Hallo!

Ich hatte schonmal ein HJT-Protokoll gepostet, bei dem mir nochdigger geholfen hatte - DANKE an dieser Stelle. Dann sollte ich noch Malwarebytes drüberlaufen lassen - wozu weiß ich allerdings nicht genau. Hab ich nun trotzdem gemacht und hier das Protokoll: (Nähere Infos zum System stehen in miener Signatur.)

Malwarebytes' Anti-Malware 1.30
Datenbank Version: 1333
Windows 6.0.6001 Service Pack 1

28.10.2008 18:42:01
mbam-log-2008-10-28 (18-42-01).txt

Scan-Methode: Vollständiger Scan (C:\|D:\|E:\|G:\|)
Durchsuchte Objekte: 222080
Laufzeit: 42 minute(s), 1 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 29
Infizierte Registrierungswerte: 3
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\CLSID\{0656a137-b161-cadd-9777-e37a75727e78} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0b682cc1-fb40-4006-a5dd-99edd3c9095d} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0e1230f8-ea50-42a9-983c-d22abc2eeb4c} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\dpcproxy (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\typelib (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\HOL5_VXIEWER.FULL.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Classes\applications\accessdiver.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\fwbd (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\HolLol (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mslagent (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Invictus (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Golden Palace Casino PT (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Golden Palace Casino NEW (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\iTunesMusic (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\rdriv (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\wkey (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\mwc (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{0e1230f8-ea50-42a9-983c-d22abc2eeb4c} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{0656a137-b161-cadd-9777-e37a75727e78} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SystemCheck2 (Trojan.Agent) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
E:\Users\XXX\Downloads\Usenext\alt.binaries.warez\XXX\XXX_multi_keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

Vielen DANK!

Warum machst Du dafür nen neuen Strang auf? Völlig unnötig und nochdigger bemerkt das so garnicht, dass Du quasi ne Antwort erstellt hast

Wie soll ich das sonst machen?
PN soll ich ihm nicht schreiben und der andere Thread wurde deaktiviert, weil ich wegen einer der "Goldenen Regeln" verstoßen habe...

Äh - sry, habs übersehen, dass das Teil inne Tonne geschmissen wurde.
Naja, wenigstens ein frisches und komplettes Hijackthis Logfile wär schon hilfreich gewesen

Infizierte Dateien:
E:\Users\XXX\Downloads\Usenext\alt.binaries.warez\ XXX\XXX_multi_keygen.exe
         

Wenn man sowas sieht, muss man sich echt nicht über Befall wundern

Mach mal bitte einen Durchlauf mit Combofix:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

• Lade dir das Tool hier herunter auf den Desktop -> KLICK

Das Programm jedoch noch nicht starten sondern zuerst folgendes tun:

• Schliesse alle Anwendungen und Programme, vor allem deine Antiviren-Software und andere Hintergrundwächter, sowie deinen Internetbrowser.
  Vermeide es auch explizit während das Combofix läuft die Maus und Tastatur zu benutzen.

• Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

• Starte nun die combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen und lass dein System durchsuchen.

• Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte abkopieren und in deinen Beitrag einfügen. Das log findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Hinweis: Combofix verhindert die Autostart Funktion aller CD / DVD und USB - Laufwerken um so eine Verbeitung einzudämmen. Wenn es hierdurch zu Problemen kommt, diese im Thread posten.

Poste alle Logfiles bitte mit Codetags umschlossen (#-Button) also so:

[code] Hier das Logfile rein! [/code]

So,
da bin ich wieder, also ich habe Deine Anleitungen befolgt, alerdings... CCleaner funktionierte wunderbar, aber bei dem Combo-Fix, da hat er die Meldung rausgegeben, dass er mit MS Vista 64-bit Systemen inkompatibel ist - gibt es eine Alternative?

dass er mit MS Vista 64-bit Systemen inkompatibel ist - gibt es eine Alternative?

Siehst Du, nun solltest Du wissen, warum man immer sein OS mit angibt.

Mit 64 Bit Vista ist das mitm Analysieren und Bereinigen nicht so einfach, da die meisten Tools weitgehend inkompatibel damit sind. Sowie es aussieht sind die meisten Schädlinge es aber auch

=> http://www.trojaner-board.de/58670-w...eenscreen.html
=> http://www.trojaner-board.de/58947-a...t-windows.html

Probier mal bitte RSIT:

Lade Random's System Information Tool (RSIT) herunter und speichere es auf Deinem Desktop.
Starte mit Doppelklick die RSIT.exe.
Klicke auf Continue, um die Nutzungsbedingungen zu akzeptieren.
Wenn Du HijackThis nicht installiert hast, wird RSIT das für Dich herunterladen und installieren.
In dem Fall bitte auch die Nutzungsbedingungen von Trend Micro (http://de.trendmicro.com/de/home) für HJT akzeptieren "I accept".
Wenn Deine Firewall fragt, bitte RSIT erlauben, ins Netz zu gehen.
Der Scan startet automatisch, RSIT checkt nun einige wichtige System-Bereiche und produziert Logfiles als Analyse-Grundlage.
Wenn der Scan beendet ist, werden zwei Logfiles erstellt und in Deinem Editor geöffnet.
Bitte poste den Inhalt von C:\rsit\log.txt und C:\rsit\info.txt (<= minimiert) hier in den Thread, wieder mit Codetags umschlossen.

Auch wenn ich Dir danke, habe auch aus meinen Fehlern gelernt -> Weil ich mein OS nicht angegeben hatte wurde der andere Thread gelöscht... Deshalb habe ich diese (u.a. auch das OS) in meiner Signatur veröffentlicht UND in meinem ersten Beitrag einen Verweis darauf gegeben: Nun siehst Du, warum Leute die lesen können klar im Vorteil sind..

Spaß bei Seite, hier die log.txt und info.txt:

 info.txt logfile of random's system information tool 1.04 2008-11-05 18:08:26

======Uninstall list======

-->MsiExec /X{A7E07C2B-2220-4415-87E3-784D5814BC93}
AC3Filter (remove only)-->D:\Program Files (x86)\AC3Filter\uninstall.exe
Acronis*True*Image*Home-->MsiExec.exe /X{633A06C3-B709-479A-AAB3-5EE94AD9EE4B}
Adobe Anchor Service CS3-->MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95}
Adobe Asset Services CS3-->MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}
Adobe Bridge CS3-->MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394}
Adobe Bridge Start Meeting-->MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23}
Adobe Camera Raw 4.0-->MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}
Adobe CMaps-->MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}
Adobe Color - Photoshop Specific-->MsiExec.exe /I{A2D81E70-2A98-4A08-A628-94388B063C5E}
Adobe Color Common Settings-->C:\Program Files (x86)\Common Files\Adobe\Installers\6c8e2cb4fd241c55406016127a6ab2e\Setup.exe
Adobe Color Common Settings-->MsiExec.exe /I{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}
Adobe Color EU Recommended Settings-->MsiExec.exe /I{73B5D990-04EA-4751-B10F-5534770B91F2}
Adobe Color JA Extra Settings-->MsiExec.exe /I{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}
Adobe Color NA Extra Settings-->MsiExec.exe /I{FF29A7E2-FF40-4D07-B7E4-2093DE59E10A}
Adobe Default Language CS3-->MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}
Adobe Device Central CS3-->MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}
Adobe Dreamweaver CS3-->C:\Program Files (x86)\Common Files\Adobe\Installers\25db75244653b42cb93dc27939d1c0e\Setup.exe
Adobe Dreamweaver CS3-->MsiExec.exe /I{4AA5B8A5-BEEF-4AD8-B11D-4443A042EA4F}
Adobe ExtendScript Toolkit 2-->C:\Program Files (x86)\Common Files\Adobe\Installers\3e054d2218e7aa282c2369d939e58ff\Setup.exe
Adobe ExtendScript Toolkit 2-->MsiExec.exe /I{24D7346D-D4B4-45E8-98EA-75EC14B42DD8}
Adobe Extension Manager CS3-->MsiExec.exe /I{BE5F3842-8309-4754-92D5-83E02E6077A3}
Adobe Flash Player ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin-->C:\Windows\SysWOW64\Macromed\Flash\uninstall_plugin.exe
Adobe Fonts All-->MsiExec.exe /I{6ABE0BEE-D572-4FE8-B434-9E72A289431B}
Adobe Help Viewer CS3-->MsiExec.exe /I{04AF207D-9A77-465A-8B76-991F6AB66245}
Adobe InDesign CS3 Icon Handler-->MsiExec.exe /I{EA7B3CC4-366D-4CF6-8350-FD7A7034116E}
Adobe InDesign CS3-->C:\Program Files (x86)\Common Files\Adobe\Installers\05ba3a63f36684fe0c5dde2ebe6f8f5\Setup.exe
Adobe InDesign CS3-->MsiExec.exe /I{CB3F8375-B600-4B9F-83C9-238ED1E583FD}
Adobe Linguistics CS3-->MsiExec.exe /I{54793AA1-5001-42F4-ABB6-C364617C6078}
Adobe PDF Library Files-->MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}
Adobe Photoshop CS3-->C:\Program Files (x86)\Common Files\Adobe\Installers\5f143314a5d434c8511097393d17397\Setup.exe
Adobe Photoshop CS3-->MsiExec.exe /I{29F05234-DCBB-4FE0-88DC-5160C9250312}
Adobe Reader 9 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A90000000001}
Adobe Setup-->MsiExec.exe /I{56B8B892-317E-4FDE-9E4D-44B189848A27}
Adobe Setup-->MsiExec.exe /I{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}
Adobe Setup-->MsiExec.exe /I{7D386596-0E80-4808-8AAE-C1DDA8212F7F}
Adobe Setup-->MsiExec.exe /I{B3C02EC1-A7B0-4987-9A43-8789426AAA7D}
Adobe Setup-->MsiExec.exe /I{F01F79AD-1F47-4685-AE4E-CCFA4EA9FF7C}
Adobe SING CS3-->MsiExec.exe /I{3F9B2FD2-1C83-4401-9967-C3636638E958}
Adobe Stock Photos CS3-->MsiExec.exe /I{29E5EA97-5F74-4A57-B8B2-D4F169117183}
Adobe Type Support-->MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}
Adobe Update Manager CS3-->MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8}
Adobe Version Cue CS3 Client-->MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5}
Adobe WinSoft Linguistics Plugin-->MsiExec.exe /I{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}
Adobe XMP Panels CS3-->MsiExec.exe /I{802771A9-A856-4A41-ACF7-1450E523C923}
AnyDVD-->"D:\Program Files (x86)\SlySoft\AnyDVD\AnyDVD-uninst.exe" /D="D:\Program Files (x86)\SlySoft\AnyDVD"
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Assassin's Creed-->C:\Program Files (x86)\InstallShield Installation Information\{8CFA9151-6404-409A-AF22-4632D04582FD}\setup.exe -runfromtemp -l0x0007 -removeonly
Avira Premium Security Suite-->C:\Program Files (x86)\Avira\Avira Premium Security Suite\SETUP.EXE /REMOVE
Brothers in Arms: Hell's Highway-->D:\Program Files (x86)\Ubisoft\Gearbox Software\Brothers in Arms - Hell's Highway\Binaries\uninst.exe
Call of Duty(R) 4 - Modern Warfare(TM) 1.4 Patch-->C:\Program Files (x86)\InstallShield Installation Information\{3BD633E0-4BF8-4499-9149-88F0767D449C}\setup.exe -runfromtemp -l0x0409
Call of Duty(R) 4 - Modern Warfare(TM) 1.5 Multiplayer Patch-->C:\Program Files (x86)\InstallShield Installation Information\{8503C901-85D7-4262-88D2-8D8B2A7B08B8}\setup.exe -runfromtemp -l0x0409
Call of Duty(R) 4 - Modern Warfare(TM)-->C:\Program Files (x86)\InstallShield Installation Information\{E48469CC-635E-4FD5-A122-1497C286D217}\setup.exe -runfromtemp -l0x0407
CCleaner (remove only)-->"D:\Program Files (x86)\CCleaner\uninst.exe"
CDBurnerXP-->"d:\Program Files (x86)\CDBurnerXP\unins000.exe"
CloneDVD2-->"D:\Program Files (x86)\Elaborate Bytes\CloneDVD2\CloneDVD2-uninst.exe" /D="D:\Program Files (x86)\Elaborate Bytes\CloneDVD2"
CloneDVDmobile-->"d:\Program Files (x86)\SlySoft\CloneDVDmobile\CloneDVDmobile-uninst.exe" /D="d:\Program Files (x86)\SlySoft\CloneDVDmobile"
Command & Conquer(TM) Generäle-->C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{06F80017-8F98-4C94-B868-52358569FC32} 
Command and Conquer(TM) Generäle Die Stunde Null -->C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{F3E9C243-122E-4D6B-ACC1-E1FEC02F6CA1} 
Counter-Strike: Source-->"D:\Program Files (x86)\Steam\steam.exe" steam://uninstall/240
Day of Defeat: Source Beta-->"D:\Program Files (x86)\Steam\steam.exe" steam://uninstall/302
Day of Defeat: Source-->"D:\Program Files (x86)\Steam\steam.exe" steam://uninstall/300
DivX Codec-->D:\Program Files (x86)\DivX\DivXCodecUninstall.exe /CODEC
DivX Player-->D:\Program Files (x86)\DivX\DivXPlayerUninstall.exe /PLAYER
EVEREST Ultimate Edition v4.50-->"D:\Program Files (x86)\Lavalys\EVEREST Ultimate Edition\unins000.exe"
Far Cry 2-->"C:\Program Files (x86)\InstallShield Installation Information\{F2835483-37F2-4123-B4FE-0E77D58447F2}\setup.exe" -runfromtemp -l0x0007 -removeonly
GRID-->"C:\Program Files (x86)\InstallShield Installation Information\{5A0B7BA5-4682-4273-81C2-69B17E649103}\setup.exe" -runfromtemp -l0x0007 -removeonly
Hercules WiFi Station-->C:\Program Files (x86)\InstallShield Installation Information\{DECE22F4-EEDD-4615-BC56-2F4827FAD64B}\setup.exe -runfromtemp -l0x0007 -removeonly
HijackThis 2.0.2-->"E:\Users\Henry\Downloads\HijackThis.exe" /uninstall
HP My Display-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{15733AD1-1CEF-459A-9245-0924FC63BDD5}\setup.exe" -l0x7  -removeonly
ICQ6-->"C:\Program Files (x86)\InstallShield Installation Information\{60DE4033-9503-48D1-A483-7846BD217CA9}\setup.exe" -runfromtemp -l0x0009 -removeonly
Java(TM) 6 Update 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160060}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Malwarebytes' Anti-Malware-->"D:\Program Files (x86)\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft Office Access MUI (German) 2007-->MsiExec.exe /X{90120000-0015-0407-0000-0000000FF1CE}
Microsoft Office Enterprise 2007-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL
Microsoft Office Enterprise 2007-->MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (German) 2007-->MsiExec.exe /X{90120000-0016-0407-0000-0000000FF1CE}
Microsoft Office Groove MUI (German) 2007-->MsiExec.exe /X{90120000-00BA-0407-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (German) 2007-->MsiExec.exe /X{90120000-0044-0407-0000-0000000FF1CE}
Microsoft Office OneNote MUI (German) 2007-->MsiExec.exe /X{90120000-00A1-0407-0000-0000000FF1CE}
Microsoft Office Outlook MUI (German) 2007-->MsiExec.exe /X{90120000-001A-0407-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (German) 2007-->MsiExec.exe /X{90120000-0018-0407-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Italian) 2007-->MsiExec.exe /X{90120000-001F-0410-0000-0000000FF1CE}
Microsoft Office Proofing (German) 2007-->MsiExec.exe /X{90120000-002C-0407-0000-0000000FF1CE}
Microsoft Office Publisher MUI (German) 2007-->MsiExec.exe /X{90120000-0019-0407-0000-0000000FF1CE}
Microsoft Office Shared MUI (German) 2007-->MsiExec.exe /X{90120000-006E-0407-0000-0000000FF1CE}
Microsoft Office Word MUI (German) 2007-->MsiExec.exe /X{90120000-001B-0407-0000-0000000FF1CE}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
NVIDIA PhysX v8.09.04-->MsiExec.exe /X{A7E07C2B-2220-4415-87E3-784D5814BC93}
OpenAL-->"C:\Program Files (x86)\OpenAL\OalinstGridRelease.exe" /U
PDF Settings-->MsiExec.exe /I{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}
Pivot Software-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{0217E1D1-BCEF-4A61-AF6D-F7740F65A066}\setup.exe" -l0x7  -removeonly
PokerStars.net-->"D:\Program Files (x86)\PokerStars.NET\PokerStarsUninstall.exe" /u:PokerStars.net
Pro Evolution Soccer 2009-->MsiExec.exe /X{A8DB611A-D80E-450D-85F6-3ACDD164BE31}
QuickTime-->MsiExec.exe /I{8DC42D05-680B-41B0-8878-6C14D24602DB}
Realtek 8169, 8168, 8101E and 8102E Ethernet Network Card Driver for Windows Vista-->C:\Program Files (x86)\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\setup.exe -runfromtemp -l0x0007 -removeonly
Realtek High Definition Audio Driver-->RtlUpd64.exe -r -m
Safari-->MsiExec.exe /I{C9D96682-5A4D-45FA-BA3E-DDCB2B0CB868}
SDK-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{0DEA342C-15CB-4F52-97B6-06A9C4B9C06F}\setup.exe" -l0x9 
Silent Hunter 4 Wolves of the Pacific-->C:\Program Files (x86)\InstallShield Installation Information\{0D005F09-A5F4-473B-A901-5735C6AF5628}\setup.exe -runfromtemp -l0x0007 -removeonly
Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
TuneUp Utilities 2008-->MsiExec.exe /I{5888428E-699C-4E71-BF71-94EE06B497DA}
Update for Word 2007 (KB934173)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {C6A89125-5473-45E3-B413-ED8186437475}
UseNeXT-->"D:\Program Files (x86)\UseNeXT\unins000.exe"
VLC media player 0.9.4-->D:\Program Files (x86)\VideoLAN\VLC\uninstall.exe
WinRAR-->D:\Program Files (x86)\WinRAR\uninstall.exe

=====HijackThis Backups=====

O4 - HKCU\..\Run: [fc161944] rundll32.exe "C:\Users\Henry\AppData\Local\Temp\dyqjippm.dll",b

======Security center information======

AS: Windows-Defender

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;D:\Program Files (x86)\QuickTime\QTSystem\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=AMD64
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=AMD64 Family 15 Model 67 Stepping 3, AuthenticAMD
"PROCESSOR_REVISION"=4303
"NUMBER_OF_PROCESSORS"=2
"CLASSPATH"=.;D:\Program Files (x86)\Java\jre1.6.0_07\lib\ext\QTJava.zip
"QTJAVA"=D:\Program Files (x86)\Java\jre1.6.0_07\lib\ext\QTJava.zip

-----------------EOF-----------------
         

und...:

 Logfile of random's system information tool 1.04 (written by random/random)
Run by Henry at 2008-11-05 18:08:19
Microsoft® Windows Vista™ Ultimate  Service Pack 1
System drive C: has 15 GB (37%) free of 40 GB
Total RAM: 4094 MB (66% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:08:25, on 05.11.2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
D:\Program Files (x86)\Java\jre1.6.0_07\bin\jusched.exe
D:\Program Files (x86)\iTunes\iTunesHelper.exe
D:\Program Files (x86)\Safari\Safari.exe
D:\Program Files (x86)\ICQ6\ICQ.exe
E:\Users\xxx\Downloads\RSIT.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~2\MICROS~1\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files (x86)\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: (no name) - {0124123D-61B4-456f-AF86-78C53A0790C5} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files (x86)\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\Avira Premium Security Suite\avgnt.exe" /min
O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://D:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\PROGRA~2\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\PROGRA~2\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Program Files (x86)\PartyPoker\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Program Files (x86)\PartyPoker\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - D:\Program Files (x86)\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - D:\Program Files (x86)\ICQ6\ICQ.exe
O13 - Gopher Prefix: 
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~2\MICROS~1\Office12\GR99D3~1.DLL
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Avira Premium Security Suite Firewall (AntiVirFirewallService) - Avira GmbH - C:\Program Files (x86)\Avira\Avira Premium Security Suite\avfwsvc.exe
O23 - Service: Avira Premium Security Suite MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files (x86)\Avira\Avira Premium Security Suite\avmailc.exe
O23 - Service: Avira Premium Security Suite Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files (x86)\Avira\Avira Premium Security Suite\sched.exe
O23 - Service: Avira Premium Security Suite Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\Avira Premium Security Suite\avguard.exe
O23 - Service: Avira Premium Security Suite WebGuard (antivirwebservice) - Avira GmbH - C:\Program Files (x86)\Avira\Avira Premium Security Suite\AVWEBGRD.EXE
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Avira Premium Security Suite MailGuard Hilfsdienst (AVEService) - Avira GmbH - C:\Program Files (x86)\Avira\Avira Premium Security Suite\avesvc.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files (x86)\Common Files\Portrait Displays\Shared\dtsrvc.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files (x86)\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NMSAccessU - Unknown owner - d:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - D:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: Acronis Try And Decide Service (TryAndDecideService) - Unknown owner - C:\Program Files (x86)\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - Unknown owner - C:\Windows\System32\TuneUpDefragService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9310 bytes

======Scheduled tasks folder======

C:\Windows\tasks\1-Klick-Wartung.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - D:\PROGRA~2\MICROS~1\Office12\GRA8E1~1.DLL [2006-10-26 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - D:\Program Files (x86)\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{0124123D-61B4-456f-AF86-78C53A0790C5}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=D:\Program Files (x86)\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
"avgnt"=C:\Program Files (x86)\Avira\Avira Premium Security Suite\avgnt.exe [2008-09-19 266497]
"GrooveMonitor"=D:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-26 31016]
"iTunesHelper"=D:\Program Files (x86)\iTunes\iTunesHelper.exe [2008-10-01 289576]
"QuickTime Task"=D:\Program Files (x86)\QuickTime\QTTask.exe [2008-09-06 413696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=D:\PROGRA~2\MICROS~1\Office12\GRA8E1~1.DLL [2006-10-26 2210608]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
relog_ap

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=
"NoActiveDesktopChanges"=
"ForceActiveDesktopOn"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cc4d9eab-2dcb-11dd-88b6-806e6f6e6963}]
shell\AutoRun\command - F:\setup.exe


======File associations======

.js - open - "D:\Program Files (x86)\Adobe\Adobe Dreamweaver CS3\Dreamweaver.exe","%1"

======List of files/folders created in the last 3 months======

2008-11-05 18:08:19 ----D---- C:\rsit
2008-11-04 16:04:53 ----D---- C:\Windows\ERDNT
2008-11-04 16:04:53 ----D---- C:\Qoobox
2008-11-04 16:04:52 ----D---- C:\ComboFix
2008-11-04 16:04:52 ----A---- C:\Windows\system32\swsc.exe
2008-11-04 16:04:52 ----A---- C:\Windows\system32\CF11621.exe
2008-11-04 16:04:45 ----D---- C:\32788R22FWJFW
2008-11-03 18:53:13 ----D---- C:\ProgramData\Codemasters
2008-11-03 18:50:33 ----RA---- C:\Windows\system32\tmp149A.tmp
2008-11-03 18:50:33 ----D---- C:\Program Files (x86)\OpenAL
2008-11-03 18:50:33 ----A---- C:\Windows\system32\wrap_oal.dll
2008-11-03 18:50:33 ----A---- C:\Windows\system32\OpenAL32.dll
2008-11-03 18:49:59 ----RA---- C:\Windows\system32\tmp147A.tmp
2008-11-02 16:11:27 ----D---- C:\ProgramData\KONAMI
2008-10-31 15:49:18 ----D---- C:\ProgramData\Office Genuine Advantage
2008-10-28 21:28:14 ----A---- C:\Windows\system32\win32spl.dll
2008-10-28 21:28:13 ----A---- C:\Windows\system32\Faultrep.dll
2008-10-28 17:56:36 ----D---- C:\Users\xxx\AppData\Roaming\Malwarebytes
2008-10-28 17:56:29 ----D---- C:\ProgramData\Malwarebytes
2008-10-26 20:26:31 ----A---- C:\Windows\system32\XAudio2_1.dll
2008-10-26 20:26:31 ----A---- C:\Windows\system32\XAPOFX1_0.dll
2008-10-26 20:26:31 ----A---- C:\Windows\system32\xactengine3_1.dll
2008-10-26 20:26:31 ----A---- C:\Windows\system32\X3DAudio1_4.dll
2008-10-26 20:26:31 ----A---- C:\Windows\system32\D3DX9_38.dll
2008-10-26 20:26:31 ----A---- C:\Windows\system32\d3dx10_38.dll
2008-10-26 20:26:31 ----A---- C:\Windows\system32\D3DCompiler_38.dll
2008-10-26 20:26:30 ----A---- C:\Windows\system32\XAudio2_0.dll
2008-10-26 20:26:30 ----A---- C:\Windows\system32\xactengine3_0.dll
2008-10-26 20:26:30 ----A---- C:\Windows\system32\X3DAudio1_3.dll
2008-10-26 20:26:29 ----A---- C:\Windows\system32\D3DX9_37.dll
2008-10-26 20:26:29 ----A---- C:\Windows\system32\d3dx10_37.dll
2008-10-26 20:26:29 ----A---- C:\Windows\system32\D3DCompiler_37.dll
2008-10-26 20:26:28 ----A---- C:\Windows\system32\xactengine2_10.dll
2008-10-26 20:26:28 ----A---- C:\Windows\system32\d3dx10_36.dll
2008-10-26 20:26:28 ----A---- C:\Windows\system32\D3DCompiler_36.dll
2008-10-26 20:26:27 ----A---- C:\Windows\system32\d3dx9_36.dll
2008-10-26 20:26:26 ----A---- C:\Windows\system32\xactengine2_9.dll
2008-10-26 20:26:26 ----A---- C:\Windows\system32\d3dx10_35.dll
2008-10-26 20:26:26 ----A---- C:\Windows\system32\D3DCompiler_35.dll
2008-10-26 20:26:25 ----A---- C:\Windows\system32\d3dx9_35.dll
2008-10-26 20:26:24 ----A---- C:\Windows\system32\xactengine2_8.dll
2008-10-26 20:26:24 ----A---- C:\Windows\system32\X3DAudio1_2.dll
2008-10-26 20:26:24 ----A---- C:\Windows\system32\d3dx10_34.dll
2008-10-26 20:26:24 ----A---- C:\Windows\system32\D3DCompiler_34.dll
2008-10-26 20:26:23 ----A---- C:\Windows\system32\xinput1_3.dll
2008-10-26 20:26:23 ----A---- C:\Windows\system32\xactengine2_7.dll
2008-10-26 20:26:23 ----A---- C:\Windows\system32\d3dx9_34.dll
2008-10-26 20:26:22 ----A---- C:\Windows\system32\d3dx10_33.dll
2008-10-26 20:26:22 ----A---- C:\Windows\system32\D3DCompiler_33.dll
2008-10-26 20:26:21 ----A---- C:\Windows\system32\xactengine2_6.dll
2008-10-26 20:26:21 ----A---- C:\Windows\system32\xactengine2_5.dll
2008-10-26 20:26:21 ----A---- C:\Windows\system32\d3dx9_33.dll
2008-10-26 20:26:20 ----A---- C:\Windows\system32\d3dx9_32.dll
2008-10-26 20:26:20 ----A---- C:\Windows\system32\d3dx10.dll
2008-10-26 20:26:19 ----A---- C:\Windows\system32\xactengine2_4.dll
2008-10-26 20:26:19 ----A---- C:\Windows\system32\x3daudio1_1.dll
2008-10-26 20:26:19 ----A---- C:\Windows\system32\d3dx9_31.dll
2008-10-26 20:26:18 ----A---- C:\Windows\system32\xinput1_2.dll
2008-10-26 20:26:18 ----A---- C:\Windows\system32\xinput1_1.dll
2008-10-26 20:26:18 ----A---- C:\Windows\system32\xactengine2_3.dll
2008-10-26 20:26:18 ----A---- C:\Windows\system32\xactengine2_2.dll
2008-10-26 20:26:17 ----A---- C:\Windows\system32\xactengine2_1.dll
2008-10-26 20:26:14 ----A---- C:\Windows\system32\d3dx9_30.dll
2008-10-26 20:26:13 ----A---- C:\Windows\system32\xactengine2_0.dll
2008-10-26 20:26:13 ----A---- C:\Windows\system32\x3daudio1_0.dll
2008-10-26 20:26:12 ----A---- C:\Windows\system32\d3dx9_29.dll
2008-10-26 20:26:12 ----A---- C:\Windows\system32\d3dx9_28.dll
2008-10-26 20:26:11 ----A---- C:\Windows\system32\d3dx9_27.dll
2008-10-26 20:26:10 ----A---- C:\Windows\system32\d3dx9_26.dll
2008-10-26 20:26:09 ----A---- C:\Windows\system32\d3dx9_25.dll
2008-10-26 20:26:09 ----A---- C:\Windows\system32\d3dx9_24.dll
2008-10-23 19:30:21 ----A---- C:\Windows\system32\netapi32.dll
2008-10-15 21:24:47 ----D---- C:\Users\xxx\AppData\Roaming\vlc
2008-10-15 19:16:32 ----A---- C:\Windows\system32\mshtml.dll
2008-10-15 19:16:32 ----A---- C:\Windows\system32\ieframe.dll
2008-10-15 19:16:31 ----A---- C:\Windows\system32\wininet.dll
2008-10-15 19:16:31 ----A---- C:\Windows\system32\urlmon.dll
2008-10-15 19:16:31 ----A---- C:\Windows\system32\iertutil.dll
2008-10-15 19:16:30 ----A---- C:\Windows\system32\mstime.dll
2008-10-15 19:16:30 ----A---- C:\Windows\system32\jsproxy.dll
2008-10-15 19:16:27 ----A---- C:\Windows\system32\EncDec.dll
2008-10-15 19:16:26 ----A---- C:\Windows\system32\psisdecd.dll
2008-10-15 17:18:53 ----D---- C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-15 17:18:53 ----D---- C:\Program Files (x86)\iPod
2008-10-07 13:33:00 ----A---- C:\Windows\system32\nvwgf2um.dll
2008-10-07 13:33:00 ----A---- C:\Windows\system32\nvoglv32.dll
2008-10-07 13:33:00 ----A---- C:\Windows\system32\nvd3dum.dll
2008-10-07 13:33:00 ----A---- C:\Windows\system32\nvcuda.dll
2008-10-07 13:33:00 ----A---- C:\Windows\system32\nvapi.dll
2008-10-04 16:03:13 ----A---- C:\Windows\system32\CmdLineExt_x64.dll
2008-10-04 12:21:25 ----RHD---- C:\Users\xxx\AppData\Roaming\SecuROM
2008-09-30 20:18:03 ----D---- C:\ProgramData\pupenqfu
2008-09-30 20:18:00 ----D---- C:\ProgramData\actdb
2008-09-24 22:01:47 ----D---- C:\ProgramData\FLEXnet
2008-09-24 21:57:29 ----D---- C:\Windows\system32\spool
2008-09-24 21:54:25 ----D---- C:\Program Files (x86)\Common Files\Macrovision Shared
2008-09-24 21:48:01 ----A---- C:\Users\xxx\AppData\Roaming\shedl.bat
2008-09-24 21:46:57 ----A---- C:\Users\xxx\AppData\Roaming\winexpl3.exe
2008-09-24 21:46:47 ----A---- C:\Users\xxx\AppData\Roaming\winexpl.exe
2008-09-24 21:43:42 ----A---- C:\Windows\system32\D3DX9_39.dll
2008-09-24 21:43:22 ----D---- C:\Program Files (x86)\Microsoft Games
2008-09-24 21:42:31 ----A---- C:\Windows\system32\gpprefcl.dll
2008-09-23 17:15:23 ----D---- C:\ProgramData\Acronis
2008-09-23 17:13:19 ----D---- C:\Program Files (x86)\Common Files\Acronis
2008-09-19 15:29:13 ----D---- C:\Users\xxx\AppData\Roaming\Avira
2008-09-19 14:37:46 ----D---- C:\ProgramData\Avira
2008-09-19 14:37:46 ----D---- C:\Program Files (x86)\Avira
2008-09-19 14:37:46 ----A---- C:\Windows\system32\avsda.dll
2008-09-19 14:31:34 ----A---- C:\Windows\system32\GEARAspi.dll
2008-09-19 14:29:56 ----D---- C:\Program Files (x86)\Bonjour
2008-09-18 21:29:55 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll
2008-09-18 21:29:55 ----A---- C:\Windows\system32\Apphlpdm.dll
2008-09-18 21:27:03 ----A---- C:\Windows\system32\wmpeffects.dll
2008-09-18 21:26:50 ----A---- C:\Windows\system32\dataclen.dll
2008-09-18 21:23:19 ----A---- C:\Windows\system32\wups.dll
2008-09-18 21:23:19 ----A---- C:\Windows\system32\wudriver.dll
2008-09-18 21:23:19 ----A---- C:\Windows\system32\wuapi.dll
2008-09-18 21:23:11 ----A---- C:\Windows\system32\wuwebv.dll
2008-09-18 21:23:11 ----A---- C:\Windows\system32\wuapp.exe
2008-09-11 21:56:13 ----D---- C:\Program Files (x86)\iPod(17)
2008-09-11 21:54:51 ----D---- C:\Program Files (x86)\Bonjour(2)
2008-09-11 21:53:53 ----D---- C:\Program Files (x86)\QuickTime(18)
2008-09-04 21:22:09 ----A---- C:\Windows\system32\Chip.dll
2008-09-04 09:31:16 ----A---- C:\Windows\system32\PhysXCplUI.exe
2008-08-29 08:53:50 ----A---- C:\Windows\system32\dnssd.dll
2008-08-28 19:19:27 ----A---- C:\Windows\system32\uxtuneup.dll
2008-08-28 19:19:13 ----A---- C:\Windows\system32\authuitu.dll
2008-08-16 08:58:15 ----A---- C:\Windows\system32\tzres.dll
2008-08-15 16:14:34 ----A---- C:\Windows\system32\inetcomm.dll
2008-08-15 16:14:31 ----A---- C:\Windows\system32\es.dll
2008-08-15 16:14:29 ----A---- C:\Windows\system32\winipsec.dll
2008-08-15 16:14:29 ----A---- C:\Windows\system32\polstore.dll
2008-08-15 16:14:29 ----A---- C:\Windows\system32\FwRemoteSvr.dll
2008-08-08 17:34:50 ----D---- C:\Program Files (x86)\Apple Software Update
         

und...:

======List of files/folders modified in the last 3 months======

2008-11-05 18:08:22 ----D---- C:\Windows\Temp
2008-11-05 18:06:35 ----D---- C:\Windows\Prefetch
2008-11-04 16:30:33 ----D---- C:\Windows\System32
2008-11-04 16:30:33 ----D---- C:\Windows\inf
2008-11-04 16:04:53 ----D---- C:\Windows\SysWOW64
2008-11-04 16:04:53 ----AD---- C:\Windows
2008-11-04 16:04:52 ----D---- C:\Windows\system32\en-US
2008-11-04 15:57:49 ----D---- C:\Windows\Debug
2008-11-03 18:53:13 ----HD---- C:\ProgramData
2008-11-03 18:50:33 ----RD---- C:\Program Files (x86)
2008-11-03 18:50:20 ----RSD---- C:\Windows\assembly
2008-11-03 18:38:58 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2008-11-02 16:15:42 ----SHD---- C:\Windows\Installer
2008-10-30 20:35:57 ----D---- C:\ProgramData\NVIDIA
2008-10-30 19:36:27 ----SD---- C:\Users\xxx\AppData\Roaming\Microsoft
2008-10-28 21:28:18 ----D---- C:\Windows\winsxs
2008-10-28 17:56:32 ----D---- C:\Windows\system32\drivers
2008-10-26 20:37:32 ----D---- C:\Program Files (x86)\Common Files\Wise Installation Wizard
2008-10-26 20:37:24 ----D---- C:\Program Files (x86)\AGEIA Technologies
2008-10-16 21:39:00 ----D---- C:\Users\xxx\AppData\Roaming\Adobe
2008-10-16 21:06:45 ----D---- C:\Program Files (x86)\Common Files\Adobe
2008-10-16 18:59:06 ----D---- C:\Program Files (x86)\Common Files\Steam
2008-10-15 19:51:32 ----D---- C:\Windows\Microsoft.NET
2008-10-15 19:48:17 ----D---- C:\Windows\ehome
2008-10-15 19:48:17 ----D---- C:\Program Files (x86)\Windows Mail
2008-10-15 19:48:16 ----D---- C:\Windows\system32\migration
2008-10-15 17:18:53 ----RD---- C:\Program Files
2008-10-14 18:36:09 ----SHD---- C:\System Volume Information
2008-10-06 17:50:49 ----D---- C:\ProgramData\Adobe
2008-10-06 17:03:25 ----D---- C:\Program Files (x86)\Adobe
2008-10-04 16:28:27 ----D---- C:\Windows\Tasks
2008-10-04 16:28:25 ----D---- C:\Windows\registration
2008-09-28 16:35:58 ----D---- C:\ProgramData\Microsoft Help
2008-09-28 16:28:02 ----A---- C:\Windows\win.ini
2008-09-25 19:01:46 ----D---- C:\Windows\Minidump
2008-09-24 21:59:06 ----RSD---- C:\Windows\Fonts
2008-09-24 21:54:25 ----D---- C:\Program Files (x86)\Common Files
2008-09-24 21:51:49 ----D---- C:\Windows\rescache
2008-09-24 21:43:26 ----D---- C:\Windows\Logs
2008-09-22 19:43:49 ----SHD---- C:\Boot
2008-09-22 19:43:49 ----D---- C:\Windows\system32\config
2008-09-18 21:36:18 ----D---- C:\Windows\system32\de-DE
2008-09-18 21:36:18 ----D---- C:\Windows\AppPatch
2008-09-18 21:27:35 ----D---- C:\Windows\PolicyDefinitions
2008-09-18 19:28:52 ----SD---- C:\ProgramData\Microsoft
2008-09-11 21:53:55 ----D---- C:\Program Files (x86)\Common Files\Apple

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avfwot;avfwot; C:\Windows\system32\DRIVERS\avfwot.sys []
R1 CSC;Offline Files Driver; C:\Windows\system32\drivers\csc.sys []
R1 ElbyCDIO;ElbyCDIO Driver; C:\Windows\System32\Drivers\ElbyCDIO.sys []
R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys []
R2 tifsfilter;Acronis True Image FS Filter; C:\Windows\system32\DRIVERS\tifsfilt.sys []
R3 AnyDVD;AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [2008-09-20 113088]
R3 avfwim;AvFw Packet Filter Miniport; C:\Windows\system32\DRIVERS\avfwim.sys []
R3 ElbyDelay;ElbyDelay; C:\Windows\System32\Drivers\ElbyDelay.sys [2007-02-16 14032]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\System32\Drivers\GEARAspiWDM.sys []
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys []
R3 ksthunk;Kernel Streaming Thunks; C:\Windows\system32\drivers\ksthunk.sys []
R3 Maplom;Maplom; C:\Windows\system32\drivers\Maplom.sys []
R3 MaplomL;MaplomL; C:\Windows\system32\drivers\MaplomL.sys []
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys []
R3 PdiPorts;Portrait Displays low level device driver; C:\Windows\system32\DRIVERS\PdiPorts.sys []
R3 rt61x64;Hercules Wifi Station Wireless Driver for Windows Vista64; C:\Windows\system32\DRIVERS\netr6164.sys []
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys []
S3 a7edjcm5;a7edjcm5; C:\Windows\system32\drivers\a7edjcm5.sys []
S3 drmkaud;Microsoft Kernel-DRM-Audioentschlüsselung; C:\Windows\system32\drivers\drmkaud.sys []
S3 GDPkIcpt;GDPkIcpt; \??\C:\Windows\system32\drivers\PktIcpt.sys []
S3 HdAudAddService;Microsoft 1.1 UAA-Funktionstreiber für High Definition Audio-Dienst; C:\Windows\system32\drivers\HdAudio.sys []
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys []
S3 MSPCLOCK;Microsoft Proxy für Streaming Clock; C:\Windows\system32\drivers\MSPCLOCK.sys []
S3 MSPQM;Microsoft Proxy für Streaming Quality Manager; C:\Windows\system32\drivers\MSPQM.sys []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\Windows\system32\drivers\MSTEE.sys []
S3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh64.sys []
S3 USBAAPL64;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl64.sys []
S3 xnacc;Treiberdienst XBOX 360-Controller für Windows; C:\Windows\system32\DRIVERS\xnacc.sys []
S3 xusb21;Xbox 360 Wireless Receiver Driver Service 21; C:\Windows\system32\DRIVERS\xusb21.sys []
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AcrSch2Svc;Acronis Scheduler2 Service; C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe [2008-04-20 605464]
R2 AntiVirFirewallService;Avira Premium Security Suite Firewall; C:\Program Files (x86)\Avira\Avira Premium Security Suite\avfwsvc.exe [2008-09-19 344321]
R2 AntiVirMailService;Avira Premium Security Suite MailGuard; C:\Program Files (x86)\Avira\Avira Premium Security Suite\avmailc.exe [2008-09-19 164097]
R2 AntiVirScheduler;Avira Premium Security Suite Planer; C:\Program Files (x86)\Avira\Avira Premium Security Suite\sched.exe [2008-10-23 68865]
R2 AntiVirService;Avira Premium Security Suite Guard; C:\Program Files (x86)\Avira\Avira Premium Security Suite\avguard.exe [2008-10-23 151297]
R2 antivirwebservice;Avira Premium Security Suite WebGuard; C:\Program Files (x86)\Avira\Avira Premium Security Suite\AVWEBGRD.EXE [2008-09-19 258305]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-10-01 116040]
R2 AVEService;Avira Premium Security Suite MailGuard Hilfsdienst; C:\Program Files (x86)\Avira\Avira Premium Security Suite\avesvc.exe [2008-09-19 41217]
R2 Bonjour Service;Bonjour-Dienst; C:\Program Files (x86)\Bonjour\mDNSResponder.exe [2008-08-29 238888]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R2 DTSRVC;Portrait Displays Display Tune Service; C:\Program Files (x86)\Common Files\Portrait Displays\Shared\dtsrvc.exe [2007-09-28 65536]
R2 NMSAccessU;NMSAccessU; d:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe [2008-03-09 71096]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe []
R2 TryAndDecideService;Acronis Try And Decide Service; C:\Program Files (x86)\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe [2008-04-21 498952]
R2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R3 iPod Service;iPod-Dienst; C:\Program Files (x86)\iPod\bin\iPodService.exe [2008-10-01 536872]
S2 StarWindServiceAE;StarWind AE Service; D:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2007-05-28 275968]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S3 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64; C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2008-01-05 93696]
S3 Fax;@%systemroot%\system32\fxsresm.dll,-118; C:\Windows\system32\fxssvc.exe []
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-09-24 654848]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; D:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-26 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PerfHost;@%systemroot%\sysWow64\perfhost.exe,-2; C:\Windows\SysWow64\perfhost.exe [2008-01-19 19968]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2008-10-15 87288]
S3 TuneUp.Defrag;@%SystemRoot%\System32\TuneUpDefragService.exe,-1; C:\Windows\System32\TuneUpDefragService.exe []
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2008-01-19 21504]
S3 wbengine;@%systemroot%\system32\wbengine.exe,-104; C:\Windows\system32\wbengine.exe []

-----------------EOF-----------------
         

Nette Nachtlektüre h:

Zitat von jesuishenry

Deshalb habe ich diese (u.a. auch das OS) in meiner Signatur veröffentlicht UND in meinem ersten Beitrag einen Verweis darauf gegeben: Nun siehst Du, warum Leute die lesen können klar im Vorteil sind..

Okay okay, das ist bei mir irgendwie untergegangen. Kann sein, dass ich mich irgendwie auf Deinen ersten Beitrag (der in der Tonne) zu sehr fixiert hatte...

C:\Windows\system32\drivers\a7edjcm5.sys
C:\Windows\system32\drivers\Maplom.sys
C:\Windows\system32\drivers\MaplomL.sys
C:\Windows\system32\drivers\PktIcpt.sys
         

Werte die mal bitte bei Virustotal.com aus und poste die Ergebnisse - mit Prüfsummen und Dateigrößenangaben, einfach alles.

Also ich habe mir jetzt mal rausgenommen keine zu kopieren, weil er bei keiner fündig geworden ist -> jedesmal 0%

Außer bei der C:\Windows\system32\drivers\a7edjcm5.sys, da kam es zu keiner Prüfung, weil die partout nicht auffindbar ist...wieso?

Sie ist wirklich nicht mehr vorhanden? Und Du hast Dir auch versteckte Dateien sowie die geschützten Systemdateien anzeigen lassen?

Beides anzeigen lassen - nicht auffindbar.

Tja Dann hat sie sich in Luft aufgelöst.

Probier mal das:

Anleitung Avenger (by swandog46)

Lade dir das Tool Avenger und speichere es auf dem Desktop:

• Doppelklick auf das Avenger-Symbol

• Kopiere nun folgenden Text in das weiße Feld bei -> "input script here"

files to delete:
C:\Windows\system32\drivers\a7edjcm5.sys
         

• Schliesse nun alle Programme und Browser-Fenster

• Um den Avenger zu starten klicke auf -> Execute
• Dann bestätigen mit "Yes" das der Rechner neu startet

• Nachdem das System neu gestartet ist, findest du einen Report vom Avenger unter -> C:\avenger.txt

• Öffne die Datei mit dem Editor und kopiere den gesamten Text in deinen Beitrag hier am Trojaner-Board.

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows NT 6.0 (build 6001, Service Pack 1)
Wed Nov 05 20:45:30 2008

20:45:30: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!


//////////////////////////////////////////


Ich habe alles so (auch den Befehl) so kopiert, wie er da steht...