BKA Trojaner 1.13

[knoepfchen27]

Hallo Botfrei-Team,

ich habe mir auf meinem anderen Laptop einen BKA Trojaner eingefangen und weiß nicht wie ich diesen wieder entfernen kann.

Der Laptop fährt zwar noch hoch, schaltet dann den Desktop um auf das Trojaner-Bild, aber reagiert dann auf nichts mehr.
Ich sehe meinen Desktop kurzzeitig, kann aber keine Eingaben oder ähnliches mehr machen.

Ich habe bereits versucht in den TASK-Manager zu gelangen, dieses war aber leider nicht mehr möglich.

Ich hoffe ihr könnt mir irgendwie weiterhelfen und werde auf eine Information von euch warten.

Lg knoepfchen

[john.doe]

Hallo Knoepfchen und

ein System zu bereinigen ist aufwaendig und mit einiger Arbeit für Dich verbunden. Es ist immer am Sichersten und meist am Schnellsten bei Schaedlingen auf dem Rechner eine Neuinstallation durchzufuehren.
Bevor wir anfangen, hier noch ein paar laestige, aber wichtige und grundsätzliche Punkte, die von Dir zu beachten sind:

• Es gibt grundsätzlich keinen Support per privater Nachricht oder Email.
• Ich bereinige keine Rechner, die geschäftlich/gewerblich genutzt werden.
• Ich bereinige keine Rechner, die Cracks, Keygens und Konsorten oder kurz, gestohlene Software enthalten.
• Es ist wichtig, dass Du solange mitarbeitest, bis alle Punkte abgearbeitet sind und das Signal kommt, dass die Bereinigung beendet ist, auch wenn die Symptome vielleicht schon nach den ersten Aktionen verschwunden sein sollten.
  
  Solltest du eigenmaechtig die Bereinigung abbrechen und dich danach noch einmal mit neuen Problemen melden, kannst du sicher sein, von mir ignoriert zu werden.
• Evtl. vorhandene persönliche Daten und Nachnamen durch *** ersetzen.

Wichtig:

• Während unserer Reinigungsphase nur Programme installieren, Programme starten und Scans durchführen, die wir anordnen.
• Arbeite die Punkte unbedingt in der vorgegebenen Reihenfolge ab. Sollte etwas nicht klar sein, dann frage nach. Sollte etwas Probleme bereiten, dann berichte es. In jedem Fall warte auf weitere Anweisungen, bevor du den naechsten Punkt startest.

1.) Starte den abgesicherten Modus mit Netzwerktreibern. Funktioniert der und hast du Zugang zum Internet?

2.) Falls das nicht funktioniert, hast du ein zweites Benutzerkonto, bei dem du dich ohne Sperrbildschirm anmelden kannst?

3.) Falls das auch nicht funktioniert, erscheint der Sperrbildschirm, wenn du vor dem Starten die Internetverbindung trennst?

ciao, andreas

[knoepfchen27]

Hallo und vielen Dank für die schnelle Antwort schonmal.

Ich konnte den Laptop im abgesicherten Modus starten und habe auch eine Internetverbindung.

Die von euch empfohlene OTL.exe habe ich mir schon heruntergeladen und auf einen USB Stick bereit.

Was muss ich jetzt tun!?

[john.doe]

Hallo knoepfchen,

du kannst es mit dem gesperrten PC herunterladen. Den USB-Stick haettest du nur dann gebraucht, falls das mit Internetzugang nicht funktioniert.

Systemscan mit OTL

Erstelle bitte OTL-Logfiles nach dieser Anleitung. Bitte in alle Kategorien "Benutze Safelist" anhaken und oben "Scanne alle Benutzer".



Fuege die beiden Logfiles OTL.txt und Extras.txt als Anhang ein, indem Du unterhalb des Textfeldes auf Erweitert klickst und die Logdateien einzeln ueber Anhaenge verwalten hochlaedst.

ciao, andreas

[knoepfchen27]

Hier die gewünschten Dateien.

DANKE DANKE

[john.doe]

Hallo knoepfchen,

von Updates scheinst du nicht sonderlich viel zu halten.

Dafuer hast du Norton und Avira installiert.

1.) Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

• Starte die OTL.exe.
  Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und waehlen "Als Administrator ausfuehren".
• Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:

:OTL
[2012.09.18 19:12:07 | 000,080,896 | ---- | C] () -- C:\ProgramData\yzgqdgtj.exe
[2012.09.18 19:11:55 | 000,076,347 | ---- | C] () -- C:\ProgramData\gqezykzesvnnptc
[2012.09.18 19:11:54 | 000,080,896 | ---- | C] () -- C:\Users\Kristina-Steffen\0.5234957259489432.exe
[2012.09.20 18:45:35 | 000,001,118 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.09.20 18:45:30 | 000,001,114 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.09.18 19:12:10 | 000,000,000 | ---D | C] -- C:\ProgramData\dcasrxbjmgymuwg
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.batc -- [ NTFS ]
O33 - MountPoints2\{4f13b705-f8e9-11dc-88b4-0019991d8ea8}\Shell - "" = AutoRun
O33 - MountPoints2\{4f13b705-f8e9-11dc-88b4-0019991d8ea8}\Shell\AutoRun\command - "" = F:\pushinst.exec
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} http://static.pe.studivz.net/photouploader/ImageUploader5.cab?nocache=1225201681 (Image Uploader Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O7 - HKU\S-1-5-21-559149942-3163695425-1619497223-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O4 - HKU\S-1-5-21-559149942-3163695425-1619497223-1000..\Run: [yzgqdgtjmbfpjgf] C:\ProgramData\yzgqdgtj.exe ()
O4 - HKLM..\RunOnce: [!BingBar] C:\Program Files\Microsoft\BingBar\7.1.361.0\MUExe\7.1.361.0\BingBarSetup-Partner.EXE (Microsoft Corporation)
O4 - HKLM..\Run: []  File not found
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)

:Files
C:\Windows\Temp
C:\ProgramData\TEMP
C:\Users\Kristina-Steffen\AppData\Local\Temp\*.exe
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache

:Commands
[emptytemp]

• Schliesse alle Programme.
• Klicke auf Fix.
• Wenn OTL einen Neustart verlangt, bitte zulassen.
• Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
  Nachtraeglich kannst Du das Logfile hier einsehen
  => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis fuer Mitleser: Obiges OTL-Script ist ausschliesslich fuer diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schaedigen!

2.) Rechner startet neu, Windows "normal" starten und berichten, ob der Sperrbildschirm noch erscheint.

ciao, andreas

[knoepfchen27]

JA das mit den Updates ist so eine Sache diesen Laptop nutzt meine Freundin und sie macht das eher selten bis gar nicht.

Also der Laptop ist normal gestartet und der Sperrbildschirm ist weg. KLASSE!!!!

Hier die Datei die ihr wolltet.:

All processes killed
========== OTL ==========
C:\ProgramData\yzgqdgtj.exe moved successfully.
C:\ProgramData\gqezykzesvnnptc moved successfully.
C:\Users\Kristina-Steffen\0.5234957259489432.exe moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job moved successfully.
C:\ProgramData\dcasrxbjmgymuwg folder moved successfully.
File C:\autoexec.batc not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4f13b705-f8e9-11dc-88b4-0019991d8ea8}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4f13b705-f8e9-11dc-88b4-0019991d8ea8}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4f13b705-f8e9-11dc-88b4-0019991d8ea8}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4f13b705-f8e9-11dc-88b4-0019991d8ea8}\ not found.
File F:\pushinst.exec not found.
Starting removal of ActiveX control {5D637FAD-E202-48D1-8F18-5B9C459BD1E3}
C:\Windows\Downloaded Program Files\ImageUploader5.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{5D637FAD-E202-48D1-8F18-5B9C459BD1E3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5D637FAD-E202-48D1-8F18-5B9C459BD1E3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5D637FAD-E202-48D1-8F18-5B9C459BD1E3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5D637FAD-E202-48D1-8F18-5B9C459BD1E3}\ not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\Windows\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry value HKEY_USERS\S-1-5-21-559149942-3163695425-1619497223-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-21-559149942-3163695425-1619497223-1000\Software\Microsoft\Windows\CurrentVersion\Run\\yzgqdgtjmbfpjgf deleted successfully.
File C:\ProgramData\yzgqdgtj.exe not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\!BingBar deleted successfully.
C:\Program Files\Microsoft\BingBar\7.1.361.0\MUExe\7.1.361.0\BingBarSetup-Partner.EXE moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Service NwlnkFwd stopped successfully!
Service NwlnkFwd deleted successfully!
File system32\DRIVERS\nwlnkfwd.sys not found.
Service NwlnkFlt stopped successfully!
Service NwlnkFlt deleted successfully!
File system32\DRIVERS\nwlnkflt.sys not found.
Service IpInIp stopped successfully!
Service IpInIp deleted successfully!
File system32\DRIVERS\ipinip.sys not found.
Service blbdrive stopped successfully!
Service blbdrive deleted successfully!
File C:\Windows\system32\drivers\blbdrive.sys not found.
========== FILES ==========
C:\Windows\Temp\~msdt\tools folder moved successfully.
C:\Windows\Temp\~msdt folder moved successfully.
C:\Windows\Temp\vcreditInso folder moved successfully.
C:\Windows\Temp\Temporary Internet Files\Content.IE5\KMZ87JX1 folder moved successfully.
C:\Windows\Temp\Temporary Internet Files\Content.IE5\I5YE9ULL folder moved successfully.
C:\Windows\Temp\Temporary Internet Files\Content.IE5\H2LJEBML folder moved successfully.
C:\Windows\Temp\Temporary Internet Files\Content.IE5\GF9DLF36 folder moved successfully.
C:\Windows\Temp\Temporary Internet Files\Content.IE5 folder moved successfully.
C:\Windows\Temp\Temporary Internet Files folder moved successfully.
C:\Windows\Temp\SxsTemp folder moved successfully.
C:\Windows\Temp\sluf5.tmp folder moved successfully.
C:\Windows\Temp\slu8f2.tmp folder moved successfully.
C:\Windows\Temp\slu7faf.tmp folder moved successfully.
C:\Windows\Temp\slu7e86.tmp folder moved successfully.
C:\Windows\Temp\slu7d76.tmp folder moved successfully.
C:\Windows\Temp\slu7d6f.tmp folder moved successfully.
C:\Windows\Temp\slu7d3b.tmp folder moved successfully.
C:\Windows\Temp\slu7a7d.tmp folder moved successfully.
C:\Windows\Temp\slu76a7.tmp folder moved successfully.
C:\Windows\Temp\slu735e.tmp folder moved successfully.
C:\Windows\Temp\slu6d74.tmp folder moved successfully.
C:\Windows\Temp\slu6d64.tmp folder moved successfully.
C:\Windows\Temp\slu6d1d.tmp folder moved successfully.
C:\Windows\Temp\slu6c8e.tmp folder moved successfully.
C:\Windows\Temp\slu6ba3.tmp folder moved successfully.
C:\Windows\Temp\slu68e0.tmp folder moved successfully.
C:\Windows\Temp\slu63cb.tmp folder moved successfully.
C:\Windows\Temp\slu5e1.tmp folder moved successfully.
C:\Windows\Temp\slu5cf2.tmp folder moved successfully.
C:\Windows\Temp\slu5ad2.tmp folder moved successfully.
C:\Windows\Temp\slu5a6.tmp folder moved successfully.
C:\Windows\Temp\slu59de.tmp folder moved successfully.
C:\Windows\Temp\slu550.tmp folder moved successfully.
C:\Windows\Temp\slu53c3.tmp folder moved successfully.
C:\Windows\Temp\slu5211.tmp folder moved successfully.
C:\Windows\Temp\slu4e0f.tmp folder moved successfully.
C:\Windows\Temp\slu4c88.tmp folder moved successfully.
C:\Windows\Temp\slu4c0c.tmp folder moved successfully.
C:\Windows\Temp\slu4a64.tmp folder moved successfully.
C:\Windows\Temp\slu4773.tmp folder moved successfully.
C:\Windows\Temp\slu45a3.tmp folder moved successfully.
C:\Windows\Temp\slu41e.tmp folder moved successfully.
C:\Windows\Temp\slu4079.tmp folder moved successfully.
C:\Windows\Temp\slu3ef.tmp folder moved successfully.
C:\Windows\Temp\slu3b05.tmp folder moved successfully.
C:\Windows\Temp\slu3a1b.tmp folder moved successfully.
C:\Windows\Temp\slu2eb2.tmp folder moved successfully.
C:\Windows\Temp\slu2d6d.tmp folder moved successfully.
C:\Windows\Temp\slu2c30.tmp folder moved successfully.
C:\Windows\Temp\slu2930.tmp folder moved successfully.
C:\Windows\Temp\slu284c.tmp folder moved successfully.
C:\Windows\Temp\slu26be.tmp folder moved successfully.
C:\Windows\Temp\slu248a.tmp folder moved successfully.
C:\Windows\Temp\slu216a.tmp folder moved successfully.
C:\Windows\Temp\slu1e73.tmp folder moved successfully.
C:\Windows\Temp\slu1e4.tmp folder moved successfully.
C:\Windows\Temp\slu1de9.tmp folder moved successfully.
C:\Windows\Temp\slu1c8b.tmp folder moved successfully.
C:\Windows\Temp\slu1b55.tmp folder moved successfully.
C:\Windows\Temp\slu1b30.tmp folder moved successfully.
C:\Windows\Temp\slu1a80.tmp folder moved successfully.
C:\Windows\Temp\slu17a.tmp folder moved successfully.
C:\Windows\Temp\slu175d.tmp folder moved successfully.
C:\Windows\Temp\slu171a.tmp folder moved successfully.
C:\Windows\Temp\slu15a0.tmp folder moved successfully.
C:\Windows\Temp\RtSigs\Data folder moved successfully.
C:\Windows\Temp\RtSigs folder moved successfully.
C:\Windows\Temp\MPTelemetrySubmit folder moved successfully.
C:\Windows\Temp\History\Results folder moved successfully.
C:\Windows\Temp\History\History.IE5 folder moved successfully.
C:\Windows\Temp\History folder moved successfully.
C:\Windows\Temp\Google Toolbar folder moved successfully.
C:\Windows\Temp\Cookies folder moved successfully.
C:\Windows\Temp\cmi{99681151-3537-434F-8D53-AA0EF9812DEC} folder moved successfully.
C:\Windows\Temp\AVSETUP_4b389f33 folder moved successfully.
C:\Windows\Temp folder moved successfully.
File\Folder C:\ProgramData\TEMP not found.
C:\Users\Kristina-Steffen\AppData\Local\Temp\AutoRun.exe moved successfully.
C:\Users\Kristina-Steffen\AppData\Local\Temp\eauninstall.exe moved successfully.
C:\Users\Kristina-Steffen\AppData\Local\Temp\EBU25C9.EXE moved successfully.
C:\Users\Kristina-Steffen\AppData\Local\Temp\EBU861.EXE moved successfully.
C:\Users\Kristina-Steffen\AppData\Local\Temp\GoogleToolbarInstaller_en32_signed.exe moved successfully.
C:\Users\Kristina-Steffen\AppData\Local\Temp\MyBabylonTB.exe moved successfully.
C:\Users\Kristina-Steffen\AppData\Local\Temp\SimCity 4 Deluxe_uninst.exe moved successfully.
C:\Users\Kristina-Steffen\AppData\Local\Temp\_is2BBC.exe moved successfully.
C:\Users\Kristina-Steffen\AppData\Local\Temp\_is3F40.exe moved successfully.
C:\Users\Kristina-Steffen\AppData\Local\Temp\_is4317.exe moved successfully.
C:\Users\Kristina-Steffen\AppData\Local\Temp\_is5FDE.exe moved successfully.
C:\Users\Kristina-Steffen\AppData\Local\Temp\_is705C.exe moved successfully.
C:\Users\Kristina-Steffen\AppData\Local\Temp\_is7F71.exe moved successfully.
C:\Users\Kristina-Steffen\AppData\Local\Temp\_is7FD3.exe moved successfully.
C:\Users\Kristina-Steffen\AppData\Local\Temp\_is8061.exe moved successfully.
C:\Users\Kristina-Steffen\AppData\Local\Temp\_is9372.exe moved successfully.
C:\Users\Kristina-Steffen\AppData\Local\Temp\_isA15A.exe moved successfully.
C:\Users\Kristina-Steffen\AppData\Local\Temp\_isA373.exe moved successfully.
C:\Users\Kristina-Steffen\AppData\Local\Temp\_isA974.exe moved successfully.
C:\Users\Kristina-Steffen\AppData\Local\Temp\_isB969.exe moved successfully.
C:\Users\Kristina-Steffen\AppData\Local\Temp\_isC668.exe moved successfully.
C:\Users\Kristina-Steffen\AppData\Local\Temp\_isC887.exe moved successfully.
C:\Users\Kristina-Steffen\AppData\Local\Temp\_isE48B.exe moved successfully.
C:\Users\Kristina-Steffen\AppData\Local\Temp\_isE565.exe moved successfully.
C:\Users\Kristina-Steffen\AppData\Local\Temp\_isECB0.exe moved successfully.
C:\Users\Kristina-Steffen\AppData\Local\Temp\_isF184.exe moved successfully.
C:\Users\Kristina-Steffen\AppData\Local\Temp\_isF43B.exe moved successfully.
C:\Users\Kristina-Steffen\AppData\Local\Temp\_isF9D1.exe moved successfully.
C:\Users\Kristina-Steffen\AppData\Local\Temp\_isFAFF.exe moved successfully.
C:\Users\Kristina-Steffen\AppData\Local\Temp\{E3B0190E-7109-454F-89D5-0CCF9E769DE6}-GoogleToolbarInstaller_updater_signed.exe moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\tmp folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 folder moved successfully.
C:\Users\Kristina-Steffen\AppData\LocalLow\Sun\Java\Deployment\cache folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Kristina-Steffen
->Temp folder emptied: 865783192 bytes
->Temporary Internet Files folder emptied: 219396803 bytes
->Flash cache emptied: 2972926 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
RecycleBin emptied: 84823430 bytes
 
Total Files Cleaned = 1.119,00 mb
 
 
OTL by OldTimer - Version 3.2.64.0 log created on 09202012_193905

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

[john.doe]

Hallo Knoepfchen (niedlicher Nick),

sie macht das eher selten bis gar nicht.

Gar nicht trifft es eher.

und der Sperrbildschirm ist weg

Schritt 1: Entsperren, so dass du wieder "normal" starten kannst. Erledigt.
Schritt 2: Schaedlinge killen. Offen.
Schritt 3: Sicherheitsluecken schließen. Offen.
Schritt 4: Aufraeumen und Absicherung. Offen.

1.) Packe den Ordner C:\_OTL\MovedFiles als Zip- oder Rar-Archiv.

2.) Lade das Archiv bei einem Filehoster hoch (z.B. www.zippyshare.com)

3.) Schicke mir den Link als private Nachricht.

4.) Welcher Browser wird benutzt?

5.) Bereinigung mit Malwarebytes' Anti-Malware (Komplett-Scan)

Mache bitte mit Malwarebytes' Anti-Malware einen Komplett-Scan nach dieser Anleitung und poste das Logfile hier in den Thread.

6.) Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus.
.

.
Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Deinstalliere Emsisoft.

7.) ESET Online Scanner

Vorbereitung

• Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
• Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren.
• Vista/Win7-User: Bitte den Browser unbedingt als Administrator starten.

Los geht's

• Lade und starte Eset Smartinstaller
• Haken setzen bei YES, I accept the Terms of Use.
• Klick auf Start.
• Haken setzen bei Remove found threads und Scan archives.
• Klick auf Start.
• Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Finish drücken.
• Browser schließen.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (manchmal auch C:\Programme\Eset\log.txt) suchen und mit Deinem Editor öffnen.
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

ciao, andreas

[knoepfchen27]

Die Datei hat über 700 MB wo kann ich die hochladen??

Und die Bereinigung mit Malwarebytes Anti-Malware funktioniert auch nicht beim ausführen erscheint ein Fehler.
CODE 267 Der Verzeichnisname ist ungültig sagt der mir.

[john.doe]

Die Datei hat über 700 MB wo kann ich die hochladen??

www.depositfiles.com

beim ausführen erscheint ein Fehler.

Lade Malwarebytes neu herunter.

ciao, andreas