar\Datamngr\ToolBar\searchqudtx.dll ()

O2 - BHO: (DataMngr) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\Program

Files\Windows iLivid Toolbar\Datamngr\BrowserConnection.dll (Bandoo Media,
inc)

O2 - BHO: (DealPly) - {A6174F27-1FFF-
E1D6-A93F-BA48AD5DD448} - C:\Program
Files\DealPly\DealPlyIE.dll (DealPly Technologies Ltd)

O3 - HKLM\..\Toolbar:
(Norton Toolbar) -
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton
360\Engine\4.4.0.12\coieplg.dll
(Symantec Corporation)

O3 - HKLM\..\Toolbar: (Babylon Toolbar) -
{98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program

Files\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon
Ltd.)

O3 - HKLM\..\Toolbar: (Searchqu
Toolbar) -
{99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files\Windows iLivid

Toolbar\Datamngr\ToolBar\searchqudtx.dll ()

O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.

O3 -
HKU\Marco_ON_C\..\Toolbar\WebBrowser: (Norton Toolbar) -
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program
Files\Norton
360\Engine\4.4.0.12\coieplg.dll (Symantec Corporation)

O4 - HKLM..\Run: [c9798u3A8Yxm3bS]
C:
\Users\Marco\AppData\Roaming\DNS_Servicex86.exe ()

O4 - HKLM..\Run: [DATAMNGR] C:\Program Files\Windows iLivid

Toolbar\Datamngr\datamngrUI.exe (Bandoo Media, inc)

O4 - HKU\Marco_ON_C..\Run: [c9798u3A8Yxm3bS]
C:
\Users\Marco\AppData\Roaming\DNS_Servicex86.exe ()

O6 -
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System:
EnableLUA = 0

O7 -

HKU\Marco_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer:
NoDriveTypeAutoRun = 255

O7 -

HKU\Marco_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer:
NoDesktop = 1

O7 -

HKU\Marco_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System:
DisableTaskMgr = 1

O7 -

HKU\Marco_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System:
DisableRegistryTools = 1

O20 - AppInit_DLLs:
(C:\PROGRA~1\WI371A~1\Datamngr\datamngr.dll) -
C:\Program Files\Windows iLivid Toolbar\Datamngr\datamngr.dll (Bandoo
Media,
inc)

O20 - AppInit_DLLs: (C:\PROGRA~1\WI371A~1\Datamngr\IEBHO.dll) - C:\Program
Files\Windows iLivid
Toolbar\Datamngr\IEBHO.dll (Bandoo Media, inc)

O20 - HKLM Winlogon: Shell -
(C:
\Users\Marco\AppData\Roaming\DNS_Servicex86.exe) -
C:\Users\Marco\AppData\Roaming\DNS_Servicex86.exe ()

O20 - HKLM
Winlogon: UserInit -
(C:\Users\Marco\AppData\Roaming\DNS_Servicex86.exe) -
C:
\Users\Marco\AppData\Roaming\DNS_Servicex86.exe ()

O20 - HKU\Marco_ON_C Winlogon: Shell -
(C:
\Users\Marco\AppData\Roaming\DNS_Servicex86.exe) -
C:\Users\Marco\AppData\Roaming\DNS_Servicex86.exe ()

O20 -
HKU\Marco_ON_C Winlogon: UserInit -
(C:\Users\Marco\AppData\Roaming\DNS_Servicex86.exe) -
C:
\Users\Marco\AppData\Roaming\DNS_Servicex86.exe ()

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006/09/18 17:
43:36 | 000,000,024 | ---- | M] () -
C:\autoexec.bat -- [ NTFS ]

[2012/04/13 14:55:12 | 000,000,000 | ---D | C] --
C:
\Users\Marco\AppData\Local\I Want This

[2012/04/13 14:55:10 | 000,000,000 | ---D | C] -- C:\Program Files\I Want
This

[2012/04/13 14:55:01 | 000,000,000 | ---D | C] -- C:\Program Files\DealPly

[2012/04/14 09:06:50 | 001,488,305 | ---- |
M] () --
C:\Users\Marco\Pictures\Desktop\mcpatcher-2.3.5_01.exe

[2012/04/14 08:50:15 | 000,000,865 | ---- | M] () --
C:
\Users\Marco\Pictures\Desktop\Uncompressor.lnk

[2012/04/13 14:54:40 | 000,010,479 | ---- | M] () -- C:\user.js

[2012/04/16 14:00:34 | 000,233,234 | ---- | C] () --
C:\Users\Marco\Pictures\Desktop\OptiFine_1.2.5_HD_A2.zip

[2011/01/22 05:54:52 | 000,000,059 | ---- | C] () -- C:\Windows\iPlayer.INI

[2011/01/22 05:27:00 | 000,020,992 | ----
| C] () -- C:\Windows\jestertb.dll
:Files C:\Users\Marco\AppData\Roaming\DNS_Servicex86.exe

C:
\Users\Marco\AppData\Roaming\Babylon

C:\ProgramData\Babylon

C:\Windows\Tasks\RegClean Pro_DEFAULT.job C:
\Windows\Tasks\RegClean
Pro_UPDATES.job C:\Windows\Tasks\RegistryBooster.job

:Commands

[purity]

[resethosts]

Dann habe ich die CD mit dem OTLPE rausgenommen und den PC versucht zu starten. Ein Stück weit ging es auch, Windows wurde gestartet aber bei so einem Fehlersuchprogramm (Regestry reviewer) bleibt es hängen und und wenn ich dieser Programm schliesse bleibt nur ein schwarzer Bildschirm.

cosinus · 14.05.2012, 08:16

Wenn Windows immer noch nicht vernünftig startet, brauche ich ein neues Log von OTLPE

bluerider · 15.05.2012, 10:18

Hallo Arne

Ich bin leider nicht mehr dazu gekommen es nochmals zu machen und fahre nun 2 Wochen in die Ferien. Ich werde mich dann nochmals daran machen - und dann halt vielleicht doch lieber ins Computergeschäft bringen...

Aber herzlichen DAnk schon mal für den Moment, ich melde mich in 2 Wochen wieder.
Liebe Grüsse
Simone

11.05.2012, 11:19	#2
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	SUISA-Virus auf Windows Vista Funktioniert noch der abgesicherte Modus mit Netzwerktreibern? Mit Internetverbindung? Abgesicherter Modus zur Bereinigung Windows mit F8-Taste beim Start in den abgesicherten Modus bringen. Starte den Rechner in den abgesicherten Modus mit Netzwerktreibern: __________________ __________________

11.05.2012, 21:36	#6
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	SUISA-Virus auf Windows Vista Ja du musst auch den Windows-Ordner auswählen Steht auch so in der Anleitung __________________ --> SUISA-Virus auf Windows Vista

14.05.2012, 08:16	#10
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	SUISA-Virus auf Windows Vista Wenn Windows immer noch nicht vernünftig startet, brauche ich ein neues Log von OTLPE __________________ Logfiles bitte immer in CODE-Tags posten

SUISA-Virus auf Windows Vista

Log-Analyse und Auswertung: SUISA-Virus auf Windows Vista