C:/WINDOWS.usnsvc.exe finden und löschen?

Skywal

Ihr habt doch von dem "MSN Wurm" gehört, also so ist es. Ich habe viel davon gelesen usw, und ich vermute das die Datei C:/WINDOWS usnsvc.exe
dahintersteckt, weil jedes mal wenn ich sie durch Taskmanager kille, geht auch mein problem weg.
Ich will zuerst die Datei mit jotti untersuchen aber mein problem ist ,das ich sie überhaupt nicht finde!?
Jedes Mal wenn ich mein Computer neustarte sehe ich sie in Taskmanager, also muss er da irgendwo sein.
Habe blacklight schon probiert, was soll ich machen?


Habe gerade Microworld Anti Virus & Spyware gemacht! UND ICH HATTE RECHT
File C:\WINDOWS\usnsvc.exe infected by "Backdoor.Win32.SdBot.bzn" Virus! Action Taken: No Action Taken.
Object "video activex access Trojan" found in File System! Action Taken: No Action Taken.
Object "purityscan Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "Possible Fujacks-type Worm" found in File System! Action Taken: No Action Taken.
Object "Possible Fujacks-type Worm" found in File System! Action Taken: No Action Taken.
Object "Possible Fujacks-type Worm" found in File System! Action Taken: No Action Taken.
Entry "HKCR\ComProxy.IIDCRLWrapper" refers to invalid object "{CD79C623-E1B7-47CF-A685-2E8A882BA3F8}". Action Taken: No Action Taken.
Entry "HKCR\ComProxy.IIDCRLWrapper.1" refers to invalid object "{CD79C623-E1B7-47CF-A685-2E8A882BA3F8}". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\messengerstatsclient.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\MessengerStatsPAClient.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\minesweeper.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\ZIntro.ocx". Action Taken: No Action Taken.
Entry "HKCU\Software\Netscape\Netscape Navigator\User Trusted External Applications" refers to invalid object ""C:\Program Files\Java\jre1.5.0_07\bin\javaws.exe"". Action Taken: No Action Taken.
Entry "HKCU\Software\Netscape\Netscape Navigator\User Trusted External Applications" refers to invalid object ""C:\Program Files\Java\jre1.5.0_09\bin\javaws.exe"". Action Taken: No Action Taken.
Entry "HKCU\Software\Netscape\Netscape Navigator\User Trusted External Applications" refers to invalid object ""C:\Program Files\Java\jre1.5.0_10\bin\javaws.exe"". Action Taken: No Action Taken.
Entry "HKCU\Software\Netscape\Netscape Navigator\User Trusted External Applications" refers to invalid object ""C:\Program Files\Java\jre1.6.0_01\bin\javaws.exe"". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\ZIntro.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\MessengerStatsPAClient.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\minesweeper.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\messengerstatsclient.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Program Files\Prevx2\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Program Files\Prevx2\log\". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".dat". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".id2". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Keylogger Killer". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{0496D9E8-224B-4AFA-8F37-23B98D52F1EB}". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{2D57FB4E-6277-4A6D-8739-304C38051B89}". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{D22DC59F-69E5-4212-880C-42FDE80693C1}". Action Taken: No Action Taken.
File C:\WINDOWS\N039_jpg.zip/www.N039_jpg-msn.com infected by "Backdoor.Win32.SdBot.bzn" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\usnsvc.exe infected by "Backdoor.Win32.SdBot.bzn" Virus! Action Taken: No Action Taken.

Logfile of Trend Micro HijackThis v2.0.2

[edit]
bitte editiere zukünftig deine links, wie es dir u.a. hier angezeigt wird:
http://www.trojaner-board.de/22771-a...tml#post171958

danke
GUA
[/edit]