Trojaner-Board - BDS/Cybot.B.2825 und TR/Spy.Gen entdeckt

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)
Code:
:OTL

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4

IE - HKLM\..\URLSearchHook: {5786d022-540e-4699-b350-b4be0ae94b79} - Reg Error: Key error. File not found

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.facemoods.com/?a=ddrnw

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:52141

FF - prefs.js..browser.search.defaultenginename: "Facemoods Search"

FF - prefs.js..browser.search.selectedEngine: "Facemoods Search"

FF - prefs.js..browser.startup.homepage: "www.Creeping-Cries.de"

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6

FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2

FF - prefs.js..network.proxy.http: "127.0.0.1"

FF - prefs.js..network.proxy.http_port: 52141

FF - prefs.js..network.proxy.type: 4

O4 - HKLM..\RunOnce: [svchost.exe] C:\Windows\System32\2790\svchost.exe (Microsoft) 

[2011.06.08 23:23:12 | 000,000,032 | ---- | M] () -- C:\Windows\0

[2011.06.08 22:47:51 | 000,000,000 | ---- | M] () -- C:\Windows\System32\0

@Alternate Data Stream - 96 bytes -> C:\ProgramData\Temp:5BC73C48

@Alternate Data Stream - 147 bytes -> C:\ProgramData\Temp:D390A6A7

@Alternate Data Stream - 147 bytes -> C:\ProgramData\Temp:6AF67671

@Alternate Data Stream - 145 bytes -> C:\ProgramData\Temp:EF5B3572

@Alternate Data Stream - 145 bytes -> C:\ProgramData\Temp:3D186293

@Alternate Data Stream - 145 bytes -> C:\ProgramData\Temp:0EC7A545

@Alternate Data Stream - 144 bytes -> C:\ProgramData\Temp:526B3022

@Alternate Data Stream - 144 bytes -> C:\ProgramData\Temp:30E0D641

@Alternate Data Stream - 143 bytes -> C:\ProgramData\Temp:F43B7E8F

@Alternate Data Stream - 142 bytes -> C:\ProgramData\Temp:EF0C5444

@Alternate Data Stream - 142 bytes -> C:\ProgramData\Temp:CBEB737E

@Alternate Data Stream - 140 bytes -> C:\ProgramData\Temp:EBCF5924

@Alternate Data Stream - 140 bytes -> C:\ProgramData\Temp:A02025CE

@Alternate Data Stream - 140 bytes -> C:\ProgramData\Temp:99AC3203

@Alternate Data Stream - 140 bytes -> C:\ProgramData\Temp:5FA4CB99

@Alternate Data Stream - 140 bytes -> C:\ProgramData\Temp:0F38B460

@Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:CF2C26D2

@Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:680086AB

@Alternate Data Stream - 137 bytes -> C:\ProgramData\Temp:EE39C93C

@Alternate Data Stream - 137 bytes -> C:\ProgramData\Temp:EA10407C

@Alternate Data Stream - 137 bytes -> C:\ProgramData\Temp:E14FA16F

@Alternate Data Stream - 137 bytes -> C:\ProgramData\Temp:61AF2B29

@Alternate Data Stream - 136 bytes -> C:\ProgramData\Temp:9A7BF72D

@Alternate Data Stream - 136 bytes -> C:\ProgramData\Temp:6017A808

@Alternate Data Stream - 136 bytes -> C:\ProgramData\Temp:488F7244

@Alternate Data Stream - 135 bytes -> C:\ProgramData\Temp:F8F070C2

@Alternate Data Stream - 135 bytes -> C:\ProgramData\Temp:6247E766

@Alternate Data Stream - 134 bytes -> C:\ProgramData\Temp:8944C195

@Alternate Data Stream - 134 bytes -> C:\ProgramData\Temp:700B9342

@Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:7E082023

@Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:55E1514E

@Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:48977386

@Alternate Data Stream - 132 bytes -> C:\ProgramData\Temp:FED25C29

@Alternate Data Stream - 131 bytes -> C:\ProgramData\Temp:C5E2BAEE

@Alternate Data Stream - 131 bytes -> C:\ProgramData\Temp:68A56598

@Alternate Data Stream - 129 bytes -> C:\ProgramData\Temp:DD04902E

@Alternate Data Stream - 129 bytes -> C:\ProgramData\Temp:A0CB43B2

@Alternate Data Stream - 129 bytes -> C:\ProgramData\Temp:9F38BF31

@Alternate Data Stream - 129 bytes -> C:\ProgramData\Temp:98982C88

@Alternate Data Stream - 129 bytes -> C:\ProgramData\Temp:7972CF54

@Alternate Data Stream - 128 bytes -> C:\ProgramData\Temp:AC0528D9

@Alternate Data Stream - 127 bytes -> C:\ProgramData\Temp:FC8FFA4E

@Alternate Data Stream - 127 bytes -> C:\ProgramData\Temp:F986CC21

@Alternate Data Stream - 126 bytes -> C:\ProgramData\Temp:A4AF8D0D

@Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:E895790F

@Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:0E22C5DB

@Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:5FFC2819

@Alternate Data Stream - 123 bytes -> C:\ProgramData\Temp:C8207070

@Alternate Data Stream - 123 bytes -> C:\ProgramData\Temp:BD27B7FC

@Alternate Data Stream - 123 bytes -> C:\ProgramData\Temp:598E0FFA

@Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:A3B8F70C

@Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:9F50A55A

@Alternate Data Stream - 121 bytes -> C:\ProgramData\Temp:109734F6

@Alternate Data Stream - 120 bytes -> C:\ProgramData\Temp:BF6C81B2

@Alternate Data Stream - 120 bytes -> C:\ProgramData\Temp:3E06C78F

@Alternate Data Stream - 120 bytes -> C:\ProgramData\Temp:206470A5

@Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:C8E82994

@Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:2495D97A

@Alternate Data Stream - 118 bytes -> C:\ProgramData\Temp:3D36932D

@Alternate Data Stream - 118 bytes -> C:\ProgramData\Temp:2B1EA607

@Alternate Data Stream - 118 bytes -> C:\ProgramData\Temp:275AA066

@Alternate Data Stream - 117 bytes -> C:\ProgramData\Temp:70E897B5

@Alternate Data Stream - 117 bytes -> C:\ProgramData\Temp:6C5EC3CD

@Alternate Data Stream - 116 bytes -> C:\ProgramData\Temp:A296A63F

@Alternate Data Stream - 115 bytes -> C:\ProgramData\Temp:5E9B629B

@Alternate Data Stream - 114 bytes -> C:\ProgramData\Temp:774A0E14

@Alternate Data Stream - 113 bytes -> C:\ProgramData\Temp:7FCB9D0D

@Alternate Data Stream - 111 bytes -> C:\ProgramData\Temp:3C282BEA

@Alternate Data Stream - 110 bytes -> C:\ProgramData\Temp:57B2B96C

@Alternate Data Stream - 109 bytes -> C:\ProgramData\Temp:95198126

@Alternate Data Stream - 109 bytes -> C:\ProgramData\Temp:0ED4AC2F

@Alternate Data Stream - 108 bytes -> C:\ProgramData\Temp:C0A9D0E7

@Alternate Data Stream - 105 bytes -> C:\ProgramData\Temp:225CD7D5

@Alternate Data Stream - 104 bytes -> C:\ProgramData\Temp:569CEE83

@Alternate Data Stream - 102 bytes -> C:\ProgramData\Temp:7C63B8CE

@Alternate Data Stream - 101 bytes -> C:\ProgramData\Temp:B91EDB04

:Files

C:\Windows\System32\2790

:Commands

[purity]

[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.