Hallo! Hab gerade otl log erstellt.

Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

:OTL
PRC - C:\WINDOWS\system32\wbextsuk¿.exe ()
PRC - C:\Dokumente und Einstellungen\Gerald\wbextsuk¿.exe ()
O4 - HKLM..\Run: [wbextsuk¿] C:\WINDOWS\system32\wbextsuk¿.exe ()
O20 - Winlogon\Notify\geBuUnNG: DllName - geBuUnNG.dll -  File not found
O33 - MountPoints2\{0a3169c6-ee3f-11dd-aefa-002197948c7c}\Shell - "" = AutoRun
O33 - MountPoints2\{0a3169c6-ee3f-11dd-aefa-002197948c7c}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{0a3169c6-ee3f-11dd-aefa-002197948c7c}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{0a3169c7-ee3f-11dd-aefa-002197948c7c}\Shell - "" = AutoRun
O33 - MountPoints2\{0a3169c7-ee3f-11dd-aefa-002197948c7c}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{0a3169c7-ee3f-11dd-aefa-002197948c7c}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{11606aae-894e-11dd-affe-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{11606aae-894e-11dd-affe-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{11606aae-894e-11dd-affe-806d6172696f}\Shell\AutoRun\command - "" = D:\tools\shelexec.exe html\index.htm -- File not found
O33 - MountPoints2\{119bcceb-dcf8-11dd-aed5-002197948c7c}\Shell\AutoRun\command - "" = G:\USBNB.exe -- File not found
O33 - MountPoints2\{1aac1b1e-d9c8-11dd-aecc-df022588aa11}\Shell - "" = AutoRun
O33 - MountPoints2\{1aac1b1e-d9c8-11dd-aecc-df022588aa11}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{1aac1b1e-d9c8-11dd-aecc-df022588aa11}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not found
O33 - MountPoints2\{56f7fdb4-f606-11dd-af06-002197948c7c}\Shell - "" = AutoRun
O33 - MountPoints2\{56f7fdb4-f606-11dd-af06-002197948c7c}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{56f7fdb4-f606-11dd-af06-002197948c7c}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{56f7fdb5-f606-11dd-af06-002197948c7c}\Shell - "" = AutoRun
O33 - MountPoints2\{56f7fdb5-f606-11dd-af06-002197948c7c}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{56f7fdb5-f606-11dd-af06-002197948c7c}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{b80d4e68-3190-11de-af68-002197948c7c}\Shell\AutoRun\command - "" = forever.exe
O33 - MountPoints2\{b80d4e68-3190-11de-af68-002197948c7c}\Shell\open\command - "" = forever.exe
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\Setup.exe -- File not found
[2010.06.11 01:12:43 | 000,000,000 | ---D | C] -- C:\INFECTED
[2010.06.07 22:30:52 | 000,038,912 | ---- | M] () -- C:\windows\System32\wbextsuk¿.exe
[2010.06.07 22:30:52 | 000,038,912 | ---- | M] () -- C:\Dokumente und Einstellungen\Gerald\wbextsuk¿.exe
:Commands
[purity]
[resethosts]
[emptytemp]
         

Klick dann auf den Button Run Fixes!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Hab ich gemacht, der Computer wurde heruntergefahren und beim hochfahren fragt mich spybot das ein wichtiger Registrierungsdatenbank-eintrag geändert wurde.
Kategorie: System Startup global entry
Änderung: Value gelöscht
Eintrag: wbextsuk und ein verkehrtes fragezeichen
Alte Daten: C:\windows\System32\wbextsuk verkehrtes fragezeichen .exe

Soll ich erlauben oder verweigern? soll ich spybot deinstallieren?

Deinstallier Spybot, das Tool hat seine besten Jahr hinter sich!!

So Spybot ist weg!
Und hier ist der log


All processes killed
========== OTL ==========
No active process named wbextsuk¿.exe was found!
No active process named wbextsuk¿.exe was found!
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\wbextsuk¿ deleted successfully.
C:\WINDOWS\system32\wbextsuk¿.exe moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\geBuUnNG\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a3169c6-ee3f-11dd-aefa-002197948c7c}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0a3169c6-ee3f-11dd-aefa-002197948c7c}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a3169c6-ee3f-11dd-aefa-002197948c7c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0a3169c6-ee3f-11dd-aefa-002197948c7c}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a3169c6-ee3f-11dd-aefa-002197948c7c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0a3169c6-ee3f-11dd-aefa-002197948c7c}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a3169c7-ee3f-11dd-aefa-002197948c7c}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0a3169c7-ee3f-11dd-aefa-002197948c7c}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a3169c7-ee3f-11dd-aefa-002197948c7c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0a3169c7-ee3f-11dd-aefa-002197948c7c}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a3169c7-ee3f-11dd-aefa-002197948c7c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0a3169c7-ee3f-11dd-aefa-002197948c7c}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{11606aae-894e-11dd-affe-806d6172696f}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11606aae-894e-11dd-affe-806d6172696f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{11606aae-894e-11dd-affe-806d6172696f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11606aae-894e-11dd-affe-806d6172696f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{11606aae-894e-11dd-affe-806d6172696f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11606aae-894e-11dd-affe-806d6172696f}\ not found.
File D:\tools\shelexec.exe html\index.htm not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{119bcceb-dcf8-11dd-aed5-002197948c7c}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{119bcceb-dcf8-11dd-aed5-002197948c7c}\ not found.
File G:\USBNB.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1aac1b1e-d9c8-11dd-aecc-df022588aa11}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1aac1b1e-d9c8-11dd-aecc-df022588aa11}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1aac1b1e-d9c8-11dd-aecc-df022588aa11}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1aac1b1e-d9c8-11dd-aecc-df022588aa11}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1aac1b1e-d9c8-11dd-aecc-df022588aa11}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1aac1b1e-d9c8-11dd-aecc-df022588aa11}\ not found.
File G:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{56f7fdb4-f606-11dd-af06-002197948c7c}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56f7fdb4-f606-11dd-af06-002197948c7c}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{56f7fdb4-f606-11dd-af06-002197948c7c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56f7fdb4-f606-11dd-af06-002197948c7c}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{56f7fdb4-f606-11dd-af06-002197948c7c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56f7fdb4-f606-11dd-af06-002197948c7c}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{56f7fdb5-f606-11dd-af06-002197948c7c}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56f7fdb5-f606-11dd-af06-002197948c7c}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{56f7fdb5-f606-11dd-af06-002197948c7c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56f7fdb5-f606-11dd-af06-002197948c7c}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{56f7fdb5-f606-11dd-af06-002197948c7c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56f7fdb5-f606-11dd-af06-002197948c7c}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b80d4e68-3190-11de-af68-002197948c7c}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b80d4e68-3190-11de-af68-002197948c7c}\ not found.
File forever.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b80d4e68-3190-11de-af68-002197948c7c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b80d4e68-3190-11de-af68-002197948c7c}\ not found.
File forever.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ not found.
File E:\Setup.exe not found.
C:\INFECTED folder moved successfully.
File C:\windows\System32\wbextsuk¿.exe not found.
C:\Dokumente und Einstellungen\Gerald\wbextsuk¿.exe moved successfully.
========== COMMANDS ==========
C:\windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->FireFox cache emptied: 3379920 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Gerald
->Temp folder emptied: 1618027 bytes
->Temporary Internet Files folder emptied: 39544913 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 36647448 bytes
->Flash cache emptied: 6698 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 14471998 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33237 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1139177 bytes
%systemroot%\System32 .tmp files removed: 2933127 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 82400 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 95,00 mb


OTL by OldTimer - Version 3.2.6.0 log created on 06132010_153325

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Verpack den Ordner C:\_OTL bitte mal in eine ZIP-Datei, vorher den Virenscanner deaktivieren, damit auch wirklich Dateien da mit in die ZIP kommen. Danach bei uns hochladen => http://www.trojaner-board.de/54791-a...ner-board.html

Hab ich gemacht!
Hoff das passt so!

Vielen Dank nochmals für Deine Hilfe und Geduld!

Jetzt ist eine 2te Zip datei hochgeladen worden, diesmal mit abgeschaltenen Antivir.
Sorry

Hallo Arne!!!

Was soll ich, deiner Meinung nach jetzt machen?
Formatieren???
Meine Bedenken sind das sich vielleicht ein Virus irgendwo versteckt und ich Zeit investiere das System neu aufzusetzen und dann hol ich ihn mir von irgendeiner versteckten Datei wieder rein. Denk ich da falsch?

Gruß daGeri

Wenn Du ein garantiert sauberes System wieder haben willst, führt nichts an format c: vorbei.

aber wenn sich die Firewall ständig abschaltet und ich neue Treiber für das Internet installiere und ich trotzdem nicht ins Netz komm...versteckt sich da nicht irgendwas irgendwo?
Oder lieg ich da falsch?

Ich hab doch geschrieben(!!) => Wenn Du ein garantiert sauberes System wieder haben willst, führt nichts an format c: vorbei.

Wir können auch noch weiter mit Combofix machen. Entscheide Dich dafür oder für format c:

Hallo!
Jetzt hab ich neu aufgesetzt und hoffe das ich lange verschont bleib.
Vielen Dank für Deine Hilfe und Geduld!

daGeri