Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Ihr Computer ist gesperrt. Ich kriege es trotz guter Anleitung nicht weg (https://www.trojaner-board.de/128655-computer-gesperrt-kriege-trotz-guter-anleitung-weg.html)

Patient107 27.12.2012 15:02
Ihr Computer ist gesperrt. Ich kriege es trotz guter Anleitung nicht weg
 
Hallo,
mein dad brachte mir grade sein Notebook und es zeigt in einem großen roten balken "Ihr Computer ist Gesperrt" zahle 100Euros um ihn wieder nutzen zu können.
Über Google konnte ich einen Beitrag in diesem Forum finden, der sich genau um dieses Thema kümmerte.
Die Anweisungen habe ich befolgt. Ich habe die Datei OTLPENet.exe geladen, auf eine CD gebrannt und alles weitere genau so ausgeführt. Am ende bin ich jedoch ins fliegen gekommen.
Ich habe das Programm auf seinem Notebook gestartet und ausgeführt. Er hat denn zwei .txt dateien erstellt und das wars auch schon. Nach dem neustart habe ich aber das selbe problem noch immer. Habe ich was flasch gemacht?
Ich bitte inständig um Hilfe. mein Vater geht mir richtig auf den keks weil er nicht googeln kann. :-)

markusg 27.12.2012 15:13
Hi,
na das erstellen von Berichten löscht nichts, wir benötigen die Berichte bitte.

Patient107 27.12.2012 15:16
Achso,
das sind nur Berichte. Ich dachte das Teil löst das Problem. Ok. Denn hole ich die Datei mal rüber und poste sie.
Danke

markusg 27.12.2012 16:29
Hi
alles klar.
USB Laufwerke sollten auf jeden Fall funktionieren.

Patient107 28.12.2012 08:45
Guten Morgen.
Es hat etwas gedauert. Aber hier ist der Inhalt von der Datei.OTL Logfile:
Code:
OTL logfile created on: 12/28/2012 8:33:34 AM - Run
OTLPE by OldTimer - Version 3.1.48.0    Folder = X:\Programs\OTLPE
Windows 7 Home Premium Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,014.00 Mb Total Physical Memory | 820.00 Mb Available Physical Memory | 81.00% Memory free
902.00 Mb Paging File | 846.00 Mb Available in Paging File | 94.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = D: | %SystemRoot% = D:\Windows | %ProgramFiles% = D:\Program Files
Drive C: | 100.00 Mb Total Space | 75.86 Mb Free Space | 75.87% Space Free | Partition Type: NTFS
Drive D: | 74.43 Gb Total Space | 31.56 Gb Free Space | 42.40% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012/12/27 07:20:35 | 000,225,280 | ---- | M] (Корпорация Майкрософт) [Auto] -- D:\Users\Georg\wgsdgsdgdsgsd.dll -- (Winmgmt)
SRV - [2012/12/11 15:49:27 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- D:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/12/06 07:34:47 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand] -- D:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/11/20 09:09:00 | 000,188,760 | ---- | M] () [Auto] -- D:\Program Files\Web Assistant\ExtensionUpdaterService.exe -- (Web Assistant Updater)
SRV - [2012/09/10 13:01:01 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2012/09/05 10:56:44 | 000,234,776 | ---- | M] (McAfee, Inc.) [On_Demand] -- D:\Program Files\McAfee Security Scan\3.0.285\McCHSvc.exe -- (McComponentHostService)
SRV - [2012/07/27 15:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto] -- D:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2010/03/08 18:40:36 | 000,144,672 | ---- | M] (Nuance Communications, Inc.) [Auto] -- D:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe -- (PDFProFiltSrvPP)
SRV - [2010/01/25 02:22:56 | 000,245,760 | ---- | M] (Brother Industries, Ltd.) [On_Demand] -- D:\Program Files\Browny02\BrYNSvc.exe -- (BrYNSvc)
SRV - [2009/07/13 20:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 20:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto] -- D:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011/08/17 02:56:32 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand] -- D:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2011/08/17 02:56:30 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand] -- D:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2011/08/17 02:56:26 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand] -- D:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2011/08/17 02:56:22 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand] -- D:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2010/11/20 16:29:24 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 16:29:03 | 000,027,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\system32\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV - [2009/07/13 19:18:07 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV - [2009/07/13 18:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\URLSearchHook: {990af1c2-5a27-4460-8149-ecc6bc122af3} - D:\Program Files\IncrediMail_MediaBar_Deutsch_2\prxtbIncr.dll (Conduit Ltd.)
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Georg_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = MyStart by IncrediMail.com
IE - HKU\Georg_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKU\Georg_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\Georg_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C9 FF 9E E0 BF 77 CD 01  [binary data]
IE - HKU\Georg_ON_D\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - D:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKU\Georg_ON_D\..\URLSearchHook: {990af1c2-5a27-4460-8149-ecc6bc122af3} - D:\Program Files\IncrediMail_MediaBar_Deutsch_2\prxtbIncr.dll (Conduit Ltd.)
IE - HKU\Georg_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "MyStart Search"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "MyStart Search"
FF - prefs.js..browser.startup.homepage: "hxxp://mystart.incredimail.com/?a=1eyoF7upjdl"
FF - prefs.js..keyword.URL: "hxxp://mystart.incredimail.com//?loc=ff_address_bar&a=1eyoF7upjdl&search="
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: D:\Windows\System32\Macromed\Flash\NPSWF32_11_5_502_135.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: D:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: D:\Windows\System32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: D:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: D:\Windows\System32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: D:\Program Files\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: D:\Program Files\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: D:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\Firefox [2012/12/12 11:18:26 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/12/06 07:34:48 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/12/06 07:34:48 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2012/08/11 07:53:48 | 000,000,000 | ---D | M] (No name found) -- D:\Users\Georg\AppData\Roaming\Mozilla\Extensions
[2012/12/12 11:16:01 | 000,000,000 | ---D | M] (No name found) -- D:\Users\Georg\AppData\Roaming\Mozilla\Firefox\Profiles\jx7ko35g.default\extensions
[2012/12/12 11:16:04 | 000,000,000 | ---D | M] (IncrediMail MediaBar Deutsch 2) -- D:\Users\Georg\AppData\Roaming\Mozilla\Firefox\Profiles\jx7ko35g.default\extensions\{990af1c2-5a27-4460-8149-ecc6bc122af3}
[2012/10/28 10:43:05 | 000,000,000 | ---D | M] ("Ask Toolbar") -- D:\Users\Georg\AppData\Roaming\Mozilla\Firefox\Profiles\jx7ko35g.default\extensions\toolbar@ask.com
[2012/10/30 13:50:48 | 000,002,399 | ---- | M] () -- D:\Users\Georg\AppData\Roaming\Mozilla\Firefox\Profiles\jx7ko35g.default\searchplugins\askcom.xml
[2012/12/12 11:13:44 | 000,002,197 | ---- | M] () -- D:\Users\Georg\AppData\Roaming\Mozilla\Firefox\Profiles\jx7ko35g.default\searchplugins\MyStart Search.xml
[2012/12/06 07:34:26 | 000,000,000 | ---D | M] (No name found) -- D:\Program Files\Mozilla Firefox\extensions
File not found (No name found) --
[2012/12/06 07:34:48 | 000,262,112 | ---- | M] (Mozilla Foundation) -- D:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/07/13 19:45:08 | 000,001,392 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/08/31 13:04:20 | 000,002,465 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/07/13 19:45:08 | 000,001,153 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012/07/13 19:45:08 | 000,006,805 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/07/13 19:45:08 | 000,001,178 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/07/13 19:45:07 | 000,001,105 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009/06/10 16:39:37 | 000,000,824 | ---- | M]) - D:\Windows\System32\drivers\etc\hosts
O2 - BHO: (IB Updater) - {336D0C35-8A85-403a-B9D2-65C292C39087} - D:\Program Files\Web Assistant\Extension32.dll ()
O2 - BHO: (PlusIEEventHelper Class) - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - D:\Program Files\Nuance\PDF Viewer Plus\bin\PlusIEContextMenu.dll (Zeon Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (IncrediMail MediaBar Deutsch 2 Toolbar) - {990af1c2-5a27-4460-8149-ecc6bc122af3} - D:\Program Files\IncrediMail_MediaBar_Deutsch_2\prxtbIncr.dll (Conduit Ltd.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - D:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (IncrediMail MediaBar Deutsch 2 Toolbar) - {990af1c2-5a27-4460-8149-ecc6bc122af3} - D:\Program Files\IncrediMail_MediaBar_Deutsch_2\prxtbIncr.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - D:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\Georg_ON_D\..\Toolbar\WebBrowser: (IncrediMail MediaBar Deutsch 2 Toolbar) - {990AF1C2-5A27-4460-8149-ECC6BC122AF3} - D:\Program Files\IncrediMail_MediaBar_Deutsch_2\prxtbIncr.dll (Conduit Ltd.)
O3 - HKU\Georg_ON_D\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - D:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ApnUpdater] D:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [BrStsMon00] D:\Program Files\Browny02\Brother\BrStMonW.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [ControlCenter4] D:\Program Files\ControlCenter4\BrCcBoot.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [IndexSearch] D:\Program Files\Nuance\PaperPort\IndexSearch.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PaperPort PTD] D:\Program Files\Nuance\PaperPort\pptd40nt.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDF5 Registry Controller] D:\Program Files\Nuance\PDF Viewer Plus\RegistryController.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDFHook] D:\Program Files\Nuance\PDF Viewer Plus\pdfPro5Hook.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PPort12reminder] D:\Program Files\Nuance\PaperPort\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKU\Georg_ON_D..\Run: [IncrediMail] D:\Program Files\IncrediMail\bin\IncMail.exe (IncrediMail, Ltd.)
O4 - HKU\Georg_ON_D..\Run: [ISUSPM] D:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)
O4 - HKU\LocalService_ON_D..\RunOnce: [mctadmin] D:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_D..\RunOnce: [mctadmin] D:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - Startup: D:\Users\Georg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ()
O4 - Startup: D:\Users\Georg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk ()
O4 - Startup: D:\Users\Georg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O13 - gopher Prefix: missing
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - D:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - D:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 16:42:20 | 000,000,024 | ---- | M] () - D:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/12/20 18:16:12 | 000,295,424 | ---- | C] (Adobe Systems Incorporated) -- D:\Windows\System32\atmfd.dll
[2012/12/20 18:16:12 | 000,034,304 | ---- | C] (Adobe Systems) -- D:\Windows\System32\atmlib.dll
[2012/12/19 09:15:52 | 000,000,000 | ---D | C] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2012/12/13 18:40:01 | 002,382,848 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\mshtml.tlb
[2012/12/13 18:40:00 | 000,420,864 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\vbscript.dll
[2012/12/13 18:40:00 | 000,176,640 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\ieui.dll
[2012/12/13 18:40:00 | 000,065,024 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\jsproxy.dll
[2012/12/13 18:39:59 | 000,607,744 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\msfeeds.dll
[2012/12/13 18:39:59 | 000,142,848 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\ieUnatt.exe
[2012/12/13 18:39:58 | 001,800,704 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\jscript9.dll
[2012/12/13 18:39:58 | 000,717,824 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\jscript.dll
[2012/12/13 18:39:58 | 000,231,936 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\url.dll
[2012/12/13 18:39:56 | 001,427,968 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\inetcpl.cpl
[2012/12/13 15:39:18 | 002,345,984 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\win32k.sys
[2012/12/13 15:39:11 | 000,271,360 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\conhost.exe
[2012/12/13 15:39:11 | 000,169,984 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\winsrv.dll
[2012/12/13 15:39:10 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
[2012/12/13 15:39:10 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
[2012/12/13 15:39:10 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
[2012/12/13 15:39:10 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
[2012/12/13 15:39:10 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
[2012/12/13 15:39:10 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
[2012/12/13 15:39:10 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
[2012/12/13 15:39:10 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
[2012/12/13 15:39:10 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
[2012/12/13 15:39:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
[2012/12/13 15:39:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
[2012/12/13 15:39:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
[2012/12/13 15:39:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
[2012/12/13 15:39:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
[2012/12/13 15:39:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
[2012/12/13 15:39:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
[2012/12/13 15:39:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
[2012/12/13 15:39:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
[2012/12/13 15:39:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012/12/13 15:39:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
[2012/12/13 15:39:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
[2012/12/13 15:39:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
[2012/12/13 15:39:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
[2012/12/13 15:39:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
[2012/12/13 15:39:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
[2012/12/13 15:39:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
[2012/12/13 15:39:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
[2012/12/13 15:39:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
[2012/12/13 15:38:58 | 000,376,832 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\dpnet.dll
[2012/12/13 15:38:52 | 000,002,048 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\tzres.dll
[2012/12/13 15:32:56 | 000,000,000 | ---D | C] -- D:\Users\Georg\AppData\Roaming\LaunchPad
[2012/12/12 11:15:47 | 000,000,000 | ---D | C] -- D:\Program Files\Conduit
[2012/12/12 11:15:42 | 000,000,000 | ---D | C] -- D:\Users\Georg\AppData\Local\Conduit
[2012/12/12 11:15:40 | 000,000,000 | ---D | C] -- D:\Program Files\IncrediMail_MediaBar_Deutsch_2
[2012/12/06 07:34:24 | 000,000,000 | ---D | C] -- D:\Program Files\Mozilla Firefox
 
========== Files - Modified Within 30 Days ==========
 
[2012/12/27 09:15:34 | 000,067,584 | --S- | M] () -- D:\Windows\bootstat.dat
[2012/12/27 09:12:05 | 095,023,320 | ---- | M] () -- D:\ProgramData\dsgsdgdsgdsgw.pad
[2012/12/27 09:10:03 | 000,001,096 | ---- | M] () -- D:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/12/27 09:03:13 | 000,025,328 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/12/27 09:03:13 | 000,025,328 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/12/27 08:56:04 | 000,001,092 | ---- | M] () -- D:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/12/27 08:55:17 | 797,777,920 | -HS- | M] () -- D:\hiberfil.sys
[2012/12/27 07:20:55 | 000,002,890 | ---- | M] () -- D:\ProgramData\dsgsdgdsgdsgw.js
[2012/12/27 07:20:55 | 000,001,045 | ---- | M] () -- D:\Users\Georg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk
[2012/12/26 17:49:01 | 000,000,884 | ---- | M] () -- D:\Windows\tasks\Adobe Flash Player Updater.job
[2012/12/26 17:16:18 | 000,001,049 | ---- | M] () -- D:\Users\Georg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2012/12/26 17:15:50 | 000,001,017 | ---- | M] () -- D:\Users\Georg\Desktop\Dropbox.lnk
[2012/12/22 14:40:19 | 000,011,876 | ---- | M] () -- D:\Users\Georg\Documents\Fernsehkanäle.odt
[2012/12/21 12:41:54 | 000,295,264 | ---- | M] () -- D:\Windows\System32\FNTCACHE.DAT
[2012/12/19 09:15:52 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2012/12/16 09:13:28 | 000,295,424 | ---- | M] (Adobe Systems Incorporated) -- D:\Windows\System32\atmfd.dll
[2012/12/16 09:13:20 | 000,034,304 | ---- | M] (Adobe Systems) -- D:\Windows\System32\atmlib.dll
[2012/12/15 16:19:14 | 000,829,277 | ---- | M] () -- D:\Users\Georg\Documents\Alko Tiefrahmen_Mercedes_Sprinter.pdf
[2012/12/13 18:09:08 | 002,157,299 | ---- | M] () -- D:\Users\Georg\Documents\autozug sommerkatalog.pdf
[2012/12/12 11:17:23 | 000,001,995 | ---- | M] () -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\IncrediMail.lnk
[2012/12/12 11:17:23 | 000,001,975 | ---- | M] () -- D:\Users\Georg\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\IncrediMail 2.0.lnk
[2012/12/12 11:17:23 | 000,000,000 | R--D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
[2012/12/12 11:17:23 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\IncrediMail
[2012/12/12 11:16:06 | 000,000,009 | ---- | M] () -- D:\END
[2012/12/11 15:49:27 | 000,697,272 | ---- | M] (Adobe Systems Incorporated) -- D:\Windows\System32\FlashPlayerApp.exe
[2012/12/11 15:49:27 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- D:\Windows\System32\FlashPlayerCPLApp.cpl
 
========== Files Created - No Company Name ==========
 
[2012/12/27 07:20:55 | 000,002,890 | ---- | C] () -- D:\ProgramData\dsgsdgdsgdsgw.js
[2012/12/27 07:20:55 | 000,001,045 | ---- | C] () -- D:\Users\Georg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk
[2012/12/27 07:20:43 | 095,023,320 | ---- | C] () -- D:\ProgramData\dsgsdgdsgdsgw.pad
[2012/12/22 14:40:17 | 000,011,876 | ---- | C] () -- D:\Users\Georg\Documents\Fernsehkanäle.odt
[2012/12/15 16:19:14 | 000,829,277 | ---- | C] () -- D:\Users\Georg\Documents\Alko Tiefrahmen_Mercedes_Sprinter.pdf
[2012/12/13 18:09:08 | 002,157,299 | ---- | C] () -- D:\Users\Georg\Documents\autozug sommerkatalog.pdf
[2012/12/12 11:17:23 | 000,001,995 | ---- | C] () -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\IncrediMail.lnk
[2012/12/12 11:17:23 | 000,001,975 | ---- | C] () -- D:\Users\Georg\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\IncrediMail 2.0.lnk
[2012/12/12 11:15:52 | 000,000,009 | ---- | C] () -- D:\END
[2012/11/23 04:30:58 | 000,000,248 | ---- | C] () -- D:\Windows\Brpfx04a.ini
[2012/11/23 04:30:58 | 000,000,093 | ---- | C] () -- D:\Windows\brpcfx.ini
[2012/11/23 04:30:27 | 000,002,944 | ---- | C] () -- D:\Windows\BRPARAM.INI
[2012/11/23 04:28:59 | 000,000,066 | ---- | C] () -- D:\Windows\Brfaxrx.ini
[2012/11/23 04:28:58 | 000,000,000 | ---- | C] () -- D:\Windows\brdfxspd.dat
[2012/11/23 04:28:44 | 000,045,056 | ---- | C] () -- D:\Windows\System32\BRTCPCON.DLL
[2012/11/23 04:28:39 | 000,000,114 | ---- | C] () -- D:\Windows\System32\BRLMW03A.INI
[2012/08/11 07:46:11 | 000,140,288 | ---- | C] () -- D:\Windows\System32\igfxtvcx.dll
[2011/04/11 20:30:05 | 000,654,166 | ---- | C] () -- D:\Windows\System32\perfh007.dat
[2011/04/11 20:30:05 | 000,295,922 | ---- | C] () -- D:\Windows\System32\perfi007.dat
[2011/04/11 20:30:05 | 000,130,006 | ---- | C] () -- D:\Windows\System32\perfc007.dat
[2011/04/11 20:30:05 | 000,038,104 | ---- | C] () -- D:\Windows\System32\perfd007.dat
[2010/11/20 16:29:24 | 000,252,928 | ---- | C] () -- D:\Windows\System32\DShowRdpFilter.dll
[2010/05/21 10:10:06 | 000,034,153 | ---- | C] () -- D:\Windows\MAXLINK.INI
[2009/09/23 12:16:08 | 002,050,952 | ---- | C] () -- D:\Windows\System32\igkrng400.bin
[2009/07/13 23:57:37 | 000,067,584 | --S- | C] () -- D:\Windows\bootstat.dat
[2009/07/13 23:33:53 | 000,295,264 | ---- | C] () -- D:\Windows\System32\FNTCACHE.DAT
[2009/07/13 21:05:48 | 000,616,008 | ---- | C] () -- D:\Windows\System32\perfh009.dat
[2009/07/13 21:05:48 | 000,291,294 | ---- | C] () -- D:\Windows\System32\perfi009.dat
[2009/07/13 21:05:48 | 000,106,388 | ---- | C] () -- D:\Windows\System32\perfc009.dat
[2009/07/13 21:05:48 | 000,031,548 | ---- | C] () -- D:\Windows\System32\perfd009.dat
[2009/07/13 21:05:05 | 000,000,741 | ---- | C] () -- D:\Windows\System32\NOISE.DAT
[2009/07/13 21:04:11 | 000,215,943 | ---- | C] () -- D:\Windows\System32\dssec.dat
[2009/07/13 18:55:01 | 000,043,131 | ---- | C] () -- D:\Windows\mib.bin
[2009/07/13 18:51:43 | 000,073,728 | ---- | C] () -- D:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 18:42:10 | 000,064,000 | ---- | C] () -- D:\Windows\System32\BWContextHandler.dll
[2009/06/10 16:26:10 | 000,673,088 | ---- | C] () -- D:\Windows\System32\mlang.dat
 
========== LOP Check ==========
 
[2012/08/11 07:27:11 | 000,000,000 | -HSD | M] -- D:\ProgramData\Anwendungsdaten
[2009/07/13 23:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Application Data
[2012/10/28 09:37:28 | 000,000,000 | ---D | M] -- D:\ProgramData\Ask
[2012/11/23 04:29:07 | 000,000,000 | ---D | M] -- D:\ProgramData\ControlCenter4
[2009/07/13 23:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Desktop
[2009/07/13 23:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Documents
[2012/08/11 07:27:11 | 000,000,000 | -HSD | M] -- D:\ProgramData\Dokumente
[2012/08/11 07:27:11 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favoriten
[2009/07/13 23:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favorites
[2012/08/13 07:18:09 | 000,000,000 | ---D | M] -- D:\ProgramData\IM
[2012/08/13 07:16:53 | 000,000,000 | ---D | M] -- D:\ProgramData\IncrediMail
[2012/11/23 04:38:10 | 000,000,000 | ---D | M] -- D:\ProgramData\Nuance
[2012/08/13 07:17:40 | 000,000,000 | ---D | M] -- D:\ProgramData\Photo Notifier and Animation Creator
[2012/11/23 04:23:18 | 000,000,000 | ---D | M] -- D:\ProgramData\ScanSoft
[2009/07/13 23:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Start Menu
[2012/08/11 07:27:11 | 000,000,000 | -HSD | M] -- D:\ProgramData\Startmenü
[2009/07/13 23:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Templates
[2012/08/11 07:27:11 | 000,000,000 | -HSD | M] -- D:\ProgramData\Vorlagen
[2012/11/23 04:24:27 | 000,000,000 | ---D | M] -- D:\ProgramData\zeon
[2012/11/18 12:43:24 | 000,032,634 | ---- | M] () -- D:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
< End of report >
--- --- ---

markusg 28.12.2012 15:04
Hi,
auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort
rein:
Code:
:OTL
O4 - Startup: D:\Users\Georg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk ()
[2012/12/27 09:12:05 | 095,023,320 | ---- | M] () -- D:\ProgramData\dsgsdgdsgdsgw.pad
[2012/12/27 07:20:55 | 000,002,890 | ---- | C] () -- D:\ProgramData\dsgsdgdsgdsgw.js
:Files
:Commands
[EMPTYFLASH]
[emptytemp]


dieses speicherst du auf nem usb stick als fix.txt
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist.
• Klicke nun bitte auf den Fix Button.
es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick.
wenn dies nicht funktioniert, bitte den fix manuell eintragen.
dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen,
log posten bitte.


Alle Zeitangaben in WEZ +1. Es ist jetzt 01:21 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131