EXTRAS
2shared - download Extras.Txt

OTL
http://www.2shared.com/file/7930789/3aaa0e98/OTL.html

Auf dem Admin Konto hab ich immernoch die Meldung "keine adminstratorrechte" :/

Bitte mal den Avenger anwenden

Vorbereitungen:
a) Deaktiviere den Hintergrundwächter vom Virenscanner.
b) Stöpsele alle externen Datenträger vom Rechner ab.


Danach:

1.) Lade Dir von hier Avenger:
Swandog46's Public Anti-Malware Tools (Download, linksseitig)

2.) Entpack das zip-Archiv, führe die Datei "avenger.exe" aus. Die Haken unten wie abgebildet setzen:



3.) Kopiere Dir exakt die Zeilen aus dem folgenden Code-Feld:

files to delete:
C:\WINDOWS\PEV.exe
C:\WINDOWS\SWXCACLS.exe
C:\WINDOWS\SWREG.exe
C:\WINDOWS\SWSC.exe
C:\WINDOWS\sed.exe
C:\WINDOWS\grep.exe
C:\WINDOWS\System32\CmdLineExt03.dll
C:\Dokumente und Einstellungen\Iliri\Desktop\golden-keylogger.zip
C:\WINDOWS\snpstd.ini
C:\WINDOWS\snpstd.src
C:\WINDOWS\System32\csnpstd.dll
C:\DOKUME~1\SHEFKI~1.ILI\LOKALE~1\Temp\winfelx.exe
C:\DOKUME~1\SHEFKI~1.ILI\LOKALE~1\Temp\jeof.exe
C:\DOKUME~1\Iliri\LOKALE~1\Temp\winmeayoa.exe
C:\DOKUME~1\Iliri\LOKALE~1\Temp\dxond.exe
         

4.) Geh in "The Avenger" nun oben auf "Load Script", dort auf "Paste from Clipboard".

5.) Der Code-Text hier aus meinem Beitrag müsste nun unter "Input Script here" in "The Avenger" zu sehen sein.

6.) Falls dem so ist, klick unten rechts auf "Execute". Bestätige die nächste Abfrage mit "Ja", die Frage zu "Reboot now" (Neustart des Systems) ebenso.

7.) Nach dem Neustart erhältst Du ein LogFile von Avenger eingeblendet. Kopiere dessen Inhalt und poste ihn hier.

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform:  Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\WINDOWS\PEV.exe" deleted successfully.
File "C:\WINDOWS\SWXCACLS.exe" deleted successfully.
File "C:\WINDOWS\SWREG.exe" deleted successfully.
File "C:\WINDOWS\SWSC.exe" deleted successfully.
File "C:\WINDOWS\sed.exe" deleted successfully.
File "C:\WINDOWS\grep.exe" deleted successfully.
File "C:\WINDOWS\System32\CmdLineExt03.dll" deleted successfully.
File "C:\Dokumente und Einstellungen\Iliri\Desktop\golden-keylogger.zip" deleted successfully.
File "C:\WINDOWS\snpstd.ini" deleted successfully.
File "C:\WINDOWS\snpstd.src" deleted successfully.
File "C:\WINDOWS\System32\csnpstd.dll" deleted successfully.

Error:  file "C:\DOKUME~1\SHEFKI~1.ILI\LOKALE~1\Temp\winfelx.exe" not found!
Deletion of file "C:\DOKUME~1\SHEFKI~1.ILI\LOKALE~1\Temp\winfelx.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
  --> the object does not exist


Error:  file "C:\DOKUME~1\SHEFKI~1.ILI\LOKALE~1\Temp\jeof.exe" not found!
Deletion of file "C:\DOKUME~1\SHEFKI~1.ILI\LOKALE~1\Temp\jeof.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
  --> the object does not exist


Error:  file "C:\DOKUME~1\Iliri\LOKALE~1\Temp\winmeayoa.exe" not found!
Deletion of file "C:\DOKUME~1\Iliri\LOKALE~1\Temp\winmeayoa.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
  --> the object does not exist


Error:  file "C:\DOKUME~1\Iliri\LOKALE~1\Temp\dxond.exe" not found!
Deletion of file "C:\DOKUME~1\Iliri\LOKALE~1\Temp\dxond.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
  --> the object does not exist


Completed script processing.

*******************

Finished!  Terminate.