Trojaner-Board - RUNDLL Fehler die Zweite

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - RUNDLL Fehler die Zweite (https://www.trojaner-board.de/63093-rundll-fehler-zweite.html)

RUNDLL Fehler die Zweite

Hallo!

Ich hatte schonmal ein HJT-Protokoll gepostet, bei dem mir nochdigger geholfen hatte - DANKE an dieser Stelle. Dann sollte ich noch Malwarebytes drüberlaufen lassen - wozu weiß ich allerdings nicht genau. Hab ich nun trotzdem gemacht und hier das Protokoll: (Nähere Infos zum System stehen in miener Signatur.)

Malwarebytes' Anti-Malware 1.30
Datenbank Version: 1333
Windows 6.0.6001 Service Pack 1

28.10.2008 18:42:01
mbam-log-2008-10-28 (18-42-01).txt

Scan-Methode: Vollständiger Scan (C:\|D:\|E:\|G:\|)
Durchsuchte Objekte: 222080
Laufzeit: 42 minute(s), 1 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 29
Infizierte Registrierungswerte: 3
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\CLSID\{0656a137-b161-cadd-9777-e37a75727e78} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0b682cc1-fb40-4006-a5dd-99edd3c9095d} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0e1230f8-ea50-42a9-983c-d22abc2eeb4c} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\dpcproxy (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\typelib (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\HOL5_VXIEWER.FULL.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Classes\applications\accessdiver.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\fwbd (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\HolLol (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mslagent (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Invictus (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Golden Palace Casino PT (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Golden Palace Casino NEW (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\iTunesMusic (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\rdriv (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\wkey (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\mwc (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{0e1230f8-ea50-42a9-983c-d22abc2eeb4c} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{0656a137-b161-cadd-9777-e37a75727e78} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SystemCheck2 (Trojan.Agent) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
E:\Users\XXX\Downloads\Usenext\alt.binaries.warez\XXX\XXX_multi_keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

Vielen DANK!

Warum machst Du dafür nen neuen Strang auf? Völlig unnötig und nochdigger bemerkt das so garnicht, dass Du quasi ne Antwort erstellt hast :balla:

Wie soll ich das sonst machen?
PN soll ich ihm nicht schreiben und der andere Thread wurde deaktiviert, weil ich wegen einer der "Goldenen Regeln" verstoßen habe...

Äh - sry, habs übersehen, dass das Teil inne Tonne geschmissen wurde. :mad:
Naja, wenigstens ein frisches und komplettes Hijackthis Logfile wär schon hilfreich gewesen ;)

Code:

Infizierte Dateien:

E:\Users\XXX\Downloads\Usenext\alt.binaries.warez\ XXX\XXX_multi_keygen.exe

Wenn man sowas sieht, muss man sich echt nicht über Befall wundern :headbang: :twak:

Mach mal bitte einen Durchlauf mit Combofix:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir das Tool hier herunter auf den Desktop -> KLICK

Das Programm jedoch noch nicht starten sondern zuerst folgendes tun:

Schliesse alle Anwendungen und Programme, vor allem deine Antiviren-Software und andere Hintergrundwächter, sowie deinen Internetbrowser.
Vermeide es auch explizit während das Combofix läuft die Maus und Tastatur zu benutzen.

Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

Starte nun die combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen und lass dein System durchsuchen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte abkopieren und in deinen Beitrag einfügen. Das log findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Hinweis: Combofix verhindert die Autostart Funktion aller CD / DVD und USB - Laufwerken um so eine Verbeitung einzudämmen. Wenn es hierdurch zu Problemen kommt, diese im Thread posten.

Poste alle Logfiles bitte mit Codetags umschlossen (#-Button) also so:

HTML-Code:

[code] Hier das Logfile rein! [/code]

So,
da bin ich wieder, also ich habe Deine Anleitungen befolgt, alerdings... CCleaner funktionierte wunderbar, aber bei dem Combo-Fix, da hat er die Meldung rausgegeben, dass er mit MS Vista 64-bit Systemen inkompatibel ist - gibt es eine Alternative?

Zitat:

dass er mit MS Vista 64-bit Systemen inkompatibel ist - gibt es eine Alternative?

Siehst Du, nun solltest Du wissen, warum man immer sein OS mit angibt. :twak:

Mit 64 Bit Vista ist das mitm Analysieren und Bereinigen nicht so einfach, da die meisten Tools weitgehend inkompatibel damit sind. Sowie es aussieht sind die meisten Schädlinge es aber auch :rolleyes:

=> http://www.trojaner-board.de/58670-w...eenscreen.html
=> http://www.trojaner-board.de/58947-a...t-windows.html

Probier mal bitte RSIT:

Lade Random's System Information Tool (RSIT) herunter und speichere es auf Deinem Desktop.
Starte mit Doppelklick die RSIT.exe.
Klicke auf Continue, um die Nutzungsbedingungen zu akzeptieren.
Wenn Du HiJackThis nicht installiert hast, wird RSIT das für Dich herunterladen und installieren.
In dem Fall bitte auch die Nutzungsbedingungen von Trend Micro (http://de.trendmicro.com/de/home) für HJT akzeptieren "I accept".
Wenn Deine Firewall fragt, bitte RSIT erlauben, ins Netz zu gehen.
Der Scan startet automatisch, RSIT checkt nun einige wichtige System-Bereiche und produziert Logfiles als Analyse-Grundlage.
Wenn der Scan beendet ist, werden zwei Logfiles erstellt und in Deinem Editor geöffnet.
Bitte poste den Inhalt von C:\rsit\log.txt und C:\rsit\info.txt (<= minimiert) hier in den Thread, wieder mit Codetags umschlossen.

Auch wenn ich Dir danke, habe auch aus meinen Fehlern gelernt -> Weil ich mein OS nicht angegeben hatte wurde der andere Thread gelöscht... Deshalb habe ich diese (u.a. auch das OS) in meiner Signatur veröffentlicht UND in meinem ersten Beitrag einen Verweis darauf gegeben: Nun siehst Du, warum Leute die lesen können klar im Vorteil sind.. :p

Spaß bei Seite, hier die log.txt und info.txt:

Code:

 info.txt logfile of random's system information tool 1.04 2008-11-05 18:08:26
 

======Uninstall list======
 

-->MsiExec /X{A7E07C2B-2220-4415-87E3-784D5814BC93}

AC3Filter (remove only)-->D:\Program Files (x86)\AC3Filter\uninstall.exe

Acronis*True*Image*Home-->MsiExec.exe /X{633A06C3-B709-479A-AAB3-5EE94AD9EE4B}

Adobe Anchor Service CS3-->MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95}

Adobe Asset Services CS3-->MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}

Adobe Bridge CS3-->MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394}

Adobe Bridge Start Meeting-->MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23}

Adobe Camera Raw 4.0-->MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}

Adobe CMaps-->MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}

Adobe Color - Photoshop Specific-->MsiExec.exe /I{A2D81E70-2A98-4A08-A628-94388B063C5E}

Adobe Color Common Settings-->C:\Program Files (x86)\Common Files\Adobe\Installers\6c8e2cb4fd241c55406016127a6ab2e\Setup.exe

Adobe Color Common Settings-->MsiExec.exe /I{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}

Adobe Color EU Recommended Settings-->MsiExec.exe /I{73B5D990-04EA-4751-B10F-5534770B91F2}

Adobe Color JA Extra Settings-->MsiExec.exe /I{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}

Adobe Color NA Extra Settings-->MsiExec.exe /I{FF29A7E2-FF40-4D07-B7E4-2093DE59E10A}

Adobe Default Language CS3-->MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}

Adobe Device Central CS3-->MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}

Adobe Dreamweaver CS3-->C:\Program Files (x86)\Common Files\Adobe\Installers\25db75244653b42cb93dc27939d1c0e\Setup.exe

Adobe Dreamweaver CS3-->MsiExec.exe /I{4AA5B8A5-BEEF-4AD8-B11D-4443A042EA4F}

Adobe ExtendScript Toolkit 2-->C:\Program Files (x86)\Common Files\Adobe\Installers\3e054d2218e7aa282c2369d939e58ff\Setup.exe

Adobe ExtendScript Toolkit 2-->MsiExec.exe /I{24D7346D-D4B4-45E8-98EA-75EC14B42DD8}

Adobe Extension Manager CS3-->MsiExec.exe /I{BE5F3842-8309-4754-92D5-83E02E6077A3}

Adobe Flash Player ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe

Adobe Flash Player Plugin-->C:\Windows\SysWOW64\Macromed\Flash\uninstall_plugin.exe

Adobe Fonts All-->MsiExec.exe /I{6ABE0BEE-D572-4FE8-B434-9E72A289431B}

Adobe Help Viewer CS3-->MsiExec.exe /I{04AF207D-9A77-465A-8B76-991F6AB66245}

Adobe InDesign CS3 Icon Handler-->MsiExec.exe /I{EA7B3CC4-366D-4CF6-8350-FD7A7034116E}

Adobe InDesign CS3-->C:\Program Files (x86)\Common Files\Adobe\Installers\05ba3a63f36684fe0c5dde2ebe6f8f5\Setup.exe

Adobe InDesign CS3-->MsiExec.exe /I{CB3F8375-B600-4B9F-83C9-238ED1E583FD}

Adobe Linguistics CS3-->MsiExec.exe /I{54793AA1-5001-42F4-ABB6-C364617C6078}

Adobe PDF Library Files-->MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}

Adobe Photoshop CS3-->C:\Program Files (x86)\Common Files\Adobe\Installers\5f143314a5d434c8511097393d17397\Setup.exe

Adobe Photoshop CS3-->MsiExec.exe /I{29F05234-DCBB-4FE0-88DC-5160C9250312}

Adobe Reader 9 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A90000000001}

Adobe Setup-->MsiExec.exe /I{56B8B892-317E-4FDE-9E4D-44B189848A27}

Adobe Setup-->MsiExec.exe /I{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}

Adobe Setup-->MsiExec.exe /I{7D386596-0E80-4808-8AAE-C1DDA8212F7F}

Adobe Setup-->MsiExec.exe /I{B3C02EC1-A7B0-4987-9A43-8789426AAA7D}

Adobe Setup-->MsiExec.exe /I{F01F79AD-1F47-4685-AE4E-CCFA4EA9FF7C}

Adobe SING CS3-->MsiExec.exe /I{3F9B2FD2-1C83-4401-9967-C3636638E958}

Adobe Stock Photos CS3-->MsiExec.exe /I{29E5EA97-5F74-4A57-B8B2-D4F169117183}

Adobe Type Support-->MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}

Adobe Update Manager CS3-->MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8}

Adobe Version Cue CS3 Client-->MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5}

Adobe WinSoft Linguistics Plugin-->MsiExec.exe /I{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}

Adobe XMP Panels CS3-->MsiExec.exe /I{802771A9-A856-4A41-ACF7-1450E523C923}

AnyDVD-->"D:\Program Files (x86)\SlySoft\AnyDVD\AnyDVD-uninst.exe" /D="D:\Program Files (x86)\SlySoft\AnyDVD"

Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}

Assassin's Creed-->C:\Program Files (x86)\InstallShield Installation Information\{8CFA9151-6404-409A-AF22-4632D04582FD}\setup.exe -runfromtemp -l0x0007 -removeonly

Avira Premium Security Suite-->C:\Program Files (x86)\Avira\Avira Premium Security Suite\SETUP.EXE /REMOVE

Brothers in Arms: Hell's Highway-->D:\Program Files (x86)\Ubisoft\Gearbox Software\Brothers in Arms - Hell's Highway\Binaries\uninst.exe

Call of Duty(R) 4 - Modern Warfare(TM) 1.4 Patch-->C:\Program Files (x86)\InstallShield Installation Information\{3BD633E0-4BF8-4499-9149-88F0767D449C}\setup.exe -runfromtemp -l0x0409

Call of Duty(R) 4 - Modern Warfare(TM) 1.5 Multiplayer Patch-->C:\Program Files (x86)\InstallShield Installation Information\{8503C901-85D7-4262-88D2-8D8B2A7B08B8}\setup.exe -runfromtemp -l0x0409

Call of Duty(R) 4 - Modern Warfare(TM)-->C:\Program Files (x86)\InstallShield Installation Information\{E48469CC-635E-4FD5-A122-1497C286D217}\setup.exe -runfromtemp -l0x0407

CCleaner (remove only)-->"D:\Program Files (x86)\CCleaner\uninst.exe"

CDBurnerXP-->"d:\Program Files (x86)\CDBurnerXP\unins000.exe"

CloneDVD2-->"D:\Program Files (x86)\Elaborate Bytes\CloneDVD2\CloneDVD2-uninst.exe" /D="D:\Program Files (x86)\Elaborate Bytes\CloneDVD2"

CloneDVDmobile-->"d:\Program Files (x86)\SlySoft\CloneDVDmobile\CloneDVDmobile-uninst.exe" /D="d:\Program Files (x86)\SlySoft\CloneDVDmobile"

Command & Conquer(TM) Generäle-->C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{06F80017-8F98-4C94-B868-52358569FC32} 

Command and Conquer(TM) Generäle Die Stunde Null -->C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{F3E9C243-122E-4D6B-ACC1-E1FEC02F6CA1} 

Counter-Strike: Source-->"D:\Program Files (x86)\Steam\steam.exe" steam://uninstall/240

Day of Defeat: Source Beta-->"D:\Program Files (x86)\Steam\steam.exe" steam://uninstall/302

Day of Defeat: Source-->"D:\Program Files (x86)\Steam\steam.exe" steam://uninstall/300

DivX Codec-->D:\Program Files (x86)\DivX\DivXCodecUninstall.exe /CODEC

DivX Player-->D:\Program Files (x86)\DivX\DivXPlayerUninstall.exe /PLAYER

EVEREST Ultimate Edition v4.50-->"D:\Program Files (x86)\Lavalys\EVEREST Ultimate Edition\unins000.exe"

Far Cry 2-->"C:\Program Files (x86)\InstallShield Installation Information\{F2835483-37F2-4123-B4FE-0E77D58447F2}\setup.exe" -runfromtemp -l0x0007 -removeonly

GRID-->"C:\Program Files (x86)\InstallShield Installation Information\{5A0B7BA5-4682-4273-81C2-69B17E649103}\setup.exe" -runfromtemp -l0x0007 -removeonly

Hercules WiFi Station-->C:\Program Files (x86)\InstallShield Installation Information\{DECE22F4-EEDD-4615-BC56-2F4827FAD64B}\setup.exe -runfromtemp -l0x0007 -removeonly

HijackThis 2.0.2-->"E:\Users\Henry\Downloads\HijackThis.exe" /uninstall

HP My Display-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{15733AD1-1CEF-459A-9245-0924FC63BDD5}\setup.exe" -l0x7  -removeonly

ICQ6-->"C:\Program Files (x86)\InstallShield Installation Information\{60DE4033-9503-48D1-A483-7846BD217CA9}\setup.exe" -runfromtemp -l0x0009 -removeonly

Java(TM) 6 Update 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160060}

Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}

Malwarebytes' Anti-Malware-->"D:\Program Files (x86)\Malwarebytes' Anti-Malware\unins000.exe"

Microsoft Office Access MUI (German) 2007-->MsiExec.exe /X{90120000-0015-0407-0000-0000000FF1CE}

Microsoft Office Enterprise 2007-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL

Microsoft Office Enterprise 2007-->MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}

Microsoft Office Excel MUI (German) 2007-->MsiExec.exe /X{90120000-0016-0407-0000-0000000FF1CE}

Microsoft Office Groove MUI (German) 2007-->MsiExec.exe /X{90120000-00BA-0407-0000-0000000FF1CE}

Microsoft Office InfoPath MUI (German) 2007-->MsiExec.exe /X{90120000-0044-0407-0000-0000000FF1CE}

Microsoft Office OneNote MUI (German) 2007-->MsiExec.exe /X{90120000-00A1-0407-0000-0000000FF1CE}

Microsoft Office Outlook MUI (German) 2007-->MsiExec.exe /X{90120000-001A-0407-0000-0000000FF1CE}

Microsoft Office PowerPoint MUI (German) 2007-->MsiExec.exe /X{90120000-0018-0407-0000-0000000FF1CE}

Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}

Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}

Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}

Microsoft Office Proof (Italian) 2007-->MsiExec.exe /X{90120000-001F-0410-0000-0000000FF1CE}

Microsoft Office Proofing (German) 2007-->MsiExec.exe /X{90120000-002C-0407-0000-0000000FF1CE}

Microsoft Office Publisher MUI (German) 2007-->MsiExec.exe /X{90120000-0019-0407-0000-0000000FF1CE}

Microsoft Office Shared MUI (German) 2007-->MsiExec.exe /X{90120000-006E-0407-0000-0000000FF1CE}

Microsoft Office Word MUI (German) 2007-->MsiExec.exe /X{90120000-001B-0407-0000-0000000FF1CE}

Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}

NVIDIA PhysX v8.09.04-->MsiExec.exe /X{A7E07C2B-2220-4415-87E3-784D5814BC93}

OpenAL-->"C:\Program Files (x86)\OpenAL\OalinstGridRelease.exe" /U

PDF Settings-->MsiExec.exe /I{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}

Pivot Software-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{0217E1D1-BCEF-4A61-AF6D-F7740F65A066}\setup.exe" -l0x7  -removeonly

PokerStars.net-->"D:\Program Files (x86)\PokerStars.NET\PokerStarsUninstall.exe" /u:PokerStars.net

Pro Evolution Soccer 2009-->MsiExec.exe /X{A8DB611A-D80E-450D-85F6-3ACDD164BE31}

QuickTime-->MsiExec.exe /I{8DC42D05-680B-41B0-8878-6C14D24602DB}

Realtek 8169, 8168, 8101E and 8102E Ethernet Network Card Driver for Windows Vista-->C:\Program Files (x86)\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\setup.exe -runfromtemp -l0x0007 -removeonly

Realtek High Definition Audio Driver-->RtlUpd64.exe -r -m

Safari-->MsiExec.exe /I{C9D96682-5A4D-45FA-BA3E-DDCB2B0CB868}

SDK-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{0DEA342C-15CB-4F52-97B6-06A9C4B9C06F}\setup.exe" -l0x9 

Silent Hunter 4 Wolves of the Pacific-->C:\Program Files (x86)\InstallShield Installation Information\{0D005F09-A5F4-473B-A901-5735C6AF5628}\setup.exe -runfromtemp -l0x0007 -removeonly

Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}

TuneUp Utilities 2008-->MsiExec.exe /I{5888428E-699C-4E71-BF71-94EE06B497DA}

Update for Word 2007 (KB934173)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {C6A89125-5473-45E3-B413-ED8186437475}

UseNeXT-->"D:\Program Files (x86)\UseNeXT\unins000.exe"

VLC media player 0.9.4-->D:\Program Files (x86)\VideoLAN\VLC\uninstall.exe

WinRAR-->D:\Program Files (x86)\WinRAR\uninstall.exe
 

=====HijackThis Backups=====
 

O4 - HKCU\..\Run: [fc161944] rundll32.exe "C:\Users\Henry\AppData\Local\Temp\dyqjippm.dll",b
 

======Security center information======
 

AS: Windows-Defender
 

======Environment variables======
 

"ComSpec"=%SystemRoot%\system32\cmd.exe

"FP_NO_HOST_CHECK"=NO

"OS"=Windows_NT

"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;D:\Program Files (x86)\QuickTime\QTSystem\

"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC

"PROCESSOR_ARCHITECTURE"=AMD64

"TEMP"=%SystemRoot%\TEMP

"TMP"=%SystemRoot%\TEMP

"USERNAME"=SYSTEM

"windir"=%SystemRoot%

"PROCESSOR_LEVEL"=15

"PROCESSOR_IDENTIFIER"=AMD64 Family 15 Model 67 Stepping 3, AuthenticAMD

"PROCESSOR_REVISION"=4303

"NUMBER_OF_PROCESSORS"=2

"CLASSPATH"=.;D:\Program Files (x86)\Java\jre1.6.0_07\lib\ext\QTJava.zip

"QTJAVA"=D:\Program Files (x86)\Java\jre1.6.0_07\lib\ext\QTJava.zip
 

-----------------EOF-----------------

und...:

Code:

 Logfile of random's system information tool 1.04 (written by random/random)

Run by Henry at 2008-11-05 18:08:19

Microsoft® Windows Vista™ Ultimate  Service Pack 1

System drive C: has 15 GB (37%) free of 40 GB

Total RAM: 4094 MB (66% free)
 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 18:08:25, on 05.11.2008

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal
 

Running processes:

D:\Program Files (x86)\Java\jre1.6.0_07\bin\jusched.exe

D:\Program Files (x86)\iTunes\iTunesHelper.exe

D:\Program Files (x86)\Safari\Safari.exe

D:\Program Files (x86)\ICQ6\ICQ.exe

E:\Users\xxx\Downloads\RSIT.exe
 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 

O1 - Hosts: ::1 localhost

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~2\MICROS~1\Office12\GRA8E1~1.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files (x86)\Java\jre1.6.0_07\bin\ssv.dll

O3 - Toolbar: (no name) - {0124123D-61B4-456f-AF86-78C53A0790C5} - (no file)

O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files (x86)\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\Avira Premium Security Suite\avgnt.exe" /min

O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files (x86)\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://D:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\PROGRA~2\Java\JRE16~1.0_0\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\PROGRA~2\Java\JRE16~1.0_0\bin\ssv.dll

O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Program Files (x86)\PartyPoker\PartyPoker\RunApp.exe (file missing)

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Program Files (x86)\PartyPoker\PartyPoker\RunApp.exe (file missing)

O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - D:\Program Files (x86)\ICQ6\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - D:\Program Files (x86)\ICQ6\ICQ.exe

O13 - Gopher Prefix: 

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~2\MICROS~1\Office12\GR99D3~1.DLL

O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: Avira Premium Security Suite Firewall (AntiVirFirewallService) - Avira GmbH - C:\Program Files (x86)\Avira\Avira Premium Security Suite\avfwsvc.exe

O23 - Service: Avira Premium Security Suite MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files (x86)\Avira\Avira Premium Security Suite\avmailc.exe

O23 - Service: Avira Premium Security Suite Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files (x86)\Avira\Avira Premium Security Suite\sched.exe

O23 - Service: Avira Premium Security Suite Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\Avira Premium Security Suite\avguard.exe

O23 - Service: Avira Premium Security Suite WebGuard (antivirwebservice) - Avira GmbH - C:\Program Files (x86)\Avira\Avira Premium Security Suite\AVWEBGRD.EXE

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Avira Premium Security Suite MailGuard Hilfsdienst (AVEService) - Avira GmbH - C:\Program Files (x86)\Avira\Avira Premium Security Suite\avesvc.exe

O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe

O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)

O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files (x86)\Common Files\Portrait Displays\Shared\dtsrvc.exe

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files (x86)\iPod\bin\iPodService.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: NMSAccessU - Unknown owner - d:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - D:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe

O23 - Service: Acronis Try And Decide Service (TryAndDecideService) - Unknown owner - C:\Program Files (x86)\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe

O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - Unknown owner - C:\Windows\System32\TuneUpDefragService.exe (file missing)

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
 

--

End of file - 9310 bytes
 

======Scheduled tasks folder======
 

C:\Windows\tasks\1-Klick-Wartung.job
 

======Registry dump======
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]

Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]

Groove GFS Browser Helper - D:\PROGRA~2\MICROS~1\Office12\GRA8E1~1.DLL [2006-10-26 2210608]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]

SSVHelper Class - D:\Program Files (x86)\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

{0124123D-61B4-456f-AF86-78C53A0790C5}
 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"SunJavaUpdateSched"=D:\Program Files (x86)\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]

"avgnt"=C:\Program Files (x86)\Avira\Avira Premium Security Suite\avgnt.exe [2008-09-19 266497]

"GrooveMonitor"=D:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-26 31016]

"iTunesHelper"=D:\Program Files (x86)\iTunes\iTunesHelper.exe [2008-10-01 289576]

"QuickTime Task"=D:\Program Files (x86)\QuickTime\QTTask.exe [2008-09-06 413696]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=D:\PROGRA~2\MICROS~1\Office12\GRA8E1~1.DLL [2006-10-26 2210608]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]

"authentication packages"=msv1_0

relog_ap
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]
 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

"EnableUIADesktopToggle"=0
 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoActiveDesktop"=

"NoActiveDesktopChanges"=

"ForceActiveDesktopOn"=
 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cc4d9eab-2dcb-11dd-88b6-806e6f6e6963}]

shell\AutoRun\command - F:\setup.exe
 
 

======File associations======
 

.js - open - "D:\Program Files (x86)\Adobe\Adobe Dreamweaver CS3\Dreamweaver.exe","%1"
 

======List of files/folders created in the last 3 months======
 

2008-11-05 18:08:19 ----D---- C:\rsit

2008-11-04 16:04:53 ----D---- C:\Windows\ERDNT

2008-11-04 16:04:53 ----D---- C:\Qoobox

2008-11-04 16:04:52 ----D---- C:\ComboFix

2008-11-04 16:04:52 ----A---- C:\Windows\system32\swsc.exe

2008-11-04 16:04:52 ----A---- C:\Windows\system32\CF11621.exe

2008-11-04 16:04:45 ----D---- C:\32788R22FWJFW

2008-11-03 18:53:13 ----D---- C:\ProgramData\Codemasters

2008-11-03 18:50:33 ----RA---- C:\Windows\system32\tmp149A.tmp

2008-11-03 18:50:33 ----D---- C:\Program Files (x86)\OpenAL

2008-11-03 18:50:33 ----A---- C:\Windows\system32\wrap_oal.dll

2008-11-03 18:50:33 ----A---- C:\Windows\system32\OpenAL32.dll

2008-11-03 18:49:59 ----RA---- C:\Windows\system32\tmp147A.tmp

2008-11-02 16:11:27 ----D---- C:\ProgramData\KONAMI

2008-10-31 15:49:18 ----D---- C:\ProgramData\Office Genuine Advantage

2008-10-28 21:28:14 ----A---- C:\Windows\system32\win32spl.dll

2008-10-28 21:28:13 ----A---- C:\Windows\system32\Faultrep.dll

2008-10-28 17:56:36 ----D---- C:\Users\xxx\AppData\Roaming\Malwarebytes

2008-10-28 17:56:29 ----D---- C:\ProgramData\Malwarebytes

2008-10-26 20:26:31 ----A---- C:\Windows\system32\XAudio2_1.dll

2008-10-26 20:26:31 ----A---- C:\Windows\system32\XAPOFX1_0.dll

2008-10-26 20:26:31 ----A---- C:\Windows\system32\xactengine3_1.dll

2008-10-26 20:26:31 ----A---- C:\Windows\system32\X3DAudio1_4.dll

2008-10-26 20:26:31 ----A---- C:\Windows\system32\D3DX9_38.dll

2008-10-26 20:26:31 ----A---- C:\Windows\system32\d3dx10_38.dll

2008-10-26 20:26:31 ----A---- C:\Windows\system32\D3DCompiler_38.dll

2008-10-26 20:26:30 ----A---- C:\Windows\system32\XAudio2_0.dll

2008-10-26 20:26:30 ----A---- C:\Windows\system32\xactengine3_0.dll

2008-10-26 20:26:30 ----A---- C:\Windows\system32\X3DAudio1_3.dll

2008-10-26 20:26:29 ----A---- C:\Windows\system32\D3DX9_37.dll

2008-10-26 20:26:29 ----A---- C:\Windows\system32\d3dx10_37.dll

2008-10-26 20:26:29 ----A---- C:\Windows\system32\D3DCompiler_37.dll

2008-10-26 20:26:28 ----A---- C:\Windows\system32\xactengine2_10.dll

2008-10-26 20:26:28 ----A---- C:\Windows\system32\d3dx10_36.dll

2008-10-26 20:26:28 ----A---- C:\Windows\system32\D3DCompiler_36.dll

2008-10-26 20:26:27 ----A---- C:\Windows\system32\d3dx9_36.dll

2008-10-26 20:26:26 ----A---- C:\Windows\system32\xactengine2_9.dll

2008-10-26 20:26:26 ----A---- C:\Windows\system32\d3dx10_35.dll

2008-10-26 20:26:26 ----A---- C:\Windows\system32\D3DCompiler_35.dll

2008-10-26 20:26:25 ----A---- C:\Windows\system32\d3dx9_35.dll

2008-10-26 20:26:24 ----A---- C:\Windows\system32\xactengine2_8.dll

2008-10-26 20:26:24 ----A---- C:\Windows\system32\X3DAudio1_2.dll

2008-10-26 20:26:24 ----A---- C:\Windows\system32\d3dx10_34.dll

2008-10-26 20:26:24 ----A---- C:\Windows\system32\D3DCompiler_34.dll

2008-10-26 20:26:23 ----A---- C:\Windows\system32\xinput1_3.dll

2008-10-26 20:26:23 ----A---- C:\Windows\system32\xactengine2_7.dll

2008-10-26 20:26:23 ----A---- C:\Windows\system32\d3dx9_34.dll

2008-10-26 20:26:22 ----A---- C:\Windows\system32\d3dx10_33.dll

2008-10-26 20:26:22 ----A---- C:\Windows\system32\D3DCompiler_33.dll

2008-10-26 20:26:21 ----A---- C:\Windows\system32\xactengine2_6.dll

2008-10-26 20:26:21 ----A---- C:\Windows\system32\xactengine2_5.dll

2008-10-26 20:26:21 ----A---- C:\Windows\system32\d3dx9_33.dll

2008-10-26 20:26:20 ----A---- C:\Windows\system32\d3dx9_32.dll

2008-10-26 20:26:20 ----A---- C:\Windows\system32\d3dx10.dll

2008-10-26 20:26:19 ----A---- C:\Windows\system32\xactengine2_4.dll

2008-10-26 20:26:19 ----A---- C:\Windows\system32\x3daudio1_1.dll

2008-10-26 20:26:19 ----A---- C:\Windows\system32\d3dx9_31.dll

2008-10-26 20:26:18 ----A---- C:\Windows\system32\xinput1_2.dll

2008-10-26 20:26:18 ----A---- C:\Windows\system32\xinput1_1.dll

2008-10-26 20:26:18 ----A---- C:\Windows\system32\xactengine2_3.dll

2008-10-26 20:26:18 ----A---- C:\Windows\system32\xactengine2_2.dll

2008-10-26 20:26:17 ----A---- C:\Windows\system32\xactengine2_1.dll

2008-10-26 20:26:14 ----A---- C:\Windows\system32\d3dx9_30.dll

2008-10-26 20:26:13 ----A---- C:\Windows\system32\xactengine2_0.dll

2008-10-26 20:26:13 ----A---- C:\Windows\system32\x3daudio1_0.dll

2008-10-26 20:26:12 ----A---- C:\Windows\system32\d3dx9_29.dll

2008-10-26 20:26:12 ----A---- C:\Windows\system32\d3dx9_28.dll

2008-10-26 20:26:11 ----A---- C:\Windows\system32\d3dx9_27.dll

2008-10-26 20:26:10 ----A---- C:\Windows\system32\d3dx9_26.dll

2008-10-26 20:26:09 ----A---- C:\Windows\system32\d3dx9_25.dll

2008-10-26 20:26:09 ----A---- C:\Windows\system32\d3dx9_24.dll

2008-10-23 19:30:21 ----A---- C:\Windows\system32\netapi32.dll

2008-10-15 21:24:47 ----D---- C:\Users\xxx\AppData\Roaming\vlc

2008-10-15 19:16:32 ----A---- C:\Windows\system32\mshtml.dll

2008-10-15 19:16:32 ----A---- C:\Windows\system32\ieframe.dll

2008-10-15 19:16:31 ----A---- C:\Windows\system32\wininet.dll

2008-10-15 19:16:31 ----A---- C:\Windows\system32\urlmon.dll

2008-10-15 19:16:31 ----A---- C:\Windows\system32\iertutil.dll

2008-10-15 19:16:30 ----A---- C:\Windows\system32\mstime.dll

2008-10-15 19:16:30 ----A---- C:\Windows\system32\jsproxy.dll

2008-10-15 19:16:27 ----A---- C:\Windows\system32\EncDec.dll

2008-10-15 19:16:26 ----A---- C:\Windows\system32\psisdecd.dll

2008-10-15 17:18:53 ----D---- C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

2008-10-15 17:18:53 ----D---- C:\Program Files (x86)\iPod

2008-10-07 13:33:00 ----A---- C:\Windows\system32\nvwgf2um.dll

2008-10-07 13:33:00 ----A---- C:\Windows\system32\nvoglv32.dll

2008-10-07 13:33:00 ----A---- C:\Windows\system32\nvd3dum.dll

2008-10-07 13:33:00 ----A---- C:\Windows\system32\nvcuda.dll

2008-10-07 13:33:00 ----A---- C:\Windows\system32\nvapi.dll

2008-10-04 16:03:13 ----A---- C:\Windows\system32\CmdLineExt_x64.dll

2008-10-04 12:21:25 ----RHD---- C:\Users\xxx\AppData\Roaming\SecuROM

2008-09-30 20:18:03 ----D---- C:\ProgramData\pupenqfu

2008-09-30 20:18:00 ----D---- C:\ProgramData\actdb

2008-09-24 22:01:47 ----D---- C:\ProgramData\FLEXnet

2008-09-24 21:57:29 ----D---- C:\Windows\system32\spool

2008-09-24 21:54:25 ----D---- C:\Program Files (x86)\Common Files\Macrovision Shared

2008-09-24 21:48:01 ----A---- C:\Users\xxx\AppData\Roaming\shedl.bat

2008-09-24 21:46:57 ----A---- C:\Users\xxx\AppData\Roaming\winexpl3.exe

2008-09-24 21:46:47 ----A---- C:\Users\xxx\AppData\Roaming\winexpl.exe

2008-09-24 21:43:42 ----A---- C:\Windows\system32\D3DX9_39.dll

2008-09-24 21:43:22 ----D---- C:\Program Files (x86)\Microsoft Games

2008-09-24 21:42:31 ----A---- C:\Windows\system32\gpprefcl.dll

2008-09-23 17:15:23 ----D---- C:\ProgramData\Acronis

2008-09-23 17:13:19 ----D---- C:\Program Files (x86)\Common Files\Acronis

2008-09-19 15:29:13 ----D---- C:\Users\xxx\AppData\Roaming\Avira

2008-09-19 14:37:46 ----D---- C:\ProgramData\Avira

2008-09-19 14:37:46 ----D---- C:\Program Files (x86)\Avira

2008-09-19 14:37:46 ----A---- C:\Windows\system32\avsda.dll

2008-09-19 14:31:34 ----A---- C:\Windows\system32\GEARAspi.dll

2008-09-19 14:29:56 ----D---- C:\Program Files (x86)\Bonjour

2008-09-18 21:29:55 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll

2008-09-18 21:29:55 ----A---- C:\Windows\system32\Apphlpdm.dll

2008-09-18 21:27:03 ----A---- C:\Windows\system32\wmpeffects.dll

2008-09-18 21:26:50 ----A---- C:\Windows\system32\dataclen.dll

2008-09-18 21:23:19 ----A---- C:\Windows\system32\wups.dll

2008-09-18 21:23:19 ----A---- C:\Windows\system32\wudriver.dll

2008-09-18 21:23:19 ----A---- C:\Windows\system32\wuapi.dll

2008-09-18 21:23:11 ----A---- C:\Windows\system32\wuwebv.dll

2008-09-18 21:23:11 ----A---- C:\Windows\system32\wuapp.exe

2008-09-11 21:56:13 ----D---- C:\Program Files (x86)\iPod(17)

2008-09-11 21:54:51 ----D---- C:\Program Files (x86)\Bonjour(2)

2008-09-11 21:53:53 ----D---- C:\Program Files (x86)\QuickTime(18)

2008-09-04 21:22:09 ----A---- C:\Windows\system32\Chip.dll

2008-09-04 09:31:16 ----A---- C:\Windows\system32\PhysXCplUI.exe

2008-08-29 08:53:50 ----A---- C:\Windows\system32\dnssd.dll

2008-08-28 19:19:27 ----A---- C:\Windows\system32\uxtuneup.dll

2008-08-28 19:19:13 ----A---- C:\Windows\system32\authuitu.dll

2008-08-16 08:58:15 ----A---- C:\Windows\system32\tzres.dll

2008-08-15 16:14:34 ----A---- C:\Windows\system32\inetcomm.dll

2008-08-15 16:14:31 ----A---- C:\Windows\system32\es.dll

2008-08-15 16:14:29 ----A---- C:\Windows\system32\winipsec.dll

2008-08-15 16:14:29 ----A---- C:\Windows\system32\polstore.dll

2008-08-15 16:14:29 ----A---- C:\Windows\system32\FwRemoteSvr.dll

2008-08-08 17:34:50 ----D---- C:\Program Files (x86)\Apple Software Update

und...:

Code:

======List of files/folders modified in the last 3 months======
 

2008-11-05 18:08:22 ----D---- C:\Windows\Temp

2008-11-05 18:06:35 ----D---- C:\Windows\Prefetch

2008-11-04 16:30:33 ----D---- C:\Windows\System32

2008-11-04 16:30:33 ----D---- C:\Windows\inf

2008-11-04 16:04:53 ----D---- C:\Windows\SysWOW64

2008-11-04 16:04:53 ----AD---- C:\Windows

2008-11-04 16:04:52 ----D---- C:\Windows\system32\en-US

2008-11-04 15:57:49 ----D---- C:\Windows\Debug

2008-11-03 18:53:13 ----HD---- C:\ProgramData

2008-11-03 18:50:33 ----RD---- C:\Program Files (x86)

2008-11-03 18:50:20 ----RSD---- C:\Windows\assembly

2008-11-03 18:38:58 ----HD---- C:\Program Files (x86)\InstallShield Installation Information

2008-11-02 16:15:42 ----SHD---- C:\Windows\Installer

2008-10-30 20:35:57 ----D---- C:\ProgramData\NVIDIA

2008-10-30 19:36:27 ----SD---- C:\Users\xxx\AppData\Roaming\Microsoft

2008-10-28 21:28:18 ----D---- C:\Windows\winsxs

2008-10-28 17:56:32 ----D---- C:\Windows\system32\drivers

2008-10-26 20:37:32 ----D---- C:\Program Files (x86)\Common Files\Wise Installation Wizard

2008-10-26 20:37:24 ----D---- C:\Program Files (x86)\AGEIA Technologies

2008-10-16 21:39:00 ----D---- C:\Users\xxx\AppData\Roaming\Adobe

2008-10-16 21:06:45 ----D---- C:\Program Files (x86)\Common Files\Adobe

2008-10-16 18:59:06 ----D---- C:\Program Files (x86)\Common Files\Steam

2008-10-15 19:51:32 ----D---- C:\Windows\Microsoft.NET

2008-10-15 19:48:17 ----D---- C:\Windows\ehome

2008-10-15 19:48:17 ----D---- C:\Program Files (x86)\Windows Mail

2008-10-15 19:48:16 ----D---- C:\Windows\system32\migration

2008-10-15 17:18:53 ----RD---- C:\Program Files

2008-10-14 18:36:09 ----SHD---- C:\System Volume Information

2008-10-06 17:50:49 ----D---- C:\ProgramData\Adobe

2008-10-06 17:03:25 ----D---- C:\Program Files (x86)\Adobe

2008-10-04 16:28:27 ----D---- C:\Windows\Tasks

2008-10-04 16:28:25 ----D---- C:\Windows\registration

2008-09-28 16:35:58 ----D---- C:\ProgramData\Microsoft Help

2008-09-28 16:28:02 ----A---- C:\Windows\win.ini

2008-09-25 19:01:46 ----D---- C:\Windows\Minidump

2008-09-24 21:59:06 ----RSD---- C:\Windows\Fonts

2008-09-24 21:54:25 ----D---- C:\Program Files (x86)\Common Files

2008-09-24 21:51:49 ----D---- C:\Windows\rescache

2008-09-24 21:43:26 ----D---- C:\Windows\Logs

2008-09-22 19:43:49 ----SHD---- C:\Boot

2008-09-22 19:43:49 ----D---- C:\Windows\system32\config

2008-09-18 21:36:18 ----D---- C:\Windows\system32\de-DE

2008-09-18 21:36:18 ----D---- C:\Windows\AppPatch

2008-09-18 21:27:35 ----D---- C:\Windows\PolicyDefinitions

2008-09-18 19:28:52 ----SD---- C:\ProgramData\Microsoft

2008-09-11 21:53:55 ----D---- C:\Program Files (x86)\Common Files\Apple
 

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
 

R1 avfwot;avfwot; C:\Windows\system32\DRIVERS\avfwot.sys []

R1 CSC;Offline Files Driver; C:\Windows\system32\drivers\csc.sys []

R1 ElbyCDIO;ElbyCDIO Driver; C:\Windows\System32\Drivers\ElbyCDIO.sys []

R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys []

R2 tifsfilter;Acronis True Image FS Filter; C:\Windows\system32\DRIVERS\tifsfilt.sys []

R3 AnyDVD;AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [2008-09-20 113088]

R3 avfwim;AvFw Packet Filter Miniport; C:\Windows\system32\DRIVERS\avfwim.sys []

R3 ElbyDelay;ElbyDelay; C:\Windows\System32\Drivers\ElbyDelay.sys [2007-02-16 14032]

R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\System32\Drivers\GEARAspiWDM.sys []

R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys []

R3 ksthunk;Kernel Streaming Thunks; C:\Windows\system32\drivers\ksthunk.sys []

R3 Maplom;Maplom; C:\Windows\system32\drivers\Maplom.sys []

R3 MaplomL;MaplomL; C:\Windows\system32\drivers\MaplomL.sys []

R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys []

R3 PdiPorts;Portrait Displays low level device driver; C:\Windows\system32\DRIVERS\PdiPorts.sys []

R3 rt61x64;Hercules Wifi Station Wireless Driver for Windows Vista64; C:\Windows\system32\DRIVERS\netr6164.sys []

R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys []

S3 a7edjcm5;a7edjcm5; C:\Windows\system32\drivers\a7edjcm5.sys []

S3 drmkaud;Microsoft Kernel-DRM-Audioentschlüsselung; C:\Windows\system32\drivers\drmkaud.sys []

S3 GDPkIcpt;GDPkIcpt; \??\C:\Windows\system32\drivers\PktIcpt.sys []

S3 HdAudAddService;Microsoft 1.1 UAA-Funktionstreiber für High Definition Audio-Dienst; C:\Windows\system32\drivers\HdAudio.sys []

S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys []

S3 MSPCLOCK;Microsoft Proxy für Streaming Clock; C:\Windows\system32\drivers\MSPCLOCK.sys []

S3 MSPQM;Microsoft Proxy für Streaming Quality Manager; C:\Windows\system32\drivers\MSPQM.sys []

S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\Windows\system32\drivers\MSTEE.sys []

S3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh64.sys []

S3 USBAAPL64;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl64.sys []

S3 xnacc;Treiberdienst XBOX 360-Controller für Windows; C:\Windows\system32\DRIVERS\xnacc.sys []

S3 xusb21;Xbox 360 Wireless Receiver Driver Service 21; C:\Windows\system32\DRIVERS\xusb21.sys []

S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys []
 

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
 

R2 AcrSch2Svc;Acronis Scheduler2 Service; C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe [2008-04-20 605464]

R2 AntiVirFirewallService;Avira Premium Security Suite Firewall; C:\Program Files (x86)\Avira\Avira Premium Security Suite\avfwsvc.exe [2008-09-19 344321]

R2 AntiVirMailService;Avira Premium Security Suite MailGuard; C:\Program Files (x86)\Avira\Avira Premium Security Suite\avmailc.exe [2008-09-19 164097]

R2 AntiVirScheduler;Avira Premium Security Suite Planer; C:\Program Files (x86)\Avira\Avira Premium Security Suite\sched.exe [2008-10-23 68865]

R2 AntiVirService;Avira Premium Security Suite Guard; C:\Program Files (x86)\Avira\Avira Premium Security Suite\avguard.exe [2008-10-23 151297]

R2 antivirwebservice;Avira Premium Security Suite WebGuard; C:\Program Files (x86)\Avira\Avira Premium Security Suite\AVWEBGRD.EXE [2008-09-19 258305]

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-10-01 116040]

R2 AVEService;Avira Premium Security Suite MailGuard Hilfsdienst; C:\Program Files (x86)\Avira\Avira Premium Security Suite\avesvc.exe [2008-09-19 41217]

R2 Bonjour Service;Bonjour-Dienst; C:\Program Files (x86)\Bonjour\mDNSResponder.exe [2008-08-29 238888]

R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2008-01-19 21504]

R2 DTSRVC;Portrait Displays Display Tune Service; C:\Program Files (x86)\Common Files\Portrait Displays\Shared\dtsrvc.exe [2007-09-28 65536]

R2 NMSAccessU;NMSAccessU; d:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe [2008-03-09 71096]

R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe []

R2 TryAndDecideService;Acronis Try And Decide Service; C:\Program Files (x86)\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe [2008-04-21 498952]

R2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\Windows\System32\svchost.exe [2008-01-19 21504]

R3 iPod Service;iPod-Dienst; C:\Program Files (x86)\iPod\bin\iPodService.exe [2008-10-01 536872]

S2 StarWindServiceAE;StarWind AE Service; D:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2007-05-28 275968]

S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2008-01-19 21504]

S3 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64; C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2008-01-05 93696]

S3 Fax;@%systemroot%\system32\fxsresm.dll,-118; C:\Windows\system32\fxssvc.exe []

S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-09-24 654848]

S3 IDriverT;InstallDriver Table Manager; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]

S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; D:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-26 65824]

S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]

S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

S3 PerfHost;@%systemroot%\sysWow64\perfhost.exe,-2; C:\Windows\SysWow64\perfhost.exe [2008-01-19 19968]

S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2008-10-15 87288]

S3 TuneUp.Defrag;@%SystemRoot%\System32\TuneUpDefragService.exe,-1; C:\Windows\System32\TuneUpDefragService.exe []

S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2008-01-19 21504]

S3 wbengine;@%systemroot%\system32\wbengine.exe,-104; C:\Windows\system32\wbengine.exe []
 

-----------------EOF-----------------

Nette Nachtlektüre :daumenhoch:

Zitat:

Zitat von jesuishenry (Beitrag 389270)

Deshalb habe ich diese (u.a. auch das OS) in meiner Signatur veröffentlicht UND in meinem ersten Beitrag einen Verweis darauf gegeben: Nun siehst Du, warum Leute die lesen können klar im Vorteil sind.. :p

:D

Okay okay, das ist bei mir irgendwie untergegangen. Kann sein, dass ich mich irgendwie auf Deinen ersten Beitrag (der in der Tonne) zu sehr fixiert hatte... :confused:

Code:

C:\Windows\system32\drivers\a7edjcm5.sys

C:\Windows\system32\drivers\Maplom.sys

C:\Windows\system32\drivers\MaplomL.sys

C:\Windows\system32\drivers\PktIcpt.sys

Werte die mal bitte bei Virustotal.com aus und poste die Ergebnisse - mit Prüfsummen und Dateigrößenangaben, einfach alles.

Also ich habe mir jetzt mal rausgenommen keine zu kopieren, weil er bei keiner fündig geworden ist -> jedesmal 0%

Außer bei der C:\Windows\system32\drivers\a7edjcm5.sys, da kam es zu keiner Prüfung, weil die partout nicht auffindbar ist...wieso?

Sie ist wirklich nicht mehr vorhanden? Und Du hast Dir auch versteckte Dateien sowie die geschützten Systemdateien anzeigen lassen?

Beides anzeigen lassen - nicht auffindbar.

Tja :rolleyes: Dann hat sie sich in Luft aufgelöst.

Probier mal das:

Anleitung Avenger (by swandog46)

Lade dir das Tool Avenger und speichere es auf dem Desktop:

Doppelklick auf das Avenger-Symbol http://saved.im/mzi3ntr4adf5/trert.jpg

Kopiere nun folgenden Text in das weiße Feld bei -> "input script here"

Code:

files to delete:

C:\Windows\system32\drivers\a7edjcm5.sys

http://mitglied.lycos.de/efunction/tb/avenger.png

Schliesse nun alle Programme und Browser-Fenster

Um den Avenger zu starten klicke auf -> Execute
Dann bestätigen mit "Yes" das der Rechner neu startet

Nachdem das System neu gestartet ist, findest du einen Report vom Avenger unter -> C:\avenger.txt

Öffne die Datei mit dem Editor und kopiere den gesamten Text in deinen Beitrag hier am Trojaner-Board.

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows NT 6.0 (build 6001, Service Pack 1)
Wed Nov 05 20:45:30 2008

20:45:30: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!

//////////////////////////////////////////

Ich habe alles so (auch den Befehl) so kopiert, wie er da steht...:heilig:

Mit "files to delete:" :confused:

Jawoll 1:1 ...ich hab jetzt nochmal RSIT suchen lassen und selbst 'es' findet die .sys nicht wieder:

Code:

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
 

R1 avfwot;avfwot; C:\Windows\system32\DRIVERS\avfwot.sys []

R1 CSC;Offline Files Driver; C:\Windows\system32\drivers\csc.sys []

R1 ElbyCDIO;ElbyCDIO Driver; C:\Windows\System32\Drivers\ElbyCDIO.sys []

R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys []

R2 tifsfilter;Acronis True Image FS Filter; C:\Windows\system32\DRIVERS\tifsfilt.sys []

R3 AnyDVD;AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [2008-09-20 113088]

R3 avfwim;AvFw Packet Filter Miniport; C:\Windows\system32\DRIVERS\avfwim.sys []

R3 ElbyDelay;ElbyDelay; C:\Windows\System32\Drivers\ElbyDelay.sys [2007-02-16 14032]

R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\System32\Drivers\GEARAspiWDM.sys []

R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys []

R3 ksthunk;Kernel Streaming Thunks; C:\Windows\system32\drivers\ksthunk.sys []

R3 Maplom;Maplom; C:\Windows\system32\drivers\Maplom.sys []

R3 MaplomL;MaplomL; C:\Windows\system32\drivers\MaplomL.sys []

R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys []

R3 PdiPorts;Portrait Displays low level device driver; C:\Windows\system32\DRIVERS\PdiPorts.sys []

R3 rt61x64;Hercules Wifi Station Wireless Driver for Windows Vista64; C:\Windows\system32\DRIVERS\netr6164.sys []

R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys []

R3 xusb21;Xbox 360 Wireless Receiver Driver Service 21; C:\Windows\system32\DRIVERS\xusb21.sys []

S3 atkjhwwx;atkjhwwx; C:\Windows\system32\drivers\atkjhwwx.sys []

S3 drmkaud;Microsoft Kernel-DRM-Audioentschlüsselung; C:\Windows\system32\drivers\drmkaud.sys []

S3 GDPkIcpt;GDPkIcpt; \??\C:\Windows\system32\drivers\PktIcpt.sys []

S3 HdAudAddService;Microsoft 1.1 UAA-Funktionstreiber für High Definition Audio-Dienst; C:\Windows\system32\drivers\HdAudio.sys []

S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys []

S3 MSPCLOCK;Microsoft Proxy für Streaming Clock; C:\Windows\system32\drivers\MSPCLOCK.sys []

S3 MSPQM;Microsoft Proxy für Streaming Quality Manager; C:\Windows\system32\drivers\MSPQM.sys []

S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\Windows\system32\drivers\MSTEE.sys []

S3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh64.sys []

S3 USBAAPL64;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl64.sys []

S3 xnacc;Treiberdienst XBOX 360-Controller für Windows; C:\Windows\system32\DRIVERS\xnacc.sys []

S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys []