Hallo!

- rKill laufen laßen
- Paladin mit Malware gelöscht....
- a-squared Free nochmal über den Pc laufen laßen...
Trojan-Spy.Win32.Ursnif gefunden, läßt sich aber nicht löschen.

Malware bekomm ich nicht mehr zum laufen...
hab ich dann gelöscht und versucht neu zu installieren geht nicht

Was muß ich machen....Hilfe!!!!


Logfile of random's system information tool 1.06 (written by random/random)
Run by x at 2010-03-01 16:31:20
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 19 GB (26%) free of 71 GB
Total RAM: 2037 MB (40% free)

HijackThis download failed

======Scheduled tasks folder======

C:\Windows\tasks\Norton AntiVirus - Vollständige Systemprüfung ausführen - ******.job
C:\Windows\tasks\Norton Internet Security - Vollständige Systemprüfung ausführen - x.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E8A6170-7264-4D0F-BEAE-D42A53123C75}]
C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll [2006-11-21 96984]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID-Anmelde-Hilfsprogramm - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-03-30 403824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - c:\program files\google\googletoolbar2.dll [2008-09-28 2427968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-07-25 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856}]
HP Smart BHO Class - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2008-03-27 501056]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - Acer eDataSecurity Management - C:\Windows\system32\eDStoolbar.dll [2007-02-06 151552]
{90222687-F593-4738-B738-FBEE9C7B26DF} - Show Norton Toolbar - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll [2006-11-21 565960]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar2.dll [2008-09-28 2427968]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2006-10-23 815104]
"eDataSecurity Loader"=C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe [2007-02-06 464168]
"Acer Tour"= []
"ccApp"=C:\Program Files\Common Files\Symantec Shared\ccApp.exe [2006-11-21 107112]
"osCheck"=C:\Program Files\Norton Internet Security\osCheck.exe [2006-11-21 22696]
"eRecoveryService"= []
"eDSMSNfix"=C:\Acer\Empowering Technology\eDSMSNfix.exe [2007-02-08 13312]
"Acer Tour Reminder"=C:\Acer\AcerTour\Reminder.exe [2007-01-17 151552]
"WarReg_PopUp"=C:\Acer\WR_PopUp\WarReg_PopUp.exe [2006-11-05 57344]
"Symantec PIF AlertEng"=C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2008-01-29 583048]
"Ulead AutoDetector v2"=C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe [2004-11-26 90112]
"FreePDF Assistant"=C:\Program Files\FreePDF_XP\fpassist.exe [2008-07-22 357376]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2008-03-25 49152]
"Windows Mobile-based device management"=C:\Windows\WindowsMobile\wmdSync.exe [2006-11-02 215552]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-07-25 149280]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-09-05 417792]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-09-08 305440]
"hpqSRMon"=C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [2008-03-13 81920]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2008-02-11 141848]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2008-02-11 166424]
"Persistence"=C:\Windows\system32\igfxpers.exe [2008-02-11 133656]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2007-03-01 4390912]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-11 1233920]
"IncrediMail"=C:\Program Files\IncrediMail\bin\IncMail.exe [2009-01-27 251264]
"ISUSPM Startup"=C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe [2005-08-11 249856]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe [2008-09-28 171448]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-19 125952]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-19 202240]
"dfsrtend"=rundll32 C:\Users\x\AppData\Local\Temp\conilder.dll,DllEntryPoint []

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
WISO Mein Sparbuch heute.lnk - C:\Program Files\WISO\Sparbuch 2009\meinsparbuchheute.exe

C:\Users\x\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
msconfig32.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2008-02-11 204800]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Acer\Empowering Technology\eDataSecurity\eDSfsu.exe"="C:\Acer\Empowering Technology\eDataSecurity\eDSfsu.exe:*:Enabled:eDSfsu"
"C:\Acer\Empowering Technology\eDataSecurity\encryption.exe"="C:\Acer\Empowering Technology\eDataSecurity\encryption.exe:*:Enabled:encryption"
"C:\Acer\Empowering Technology\eDataSecurity\decryption.exe"="C:\Acer\Empowering Technology\eDataSecurity\decryption.exe:*:Enabled:decryption"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d463c2f8-8200-11de-a112-001b381ee2d1}]
shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\Recycled\ctfmon.exe
shell\Open(&0)\command - F:\Recycled\ctfmon.exe


======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-02-28 21:52:53 ----D---- C:\Program Files\a-squared Free
2010-02-24 23:48:50 ----D---- C:\Program Files\Avira
2010-02-24 23:43:28 ----D---- C:\Program Files\Microsoft
2010-02-24 16:54:19 ----D---- C:\rsit
2010-02-24 16:33:59 ----D---- C:\Program Files\CCleaner
2010-02-24 16:19:25 ----A---- C:\Windows\system32\secproc_isv.dll
2010-02-24 16:19:24 ----A---- C:\Windows\system32\secproc.dll
2010-02-24 16:19:24 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe
2010-02-24 16:19:24 ----A---- C:\Windows\system32\RMActivate_ssp.exe
2010-02-24 16:19:24 ----A---- C:\Windows\system32\RMActivate_isv.exe
2010-02-24 16:19:24 ----A---- C:\Windows\system32\RMActivate.exe
2010-02-24 16:19:23 ----A---- C:\Windows\system32\secproc_ssp_isv.dll
2010-02-24 16:19:23 ----A---- C:\Windows\system32\secproc_ssp.dll
2010-02-24 16:19:23 ----A---- C:\Windows\system32\msdrm.dll
2010-02-24 16:19:21 ----A---- C:\Windows\system32\gameux.dll
2010-02-24 16:19:20 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll
2010-02-24 16:19:20 ----A---- C:\Windows\system32\Apphlpdm.dll
2010-02-24 11:36:20 ----A---- C:\Windows\system32\jscript.dll
2010-02-24 11:36:09 ----A---- C:\Windows\system32\tzres.dll
2010-02-24 11:31:29 ----D---- C:\Program Files\Paladin Antivirus
2010-02-23 23:41:52 ----D---- C:\Users\x\AppData\Roaming\Malwarebytes
2010-02-23 22:07:28 ----D---- C:\ProgramData\Malwarebytes
2010-02-23 22:07:28 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-02-23 21:47:40 ----D---- C:\Program Files\Windows Portable Devices
2010-02-23 21:27:52 ----A---- C:\Windows\system32\UIRibbonRes.dll
2010-02-23 21:27:52 ----A---- C:\Windows\system32\UIAnimation.dll
2010-02-23 21:27:51 ----A---- C:\Windows\system32\UIRibbon.dll
2010-02-23 21:27:22 ----A---- C:\Windows\system32\WMPhoto.dll
2010-02-23 21:27:21 ----A---- C:\Windows\system32\XpsRasterService.dll
2010-02-23 21:27:21 ----A---- C:\Windows\system32\XpsGdiConverter.dll
2010-02-23 21:27:21 ----A---- C:\Windows\system32\printfilterpipelineprxy.dll
2010-02-23 21:27:21 ----A---- C:\Windows\system32\d3d10warp.dll
2010-02-23 21:27:21 ----A---- C:\Windows\system32\cdd.dll
2010-02-23 21:27:20 ----A---- C:\Windows\system32\xpsservices.dll
2010-02-23 21:27:20 ----A---- C:\Windows\system32\XpsPrint.dll
2010-02-23 21:27:20 ----A---- C:\Windows\system32\WindowsCodecsExt.dll
2010-02-23 21:27:20 ----A---- C:\Windows\system32\WindowsCodecs.dll
2010-02-23 21:27:20 ----A---- C:\Windows\system32\printfilterpipelinesvc.exe
2010-02-23 21:27:20 ----A---- C:\Windows\system32\PhotoMetadataHandler.dll
2010-02-23 21:27:20 ----A---- C:\Windows\system32\OpcServices.dll
2010-02-23 21:27:20 ----A---- C:\Windows\system32\FntCache.dll
2010-02-23 21:27:20 ----A---- C:\Windows\system32\dxgi.dll
2010-02-23 21:27:20 ----A---- C:\Windows\system32\dxdiagn.dll
2010-02-23 21:27:20 ----A---- C:\Windows\system32\dxdiag.exe
2010-02-23 21:27:20 ----A---- C:\Windows\system32\DWrite.dll
2010-02-23 21:27:20 ----A---- C:\Windows\system32\d3d11.dll
2010-02-23 21:27:20 ----A---- C:\Windows\system32\d3d10level9.dll
2010-02-23 21:27:20 ----A---- C:\Windows\system32\d3d10core.dll
2010-02-23 21:27:20 ----A---- C:\Windows\system32\d3d10_1core.dll
2010-02-23 21:27:20 ----A---- C:\Windows\system32\d3d10_1.dll
2010-02-23 21:27:20 ----A---- C:\Windows\system32\d2d1.dll
2010-02-23 21:27:19 ----A---- C:\Windows\system32\d3d10.dll
2010-02-23 21:26:55 ----A---- C:\Windows\system32\WPDShextAutoplay.exe
2010-02-23 21:26:55 ----A---- C:\Windows\system32\wpdbusenum.dll
2010-02-23 21:26:55 ----A---- C:\Windows\system32\BthMtpContextHandler.dll
2010-02-23 21:26:53 ----A---- C:\Windows\system32\PortableDeviceConnectApi.dll
2010-02-23 21:26:52 ----A---- C:\Windows\system32\WpdMtpUS.dll
2010-02-23 21:26:52 ----A---- C:\Windows\system32\WpdConns.dll
2010-02-23 21:26:51 ----A---- C:\Windows\system32\WPDSp.dll
2010-02-23 21:26:51 ----A---- C:\Windows\system32\WPDShServiceObj.dll
2010-02-23 21:26:51 ----A---- C:\Windows\system32\wpdshext.dll
2010-02-23 21:26:51 ----A---- C:\Windows\system32\WpdMtp.dll
2010-02-23 21:26:51 ----A---- C:\Windows\system32\wpd_ci.dll
2010-02-23 21:26:51 ----A---- C:\Windows\system32\PortableDeviceWMDRM.dll
2010-02-23 21:26:51 ----A---- C:\Windows\system32\PortableDeviceTypes.dll
2010-02-23 21:26:51 ----A---- C:\Windows\system32\PortableDeviceClassExtension.dll
2010-02-23 21:26:51 ----A---- C:\Windows\system32\PortableDeviceApi.dll
2010-02-23 21:25:57 ----A---- C:\Windows\system32\UIAutomationCore.dll
2010-02-23 21:25:57 ----A---- C:\Windows\system32\oleaccrc.dll
2010-02-23 21:25:57 ----A---- C:\Windows\system32\oleacc.dll
2010-02-23 21:20:29 ----D---- C:\Windows\system32\x64
2010-02-23 21:14:41 ----A---- C:\Windows\system32\wmp.dll
2010-02-23 21:14:36 ----A---- C:\Windows\system32\unregmp2.exe
2010-02-23 21:14:34 ----A---- C:\Windows\system32\wmploc.DLL
2010-02-23 21:06:24 ----A---- C:\ProgramData\fiosejgfse.dll
2010-02-12 20:36:23 ----HD---- C:\Program Files\Zero G Registry
2010-02-12 20:36:23 ----D---- C:\Program Files\CUTEX Systems
2010-02-09 20:55:34 ----A---- C:\Windows\system32\ntoskrnl.exe
2010-02-09 20:55:34 ----A---- C:\Windows\system32\ntkrnlpa.exe
2010-02-09 20:55:25 ----A---- C:\Windows\system32\quartz.dll
2010-02-09 20:55:24 ----A---- C:\Windows\system32\tsbyuv.dll
2010-02-09 20:55:24 ----A---- C:\Windows\system32\msyuv.dll
2010-02-09 20:55:24 ----A---- C:\Windows\system32\msvidc32.dll
2010-02-09 20:55:24 ----A---- C:\Windows\system32\msvfw32.dll
2010-02-09 20:55:24 ----A---- C:\Windows\system32\msrle32.dll
2010-02-09 20:55:24 ----A---- C:\Windows\system32\mciavi32.dll
2010-02-09 20:55:24 ----A---- C:\Windows\system32\iyuv_32.dll
2010-02-09 20:55:24 ----A---- C:\Windows\system32\avifil32.dll
2010-02-03 20:48:54 ----D---- C:\ProgramData\McAfee
2010-02-03 20:48:42 ----D---- C:\ProgramData\NOS

======List of files/folders modified in the last 1 months======

2010-03-01 16:31:22 ----D---- C:\Windows\Prefetch
2010-03-01 16:31:15 ----D---- C:\Windows\Temp
2010-02-28 22:01:41 ----RD---- C:\Program Files
2010-02-28 21:28:58 ----D---- C:\Windows\system32\Tasks
2010-02-28 21:26:13 ----HD---- C:\ProgramData
2010-02-28 21:26:13 ----D---- C:\Windows\system32\drivers
2010-02-28 13:45:57 ----D---- C:\Windows\Minidump
2010-02-28 13:45:52 ----D---- C:\Windows
2010-02-26 10:01:52 ----SHD---- C:\Windows\Installer
2010-02-26 10:01:52 ----D---- C:\Config.Msi
2010-02-26 02:17:44 ----D---- C:\Program Files\ResiGo
2010-02-25 00:25:18 ----D---- C:\Program Files\CONEXANT
2010-02-25 00:25:05 ----D---- C:\Windows\system32\catroot
2010-02-25 00:25:05 ----D---- C:\Windows\System32
2010-02-25 00:25:05 ----D---- C:\Windows\inf
2010-02-24 23:50:34 ----SHD---- C:\System Volume Information
2010-02-24 23:48:01 ----D---- C:\Windows\winsxs
2010-02-24 23:43:32 ----D---- C:\Program Files\Common Files\microsoft shared
2010-02-24 22:41:49 ----D---- C:\Windows\Acer
2010-02-24 22:35:54 ----RSD---- C:\Windows\assembly
2010-02-24 22:32:40 ----D---- C:\Windows\Microsoft.NET
2010-02-24 17:10:31 ----D---- C:\Windows\AppPatch
2010-02-24 17:10:30 ----RSD---- C:\Windows\Fonts
2010-02-24 16:44:46 ----D---- C:\Windows\Debug
2010-02-24 16:24:28 ----D---- C:\Windows\rescache
2010-02-24 16:20:39 ----SD---- C:\ProgramData\Microsoft
2010-02-24 16:20:03 ----D---- C:\Windows\system32\catroot2
2010-02-24 11:38:19 ----D---- C:\Windows\system32\de-DE
2010-02-24 09:16:06 ----N---- C:\Windows\system32\MpSigStub.exe
2010-02-23 22:43:28 ----D---- C:\MyWorks
2010-02-23 21:55:51 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-02-23 21:47:40 ----D---- C:\Windows\system32\wbem
2010-02-23 21:47:37 ----D---- C:\Windows\system32\uk-UA
2010-02-23 21:47:37 ----D---- C:\Windows\system32\pt-PT
2010-02-23 21:47:37 ----D---- C:\Windows\system32\pt-BR
2010-02-23 21:47:37 ----D---- C:\Windows\system32\pl-PL
2010-02-23 21:47:37 ----D---- C:\Windows\system32\ko-KR
2010-02-23 21:47:37 ----D---- C:\Windows\system32\it-IT
2010-02-23 21:47:37 ----D---- C:\Windows\system32\hu-HU
2010-02-23 21:47:37 ----D---- C:\Windows\system32\he-IL
2010-02-23 21:47:37 ----D---- C:\Windows\system32\bg-BG
2010-02-23 21:47:36 ----D---- C:\Windows\system32\zh-TW
2010-02-23 21:47:36 ----D---- C:\Windows\system32\zh-HK
2010-02-23 21:47:36 ----D---- C:\Windows\system32\zh-CN
2010-02-23 21:47:36 ----D---- C:\Windows\system32\tr-TR
2010-02-23 21:47:36 ----D---- C:\Windows\system32\th-TH
2010-02-23 21:47:36 ----D---- C:\Windows\system32\sv-SE
2010-02-23 21:47:36 ----D---- C:\Windows\system32\sr-Latn-CS
2010-02-23 21:47:36 ----D---- C:\Windows\system32\sl-SI
2010-02-23 21:47:36 ----D---- C:\Windows\system32\sk-SK
2010-02-23 21:47:36 ----D---- C:\Windows\system32\ru-RU
2010-02-23 21:47:36 ----D---- C:\Windows\system32\ro-RO
2010-02-23 21:47:36 ----D---- C:\Windows\system32\nl-NL
2010-02-23 21:47:36 ----D---- C:\Windows\system32\nb-NO
2010-02-23 21:47:36 ----D---- C:\Windows\system32\lv-LV
2010-02-23 21:47:36 ----D---- C:\Windows\system32\lt-LT
2010-02-23 21:47:36 ----D---- C:\Windows\system32\ja-JP
2010-02-23 21:47:36 ----D---- C:\Windows\system32\hr-HR
2010-02-23 21:47:36 ----D---- C:\Windows\system32\fr-FR
2010-02-23 21:47:36 ----D---- C:\Windows\system32\fi-FI
2010-02-23 21:47:36 ----D---- C:\Windows\system32\et-EE
2010-02-23 21:47:36 ----D---- C:\Windows\system32\es-ES
2010-02-23 21:47:36 ----D---- C:\Windows\system32\en-US
2010-02-23 21:47:36 ----D---- C:\Windows\system32\el-GR
2010-02-23 21:47:36 ----D---- C:\Windows\system32\da-DK
2010-02-23 21:47:36 ----D---- C:\Windows\system32\cs-CZ
2010-02-23 21:47:36 ----D---- C:\Windows\system32\ar-SA
2010-02-23 21:47:35 ----D---- C:\Program Files\Internet Explorer
2010-02-23 21:47:31 ----D---- C:\Windows\ehome
2010-02-23 21:47:30 ----D---- C:\Program Files\Windows Mail
2010-02-23 21:47:29 ----D---- C:\Program Files\Windows Media Player
2010-02-23 21:28:38 ----D---- C:\ProgramData\Microsoft Help
2010-02-21 20:51:56 ----A---- C:\Windows\iedit_.INI
2010-02-09 11:16:48 ----D---- C:\Program Files\Microsoft Works
2010-02-04 08:39:40 ----SD---- C:\Windows\Downloaded Program Files

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [2008-09-02 371248]
R1 IDSvix86;Symantec Intrusion Prevention Driver; \??\C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20081118.001\IDSvix86.sys [2008-10-07 270384]
R1 SRTSPX;SRTSPX; C:\Windows\System32\Drivers\SRTSPX.SYS [2007-11-30 43696]
R1 SYMTDI;SYMTDI; C:\Windows\System32\Drivers\SYMTDI.SYS [2009-08-03 188080]
R2 acedrv11;acedrv11; \??\C:\Windows\system32\drivers\acedrv11.sys [2008-01-23 501560]
R2 int15;int15; \??\C:\Acer\Empowering Technology\eRecovery\int15.sys [2006-12-07 76584]
R2 irda;IrDA-Protokoll; C:\Windows\system32\DRIVERS\irda.sys [2008-01-19 95744]
R3 BCM43XX;Treiber für Broadcom 802.11-Netzwerkadapter; C:\Windows\system32\DRIVERS\bcmwl6.sys [2006-12-19 534016]
R3 bcm4sbxp;Broadcom 440x 10/100-integrierter Controller-XP-Treiber; C:\Windows\system32\DRIVERS\bcm4sbxp.sys [2006-11-02 45056]
R3 CmBatt;Treiber für Microsoft-ACPI-Kontrollmethodenkompatible Batterie; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-19 14208]
R3 EMSCR;EMSCR; C:\Windows\system32\DRIVERS\EMS7SK.sys [2006-10-25 62208]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-09-02 99376]
R3 ESDCR;ESDCR; C:\Windows\system32\DRIVERS\ESD7SK.sys [2006-10-25 42240]
R3 ESMCR;ESMCR; C:\Windows\system32\DRIVERS\ESM7SK.sys [2006-10-25 76928]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2006-11-02 987648]
R3 HSFHWAZL;HSFHWAZL; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2006-11-02 200704]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2008-02-11 2302976]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-03-01 1744928]
R3 NTIDrvr;Upper Class Filter Driver; C:\Windows\system32\DRIVERS\NTIDrvr.sys [2007-03-27 6144]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-04-11 89088]
R3 SYMDNS;SYMDNS; C:\Windows\System32\Drivers\SYMDNS.SYS [2009-08-03 12720]
R3 SymEvent;SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT.SYS [2009-12-21 124464]
R3 SYMFW;SYMFW; C:\Windows\System32\Drivers\SYMFW.SYS [2009-08-03 145968]
R3 SYMIDS;SYMIDS; C:\Windows\System32\Drivers\SYMIDS.SYS [2009-08-03 39856]
R3 SYMNDISV;SYMNDISV; C:\Windows\System32\Drivers\SYMNDISV.SYS [2009-08-03 38448]
R3 SYMREDRV;SYMREDRV; C:\Windows\System32\Drivers\SYMREDRV.SYS [2009-08-03 26416]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2006-10-23 179896]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2006-11-02 654336]
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-01-19 11264]
S2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys []
S2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys []
S3 BCM43XV;Broadcom Extensible 802.11-Netzwerkadaptertreiber; C:\Windows\system32\DRIVERS\bcmwl6.sys [2006-12-19 534016]
S3 Dot4;MS IEEE-1284.4-Treiber; C:\Windows\system32\DRIVERS\Dot4.sys [2008-01-19 131584]
S3 Dot4Print;Druckerklassentreiber für IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2008-01-19 16384]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2008-01-19 36864]
S3 drmkaud;Microsoft Kernel-DRM-Audioentschlüsselung; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 HdAudAddService;Microsoft 1.1 UAA-Funktionstreiber für High Definition Audio-Dienst; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys []
S3 ialm;ialm; C:\Windows\system32\DRIVERS\igdkmd32.sys [2008-02-11 2302976]
S3 irsir;Microsoft serieller Infrarottreiber; C:\Windows\system32\DRIVERS\irsir.sys [2008-01-19 20992]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Microsoft Proxy für Streaming Clock; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Microsoft Proxy für Streaming Quality Manager; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 NAVENG;NAVENG; \??\C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20081118.002\NAVENG.SYS [2008-11-11 89104]
S3 NAVEX15;NAVEX15; \??\C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20081118.002\NAVEX15.SYS [2008-11-11 876112]
S3 s0017bus;Sony Ericsson Device 0017 driver (WDM); C:\Windows\system32\DRIVERS\s0017bus.sys [2008-05-27 90536]
S3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter; C:\Windows\system32\DRIVERS\s0017mdfl.sys [2008-05-27 15016]
S3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver; C:\Windows\system32\DRIVERS\s0017mdm.sys [2008-05-27 122152]
S3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM); C:\Windows\system32\DRIVERS\s0017mgmt.sys [2008-05-27 115496]
S3 s0017nd5;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS); C:\Windows\system32\DRIVERS\s0017nd5.sys [2008-05-27 25768]
S3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface; C:\Windows\system32\DRIVERS\s0017obex.sys [2008-05-27 111912]
S3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM); C:\Windows\system32\DRIVERS\s0017unic.sys [2008-05-27 117672]
S3 SPBBCDrv;SPBBCDrv; \??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys [2006-11-21 406672]
S3 SRTSP;SRTSP; C:\Windows\System32\Drivers\SRTSP.SYS [2007-11-30 279088]
S3 SRTSPL;SRTSPL; C:\Windows\System32\Drivers\SRTSPL.SYS [2007-11-30 317616]
S3 usbscan;USB-Scannertreiber; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-19 35328]
S3 winusb;WinUSB Service; C:\Windows\system32\DRIVERS\winusb.sys [2009-04-11 31616]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-10-01 40448]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]
S4 UIUSys;Conexant Setup API; C:\Windows\system32\DRIVERS\UIUSYS.SYS []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 a2free;a-squared Free Service; C:\Program Files\a-squared Free\a2service.exe [2009-10-01 1858144]
R2 ALaunchService;ALaunch Service; C:\Acer\ALaunch\ALaunchSvc.exe [2007-01-26 50688]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-08-28 144672]
R2 Bonjour Service;Bonjour-Dienst; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 Capture Device Service;Capture Device Service; C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe [2007-03-06 198168]
R2 DBService;DATA BECKER Update Service; C:\Program Files\Common Files\DATA BECKER Shared\DBService.exe [2008-09-27 187456]
R2 eDataSecurity Service;eDSService.exe; C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe [2007-02-06 457512]
R2 eLockService;eLock Service; C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe [2006-12-22 24576]
R2 eRecoveryService;eRecovery Service; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [2007-01-31 53248]
R2 hpqddsvc;HP CUE DeviceDiscovery Service; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 Irmon;@%SystemRoot%\System32\irmon.dll,-2000; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2006-12-14 61440]
R2 MobilityService;MobilityService; C:\Acer\Mobility Center\MobilityService.exe [2006-11-24 107008]
R2 RapiMgr;@%windir%\WindowsMobile\rapimgr.dll,-104; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe [2006-07-19 262247]
R2 WcesComm;@%windir%\WindowsMobile\wcescomm.dll,-40079; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-03-30 1533808]
R2 WMIService;ePower Service; C:\Acer\Empowering Technology\ePower\ePowerSvc.exe [2007-01-02 135168]
R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R3 iPod Service;iPod-Dienst; C:\Program Files\iPod\bin\iPodService.exe [2009-09-08 545568]
S2 Automatisches LiveUpdate - Scheduler;Automatisches LiveUpdate - Scheduler; C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2007-09-26 554352]
S2 ccEvtMgr;Symantec Event Manager; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2006-11-21 107624]
S2 ccSetMgr;Symantec Settings Manager; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2006-11-21 107624]
S2 CLTNetCnService;Symantec Lic NetConnect service; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2006-11-21 107624]
S2 LiveUpdate Notice Ex;LiveUpdate Notice Service Ex; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2006-11-21 107624]
S2 LiveUpdate Notice Service;LiveUpdate Notice Service; C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2008-01-29 583048]
S2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-19 21504]
S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-19 21504]
S2 SymAppCore;Symantec AppCore Service; C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe [2006-11-21 46736]
S2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2006-08-05 386560]
S3 comHost;COM Host; C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe [2006-11-21 49296]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-09-28 138168]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-03 69632]
S3 ISPwdSvc;Symantec IS Kennwortprüfung; C:\Program Files\Norton Internet Security\isPwdSvc.exe [2006-11-21 80552]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2007-09-26 2999664]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 Symantec Core LC;Symantec Core LC; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe [2008-08-21 1251720]

-----------------EOF-----------------

> HijackThis download failed

Anscheinend wird der Download von HJT blockiert.
Bitte abcdef.msi (= HijackThis, umbennant) speichern, ausführen und ein Log erstellen.

Weiters bitte ein KomplettScan mit MBAM durchführen.

mfg,TXL

TXL Danke für deine Antwort...
hab jetzt HijackThis auf meinem Rechner und hab mal auf scan geklickt...dann kam

For some reason your system denied write access to the Hosts file. If any hijacked domains are in this file, HijackThis may NOT be able to fix this. If that happens you need to edit the file yourself. To di this, click Start, Run and type:
notepad C:/Windows /Systen 32/ drivers/etc/hosts an press Enter.......usw...usw

versteh das ganze nicht so.....was muß ich machen????

Das kommt beim Scan





und
HJT Log-File im geöffneten Notepad kommt nicht...hab nur ein Fenster wo ich Häkchen herein machen kann ??????!!!!!!

Ok, dann anders:
Bitte mal MBAM anwenden.
Wenn du externe Festplatten oder USB Sticks hast, bitte während des Scans mit MBAM anschließen.

mfg,TXL

ok....MBAM hab ich zum laufen bekommen.
Wenn er soweit ist, poste ich hier den Log.

Achja, noch was (nach MBAM):
Start -> Ausführen -> "notepad C:/Windows/System32/drivers/etc/hosts"
Bitte Inhalt posten.
mfg TXL

Zitat von sunda

Das kommt beim Scan





und
HJT Log-File im geöffneten Notepad kommt nicht...hab nur ein Fenster wo ich Häkchen herein machen kann ??????!!!!!!

Hallo,



Rechtsklick auf die HijackThis Verknüpfung -> Als Administrator starten



mfg

Hier ist der Log von MBAM

Malwarebytes' Anti-Malware 1.44
Datenbank Version: 3510
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18882

01.03.2010 22:53:41
mbam-log-2010-03-01 (22-53-41).txt

Scan-Methode: Vollständiger Scan (C:\|D:\|)
Durchsuchte Objekte: 346498
Laufzeit: 1 hour(s), 3 minute(s), 51 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Zitat von TXL

Achja, noch was (nach MBAM):
Start -> Ausführen -> "notepad C:/Windows/System32/drivers/etc/hosts"
Bitte Inhalt posten.
mfg TXL

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost
::1 localhost

Zitat von Slimix87

Hallo,



Rechtsklick auf die HijackThis Verknüpfung -> Als Administrator starten



mfg

Ok...Danke so ging es....


Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 23:08:14, on 01.03.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18882)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\eDSMSNfix.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
C:\Program Files\FreePDF_XP\fpassist.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Windows\WindowsMobile\wmdSync.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\WISO\Sparbuch 2009\meinsparbuchheute.exe
C:\Windows\system32\svchost.exe
C:\Windows\ehome\ehmsas.exe
C:\Users\x\AppData\Local\Temp\RtkBtMnt.exe
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\IncrediMail\bin\IMApp.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\sdclt.exe
C:\Windows\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://de.intl.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://de.intl.acer.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://de.rd.yahoo.com/customize/ycomp/defaults/su/*http://de.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [eDSMSNfix] C:\Acer\Empowering Technology\eDSMSNfix.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [FreePDF Assistant] C:\Program Files\FreePDF_XP\fpassist.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [dfsrtend] rundll32 "C:\Users\x\AppData\Local\Temp\conilder.dll",DllEntryPoint
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - Startup: msconfig32.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: WISO Mein Sparbuch heute.lnk = C:\Program Files\WISO\Sparbuch 2009\meinsparbuchheute.exe
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O13 - Gopher Prefix:
O16 - DPF: {2016970B-4A5F-4B51-A306-01849EB2EFA4} (PDLicenseHelper Object) - http://www.protectdisc.com/pd/PDLicHelperSetup.exe
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatisches LiveUpdate - Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: DATA BECKER Update Service (DBService) - DATA BECKER GmbH & Co KG - C:\Program Files\Common Files\DATA BECKER Shared\DBService.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Kennwortprüfung (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 12935 bytes

Ok, MBAM hat nichts gefunden.
HJT-Log ist soweit sauber.
Um ganz sicher zu gehen, lade doch bitte folgende Dateien bei Virustotal hoch und lass sie auswerten:

c:\Users\x\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msconfig32.exe
c:\Users\x\AppData\Local\Temp\conilder.dll
         

"x" ist natürlich dein Username auf dem PC

Solltest du die Dateien nicht finden: alle Windows Dateien sichtbar machen

Den Ergebnislink bitte hier posten

mfg,TXL

Antivirus Version letzte aktualisierung Ergebnis
a-squared 4.5.0.50 2010.03.02 Trojan.SuspectCRC!IK
AhnLab-V3 5.0.0.2 2010.03.02 -
AntiVir 8.2.1.176 2010.03.02 -
Antiy-AVL 2.0.3.7 2010.03.02 -
Authentium 5.2.0.5 2010.03.02 -
Avast 4.8.1351.0 2010.03.02 -
Avast5 5.0.332.0 2010.03.02 -
AVG 9.0.0.730 2010.03.02 -
BitDefender 7.2 2010.03.02 Trojan.Generic.KD.103
CAT-QuickHeal 10.00 2010.03.02 -
ClamAV 0.96.0.0-git 2010.03.02 -
Comodo 4091 2010.02.28 -
DrWeb 5.0.1.12222 2010.03.02 Trojan.Siggen1.4277
eSafe 7.0.17.0 2010.03.01 -
eTrust-Vet 35.2.7335 2010.03.02 -
F-Prot 4.5.1.85 2010.03.02 -
F-Secure 9.0.15370.0 2010.03.02 Gen:Heur.Krypt.5
Fortinet 4.0.14.0 2010.02.28 -
GData 19 2010.03.02 Trojan.Generic.KD.103
Ikarus T3.1.1.80.0 2010.03.02 Trojan.SuspectCRC
Jiangmin 13.0.900 2010.03.02 -
K7AntiVirus 7.10.986 2010.03.01 -
Kaspersky 7.0.0.125 2010.03.02 -
McAfee 5907 2010.03.01 -
McAfee+Artemis 5907 2010.03.01 -
McAfee-GW-Edition 6.8.5 2010.03.02 -
Microsoft 1.5502 2010.03.02 -
NOD32 4908 2010.03.02 -
Norman 6.04.08 2010.03.01 -
nProtect 2009.1.8.0 2010.03.02 -
Panda 10.0.2.2 2010.03.01 Suspicious file
PCTools 7.0.3.5 2010.03.02 -
Prevx 3.0 2010.03.02 -
Rising 22.37.01.04 2010.03.02 -
Sophos 4.50.0 2010.03.02 -
Sunbelt 5716 2010.03.01 -
Symantec 20091.2.0.41 2010.03.02 Suspicious.Insight
TheHacker 6.5.1.7.218 2010.03.02 -
TrendMicro 9.120.0.1004 2010.03.02 TROJ_FAKEAV.VGC
VBA32 3.12.12.2 2010.03.02 -
ViRobot 2010.3.2.2208 2010.03.02 -
VirusBuster 5.0.27.0 2010.03.02 -
weitere Informationen
File size: 39424 bytes
MD5...: 1f9d3a73da0a142c24aea9e257535f57
SHA1..: 7e9d804b46e8eae102068ff1dbc403876be0d42c
SHA256: d1c41f35b7c9d9d9b2eeffd198820cb5fdd8a467fc2cbebcaa7de7c6676b79ea
ssdeep: 768:tanB/9ta1IeuKw7h6JxeUMTLLACk9P5BaVOMzCMOS3XMygY8f:tan9aVuN6J
sR/K5BUOY7OS3XGX

PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x3c5f
timedatestamp.....: 0x4b86c43b (Thu Feb 25 18:40:59 2010)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x2dec 0x2e00 6.09 9a37f20cae12e95d4a77e3f30fd4086b
.rdata 0x4000 0x206d 0x2200 5.68 316edb3e50bc6b9d212251cc12f75865
.data 0x7000 0x157a0 0x4200 6.12 1bbda29f578d9a8e120e66425601af57
.rsrc 0x1d000 0x380 0x400 2.93 2f42b6496cc95cfe533f403527c7dca7

( 5 imports )
> KERNEL32.dll: ExitProcess, GetSystemTimeAsFileTime, lstrcpyW, GetProcessHeap, lstrlenW, SetFilePointer, SetLastError, TerminateProcess, LocalAlloc, GetLastError, GetModuleHandleA, VirtualFree, VirtualAlloc, GetVersion, GetCommandLineW, GetModuleHandleW, LocalFree, CreateFileA, WriteFile, CloseHandle, SetEvent, GetCPInfo, GetModuleFileNameA, GetCurrentProcess, GetCommandLineA, GetStartupInfoA
> USER32.dll: GetSystemMetrics, ClientToScreen, ShowWindow, TranslateMessage, EndPaint, BeginPaint, SetWindowLongA, GetWindowLongA, GetMessageA, LoadAcceleratorsA, DispatchMessageA, RedrawWindow, PostQuitMessage, RegisterClassW, CreateWindowExA, MessageBoxA
> ADVAPI32.dll: LookupPrivilegeValueW, DeleteService, CreateServiceW, RegQueryValueExA, RegSetValueExW, RegOpenKeyExA, RegCloseKey, GetTokenInformation
> WS2_32.dll: -, -, -, -, -, -, -, -
> MSVCRT.dll: _controlfp, __setusermatherr, _initterm, __getmainargs, _acmdln, exit, _XcptFilter, _exit, fclose, memchr, memcpy, __p__commode, __p__fmode, __set_app_type, _except_handler3, _adjust_fdiv

( 2 exports )
YFAALPOAGN, pfWtgaxKMRCB

RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:
publisher....: IrBXJDKfFt
copyright....: VfaTl
product......: IrBXJDKfFt
description..: EkKweXi
original name: IrBXJDKfFt.exe
internal name: IrBXJDKfFt.exe
file version.: 2.0.0.5
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

Antivirus Version letzte aktualisierung Ergebnis
a-squared 4.5.0.50 2010.03.02 Trojan-Spy.Win32.Ursnif!IK
AhnLab-V3 5.0.0.2 2010.03.02 -
AntiVir 8.2.1.176 2010.03.02 TR/Agent.35328
Antiy-AVL 2.0.3.7 2010.03.02 Backdoor/Win32.Papras
Authentium 5.2.0.5 2010.03.02 W32/Heuristic-KPP!Eldorado
Avast 4.8.1351.0 2010.03.02 Win32:Malware-gen
Avast5 5.0.332.0 2010.03.02 Win32:Malware-gen
AVG 9.0.0.730 2010.03.02 BackDoor.Generic12.ALRO
BitDefender 7.2 2010.03.02 Trojan.Generic.3259128
CAT-QuickHeal 10.00 2010.03.02 Backdoor.Papras.ay
ClamAV 0.96.0.0-git 2010.03.02 Trojan.PWS.Papras-1
Comodo 4091 2010.02.28 Backdoor.Win32.Papras.ay
DrWeb 5.0.1.12222 2010.03.02 BACKDOOR.Trojan
eSafe 7.0.17.0 2010.03.01 Win32.TRAgent
eTrust-Vet 35.2.7335 2010.03.02 Win32/Ursnif.IG
F-Prot 4.5.1.85 2010.03.02 W32/Heuristic-KPP!Eldorado
F-Secure 9.0.15370.0 2010.03.02 Trojan-Spy:W32/Papras.gen!A
Fortinet 4.0.14.0 2010.02.28 W32/Papras.AY!tr.bdr
GData 19 2010.03.02 Trojan.Generic.3259128
Ikarus T3.1.1.80.0 2010.03.02 Trojan-Spy.Win32.Ursnif
Jiangmin 13.0.900 2010.03.02 Backdoor/Papras.m
K7AntiVirus 7.10.986 2010.03.01 Backdoor.Win32.Papras.ay
Kaspersky 7.0.0.125 2010.03.02 Backdoor.Win32.Papras.ay
McAfee 5907 2010.03.01 Generic PWS.y!cbh
McAfee+Artemis 5907 2010.03.01 Generic PWS.y!cbh
McAfee-GW-Edition 6.8.5 2010.03.02 Heuristic.LooksLike.Trojan.Agent.H
Microsoft 1.5502 2010.03.02 TrojanSpy:Win32/Ursnif.gen!I
NOD32 4908 2010.03.02 a variant of Win32/PSW.Papras.AW
Norman 6.04.08 2010.03.01 -
nProtect 2009.1.8.0 2010.03.02 Backdoor/W32.Papras.35328.K
Panda 10.0.2.2 2010.03.01 Generic Trojan
PCTools 7.0.3.5 2010.03.02 Backdoor.Trojan
Prevx 3.0 2010.03.02 High Risk System Back Door
Rising 22.37.01.04 2010.03.02 -
Sophos 4.50.0 2010.03.02 Mal/Generic-L
Sunbelt 5716 2010.03.01 Trojan.Win32.Generic!BT
Symantec 20091.2.0.41 2010.03.02 Backdoor.Trojan
TheHacker 6.5.1.7.218 2010.03.02 Backdoor/Papras.ay
TrendMicro 9.120.0.1004 2010.03.02 -
VBA32 3.12.12.2 2010.03.02 Backdoor.Win32.Papras.ay
ViRobot 2010.3.2.2208 2010.03.02 -
VirusBuster 5.0.27.0 2010.03.02 -
weitere Informationen
File size: 35328 bytes
MD5...: eb6ecc316e1691e51451b539a36b85fe
SHA1..: 0689573aa2ba59b6b7255726aee46f43ab3533c9
SHA256: 4148f657fce5b752719ed8a1f59027a5489129bafc30645ba94a67a99fd43f40
ssdeep: 768:rj1COhI+BShUPFuJtoWvedX+CtxvqN4574n2:1pIiRWto0e8qxSh2

PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x12d8
timedatestamp.....: 0x4b7fd55f (Sat Feb 20 12:28:15 2010)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x5d70 0x5e00 6.29 0a37af733b3cee5b2dffcc479d365393
.rdata 0x7000 0x16e9 0x1800 5.06 211894e0d55a9d605e6e56c3c3348ab2
.data 0x9000 0x578 0x400 2.93 d366260d82a03ea9eecaeeaf113592c5
.reloc 0xa000 0xb3e 0xc00 5.83 de1b7b1d918afb600de7754b9b047417

( 5 imports )
> ntdll.dll: memset, ZwOpenProcess, ZwClose, ZwQueryInformationToken, memcmp, memcpy, ZwOpenProcessToken, RtlUnwind, NtQueryVirtualMemory
> SHLWAPI.dll: StrChrA, StrStrIW, StrRChrA, StrStrIA
> KERNEL32.dll: CloseHandle, LocalFree, ResumeThread, CreateThread, SetEvent, HeapDestroy, HeapCreate, lstrlenA, HeapAlloc, SetWaitableTimer, HeapFree, LeaveCriticalSection, lstrcatA, FindFirstFileA, lstrcmpiA, RemoveDirectoryA, EnterCriticalSection, LocalAlloc, WaitForMultipleObjects, FindNextFileA, CreateMutexA, ReleaseMutex, CreateWaitableTimerA, DeleteFileA, lstrcpyA, GetModuleHandleA, CreateFileA, lstrcpynA, GlobalLock, WriteFile, lstrlenW, GlobalUnlock, lstrcpyW, LoadLibraryExW, SetLastError, lstrcmpW, HeapReAlloc, WaitForSingleObject, OpenProcess, CreateEventA, Process32First, GetProcAddress, ResetEvent, Process32Next, CreateToolhelp32Snapshot, GetCurrentProcessId, GetTempPathA, FreeLibrary, InterlockedExchange, LoadLibraryA, RaiseException, GetLastError, CreateProcessA, Sleep, GetCurrentProcess, CreateProcessW, VirtualAllocEx, GetModuleFileNameA, WriteProcessMemory, VirtualProtect, SwitchToThread, TerminateThread, InitializeCriticalSection, CreateRemoteThread, GetVersion, GetTickCount
> ADVAPI32.dll: ConvertStringSecurityDescriptorToSecurityDescriptorA, AdjustTokenPrivileges, RegDeleteValueA, LookupPrivilegeValueA, RegDeleteKeyA, OpenProcessToken, RegEnumValueA, RegCloseKey, RegOpenKeyA, RegCreateKeyA, RegQueryValueExA, RegSetValueExA, CreateProcessAsUserW, CreateProcessAsUserA
> PSAPI.DLL: GetModuleFileNameExA, EnumProcessModules

( 2 exports )
CreateProcessNotify, DllEntryPoint

RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable MS Visual C++ (generic) (53.1%)
Windows Screen Saver (18.4%)
Win32 Executable Generic (12.0%)
Win32 Dynamic Link Library (generic) (10.6%)
Generic Win/DOS Executable (2.8%)
<a href='http://info.prevx.com/aboutprogramtext.asp?PX5=43BCC63B00B838D28A60005880949D003C8E7E30' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=43BCC63B00B838D28A60005880949D003C8E7E30</a>
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

ich hoffe das ist so ok...hab große Probleme mit dem IE---der geht immer wieder zu und ich muß mich ständig neu hier einloggen