Hallo erstmal ich bin neu hier und lass schon mal ein schönen grüss an alle da.
Also zu meinem problem ich habe mir ein virus eingefangen was aber mein antivir aber direkt gefunden hat und gelöscht hat.Aber trotzallem öffnet sich jetzt die ganze Zeit IE. Hab auch schon im abgesichertem Modus Antivir laufen lassen aber der findet nichts mehr. Hier mal mal Logfile vieleicht könntet ihr mir bitte helfen. danke mfg qta88


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:50:44, on 15.02.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18882)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\msa.exe
C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Windows\PLFSetI.exe
C:\Program Files\Acer Bio Protection\PdtWzd.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe
C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Users\Akyay\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Apoint2K\HidFind.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Acer\Acer VCM\AcerVCM.exe
C:\Users\Akyay\AppData\Local\Temp\Pzl.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Acer Bio Protection\PwdBank.exe
C:\Windows\system32\ctfmon.exe
C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Acer\Acer VCM\Vc.exe
C:\Program Files\Java\jre6\bin\javaw.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=0809&m=aspire_7738
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=0809&m=aspire_7738
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=0809&m=aspire_7738
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=0809&m=aspire_7738
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [ArcadeDeluxeAgent] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AmIcoSinglun] C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] C:\Program Files\Realtek\Audio\HDA\Skytel.exe
O4 - HKLM\..\Run: [PLFSetI] C:\Windows\PLFSetI.exe
O4 - HKLM\..\Run: [VitaKeyPdtWzd] c:\Program Files\Acer Bio Protection\PdtWzd.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe
O4 - HKLM\..\Run: [BackupManagerTray] "C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -k
O4 - HKLM\..\Run: [Acer ePower Management] C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe
O4 - HKLM\..\Run: [EgisTecLiveUpdate] "C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe"
O4 - HKLM\..\Run: [mwlDaemon] C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [ProductReg] "C:\Program Files\Acer\WR_PopUp\ProductReg.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [F5JMWNZTHI] C:\Users\Akyay\AppData\Local\Temp\Pzl.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - Startup: OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: Acer VCM.lnk = ?
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Quick-Launch Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - c:\Program Files\Acer Bio Protection\PwdBank.exe
O9 - Extra 'Tools' menuitem: Quick-Launch Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - c:\Program Files\Acer Bio Protection\PwdBank.exe
O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Acer\Acer VCM\Skype4COM.dll
O18 - Protocol: vw-wi - {0F3C833F-FB28-40EA-8CB9-6A55B996C3F6} - C:\ElsaWin\bin\wiProt.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: CLHNService - Unknown owner - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\Windows\SYSTEM32\crypserv.exe
O23 - Service: Defragmentation-Service (DfSdkS) - mst software GmbH, Germany - C:\Program Files\Ashampoo\Ashampoo WinOptimizer 2010 Advanced\Dfsdks.exe
O23 - Service: Acer ePower Service (ePowerSvc) - Acer Incorporated - C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: Google Desktop Manager 5.9.911.3589 (GoogleDesktopManager-110309-193829) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: EgisTec Service (IGBASVC) - Egis Technology Inc. - c:\Program Files\Acer Bio Protection\BASVC.exe
O23 - Service: ELSA Administration Service (LcSvrAdm) - Volkswagen AG - C:\ElsaWin\bin\LcSvrAdm.exe
O23 - Service: ELSA Auftragsverwaltungs Service (LcSvrAuf) - Volkswagen AG - C:\ElsaWin\bin\LcSvrAuf.exe
O23 - Service: ELSA DBA Server (LcSvrDba) - Volkswagen AG - C:\ElsaWin\bin\LcSvrDba.exe
O23 - Service: ELSA Historie Server (LcSvrHis) - Volkswagen AG - C:\ElsaWin\bin\LcSvrHis.exe
O23 - Service: ELSA PASS Server (LcSvrPAS) - Volkswagen AG - C:\ElsaWin\bin\LcSvrPas.exe
O23 - Service: ELSA APOSpro Server (LcSvrSaz) - Volkswagen AG - C:\ElsaWin\bin\LcSvrSaz.exe
O23 - Service: MyWinLocker Service (MWLService) - Egis Technology Inc. - C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NTI IScheduleSvc - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: organiser database (organiserservice) - Acresso - C:\PROGRA~1\VIVIDW~1\ORGANI~1.EXE
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Raw Socket Service (RS_Service) - Acer Incorporated - C:\Program Files\Acer\Acer VCM\RS_Service.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: ELSA Vaudis Service (VSGate) - Volkswagen AG - C:\ElsaWin\bin\VSGate.exe

--
End of file - 11565 bytes

lad mal dwm.exe bei virustotal hoch

msa.exe iss böse lad das auch mal bei virustotal hoch
dann lad dir Malwarebytes hoch und tu von virustotal und Malwarebytes die logfiles hier rein

Danke schon mal für die schnelle antwort
ich habe die datei hochgeladen dann kommt da "die datei ist schon analysiert worde" dann komm ich auf die seite:

http://www.virustotal.com/de/analisis/8aed6773ae1c8b65b4cad6229bd05e224d348cf2a9d9f7d50f2513a9b1e14f66-1266235781

was heist das nun?

und das kommt bei der datei msa.exe






Antivirus Version letzte aktualisierung Ergebnis
a-squared 4.5.0.50 2010.02.15 -
AhnLab-V3 5.0.0.2 2010.02.15 -
AntiVir 7.9.1.170 2010.02.15 -
Antiy-AVL 2.0.3.7 2010.02.15 Packed/Win32.Krap.gen
Authentium 5.2.0.5 2010.02.15 W32/SuspPack.BL.gen!Eldorado
Avast 4.8.1351.0 2010.02.14 Win32:FakeAV-AJN
AVG 9.0.0.730 2010.02.15 Generic16.AZKG
BitDefender 7.2 2010.02.15 -
CAT-QuickHeal 10.00 2010.02.15 Trojan.Krap.ag
ClamAV 0.96.0.0-git 2010.02.15 -
Comodo 3944 2010.02.15 -
DrWeb 5.0.1.12222 2010.02.15 Trojan.Click.39881
eSafe 7.0.17.0 2010.02.14 -
eTrust-Vet 35.2.7303 2010.02.15 Win32/Warduncrypt!packed
F-Prot 4.5.1.85 2010.02.15 W32/SuspPack.BL.gen!Eldorado
F-Secure 9.0.15370.0 2010.02.15 -
Fortinet 4.0.14.0 2010.02.15 -
GData 19 2010.02.15 Win32:FakeAV-AJN
Ikarus T3.1.1.80.0 2010.02.15 -
Jiangmin 13.0.900 2010.02.15 Packed.Krap.bleg
K7AntiVirus 7.10.972 2010.02.12 -
Kaspersky 7.0.0.125 2010.02.15 Packed.Win32.Krap.ag
McAfee 5892 2010.02.14 FakeAlert-IM
McAfee+Artemis 5892 2010.02.14 FakeAlert-IM
McAfee-GW-Edition 6.8.5 2010.02.15 -
Microsoft 1.5406 2010.02.15 TrojanDownloader:Win32/Renos.KF
NOD32 4867 2010.02.15 -
Norman 6.04.08 2010.02.15 -
nProtect 2009.1.8.0 2010.02.15 -
Panda 10.0.2.2 2010.02.14 Suspicious file
PCTools 7.0.3.5 2010.02.15 -
Rising 22.34.01.03 2010.02.11 -
Sophos 4.50.0 2010.02.15 Mal/FakeDouf-B
Sunbelt 5678 2010.02.15 Trojan.Win32.FraudPack.gen.a (v)
Symantec 20091.2.0.41 2010.02.15 Suspicious.Insight
TheHacker 6.5.1.4.194 2010.02.15 Trojan/FakeAV.gen
TrendMicro 9.120.0.1004 2010.02.15 -
VBA32 3.12.12.2 2010.02.14 -
ViRobot 2010.2.13.2186 2010.02.13 Trojan.Win32.Krap.170496.E
VirusBuster 5.0.21.0 2010.02.15 -
weitere Informationen
File size: 170496 bytes
MD5 : 19f17224db38b6f2bee9961615032c88
SHA1 : 8fd76d15aa9f6a0e4bbdcf4e086dc7bcc30dcdd9
SHA256: b0528c896377824916c70e76855bf04714b7427023c713a2aef63b95b1e7c377
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x2416
timedatestamp.....: 0x4A9DE712 (Wed Sep 2 05:31:30 2009)
machinetype.......: 0x14C (Intel I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
CODE 0x1000 0x27D4 0x2800 1.46 7dbb8bd59efca938b3fcf615419c9ef1
.data 0x4000 0x639A 0x6400 1.58 81f98e617ff2d76fd0e94dcc9f067d1d
.edata 0xB000 0x6A653 0x1F800 6.88 ab29346cb7e20a41aa7c1f43ab8b15f3
.idata 0x76000 0xBE1 0xC00 1.83 f55e8dc2c48824d9f83046a76f5c412e
.init 0x77000 0x435 0x600 0.02 72d6b118179296187518110ef139429b

( 3 imports )

> advapi32.dll: RegDeleteValueW, RegEnumKeyExA, RegCreateKeyW, RegCreateKeyW, RegDeleteValueW, RegLoadKeyA
> kernel32.dll: ExitProcess, GetLocalTime, HeapAlloc, GetCommandLineA, GetStdHandle
> user32.dll: EndDialog, AlignRects, IsWindow, DialogBoxParamW, IsWindow, GetWindowTextLengthA, CopyIcon, GetWindowTextLengthA, GetScrollPos

( 0 exports )
TrID : File type identification
Win32 Executable Generic (38.4%)
Win32 Dynamic Link Library (generic) (34.2%)
Clipper DOS Executable (9.1%)
Generic Win/DOS Executable (9.0%)
DOS Executable Generic (9.0%)
ssdeep: 3072:v1SNL5QO7LEyKU4hapzSr0/DJru6zzHqeUpe2A:EZAcF86HUpD
sigcheck: publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
PEiD : -
RDS : NSRL Reference Data Set

also,
bitte poste Malwarebytes log hier
dann mach bitte noch einmal einen onlinescan zb trendmicro housecall
und poste das dann auch hier

dann lad dir Dr. Web cureit herunter starte im abegsicherten modus und für das
aus (vorher internet abtrennen) dann Dr. Web laufenlassen und das log auch hier rein posten und nochma neues hijack this
ich glaub jetzt bist du erstmal beschaftigt

Ps:. msa.exe versuchte das mal so zu löschen wenn nicht geh versuch mal umzubennenen in zb. "hghgsg.com" und versuche dann zu löschen
ich hoffe mal das klappt soweit denn hier ist mein latein zu ende frag ma
einen der mehr ahnung hat als ich
Libe grüsse Punk

msa.exe konnte ich nicht löschen auch wenn ich die datei umschreibe.
mit den anderen sachen haste recht da bin ich erstmal beschäftigt aber ich versuch es so schnell wie möglich dann ihr rein zu posten.

hier ist schon mal der internet scann

BitDefender QuickScan Beta 32-bit v0.9.9.0
------------------------------------------

Scan date: Mon Feb 15 13:55:07 2010
Machine ID: 348B2999

Warning: Low execution rights. Please run QuickScan/browser as Administrator.


Found 1 infected file!
------------------------
C:\Users\Akyay\AppData\Local\Temp\Pzl.exe - Trojan.Fakealert.5423


Processes
---------
<unsigned> Acer Video Conference Manager 3208 C:\Program Files\Acer\Acer VCM\AcerVCM.exe
<unsigned> AntiVir Desktop 2620 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
<unsigned> DefaultSettingEXE Application 3392 C:\Windows\PLFSetI.exe
<unsigned> Fingerprint Solution 3436 C:\Program Files\Acer Bio Protection\PdtWzd.exe
<unsigned> Fingerprint Solution 4336 C:\Program Files\Acer Bio Protection\PwdBank.exe
<unsigned> Realtek HD Audio Data Rerouter 2692 C:\Users\Akyay\AppData\Local\Temp\RtkBtMnt.exe

<verified> Acer ePower Management 4416 C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe
<verified> Alps Pointing-device Driver 3452 C:\Program Files\Apoint2K\Apoint.exe
<verified> Alps Pointing-device Driver 3188 C:\Program Files\Apoint2K\HidFind.exe
<verified> Alps Pointing-device Driver for Windows NT/2000/XP 3940 C:\Program Files\Apoint2K\Apntex.exe
<verified> Betriebssystem Microsoft® Windows® 4088 C:\Program Files\Windows Media Player\wmpnscfg.exe
<verified> Betriebssystem Microsoft® Windows® 2316 C:\Windows\Explorer.EXE
<verified> Betriebssystem Microsoft® Windows® 2224 C:\Windows\system32\Dwm.exe
<verified> Betriebssystem Microsoft® Windows® 2260 C:\Windows\system32\taskeng.exe
<verified> Firefox 5684 C:\Program Files\Mozilla Firefox\firefox.exe
<verified> HD Audio Control Panel 3356 C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
<verified> Microsoft® Windows® Operating System 4448 C:\Windows\system32\wbem\unsecapp.exe
<verified> MyWinLocker 2144 C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe


Network activity
----------------
Process firefox.exe (5684) connected on port 80 (HTTP) - bw-in-f138.1e100.net
Process firefox.exe (5684) connected on port 80 (HTTP) - fk-in-f156.1e100.net
Process firefox.exe (5684) connected on port 80 (HTTP) - fk-in-f156.1e100.net
Process firefox.exe (5684) connected on port 80 (HTTP) - fk-in-f156.1e100.net
Process firefox.exe (5684) connected on port 80 (HTTP) - a88-221-61-115.deploy.akamaitechnologies.com
Process firefox.exe (5684) connected on port 80 (HTTP) - rcm-de.amazon.de
Process firefox.exe (5684) connected on port 80 (HTTP) - fk-in-f103.1e100.net
Process firefox.exe (5684) connected on port 80 (HTTP) - fk-in-f103.1e100.net
Process firefox.exe (5684) connected on port 80 (HTTP) - dc2.122.2o7.net



Autoruns and critical files
---------------------------
<unsigned> ProductR Application C:\Program Files\Acer\WR_PopUp\ProductReg.exe
<unsigned> AntiVir Desktop C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
<unsigned> DefaultSettingEXE Application C:\Windows\PLFSetI.exe
<unsigned> Fingerprint Solution C:\Program Files\Acer Bio Protection\PdtWzd.exe
<unsigned> Google Desktop c:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll
<unsigned> Pzl.exe C:\Users\Akyay\AppData\Local\Temp\Pzl.exe

<verified> Acer ePower Management C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe
<verified> Adobe Acrobat C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
<verified> Adobe Reader and Acrobat Manager C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
<verified> Alps Pointing-device Driver C:\Program Files\Apoint2K\Apoint.exe
<verified> Betriebssystem Microsoft® Windows® C:\Windows\System32\browseui.dll
<verified> Betriebssystem Microsoft® Windows® c:\windows\system32\userinit.exe
<verified> GrooveShellExtensions Module C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
<verified> HD Audio Control Panel C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
<verified> Launch Manager C:\Program Files\Launch Manager\LManager.exe
<verified> Malwarebytes' Anti-Malware C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
<verified> MyWinLocker C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
<verified> NVIDIA Compatible Windows7 Display driver, Version C:\Windows\system32\NvCpl.dll
<verified> Realtek Voice Manager C:\Program Files\Realtek\Audio\HDA\Skytel.exe
<verified> Windows Defender C:\Program Files\Windows Defender\MSASCui.exe
<verified> Windows Live Messenger C:\Program Files\Windows Live\Messenger\msnmsgr.exe
<verified> Windows® Internet Explorer C:\Windows\System32\webcheck.dll


Browser plugins
---------------
<unsigned> Fingerprint Solution C:\Program Files\Acer Bio Protection\PwdBank.exe
<unsigned> nppdf32.DEU C:\Program Files\Mozilla Firefox\plugins\nppdf32.DEU
<unsigned> ToolBand Module c:\program files\daemon tools toolbar\dttoolbar.dll
<unsigned> ToolBand Module C:\Users\Akyay\AppData\Roaming\Mozilla\Firefox\Profiles/bk9rn55p.default\extensions\DTToolbar@toolbarnet.com\components\DTToolbarFF.dll
<unsigned> VLC Multimedia Plug-in C:\Program Files\VideoLAN\VLC\npvlc.dll

<verified> 2007 Microsoft Office system C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL
<verified> AcroIEHelperShim Library c:\program files\common files\adobe\acrobat\activex\acroiehelpershim.dll
<verified> Adobe Acrobat C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll
<verified> Betriebssystem Microsoft® Windows® C:\Windows\System32\mswsock.dll
<verified> Betriebssystem Microsoft® Windows® C:\Windows\System32\NapiNSP.dll
<verified> Betriebssystem Microsoft® Windows® C:\Windows\System32\pnrpnsp.dll
<verified> BitDefender QuickScan C:\Users\Akyay\AppData\Roaming\Mozilla\Firefox\Profiles/bk9rn55p.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\bdqscan.dll
<verified> BitDefender QuickScan C:\Users\Akyay\AppData\Roaming\Mozilla\Firefox\Profiles/bk9rn55p.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
<verified> Java Deployment Toolkit 6.0.150.3 C:\Program Files\Mozilla Firefox\plugins\npdeploytk.dll
<verified> Microsoft® Windows Live ID c:\program files\common files\microsoft shared\windows live\windowslivelogin.dll
<verified> Microsoft® Windows® Operating System C:\Windows\System32\nlaapi.dll
<verified> Microsoft® Windows® Operating System C:\Windows\System32\winrnr.dll
<verified> Mozilla Default Plug-in C:\Program Files\Mozilla Firefox\plugins\npnul32.dll
<verified> NPSWF32.dll C:\Windows\system32\Macromed\Flash\NPSWF32.dll
<verified> Windows Live® Photo Gallery C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
<verified> Windows Presentation Foundation c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
<verified> Windows® Internet Explorer C:\Windows\System32\ieframe.dll


Scan
----

No file uploaded.

Scan finished - communication took 4 sec
Total traffic - 0.05 MB sent, 3.04 KB recvd
Scanned 1003 files and modules - 164 seconds

Kann ich den gefunden virus Plz.exe einfach so löschen????

hey ich glaube ich weiß jetzt was dein problem ist du musst folgendes loswerden:

C:\Windows\system32\Dwm.exe
C:\Windows\msa.exe
C:\Users\Akyay\AppData\Local\Temp\Pzl.exe
lass folgendes mit Malwarebytes scannen und lass Malwarebytes versuchen dies zu löschen.

Ps:. nehm mal bitte meine freundschafts einladung an

C:\Windows\system32\Dwm.exe >>http://www.neuber.com/taskmanager/process/dwm.exe.html

bitte guck mal in deinem postfach nach da steht drin wie du die viren loswirst

Warum per PM,wir wollen auch gerne wissen wie es weiter geht

hi argus ich habe nur per pm ihm meinen serial für Malwarebytes gegeben
damit er mit dem tool fileassasin oder wie das heisst die wiren löschen kann wenn du ihn auch willst ich geb ihn dir per pm habe kein bock dass hier jeder mein key pekommt

Das wass du jetzt gemacht hast,ist illigal

Er/Sie hatte nur Malwarebytes benutzen muessen

http://www.trojaner-board.de/69886-alle-hilfesuchenden-eroeffnung-themas-beachten.html