"page is loading please wait. this may take up to 30 seconds"

shazam · 21.10.2012, 13:22

hallo!

habe scheinbar einen virus auf meinem laptop, wenn ich mich anmelde kommt nur ein weißes bild mit folgendem text:

page is loading please wait. this may take up to 30 seconds

mehr passiert leider auch nicht mehr...
abgesicherter modus geht auch nicht.

jetzt habe ich schon "OTLPENet" heruntergeladen, auf eine dvd gebrannt und gebootet. sobald dann das ladesymbol von windows xp kommt (normal ist ja eigentlich windwos 7 drauf) kommt ein bluescreen.

was kann ich noch machen?

danke und schöne grüße,
shazam

hallo!

habe jetzt herausgefunden, dass ich im bios noch bei der festplatte etwas umstellen musste.

jetzt das logfile:

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 10/21/2012 7:00:58 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
64bit-Windows 7 Home Premium Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 88.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 96.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = F: | %SystemRoot% = F:\windows | %ProgramFiles% = F:\Program Files (x86)
Drive C: | 200.00 Mb Total Space | 170.29 Mb Free Space | 85.15% Space Free | Partition Type: NTFS
Drive D: | 29.00 Gb Total Space | 0.01 Gb Free Space | 0.04% Space Free | Partition Type: NTFS
Drive F: | 421.81 Gb Total Space | 312.16 Gb Free Space | 74.00% Space Free | Partition Type: NTFS
Drive G: | 3.95 Gb Total Space | 3.95 Gb Free Space | 100.00% Space Free | Partition Type: FAT
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2009/09/22 14:16:32 | 000,579,400 | ---- | M] (Lenovo Group Limited) [On_Demand] -- F:\Program Files\Lenovo\ReadyComm\ConnSvc.exe -- (Lenovo ReadyComm ConnSvc)
SRV:64bit: - [2009/08/14 10:22:48 | 000,509,192 | ---- | M] (Lenovo Group Limited) [On_Demand] -- F:\Program Files\Lenovo\ReadyComm\AppSvc.exe -- (Lenovo ReadyComm AppSvc)
SRV:64bit: - [2009/08/11 12:59:38 | 000,864,032 | ---- | M] (Broadcom Corporation.) [Auto] -- F:\Program Files\Lenovo\Bluetooth Software\btwdins.exe -- (btwdins)
SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto] -- F:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2012/09/29 16:03:31 | 000,250,288 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- F:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/09/19 10:21:14 | 000,795,072 | ---- | M] (Spigot, Inc.) [Auto] -- F:\Program Files (x86)\Application Updater\ApplicationUpdater.exe -- (Application Updater)
SRV - [2012/09/12 14:31:16 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand] -- F:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2011/07/07 13:31:08 | 000,195,336 | ---- | M] (Microsoft Corporation.) [On_Demand] -- F:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011/06/17 13:33:04 | 000,237,008 | ---- | M] (McAfee, Inc.) [On_Demand] -- F:\Program Files (x86)\McAfee Security Scan\3.0.207\McCHSvc.exe -- (McComponentHostService)
SRV - [2011/06/15 11:33:20 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto] -- F:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (BBUpdate)
SRV - [2010/03/18 07:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- F:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/03/03 16:16:06 | 000,013,336 | ---- | M] (Intel Corporation) [Auto] -- F:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)
SRV - [2009/12/09 04:48:26 | 002,320,920 | ---- | M] (Intel Corporation) [Auto] -- F:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2009/12/09 04:48:24 | 000,268,824 | ---- | M] (Intel Corporation) [Auto] -- F:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2009/07/14 10:27:26 | 000,038,152 | ---- | M] (Lenovo Group Limited) [On_Demand] -- F:\Program Files (x86)\Lenovo\ReadyComm\common\IGRS.exe -- (IGRS)
SRV - [2009/07/13 21:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) [Auto] -- F:\windows\SysWow64\IgrsSvcs.exe -- (ReadyComm.DirectRouter)
SRV - [2009/07/13 21:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) [On_Demand] -- F:\windows\SysWow64\IgrsSvcs.exe -- (PS_MDP)
SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- F:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012/04/25 06:11:36 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand] -- F:\Windows\System32\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2010/11/20 07:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/04/20 16:14:16 | 000,200,704 | ---- | M] (SMI) [Kernel | On_Demand] -- F:\Windows\System32\drivers\SMIksdrv.sys -- (usbsmi)
DRV:64bit: - [2010/03/11 23:23:16 | 000,242,720 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- F:\Windows\System32\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2010/01/28 07:55:04 | 000,086,120 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2010/01/18 05:45:50 | 000,717,368 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand] -- F:\Windows\System32\drivers\CHDRT64.sys -- (CnxtHdAudService)
DRV:64bit: - [2009/11/06 08:56:06 | 001,550,848 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- F:\Windows\System32\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009/10/18 20:40:50 | 000,028,176 | ---- | M] (Lenovo Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\AcpiVpc.sys -- (ACPIVPC)
DRV:64bit: - [2009/09/17 00:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\HECIx64.sys -- (HECIx64) Intel(R)
DRV:64bit: - [2009/08/20 12:05:06 | 000,239,616 | ---- | M] (Realtek                                            ) [Kernel | On_Demand] -- F:\Windows\System32\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009/07/21 10:20:06 | 000,121,840 | ---- | M] (CyberLink) [Kernel | On_Demand] -- F:\Windows\System32\drivers\wsvd.sys -- (wsvd)
DRV:64bit: - [2009/07/16 07:55:34 | 000,011,280 | ---- | M] (Lenovo) [Kernel | On_Demand] -- F:\Windows\System32\drivers\WDMirror.sys -- (wdmirror)
DRV:64bit: - [2009/07/15 23:38:20 | 000,079,376 | ---- | M] (Lenovo) [Kernel | On_Demand] -- F:\Windows\System32\drivers\WDBridge.sys -- (Bridge0)
DRV:64bit: - [2009/07/01 00:46:58 | 000,052,264 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- F:\Windows\System32\drivers\btusbflt.sys -- (btusbflt)
DRV:64bit: - [2009/06/10 16:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- F:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 16:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009/06/10 16:35:28 | 005,434,368 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\netw5v64.sys -- (netw5v64) Intel(R)
DRV:64bit: - [2009/06/10 16:34:36 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\k57nd60a.sys -- (k57nd60a) Broadcom NetLink (TM)
DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- F:\windows\system32\DRIVERS\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- F:\windows\system32\DRIVERS\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2008/08/06 08:32:16 | 000,151,656 | ---- | M] (Microsoft Corporation) [File_System | On_Demand] -- F:\Windows\System32\drivers\WimFltr.sys -- (WimFltr)
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\St_ON_F\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
IE - HKU\St_ON_F\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\St_ON_F\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/ [binary data]
IE - HKU\St_ON_F\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo.msn.com
IE - HKU\St_ON_F\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKU\St_ON_F\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKU\St_ON_F\..\URLSearchHook: {B922D405-6D13-4A2B-AE89-08A030DA4402} - Reg Error: Key error. File not found
IE - HKU\St_ON_F\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\St_ON_F\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: F:\Windows\System32\Macromed\Flash\NPSWF64_11_4_402_278.dll ()
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE:  File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: F:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: F:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_278.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=:  
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=1.0: F:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: F:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin:  File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE:  File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: F:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: F:\Program Files (x86)\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: F:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: F:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/09/12 14:31:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2012/07/31 16:29:12 | 000,000,000 | ---D | M] (No name found) -- F:\Program Files (x86)\Mozilla Firefox\extensions
[2012/09/12 14:31:18 | 000,266,720 | ---- | M] (Mozilla Foundation) -- F:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/09/12 14:31:13 | 000,001,392 | ---- | M] () -- F:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/09/12 14:31:13 | 000,002,465 | ---- | M] () -- F:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/09/12 14:31:13 | 000,001,153 | ---- | M] () -- F:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012/09/12 14:31:13 | 000,006,805 | ---- | M] () -- F:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/09/12 14:31:13 | 000,001,178 | ---- | M] () -- F:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/09/12 14:31:13 | 000,001,105 | ---- | M] () -- F:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | ---- | M]) - F:\Windows\System32\drivers\etc\hosts
O2:64bit: - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - F:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - F:\Program Files (x86)\pdfforge Toolbar\IE\6.3\pdfforgeToolbarIE.dll (Spigot, Inc.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - F:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3:64bit: - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - F:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - F:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - F:\Program Files (x86)\pdfforge Toolbar\IE\6.3\pdfforgeToolbarIE.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\St_ON_F\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O4:64bit: - HKLM..\Run: [cAudioFilterAgent] F:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe (Conexant Systems, Inc.)
O4:64bit: - HKLM..\Run: [Energy Management] F:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe (Lenovo (Beijing) Limited)
O4:64bit: - HKLM..\Run: [EnergyUtility] F:\Program Files (x86)\Lenovo\Energy Management\utility.exe (Lenovo(beijing) Limited)
O4:64bit: - HKLM..\Run: [ETDWare] F:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronics Corp.)
O4:64bit: - HKLM..\Run: [NvCplDaemon] F:\windows\System32\NvCpl.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [OnekeyStudio] F:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe (Lenovo)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [APSDaemon] F:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [IAStorIcon] F:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [Nikon Transfer Monitor] F:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation)
O4 - HKLM..\Run: [SearchSettings] F:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)
O4 - HKLM..\Run: [UCam_Menu] F:\Program Files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateP2GShortCut] F:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [VeriFaceManager]  File not found
O4 - HKLM..\Run: [YouCam Mirror Tray icon] F:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe (CyberLink Corp.)
O4 - HKU\LocalService_ON_F..\Run: [Sidebar] F:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_F..\Run: [Sidebar] F:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\St_ON_F..\Run: [K0FnljCdupF1YvH] F:\Users\St\AppData\Roaming\07F4HkiN.exe ()
O4 - HKU\St_ON_F..\Run: [NvCplDaemonTool]  File not found
O4 - HKU\LocalService_ON_F..\RunOnce: [mctadmin]  File not found
O4 - HKU\NetworkService_ON_F..\RunOnce: [mctadmin]  File not found
O4 - HKU\St_ON_F..\RunOnce: [FlashPlayerUpdate]  File not found
O4 - Startup: Error locating startup folders.
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Add to Google Photos Screensa&ver - F:\windows\SysWow64\GPhotos.scr (Google Inc.)
O9:64bit: - Extra Button: @C:\Program Files\Lenovo\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - F:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\Lenovo\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - F:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -  File not found
O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - F:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - F:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - F:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - F:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 194.183.128.35 194.183.128.36 195.34.133.21
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - F:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - F:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - F:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKU\St_ON_F Winlogon: Shell - (C:\Users\St\AppData\Roaming\07F4HkiN.exe) - F:\Users\St\AppData\Roaming\07F4HkiN.exe ()
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/10/07 13:46:08 | 000,000,000 | ---D | C] -- F:\Users\St\AppData\Roaming\Roaming
[2012/10/05 13:56:37 | 000,000,000 | ---D | C] -- F:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
[2012/09/29 15:13:10 | 000,000,000 | ---D | C] -- F:\Users\St\AppData\Local\Macromedia
[2012/09/29 15:10:42 | 000,696,240 | ---- | C] (Adobe Systems Incorporated) -- F:\windows\SysWow64\FlashPlayerApp.exe
[2012/09/29 15:10:42 | 000,073,136 | ---- | C] (Adobe Systems Incorporated) -- F:\windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/09/25 15:02:42 | 000,245,760 | ---- | C] (Microsoft Corporation) -- F:\windows\System32\OxpsConverter.exe
[2012/09/25 14:41:35 | 000,000,000 | ---D | C] -- F:\Program Files (x86)\Common Files\Spigot
[2012/09/25 14:41:35 | 000,000,000 | ---D | C] -- F:\Program Files (x86)\pdfforge Toolbar
[2012/09/25 14:41:35 | 000,000,000 | ---D | C] -- F:\Program Files (x86)\Application Updater
[2012/09/24 13:45:07 | 000,096,768 | ---- | C] (Microsoft Corporation) -- F:\windows\System32\mshtmled.dll
[2012/09/24 13:45:07 | 000,073,216 | ---- | C] (Microsoft Corporation) -- F:\windows\SysWow64\mshtmled.dll
[2012/09/24 13:45:05 | 000,248,320 | ---- | C] (Microsoft Corporation) -- F:\windows\System32\ieui.dll
[2012/09/24 13:45:05 | 000,176,640 | ---- | C] (Microsoft Corporation) -- F:\windows\SysWow64\ieui.dll
[2012/09/24 13:45:05 | 000,173,056 | ---- | C] (Microsoft Corporation) -- F:\windows\System32\ieUnatt.exe
[2012/09/24 13:45:05 | 000,142,848 | ---- | C] (Microsoft Corporation) -- F:\windows\SysWow64\ieUnatt.exe
[2012/09/24 13:45:04 | 002,312,704 | ---- | C] (Microsoft Corporation) -- F:\windows\System32\jscript9.dll
[2012/09/24 13:45:04 | 001,494,528 | ---- | C] (Microsoft Corporation) -- F:\windows\System32\inetcpl.cpl
[2012/09/24 13:45:04 | 001,427,968 | ---- | C] (Microsoft Corporation) -- F:\windows\SysWow64\inetcpl.cpl
[2012/09/24 13:45:04 | 000,729,088 | ---- | C] (Microsoft Corporation) -- F:\windows\System32\msfeeds.dll
[2012/09/24 13:45:04 | 000,237,056 | ---- | C] (Microsoft Corporation) -- F:\windows\System32\url.dll
[2012/09/24 13:45:04 | 000,231,936 | ---- | C] (Microsoft Corporation) -- F:\windows\SysWow64\url.dll
[2012/09/24 13:45:03 | 000,607,744 | ---- | C] (Microsoft Corporation) -- F:\windows\SysWow64\msfeeds.dll
[2012/09/24 13:45:02 | 001,800,704 | ---- | C] (Microsoft Corporation) -- F:\windows\SysWow64\jscript9.dll
[2012/09/24 13:45:02 | 000,816,640 | ---- | C] (Microsoft Corporation) -- F:\windows\System32\jscript.dll
[2012/09/24 13:45:02 | 000,717,824 | ---- | C] (Microsoft Corporation) -- F:\windows\SysWow64\jscript.dll
[2012/09/24 13:45:02 | 000,599,040 | ---- | C] (Microsoft Corporation) -- F:\windows\System32\vbscript.dll
[2012/09/23 06:02:59 | 000,376,688 | ---- | C] (Microsoft Corporation) -- F:\windows\System32\drivers\netio.sys
[2012/09/23 06:02:59 | 000,288,624 | ---- | C] (Microsoft Corporation) -- F:\windows\System32\drivers\FWPKCLNT.SYS
[2012/09/23 06:02:58 | 000,041,472 | ---- | C] (Microsoft Corporation) -- F:\windows\System32\drivers\RNDISMP.sys
[9 F:\windows\SysWow64\*.tmp files -> F:\windows\SysWow64\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/10/21 07:35:50 | 000,067,584 | --S- | M] () -- F:\windows\bootstat.dat
[2012/10/21 07:35:45 | 000,013,632 | -H-- | M] () -- F:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/10/21 07:35:45 | 000,013,632 | -H-- | M] () -- F:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/10/21 07:28:47 | 3113,365,504 | -HS- | M] () -- F:\hiberfil.sys
[2012/10/21 07:28:13 | 000,003,224 | ---- | M] () -- F:\bootsqm.dat
[2012/10/07 13:50:00 | 000,000,884 | ---- | M] () -- F:\windows\tasks\Adobe Flash Player Updater.job
[2012/10/07 13:46:06 | 000,204,647 | ---- | M] () -- F:\Users\St\AppData\Roaming\07F4HkiN.exe
[2012/10/07 06:29:35 | 000,654,400 | ---- | M] () -- F:\windows\System32\perfh007.dat
[2012/10/07 06:29:35 | 000,616,242 | ---- | M] () -- F:\windows\System32\perfh009.dat
[2012/10/07 06:29:35 | 000,130,240 | ---- | M] () -- F:\windows\System32\perfc007.dat
[2012/10/07 06:29:35 | 000,106,622 | ---- | M] () -- F:\windows\System32\perfc009.dat
[2012/10/05 13:56:44 | 000,000,000 | ---D | M] -- F:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
[2012/10/05 13:56:39 | 000,002,094 | ---- | M] () -- F:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2012/10/05 13:56:39 | 000,000,000 | R--D | M] -- F:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
[2012/10/05 13:56:38 | 000,002,094 | ---- | M] () -- F:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2012/09/29 16:03:30 | 000,696,240 | ---- | M] (Adobe Systems Incorporated) -- F:\windows\SysWow64\FlashPlayerApp.exe
[2012/09/29 16:03:30 | 000,073,136 | ---- | M] (Adobe Systems Incorporated) -- F:\windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/09/23 06:12:00 | 000,428,128 | ---- | M] () -- F:\windows\System32\FNTCACHE.DAT
[9 F:\windows\SysWow64\*.tmp files -> F:\windows\SysWow64\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/10/21 07:28:13 | 000,003,224 | ---- | C] () -- F:\bootsqm.dat
[2012/10/07 13:46:07 | 000,204,647 | ---- | C] () -- F:\Users\St\AppData\Roaming\07F4HkiN.exe
[2012/09/29 15:10:43 | 000,000,884 | ---- | C] () -- F:\windows\tasks\Adobe Flash Player Updater.job
[2012/07/15 14:00:26 | 000,000,268 | RH-- | C] () -- F:\ProgramData\Synth Basics
[2012/07/15 14:00:26 | 000,000,268 | RH-- | C] () -- F:\Users\St\AppData\Roaming\Super Strings
[2012/07/15 14:00:26 | 000,000,020 | -H-- | C] () -- F:\ProgramData\PKP_DLdw.DAT
[2012/07/15 13:58:33 | 000,000,268 | RH-- | C] () -- F:\ProgramData\Sync Schema
[2012/07/15 13:58:33 | 000,000,268 | RH-- | C] () -- F:\Users\St\AppData\Roaming\String Ensemble
[2012/07/15 13:58:33 | 000,000,020 | -H-- | C] () -- F:\ProgramData\PKP_DLdu.DAT
[2011/06/07 01:21:46 | 000,252,928 | ---- | C] () -- F:\windows\SysWow64\DShowRdpFilter.dll
[2011/04/13 11:47:22 | 001,779,047 | ---- | C] () -- F:\Users\St\AppData\Roaming\mdbu.bin
[2010/09/17 23:48:11 | 000,000,512 | ---- | C] () -- F:\windows\previous.bin
[2010/09/17 23:48:11 | 000,000,512 | ---- | C] () -- F:\windows\current.bin
[2010/09/17 23:40:49 | 000,016,648 | R--- | C] () -- F:\windows\SysWow64\LogAPI.dll
[2010/09/17 23:33:09 | 002,110,816 | ---- | C] () -- F:\windows\SysWow64\Apblend.dll
[2010/09/17 23:33:09 | 001,171,456 | ---- | C] () -- F:\windows\SysWow64\PicNotify.dll
[2010/09/17 23:33:01 | 001,044,480 | ---- | C] () -- F:\windows\SysWow64\3DImageRenderer.dll
[2009/07/14 01:38:36 | 000,067,584 | --S- | C] () -- F:\windows\bootstat.dat
[2009/07/13 22:35:51 | 000,000,741 | ---- | C] () -- F:\windows\SysWow64\NOISE.DAT
[2009/07/13 22:34:42 | 000,215,943 | ---- | C] () -- F:\windows\SysWow64\dssec.dat
[2009/07/13 20:10:29 | 000,043,131 | ---- | C] () -- F:\windows\mib.bin
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- F:\windows\SysWow64\BWContextHandler.dll
[2009/07/13 18:25:04 | 000,197,632 | ---- | C] () -- F:\windows\SysWow64\ir32_32.dll
[2009/07/13 17:59:36 | 000,982,196 | ---- | C] () -- F:\windows\SysWow64\igkrng500.bin
[2009/07/13 17:59:36 | 000,139,824 | ---- | C] () -- F:\windows\SysWow64\igfcg500.bin
[2009/07/13 17:59:36 | 000,097,448 | ---- | C] () -- F:\windows\SysWow64\igfcg500m.bin
[2009/07/13 17:59:35 | 000,417,344 | ---- | C] () -- F:\windows\SysWow64\igcompkrng500.bin
[2009/07/13 17:03:59 | 000,364,544 | ---- | C] () -- F:\windows\SysWow64\msjetoledb40.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- F:\windows\SysWow64\mlang.dat
 
========== LOP Check ==========
 
[2011/04/12 13:47:08 | 000,000,000 | -HSD | M] -- F:\ProgramData\Anwendungsdaten
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- F:\ProgramData\Application Data
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- F:\ProgramData\Desktop
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- F:\ProgramData\Documents
[2011/04/12 13:47:08 | 000,000,000 | -HSD | M] -- F:\ProgramData\Dokumente
[2012/07/15 14:00:26 | 000,000,000 | ---D | M] -- F:\ProgramData\EnterNHelp
[2011/07/19 01:52:16 | 000,000,000 | ---D | M] -- F:\ProgramData\EPSON
[2011/04/12 13:47:08 | 000,000,000 | -HSD | M] -- F:\ProgramData\Favoriten
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- F:\ProgramData\Favorites
[2011/04/13 11:46:04 | 000,000,000 | ---D | M] -- F:\ProgramData\HappyFoto-Designer
[2012/07/15 13:59:16 | 000,000,000 | ---D | M] -- F:\ProgramData\Nikon
[2012/06/20 15:02:29 | 000,000,000 | ---D | M] -- F:\ProgramData\PhotoGenie
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- F:\ProgramData\Start Menu
[2011/04/12 13:47:08 | 000,000,000 | -HSD | M] -- F:\ProgramData\Startmenü
[2010/09/17 23:39:49 | 000,000,000 | ---D | M] -- F:\ProgramData\Temp
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- F:\ProgramData\Templates
[2012/09/17 07:31:36 | 000,000,000 | ---D | M] -- F:\ProgramData\tmp
[2011/07/19 01:55:37 | 000,000,000 | ---D | M] -- F:\ProgramData\UDL
[2012/07/15 14:00:26 | 000,000,000 | ---D | M] -- F:\ProgramData\Ultima_T15
[2012/07/15 14:00:26 | 000,000,000 | ---D | M] -- F:\ProgramData\vhosts
[2011/04/12 13:47:08 | 000,000,000 | -HSD | M] -- F:\ProgramData\Vorlagen
[2012/07/15 13:58:33 | 000,000,000 | ---D | M] -- F:\ProgramData\Workflows
[2011/10/17 14:04:04 | 000,000,000 | ---D | M] -- F:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
[2012/01/14 02:43:32 | 000,032,640 | ---- | M] () -- F:\windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
< End of report >

--- --- ---

[/code]

danke für eure hilfe!

gruß,
shazam

cosinus · 22.10.2012, 12:54

Starte OTLPE und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

ATTFilter

:OTL
O4 - HKU\St_ON_F..\Run: [K0FnljCdupF1YvH] F:\Users\St\AppData\Roaming\07F4HkiN.exe ()
O20 - HKU\St_ON_F Winlogon: Shell - (C:\Users\St\AppData\Roaming\07F4HkiN.exe) - F:\Users\St\AppData\Roaming\07F4HkiN.exe ()
F:\Users\St\AppData\Roaming\07F4HkiN.exe
:Files
F:\ProgramData\PKP_*.DAT
F:\Users\St\AppData\Roaming\*.exe
:Commands
[purity]
[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Danach sollte Windows wieder normal starten - stell uns bitte den Quarantäneordner von OTL zur Verfügung. Dabei bitte so vorgehen:

1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf das Packen nicht beeinträchtigen!
2.) Ordner movedfiles in C:\_OTL in eine Datei zippen
3.) Die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang in den Thread posten!

4.) Wenns erfolgreich war Bescheid sagen
5.) Erst dann wieder den Virenscanner einschalten

shazam · 22.10.2012, 21:01

hallo cosinus,

hat super geklappt, computer funktioniert wieder.
zip datei habe ich hochgeladen, hier noch das logfile:

Code:

ATTFilter

========== OTL ==========
Registry key HKEY_USERS\St_ON_F\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run not found.
F:\Users\St\AppData\Roaming\07F4HkiN.exe moved successfully.
Registry value HKEY_USERS\St_ON_F\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Users\St\AppData\Roaming\07F4HkiN.exe deleted successfully.
File F:\Users\St\AppData\Roaming\07F4HkiN.exe not found.
========== FILES ==========
F:\ProgramData\PKP_DLdu.DAT moved successfully.
F:\ProgramData\PKP_DLdw.DAT moved successfully.
File\Folder F:\Users\St\AppData\Roaming\*.exe not found.
========== COMMANDS ==========
F:\windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTLPE by OldTimer - Version 3.1.48.0 log created on 10232012_015053

muss ich jetzt noch etwas beachten?

nochmals vielen dank!

gruß,
shazam

cosinus · 23.10.2012, 16:12

Bitte nun routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

ATTFilter

 hier steht das Log

shazam · 23.10.2012, 22:10

hallo cosinus,

besten dank für deine hilfe.
da ich beruflich unterwegs bin kann ich dies jedoch nicht vor freitag machen, ich bitte um geduld.

vielen dank und schöne grüße,
shazam

cosinus · 24.10.2012, 12:28

Ok, dann bis Freitag

24.10.2012, 12:28	#6
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	"page is loading please wait. this may take up to 30 seconds" Ok, dann bis Freitag __________________ --> "page is loading please wait. this may take up to 30 seconds"

"page is loading please wait. this may take up to 30 seconds"

Plagegeister aller Art und deren Bekämpfung: "page is loading please wait. this may take up to 30 seconds"