Virus Problem bei MSN

[Cango002]

Hallo User,

hoffe ihr könnt mir helfen, ein MSN kontakt von mir hat mir mal nen link geschickt, ich dachte mir nichts dabei und habe es angenommen und nun schicke ich selber diesen Link an alle die ONLINE sind.
Nachdem automatischen verschicken kann ich die Kontakte nicht anschreiben denen ich diese links auto... verschickt habe.

Was tun bin am verzweifeln.

MFG


PS: Sry fals ich hier falsch bin, bin nicht soo oft in Foren aktiv.

 

[Dunkelschwinge]

ändere Dein MSN Passwort und das Passwort des Onlinedienstes bei dem Du dich "eingeloggt" hast!
Das reicht um vor Zugriff zu schützen.

Und hoffe Das Deine Kontakte nicht blind klicken so wie Du. mehr kannst Du nicht tun...

technisch gesehen ist das Phishing und kein Virus!

 

[unknowen]

MSN heißt jetzt nur noch die Webseite, ich nehme an du meinst den Windows Live Messenger.

Was heißt angenommen? Hast du deinen Benutzernamen und Passwort auf einer dieser passwortklauenden Webseiten eingegeben?

Es gibt keine automatische Sperre für solchen missbrauchten Accounts, ich nehme an, die betreffenden Personen haben dich blockiert. Da musst du selbst dafür sorgen, das sie dich wieder akzeptieren.

Sonst gilt nur noch: so schnell wie möglich Passwort ändern und dann dürfte der Spammer nicht mehr deinen Account missbrauchen können.

 

[Cango002]

@unknowen ach was nein.
mir wurde ein Link geschickt den ich angeklickt habe und ich was zum Ausführen hatte nachdem ich es angenommen hatte hat mein WIndows Live Messenger nun die selben prob. denn ich verschicke nun den link an alle

Ergänzung (22. Juni 2010)

habe jetzt die passwörter auch geändert mal schauen warte im mom. nur ab

Ergänzung (22. Juni 2010)

Deinstalliert und wieder Installiert habe ich auch schon 1-2 mal nur zur Info.....

 

[CarstenJoe]

Jaja, ich bekam das eben auch geschickt. Das Passwort ändern müsste reichen. Ich hoffe du weißt nun für das nächste Mal, dass man keine Bilder 'downloaden' und 'installieren' muss.

 

[Cango002]

es geht immer noch nicht heul

 

[kernel panic]

haste mal nen virenscann gemacht, viell blockt der virus das? ich meine wenn du sie online siehst, haben dich die kontakte nicht blockiert, sondern der virus "ärgert" dich im hintergrund...

 

[Cango002]

also nen Virenscan habe ich schon durchgeführt nichts gebracht
versuche es grad mit Windows Defender

Ergänzung (22. Juni 2010)

Leider hat dies auch nichts gebracht

 

[kernel panic]

wie wärs mit einer live-cd ( z.b. desinfec´t von ct oder von avira etc.)?

 

[emlyn d.]

https://www.computerbase.de/forum/t...cht-infektion-vor-dem-posten-beachten.741157/

 

[Cango002]

naja zu dem link weiss ich nicht was ich machen soll habe zwar rkill... gerade durchgeführt aber dort steht nur :

This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.
Ran as ™zgr on 22.06.2010 at 20:11:00.


Processes terminated by Rkill or while it was running:


C:\Users\Özgür\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Özgür\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Özgür\Downloads\rkill.exe
C:\Users\Özgür\AppData\Local\Temp\2433.tmp\pev.rkexe


Rkill completed on 22.06.2010 at 20:11:04.



mehr nicht was bringt mir das nun?

 

[Cango002]

...

Ergänzung (22. Juni 2010)

leute ich komme nicht weiter und das deprimiert mich ...

 

[Boogeyman]

Lies die die Anleitung doch bitte mal genau durch! Mit ich komme nicht weiter, können andere nichts anfangen. Beschreibe genau was du machst und wo etwas nicht geht.

 

[Cango002]

Habe USB fix durchgeführt und es kam dies heraus:

############################## | UsbFix 7.013 | [Research]

User: Özgür (Administrator) # ÖZGÜR-LEPPI [TOSHIBA Satellite L550]
Updated 21/06/10 by El Desaparecido / C_XX
Started at 20:44:29 | 22/06/2010
Website: http://pagesperso-orange.fr/NosTools/index.html
Contact: FindyKill.Contact@gmail.com

CPU: Intel(R) Core(TM)2 Duo CPU P8700 @ 2.53GHz
CPU 2: Intel(R) Core(TM)2 Duo CPU P8700 @ 2.53GHz
Microsoft Windows 7 Ultimate (6.1.7600 64-Bit) #
Internet Explorer 8.0.7600.16385

Windows Firewall: Enabled
RAM -> 4061 Mb
C:\ (%systemdrive%) -> Fixed drive # 149 Gb (103 Mb free - 69%) [Vista] # NTFS
D:\ -> CD-ROM
E:\ -> Fixed drive # 147 Gb (133 Mb free - 91%) [Data] # NTFS
F:\ -> CD-ROM
G:\ -> Removable drive # 964 Mb (457 Mb free - 47%) [] # FAT
H:\ -> Removable drive # 4 Gb (3 Mb free - 80%) [] # FAT32

################## | Files # Infected Folders |

Found ! C:\Users\ZGR~1\AppData\Local\Temp\bfw.exe
Found ! C:\Users\ZGR~1\AppData\Local\Temp\xjc.exe
Found ! C:\Users\ZGR~1\AppData\Local\Temp\2536.exe
Found ! C:\Users\ZGR~1\AppData\Local\Temp\6977.exe
Found ! C:\log.txt
Found ! G:\winamp_cache_0001.xml

################## | Registry |


################## | Mountpoints2 |

HKCU\.\.\.\.\Explorer\MountPoints2\{47c5cbc2-7d79-11df-a009-0026222e4f46}
Shell\AutoRun\Command = D:\autorun.exe


################## | Vaccin |

(!) This computer is not vaccinated!

################## | E.O.F |

Ergänzung (22. Juni 2010)

was soll ich denn nun tun? Bringt Euch das denn etwas ??

Ergänzung (22. Juni 2010)

Und das kam beim rkill raus:
This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.
Ran as ™zgr on 22.06.2010 at 20:54:01.


Processes terminated by Rkill or while it was running:


C:\Users\Özgür\Downloads\rkill.com
C:\Users\Özgür\AppData\Local\Temp\8650.tmp\pev.rkexe


Rkill completed on 22.06.2010 at 20:54:06.

 

[Boogeyman]

Was ist mit der Analyse mittels D.D.S.?
RKill brauchst du nur ausführen, wenn sich D.D.S und UsbFix nicht starten lassen.

Es gibt Malware, die das Ausführen von Programmen mit einer Meldung wie z.B. "The file [...] is infected." blockt.
In solchen Fällen bietet sich der Einsatz von RKill(erstellt von Grinler) an.
Das Programm muss mit Adminrechten angewendet werden.

Ich bitte dich noch mal, die Anleitung genau zu lesen!

 

[Cango002]

Hier die DDS:


DDS (Ver_10-03-17.01) - NTFSX64
Run by ™zgr at 21:28:29,99 on 22.06.2010
Internet Explorer: 8.0.7600.16385
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.4061.2762 [GMT 2:00]


============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\atieclxx.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCameraSrv.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Windows\system32\sppsvc.exe
C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
C:\Program Files (x86)\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
C:\Windows\system32\TODDSrv.exe
C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
C:\Program Files\TOSHIBA\TECO\TecoService.exe
C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
C:\Windows\system32\wbengine.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
C:\Program Files\TOSHIBA\TECO\Teco.exe
C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe
C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Apoint2K\HidFind.exe
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Windows\system32\conhost.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Users\Özgür\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Users\Özgür\Downloads\wlsetup-custom.exe
C:\Users\Özgür\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\msiexec.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Özgür\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Özgür\Downloads\dds.scr
C:\Windows\system32\conhost.exe

============== Pseudo HJT Report ===============

uDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSEG&bmod=TSEG;
uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSEG&bmod=TSEG;
mLocal Page = c:\windows\syswow64\blank.htm
mWinlogon: Userinit=userinit.exe
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files (x86)\java\jre6\bin\ssv.dll
BHO: Partner BHO Class: {83ff80f4-8c74-4b80-b5ba-c8ddd434e5c4} - c:\programdata\partner\partner.dll
BHO: Windows Live Anmelde-Hilfsprogramm: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files (x86)\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files (x86)\google\google toolbar\GoogleToolbar.dll
BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files (x86)\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files (x86)\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files (x86)\google\google toolbar\component\fastsearch_9993303B90FE6C1D.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files (x86)\java\jre6\bin\jp2ssv.dll
TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files (x86)\google\google toolbar\GoogleToolbar.dll
uRun: [DAEMON Tools Lite] "c:\program files (x86)\daemon tools lite\DTLite.exe" -autorun
uRun: [msnmsgr] "c:\program files (x86)\windows live\messenger\msnmsgr.exe" /background
mRun: [Adobe Reader Speed Launcher] "c:\program files (x86)\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [cfFncEnabler.exe] "c:\program files (x86)\toshiba\configfree\cfFncEnabler.exe"
mRun: [HWSetup] "c:\program files\toshiba\utilities\HWSetup.exe" hwSetUP
mRun: [KeNotify] "c:\program files (x86)\toshiba\utilities\KeNotify.exe"
mRun: [NDSTray.exe] "c:\program files (x86)\toshiba\configfree\NDSTray.exe"
mRun: [StartCCC] "c:\program files (x86)\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [SunJavaUpdateSched] "c:\program files (x86)\java\jre6\bin\jusched.exe"
mRun: [SVPWUTIL] "c:\program files (x86)\toshiba\utilities\SVPWUTIL.exe" SVPwUTIL
mRun: [ToshibaServiceStation] c:\program files (x86)\toshiba\toshiba service station\ToshibaServiceStation.exe /hide:60
mRun: [TWebCamera] "%ProgramFiles(x86)%\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-explorer: ForceActiveDesktopOn = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {76577871-04EC-495E-A12B-91F7C3600AFA} - http://rover.ebay.com/rover/1/707-44556-9400-3/4
IE: {8A918C1D-E123-4E36-B562-5C1519E434CE} - http://www.amazon.de/exec/obidos/redirect-home?tag=Toshibadebholink-21&site=home
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~2\micros~1\office12\ONBttnIE.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files (x86)\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~2\micros~1\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files (x86)\google\google toolbar\component\fastsearch_9993303B90FE6C1D.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files (x86)\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~2\common~1\skype\SKYPE4~1.DLL
TB-X64: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
mRun-x64: [Apoint] c:\program files\apoint2k\Apoint.exe
mRun-x64: [RtHDVCpl] c:\program files\realtek\audio\hda\RAVCpl64.exe
mRun-x64: [Skytel] c:\program files\realtek\audio\hda\Skytel.exe
mRun-x64: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
mRun-x64: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
mRun-x64: [SmartFaceVWatcher] %ProgramFiles%\Toshiba\SmartFaceV\SmartFaceVWatcher.exe
mRun-x64: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
mRun-x64: [Teco] "%ProgramFiles%\TOSHIBA\TECO\Teco.exe" /r
mRun-x64: [Toshiba Registration] c:\program files\toshiba\registration\ToshibaReminder.exe
mRun-x64: [TosSENotify] c:\program files\toshiba\toshiba hdd ssd alert\TosSENotify.exe
mRun-x64: [TPCHWMsg] %ProgramFiles%\TOSHIBA\TPHM\TPCHWMsg.exe
mRun-x64: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE

================= FIREFOX ===================

FF - ProfilePath -

---- FIREFOX POLICIES ----
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files (x86)\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-14 59904]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-8-18 203264]
R2 camsvc;TOSHIBA Web Camera Service;c:\program files (x86)\toshiba\toshiba web camera application\TWebCameraSrv.exe [2010-6-21 20544]
R2 ConfigFree Gadget Service;ConfigFree Gadget Service;c:\program files (x86)\toshiba\configfree\CFProcSRVC.exe [2009-3-6 36864]
R2 ConfigFree Service;ConfigFree Service;c:\program files (x86)\toshiba\configfree\CFSvcs.exe [2009-3-10 46448]
R2 TMachInfo;TMachInfo;c:\program files (x86)\toshiba\toshiba service station\TMachInfo.exe [2010-6-21 62776]
R2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\toshiba\teco\TecoService.exe [2009-4-24 242176]
R2 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\toshiba\toshiba hdd ssd alert\TosSmartSrv.exe [2009-3-17 84480]
R2 TPCHSrv;TPCH Service;c:\program files\toshiba\tphm\TPCHSrv.exe [2009-4-15 803696]
R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\drivers\TVALZFL.sys [2009-3-23 14472]
R3 NETw5s64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\drivers\NETw5s64.sys [2009-9-15 6952960]
R3 PGEffect;Pangu effect driver;c:\windows\system32\drivers\PGEffect.sys [2010-6-21 32832]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt64win7.sys [2009-3-1 187392]
S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\drivers\netw5v64.sys [2009-6-10 5434368]
S3 Partner Service;Partner Service;c:\programdata\partner\partner.exe [2009-6-5 111088]

=============== Created Last 30 ================

2010-06-22 19:28:06 0 d-----w- c:\program files (x86)\Windows Live SkyDrive
2010-06-22 19:23:20 65536 --sha-w- c:\users\özgür\ntuser.dat{21179bef-7e32-11df-8316-0026222e4f46}.TM.blf
2010-06-22 19:23:20 524288 --sha-w- c:\users\özgür\ntuser.dat{21179bef-7e32-11df-8316-0026222e4f46}.TMContainer00000000000000000002.regtrans-ms
2010-06-22 19:23:20 524288 --sha-w- c:\users\özgür\ntuser.dat{21179bef-7e32-11df-8316-0026222e4f46}.TMContainer00000000000000000001.regtrans-ms
2010-06-22 18:43:24 0 d-----w- C:\UsbFix
2010-06-22 17:25:29 0 d-----w- c:\windows\PCHEALTH
2010-06-22 16:25:35 0 d-----w- c:\users\zgr~1\appdata\roaming\Avira
2010-06-22 16:09:23 0 d-----w- c:\users\zgr~1\appdata\roaming\LolClient
2010-06-22 14:59:53 0 d--h--w- c:\windows\msdownld.tmp
2010-06-22 14:59:48 0 d-----w- c:\windows\syswow64\directx
2010-06-22 13:51:50 0 d-----w- c:\program files (x86)\League of Legends
2010-06-22 13:51:03 0 d-----w- c:\program files (x86)\Pando Networks
2010-06-22 13:27:31 0 d-----w- c:\programdata\Messenger Plus!
2010-06-22 13:26:57 0 d-----w- c:\program files (x86)\Messenger Plus! Live
2010-06-22 12:03:43 0 d-----w- c:\users\zgr~1\appdata\roaming\myphotobook
2010-06-22 11:39:52 0 d-----w- c:\program files (x86)\Steam
2010-06-22 11:25:30 0 d-----w- c:\program files (x86)\Microsoft Visual Studio 8
2010-06-22 11:09:17 0 d-----w- c:\program files\iPod
2010-06-22 11:09:16 0 d-----w- c:\programdata\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
2010-06-22 11:09:16 0 d-----w- c:\program files (x86)\iTunes
2010-06-22 11:08:00 0 d-----w- c:\programdata\Apple Computer
2010-06-22 11:07:36 0 d-----w- c:\program files (x86)\Bonjour
2010-06-22 11:00:38 0 d-----w- c:\program files\WinRAR
2010-06-22 10:57:19 0 d-----w- c:\users\özgür\Tracing
2010-06-22 10:55:36 0 d-----w- c:\program files (x86)\Microsoft
2010-06-22 10:53:22 0 d-----w- c:\programdata\Avira
2010-06-22 10:53:22 0 d-----w- c:\program files (x86)\Avira
2010-06-22 10:52:56 0 d-----w- c:\program files (x86)\common files\Windows Live
2010-06-22 05:49:42 0 d--h--w- C:\$WINDOWS.~Q
2010-06-22 05:47:32 0 d--h--w- C:\$INPLACE.~TR
2010-06-21 21:16:57 56 ---ha-w- c:\programdata\ezsidmv.dat
2010-06-21 21:15:51 0 d-----r- c:\program files (x86)\Skype
2010-06-21 21:06:53 0 d-----w- c:\windows\system32\wbem\de-DE
2010-06-21 21:03:02 0 d-----w- c:\windows\system32\appmgmt
2010-06-21 20:51:02 0 d-----w- c:\programdata\Skype
2010-06-21 20:48:30 0 d-----w- c:\program files (x86)\VideoLAN
2010-06-21 20:46:40 14336 ----a-w- c:\windows\system32\drivers\sffp_sd.sys
2010-06-21 20:44:49 294912 ----a-w- c:\windows\system32\browserchoice.exe
2010-06-21 20:43:27 0 d-----w- c:\program files (x86)\CCleaner
2010-06-21 20:41:17 834544 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-06-21 20:41:16 0 d-----w- c:\program files (x86)\DAEMON Tools Lite
2010-06-21 20:40:58 0 d-----w- c:\users\zgr~1\appdata\roaming\DAEMON Tools Lite
2010-06-21 20:40:55 0 d-----w- c:\programdata\DAEMON Tools Lite
2010-06-21 20:25:46 20 --sh--w- c:\users\özgür\ntuser.ini
2010-06-21 20:24:48 220672 ----a-w- c:\windows\system32\wintrust.dll
2010-06-21 20:24:48 172032 ----a-w- c:\windows\syswow64\wintrust.dll
2010-06-21 20:24:48 139264 ----a-w- c:\windows\system32\cabview.dll
2010-06-21 20:24:48 132608 ----a-w- c:\windows\syswow64\cabview.dll
2010-06-21 20:22:47 0 d-sh--we c:\programdata\Documents
2010-06-21 20:22:47 0 d-sh--we C:\Documents and Settings
2010-06-21 20:22:47 0 d-sh--w- C:\Recovery
2010-06-21 20:16:17 22800 ----a-w- c:\windows\system32\emptyregdb.dat
2010-06-21 20:02:52 10288 ---ha-w- c:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2010-06-21 20:02:52 10288 ---ha-w- c:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2010-06-21 20:02:22 0 d-----w- c:\windows\syswow64\RTCOM
2010-06-21 20:02:22 0 d-----w- c:\program files\Realtek
2010-06-21 20:02:19 0 ----a-w- c:\windows\ativpsrm.bin
2010-06-21 20:02:07 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_Apfiltr_01005.Wdf
2010-06-21 20:02:05 0 d-----w- c:\program files\Apoint2K
2010-06-21 19:17:28 0 d-----w- c:\windows\system32\Vistalizator
2010-06-21 18:45:44 1890 ----a-w- c:\windows\diagwrn.xml
2010-06-21 18:45:44 1890 ----a-w- c:\windows\diagerr.xml
2010-06-21 18:40:01 0 d-----r- c:\users\özgür\Searches
2010-06-21 18:39:46 0 d-----r- c:\users\özgür\Contacts
2010-06-21 18:36:45 0 d-----w- c:\programdata\ToshibaEurope
2010-06-21 18:32:03 0 d-sh--we C:\Programme
2010-06-21 18:32:03 0 d-sh--we C:\Dokumente und Einstellungen
2010-06-21 18:29:03 0 ----a-w- c:\windows\NDSTray.INI
2010-06-21 18:27:19 0 d-----w- c:\program files (x86)\common files\Toshiba Shared
2010-06-21 18:27:02 3426072 ----a-w- c:\windows\syswow64\d3dx9_32.dll
2010-06-21 18:26:22 32832 ----a-w- c:\windows\system32\drivers\PGEffect.sys
2010-06-21 18:21:59 0 d-----w- c:\programdata\TOSHIBA
2010-06-21 18:11:38 24576 ----a-w- c:\windows\syswow64\TSCI.dll
2010-06-21 18:11:38 24576 ----a-w- c:\windows\syswow64\THCI.dll
2010-06-21 18:10:21 0 d-----w- c:\programdata\ATI
2010-06-21 18:07:17 0 d-----w- c:\program files\ATI
2010-06-21 18:07:15 0 d-----w- c:\program files (x86)\ATI Technologies

Ergänzung (22. Juni 2010)

==================== Find3M ====================

2010-06-22 19:28:06 1310720 --sha-w- c:\users\özgür\ntuser.dat
2010-06-22 19:28:03 793088 ----a-w- c:\windows\system32\perfh007.dat
2010-06-22 19:28:03 160166 ----a-w- c:\windows\system32\perfc007.dat
2010-06-21 20:42:26 38104 ----a-w- c:\windows\system32\perfd007.dat
2010-06-21 20:42:26 38104 ----a-w- c:\windows\inf\perflib\0407\perfd.dat
2010-06-21 20:42:26 38104 ----a-w- c:\windows\inf\perflib\0407\perfc.dat
2010-06-21 20:42:26 295922 ----a-w- c:\windows\system32\perfi007.dat
2010-06-21 20:42:26 295922 ----a-w- c:\windows\inf\perflib\0407\perfi.dat
2010-06-21 20:42:26 295922 ----a-w- c:\windows\inf\perflib\0407\perfh.dat
2010-05-27 07:24:13 34304 ----a-w- c:\windows\syswow64\atmlib.dll
2010-05-27 06:34:09 46080 ----a-w- c:\windows\system32\atmlib.dll
2010-05-27 04:11:32 366080 ----a-w- c:\windows\system32\atmfd.dll
2010-05-27 03:49:37 293888 ----a-w- c:\windows\syswow64\atmfd.dll
2010-05-21 12:14:28 270208 ------w- c:\windows\system32\MpSigStub.exe
2010-05-21 05:52:30 1192960 ----a-w- c:\windows\system32\wininet.dll
2010-05-21 05:18:06 977920 ----a-w- c:\windows\syswow64\wininet.dll
2010-05-21 05:14:50 48128 ----a-w- c:\windows\syswow64\jsproxy.dll
2010-05-06 12:42:05 1225216 ----a-w- c:\windows\syswow64\urlmon.dll
2010-05-06 12:41:55 606208 ----a-w- c:\windows\syswow64\mstime.dll
2010-05-06 12:41:53 64512 ----a-w- c:\windows\syswow64\msfeedsbs.dll
2010-05-06 12:41:53 5970944 ----a-w- c:\windows\syswow64\mshtml.dll
2010-05-06 12:41:49 381440 ----a-w- c:\windows\syswow64\iedkcs32.dll
2010-05-06 12:41:49 10984448 ----a-w- c:\windows\syswow64\ieframe.dll
2010-05-01 15:07:05 3122176 ----a-w- c:\windows\system32\win32k.sys
2010-04-23 07:13:36 2048 ----a-w- c:\windows\syswow64\tzres.dll
2010-04-23 07:11:58 2048 ----a-w- c:\windows\system32\tzres.dll
2009-07-14 05:37:38 31548 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2009-07-14 05:37:38 31548 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2009-07-14 05:37:38 291294 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2009-07-14 05:37:38 291294 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2009-07-14 04:54:24 174 --sha-w- c:\program files\desktop.ini
2009-07-14 04:54:24 174 --sha-w- c:\program files (x86)\desktop.ini
2009-07-14 01:00:34 291294 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2009-07-14 01:00:34 291294 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2009-07-14 01:00:32 31548 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2009-07-14 01:00:32 31548 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
2009-06-10 20:44:08 9633792 --sha-r- c:\windows\fonts\StaticCache.dat
2009-07-14 04:55:03 16384 --sha-w- c:\windows\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\history.ie5\index.dat
2009-07-14 04:55:03 32768 --sha-w- c:\windows\syswow64\config\systemprofile\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat
2009-07-14 04:55:03 16384 --sha-w- c:\windows\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\cookies\index.dat
2009-07-14 01:39:53 398848 --sha-w- c:\windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_4d4d1f2f696639a2\WinMail.exe
2009-07-14 01:14:45 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

============= FINISH: 21:31:10,18 ===============

Ergänzung (22. Juni 2010)

Frage bringt ne systemwiederherstellung etwas bis zu dem zeitpunkt bevor ich den link angenommen habe?

 

[Boogeyman]

Die Systemwiederherstellung ist nicht geeignet, um Malware zu entfernen.
Übrigens, D.D.S erzeugt zwei Logfiles. Bitte die Anleitung in Ruhe lesen und gewissenhaft abarbeiten.

 

[Cango002]

Hier die 2te. Atach:



UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft Windows 7 Ultimate
Boot Device: \Device\HarddiskVolume2
Install Date: 21.06.2010 22:21:07
System Uptime: 22.06.2010 19:20:37 (1 hours ago)

Motherboard: TOSHIBA | | KTWAA
Processor: Intel(R) Core(TM)2 Duo CPU P8700 @ 2.53GHz | U2E1 | 1596/mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 149 GiB total, 102,678 GiB free.
D: is CDROM ()
E: is FIXED (NTFS) - 147 GiB total, 133,471 GiB free.
F: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP1: 21.06.2010 22:29:06 - Windows Update
RP2: 21.06.2010 22:35:57 - Windows Update
RP3: 22.06.2010 12:40:41 - Windows Update
RP4: 22.06.2010 13:08:16 - Installed iTunes
RP5: 22.06.2010 13:23:22 - Installed Microsoft Office Enterprise 2007
RP6: 22.06.2010 13:24:38 - Installed Microsoft Office Enterprise 2007
RP7: 22.06.2010 13:30:10 - Installed DEVIL MAY CRY 4.
RP8: 22.06.2010 13:39:27 - Steam wird installiert
RP9: 22.06.2010 13:42:58 - Windows Update
RP10: 22.06.2010 13:58:26 - Removed Skype Toolbars
RP11: 22.06.2010 14:20:28 - DirectX wurde installiert
RP12: 22.06.2010 14:32:28 - DirectX wurde installiert
RP13: 22.06.2010 14:38:34 - Windows Live Anmelde-Assistent wird entfernt
RP14: 22.06.2010 14:38:53 - Windows Live Sync wird entfernt
RP15: 22.06.2010 14:39:14 - Windows Live-Uploadtool wird entfernt
RP16: 22.06.2010 14:59:12 - DirectX wurde installiert
RP17: 22.06.2010 17:00:40 - DirectX wurde installiert

==== Installed Programs ======================

Adobe AIR
Adobe Flash Player 10 Plugin
Adobe Reader 9 - Deutsch
Apple Application Support
Apple Software Update
Avira AntiVir Personal - Free Antivirus
Catalyst Control Center - Branding
Catalyst Control Center Core Implementation
Catalyst Control Center Graphics Full Existing
Catalyst Control Center Graphics Full New
Catalyst Control Center Graphics Light
Catalyst Control Center Graphics Previews Vista
Catalyst Control Center InstallProxy
Catalyst Control Center Localization All
ccc-core-static
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
CCleaner
Compatibility Pack für 2007 Office System
Google Chrome
Google Desktop
Google Toolbar for Internet Explorer
Java(TM) 6 Update 11
League of Legends
Messenger Plus! Live
Microsoft Choice Guard
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (German) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (German) 2007
Microsoft Office Groove MUI (German) 2007
Microsoft Office Home and Student 2007
Microsoft Office InfoPath MUI (German) 2007
Microsoft Office Live Add-in 1.3
Microsoft Office OneNote MUI (German) 2007
Microsoft Office Outlook Connector
Microsoft Office Outlook MUI (German) 2007
Microsoft Office PowerPoint MUI (German) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (German) 2007
Microsoft Office Proof (Italian) 2007
Microsoft Office Proofing (German) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (German) 2007
Microsoft Office Shared MUI (German) 2007
Microsoft Office Word MUI (German) 2007
Microsoft Silverlight
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Works
Mozilla Firefox (3.6.3)
MSVCRT
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
myphotobook 3.65
Pando Media Booster
Picasa 2
QuickTime
Realtek 8136 8168 8169 Ethernet Driver
Realtek High Definition Audio Driver
Realtek USB 2.0 Card Reader
Skins
Skype™ 4.2
Steam
Toshiba Assist
TOSHIBA Benutzerhandbücher
TOSHIBA ConfigFree
TOSHIBA DVD PLAYER
TOSHIBA eco Utility
TOSHIBA Extended Tiles for Windows Mobility Center
TOSHIBA Face Recognition
TOSHIBA Flash Cards Support Utility
TOSHIBA Hardware Setup
TOSHIBA HDD/SSD Alert
Toshiba Online Product Information
TOSHIBA Recovery Disk Creator Reminder
TOSHIBA Service Station
TOSHIBA Supervisor Password
TOSHIBA Supervisorkennwort
TOSHIBA Value Added Package
TOSHIBA Web Camera Application
TRORDCLauncher
Update für Microsoft Office Excel 2007 Help (KB963678)
Update für Microsoft Office Outlook 2007 Help (KB963677)
Update für Microsoft Office Powerpoint 2007 Help (KB963669)
Update für Microsoft Office Word 2007 Help (KB963665)
Update for 2007 Microsoft Office System (KB967642)
Update for Outlook 2007 Junk Email Filter (kb983486)
Utility Common Driver
VLC media player 1.0.5
WildTangent-Spiele
Windows Live Anmelde-Assistent
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Messenger
Windows Live OneCare safety scanner
Windows Live Sync
Windows Live Upload Tool

==== End Of File ===========================

 

[emlyn d.]

2010-06-21 20:23:31 171136 --sha-r- C:\w7ldr
huch!
ich fürchte, ich kann dir nicht weiterhelfen.

 

[Cango002]

warum?
ehhm nützt denn Neu booten was also ich würde dann Recovery CD nutzen un dann wieder W7 bringt das dann was?