FRST-Fix
Virenscanner jetzt bitte komplett deaktivieren, damit sichergestellt ist, dass der Fix sauber durchläuft!
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.
Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
HKU\S-1-5-21-3707763914-2828650107-2775741400-1001\...\Run: [RRRV2SMXUP] => C:\Program Files\ZAUU1FC4ZY\ZAUU1FC4Z.exe [369664 2017-01-01] ()
HKU\S-1-5-21-3707763914-2828650107-2775741400-1001\...\Run: [1HNLNTZGDW] => C:\Program Files\NSWWDIN18Z\NSWWDIN18.exe [369664 2017-01-01] ()
HKU\S-1-5-21-3707763914-2828650107-2775741400-1001\...\Run: [4YFG394BZN] => C:\Program Files\2LA9XOQK4R\2LA9XOQK4.exe [369664 2017-01-01] ()
HKU\S-1-5-21-3707763914-2828650107-2775741400-1001\...\Run: [SA9EN75ICN] => C:\Program Files\Z06UCTZZ10\Z06UCTZZ1.exe [369664 2017-01-01] ()
HKU\S-1-5-21-3707763914-2828650107-2775741400-1001\...\Run: [DVQCLJMAEQ] => C:\Users\Aruran\AppData\Local\Temp\NBGTI2CFT\NBGTI2CFT.exe [369664 2017-01-01] () <===== ACHTUNG
HKU\S-1-5-21-3707763914-2828650107-2775741400-1001\...\Run: [AWFREW3ZKU] => C:\Program Files\394AHT7JYC\394AHT7JY.exe [369664 2017-01-01] ()
HKU\S-1-5-21-3707763914-2828650107-2775741400-1001\...\Run: [7VT3UPTOXR] => C:\Program Files\G5NV6PMZQY\TUTAEOS0P.exe [369664 2017-01-01] ()
HKU\S-1-5-21-3707763914-2828650107-2775741400-1001\...\Run: [48ALI829O4] => C:\Program Files\2UPOF0VUZ8\2UPOF0VUZ.exe [369664 2017-01-01] ()
HKU\S-1-5-21-3707763914-2828650107-2775741400-1001\...\Run: [B9FKZYJYPU] => C:\Program Files\H1ASR0KVAA\H1ASR0KVA.exe [369664 2017-01-01] ()
HKU\S-1-5-21-3707763914-2828650107-2775741400-1001\...\Run: [CIR0HP9PPD] => C:\Users\Aruran\AppData\Local\Temp\Y7QHIVYEP\Y7QHIVYEP.exe [369664 2017-01-01] () <===== ACHTUNG
HKU\S-1-5-21-3707763914-2828650107-2775741400-1001\...\Run: [0AYADRMO1L] => C:\Users\Aruran\AppData\Local\Temp\5ANZUSRV6\5ANZUSRV6.exe [369664 2017-01-01] () <===== ACHTUNG
HKU\S-1-5-21-3707763914-2828650107-2775741400-1001\...\Run: [HIG670TBSL] => C:\Program Files\WSYN11RTPB\WSYN11RTP.exe [369664 2017-01-01] ()
HKU\S-1-5-21-3707763914-2828650107-2775741400-1001\...\Run: [PM1WKY2Y7U] => C:\Users\Aruran\AppData\Local\Temp\O07ST4XN6\O07ST4XN6.exe [369664 2017-01-01] () <===== ACHTUNG
ShellExecuteHooks: Kein Name - {0E1572E8-CC3F-11E6-87D6-64006A5CFC23} - C:\Users\Aruran\AppData\Roaming\Lokiied\Coizis.dll -> Keine Datei
Task: {0B456BE1-1419-4ECB-B378-AA54D62EF56E} - System32\Tasks\{CECE02B3-7965-B518-E4E7-2F25542EAD08} => C:\ProgramData\{05DDD3DF-B276-6474-5CC7-B86433FAE339}\0D3A5193-BA91-E638-BCD1-616F454D345A.exe <==== ACHTUNG
Task: {345BB094-D7CE-4485-B18B-BB6E6113E67F} - System32\Tasks\{689EB747-DF35-00EC-B570-6AB16B35BA53} => C:\ProgramData\{CC009523-7BAB-2288-230F-30FDE668E57E}\48BE59E1-FF15-EE4A-6008-FDDD5BEB120A.exe <==== ACHTUNG
Task: {458306B3-8909-4ABE-A082-A4D69AC20A4C} - System32\Tasks\{51AD42E9-7519-41A3-9144-2B8A2A7B0F58} => Regsvr32.exe /s /n /i:"/rt" "C:\PROGRA~3\e366fc6e\9007857a.dll" <==== ACHTUNG
Task: {4CB771CD-5932-489A-9AC5-800E4AE28EA2} - System32\Tasks\{FA4CBE32-4DE7-0999-0AE0-D79F1C9059F7} => C:\ProgramData\{62BB382F-D510-8F84-5DC3-EBD1D57EC79D}\E94FCAC8-5EE4-7D63-6411-6C42F26F2043.exe <==== ACHTUNG
Task: {7F22EA6C-A5D6-40B1-8DF3-49C7038DFE72} - System32\Tasks\{A8B45195-1F1F-E63E-863B-391E2A604E67} => C:\ProgramData\{569357B0-E138-E01B-DF7B-33C9598DB512}\A96D7853-1EC6-CFF8-8017-39589984F9B6.exe <==== ACHTUNG
Task: {8FFB5DAA-7BF6-4F75-A127-4903D75EC4FC} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG
Task: {9A35D169-00F1-4A3F-9E5A-E7F1EAB861D4} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG
Task: {B5163DAF-6BBD-4D4C-9034-E7AE4963A329} - System32\Tasks\{675B675A-D0F0-D0F1-56D3-080DA1076E60} => C:\ProgramData\{88F78037-3F5C-379C-D3BE-B6783C70F4CA}\4EA4D68D-F90F-6126-5C54-2F00008CD9CA.exe <==== ACHTUNG
Task: {C12A4D22-A980-4748-939A-DC4FBAF8F887} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG
Task: {C8808CE4-E380-4B23-84CA-83D2C4156C73} - System32\Tasks\{F20603A7-45AD-B40C-1F74-17068C597159} => C:\ProgramData\{F5B0148B-421B-A320-68D4-1FB6A68E977A}\B56BB539-02C0-0292-19D1-AF24E7E2B68C.exe <==== ACHTUNG
Task: {D7DD0DEA-C193-4E85-9271-0002515D2453} - System32\Tasks\{11F0C66E-A65B-71C5-D91F-1BAB456A64B0} => C:\ProgramData\{632EDB6A-D485-6CC1-A891-F262EA8DC3DE}\E6427A4F-51E9-CDE4-D717-311225045A97.exe <==== ACHTUNG
Task: {E678182B-DA87-48B4-BB32-278B433E074A} - System32\Tasks\{58CCAE19-EF67-19B2-048E-8AA9CB0C36D6} => C:\ProgramData\{0A063EFE-BDAD-8955-3A52-44CE203D919E}\58766930-EFDD-DE9B-6D55-05DEC9A921D8.exe <==== ACHTUNG
Task: {E93758AC-FE24-4D87-B491-A4967B679F3C} - System32\Tasks\{B39DCCAA-0436-7B01-115A-E0070E00E8F9} => C:\ProgramData\{3386FBFE-842D-4C55-1EAE-4CDE7EA6597E}\A77CD74F-10D7-60E4-B02B-39DD9772AE03.exe <==== ACHTUNG
Task: {FA7C4B09-BF43-4198-B586-886BF9D4C302} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG
C:\Program Files (x86)\ks6ywgdk
C:\Program Files\ZAUU1FC4ZY
C:\Program Files\NSWWDIN18Z
C:\Program Files\2LA9XOQK4R
C:\Program Files\Z06UCTZZ10
C:\Program Files\394AHT7JYC
C:\Program Files\G5NV6PMZQY
C:\Program Files\2UPOF0VUZ8
C:\Program Files\H1ASR0KVAA
C:\Program Files\WSYN11RTPB
C:\Users\Aruran\AppData\Roaming\Lokiied
C:\Program Files (x86)\Delyqgach
C:\WINDOWS\System32\Tasks\Pheroghtlqale Collector
C:\Users\Aruran\AppData\Local\Qepoied
C:\Program Files (x86)\d1c802b0-1c53-4d5f-913b-bee5d5ae526f
C:\Program Files (x86)\901e8fd0-3b04-46c8-9b59-587dbc917638
C:\ProgramData\{05DDD3DF-B276-6474-5CC7-B86433FAE339}
C:\ProgramData\{CC009523-7BAB-2288-230F-30FDE668E57E}
C:\ProgramData\{62BB382F-D510-8F84-5DC3-EBD1D57EC79D}
C:\ProgramData\{569357B0-E138-E01B-DF7B-33C9598DB512}
C:\ProgramData\{88F78037-3F5C-379C-D3BE-B6783C70F4CA}
C:\ProgramData\{F5B0148B-421B-A320-68D4-1FB6A68E977A}
C:\ProgramData\{632EDB6A-D485-6CC1-A891-F262EA8DC3DE}
C:\ProgramData\{0A063EFE-BDAD-8955-3A52-44CE203D919E}
C:\ProgramData\{3386FBFE-842D-4C55-1EAE-4CDE7EA6597E}
C:\PROGRA~3\e366fc6e
emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
- Starte nun FRST erneut und klicke den Entfernen Button.
- Das Tool erstellt eine Fixlog.txt.
- Poste mir deren Inhalt.
| 