Trojaner-Board - Trojaner gefunden, nix hilft!

Hallo Gemeinde,

nachdem Antivir keine Updates durchgeführt hat und ich die Fehlermeldung nicht mitbekommen hatte, habe ich gestern ein manuelles Update gemacht.
Daraufhin wurde folgende Datei gefunden: c:\windows\ssxrur.byf
Diese Datei kann ich nicht löschen oder in Quarantäne verschieben. Sie kopiert sich immer neu.

Bitdefender und Kaspersky Online Scanner haben die Datei nicht entdeckt.
Infos über diese Datei habe ich im Netz nicht gefunden.

Deshalb nun die Hilfesuche hier bei Euch.
Im Anhang HJT und Virustotal Infos.

Vielen Dank für die Hilfe, ich hoffe es wird gut!
Gruss Psychodelic :heulen:

Code:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:41:49, on 16.04.2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programme\Avira\AntiVir Desktop\sched.exe

C:\Programme\Bonjour\mDNSResponder.exe

C:\Programme\Gemeinsame Dateien\InterVideo\RegMgr\iviRegMgr.exe

C:\Programme\Java\jre6\bin\jqs.exe

C:\Programme\Gemeinsame Dateien\Protexis\License Service\PsiService_2.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\PRISMSTA.EXE

C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe

C:\Programme\TCM\TCM Keyboard Only\PS2USBKbdDrv.exe

C:\WINDOWS\Dit.exe

C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE

C:\Programme\Java\jre6\bin\jusched.exe

C:\WINDOWS\System32\svchost.exe

C:\Programme\Winamp\winampa.exe

C:\WINDOWS\DitExp.exe

C:\Programme\Avira\AntiVir Desktop\avgnt.exe

C:\Programme\Windows Live\Messenger\MsnMsgr.Exe

C:\Programme\Messenger\msmsgs.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programme\Telekom\Eumex 404PC\Capictrl.exe

C:\Programme\Skype\Plugin Manager\SkypePM.exe

C:\Programme\Windows Live\Contacts\wlcomm.exe

C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\Programme\Avira\AntiVir Desktop\avguard.exe

C:\WINDOWS\System32\svchost.exe

C:\Programme\Mozilla Firefox\firefox.exe

C:\Programme\Microsoft Office\Office10\OUTLOOK.EXE

C:\Programme\Microsoft Office\Office10\WINWORD.EXE

C:\Dokumente und Einstellungen\***\Desktop\HiJackThis.exe
 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = h**p://google.icq.com/search/search_frame.php

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.google.de/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [PRISMSTA.EXE] PRISMSTA.EXE START

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

O4 - HKLM\..\Run: [WireLessKeyboard ] C:\Programme\TCM\TCM Keyboard Only\PS2USBKbdDrv.exe

O4 - HKLM\..\Run: [Dit] Dit.exe

O4 - HKLM\..\Run: [StartCCC] "C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"

O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe"  -osboot

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe

O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [UpdateStar] C:\Dokumente und Einstellungen\***\Anwendungsdaten\UpdateStar\UpdateStar.exe -A

O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?

O4 - Global Startup: CAPIControl.lnk = ?

O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert to existing PDF - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Easy-WebPrint - Drucken - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

O8 - Extra context menu item: Easy-WebPrint - Vorschau - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll

O9 - Extra 'Tools' menuitem: Mobilen Favoriten erstellen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\WINDOWS\System32\shdocvw.dll

O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\WINDOWS\System32\shdocvw.dll

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - h**p://pcpitstop.com/pcpitstop/PCPitStop.CAB

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - h**p://www.kaspersky.com/kos/german/partner/de/kavwebscan_unicode.cab

O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} - h**p://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab

O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - h**p://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - h**p://www.bitdefender.de/scan_de/scan8/oscan8.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - h**p://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1155769705890

O16 - DPF: {8436FE12-31DB-48BF-83BF-FE682F9160B4} (NanoInstaller Class) - h**p://www.nanoscan.com/cabs/nanoinst.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - h**p://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - h**p://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

O16 - DPF: {FB48C7B0-EB66-4BE6-A1C5-9DDF3C37249A} (MCSendMessageHandler Class) - http://xtraz.icq.com/xtraz/activex/MISBH.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL

O21 - SSODL: SysTray - {E61B5E20-DE35-11CF-9C87-1579005127ED} - (no file)

O21 - SSODL: msp.cpl - {E21B5E20-DE35-11CF-9C87-157900512701} - (no file)

O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Programme\Bonjour\mDNSResponder.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: IviRegMgr - InterVideo - C:\Programme\Gemeinsame Dateien\InterVideo\RegMgr\iviRegMgr.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe

O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Macromedia Shared\Service\Macromedia Licensing.exe

O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - C:\Programme\Gemeinsame Dateien\Protexis\License Service\PsiService_2.exe

O23 - Service: ServiceLayer - Nokia. - C:\Programme\PC Connectivity Solution\ServiceLayer.exe

O23 - Service: TomTomHOMEService - TomTom - C:\Programme\TomTom HOME 2\TomTomHOMEService.exe
 

--

End of file - 12862 bytes

Hier die Antwort von Virus Total

Code:

Datei ssxrur.byf empfangen 2009.04.16 01:14:08 (CET)

Antivirus        Version        letzte aktualisierung        Ergebnis

a-squared        4.0.0.101        2009.04.15        Trojan-PWS.Delf!IK

AhnLab-V3        5.0.0.2        2009.04.15        -

AntiVir        7.9.0.143        2009.04.15        TR/PSW.Delf.23040

Antiy-AVL        2.0.3.1        2009.04.15        -

Authentium        5.1.2.4        2009.04.16        -

Avast        4.8.1335.0        2009.04.15        -

AVG        8.5.0.287        2009.04.16        Downloader.Generic_c.AOA

BitDefender        7.2        2009.04.16        -

CAT-QuickHeal        10.00        2009.04.15        -

ClamAV        0.94.1        2009.04.15        -

Comodo        1115        2009.04.15        -

DrWeb        4.44.0.09170        2009.04.16        -

eSafe        7.0.17.0        2009.04.13        -

eTrust-Vet        31.6.6455        2009.04.14        -

F-Prot        4.4.4.56        2009.04.15        -

F-Secure        8.0.14470.0        2009.04.16        -

Fortinet        3.117.0.0        2009.04.15        -

GData        19        2009.04.16        -

Ikarus        T3.1.1.49.0        2009.04.15        Trojan-PWS.Delf

K7AntiVirus        7.10.704        2009.04.15        -

Kaspersky        7.0.0.125        2009.04.16        -

McAfee        5585        2009.04.15        -

McAfee+Artemis        5585        2009.04.15        -

McAfee-GW-Edition        6.7.6        2009.04.15        Trojan.PSW.Delf.23040

Microsoft        1.4502        2009.04.15        Trojan:Win32/Delf

NOD32        4011        2009.04.15        -

Norman        6.00.06        2009.04.15        -

nProtect        2009.1.8.0        2009.04.15        -

Panda        10.0.0.14        2009.04.15        -

PCTools        4.4.2.0        2009.04.15        -

Prevx1        V2        2009.04.16        -

Rising        21.25.24.00        2009.04.15        -

Sophos        4.40.0        2009.04.15        -

Sunbelt        3.2.1858.2        2009.04.15        -

Symantec        1.4.4.12        2009.04.15        -

TheHacker        6.3.4.0.309        2009.04.15        -

TrendMicro        8.700.0.1004        2009.04.15        -

VBA32        3.12.10.2        2009.04.12        -

ViRobot        2009.4.15.1694        2009.04.15        -

VirusBuster        4.6.5.0        2009.04.15        -

weitere Informationen

File size: 23040 bytes

MD5...: 0c987fb632f21698ed6f6f24fa7cd0ab

SHA1..: 5f9543f083499a9842f26cd3c6513b068c8c5120

SHA256: 8eb16b5c6822dd45700873ba9510e31a8ae90e62cc8d2f480a7c8436c3338448

SHA512: a4fcace61e2cf73b4b537a3cd111a918607c3c31cbc7d0dc87c1745862932727<br>d00adf830cf14e16727ee40e3d7749bbb6ce056bfb8435d2d8e867887b665bde

ssdeep: 384:nRQ6AxgjIYkKpSS5IkmjnsY3qs7qeJoZ+mIag0jHOLFJoz85c:nu6AijJk2S<br>mIkA30eiZlf/jaz5<br>

PEiD..: -

TrID..: File type identification<br>Win32 Executable Generic (58.3%)<br>Win16/32 Executable Delphi generic (14.1%)<br>Generic Win/DOS Executable (13.7%)<br>DOS Executable Generic (13.6%)<br>Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)

PEInfo: PE Structure information<br><br>( base data )<br>entrypointaddress.: 0x581c<br>timedatestamp.....: 0x2a425e19 (Fri Jun 19 22:22:17 1992)<br>machinetype.......: 0x14c (I386)<br><br>( 6 sections )<br>name viradd virsiz rawdsiz ntrpy md5<br>CODE 0x1000 0x483c 0x4a00 6.04 957b97ca4709c0a20828ca9aa43f96fb<br>DATA 0x6000 0x1c0 0x200 4.63 8f7157f19337f1b206b4d43ee1ae941e<br>BSS 0x7000 0xf5d 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e<br>.idata 0x8000 0x2ae 0x400 3.21 1d760f1252545a107ba1f34518593c9f<br>.reloc 0x9000 0x21c 0x400 3.96 4223f93d4d90b3f50d92c28c78d0c9c8<br>.rsrc 0xa000 0x180 0x200 2.73 26cdebac47f86ab6bd9a4ac47fdbab59<br><br>( 2 imports ) <br>&gt; kernel32.dll: GetCurrentThreadId, ExitProcess, UnhandledExceptionFilter, RtlUnwind, RaiseException, TlsSetValue, TlsGetValue, TlsFree, TlsAlloc, LocalFree, LocalAlloc, FreeLibrary, GetProcessHeap<br>&gt; kernel32.dll: VirtualFree, VirtualAlloc, Sleep, ReadFile, HeapFree, HeapAlloc, GetTickCount, GetProcessHeap, GetProcAddress, GetModuleFileNameA, GetFileSize, GetComputerNameA, FindAtomA, ExitProcess, CreateThread, CreateFileA, CloseHandle, AddAtomA<br><br>( 0 exports ) <br>

RDS...: NSRL Reference Data Set<br>-