Trojaner-Board - Hilfe ich habe ein Problem mit Virtumonde und wie bekomm ich es weg

Hallo trojan-death,

hier sind einmal die HiJackThis Logfile und Malwarebytes Anti-Malware Daten

HiJackThis Logfile

Code:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 17:20:26, on 18.07.2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Programme\Alwil Software\Avast4\aswUpdSv.exe

C:\Programme\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\svchost.exe

C:\Programme\Alwil Software\Avast4\ashMaiSv.exe

C:\Programme\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Programme\Java\jre1.6.0_05\bin\jusched.exe

D:\Programme\Winamp\winampa.exe

C:\Programme\SyncroSoft\Pos\H2O\cledx.exe

C:\Programme\ScanSoft\OmniPageSE4.0\OpwareSE4.exe

D:\Programme\iTunes\iTunesHelper.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Programme\RocketDock\RocketDock.exe

C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe

D:\Programme\Veoh Networks\Veoh\VeohClient.exe

C:\Programme\Windows Media Player\WMPNSCFG.exe

C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe

C:\Programme\iPod\bin\iPodService.exe

C:\WINDOWS\system32\rundll32.exe

C:\Programme\ICQ6\ICQ.exe

C:\WINDOWS\system32\rundll32.exe

D:\Programme\Spybot - Search & Destroy\SpybotSD.exe

C:\Programme\Mozilla Firefox\firefox.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\taskmgr.exe

C:\Dokumente und Einstellungen\Björn\Desktop\Virtumonde - Bekämpfung\HijackThis.exe
 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.prosieben.de/index.php?icqpath=icq

R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)

O3 - Toolbar: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll

O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - D:\Programme\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [SpywareTerminator] "D:\Programme\Spyware Terminator\SpywareTerminatorShield.exe"

O4 - HKLM\..\Run: [WinampAgent] D:\Programme\Winamp\winampa.exe

O4 - HKLM\..\Run: [H2O] C:\Programme\SyncroSoft\Pos\H2O\cledx.exe

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

O4 - HKLM\..\Run: [OpwareSE4] "C:\Programme\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "D:\Programme\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [BMd70b72b6] Rundll32.exe "C:\WINDOWS\system32\paoqdrey.dll",s

O4 - HKLM\..\Run: [d438412a] rundll32.exe "C:\WINDOWS\system32\fycxcvrh.dll",b

O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "D:\Programme\Spybot - Search & Destroy\SpybotSD.exe" /autocheck

O4 - HKLM\..\RunOnce: [SpybotDeletingA8753] command /c del "C:\WINDOWS\system32\awtutuSl.dll"

O4 - HKLM\..\RunOnce: [SpybotDeletingC6811] cmd /c del "C:\WINDOWS\system32\awtutuSl.dll"

O4 - HKCU\..\Run: [RocketDock] "C:\Programme\RocketDock\RocketDock.exe"

O4 - HKCU\..\Run: [Google Desktop Search] "C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKCU\..\Run: [Veoh] "D:\Programme\Veoh Networks\Veoh\VeohClient.exe" /VeohHide

O4 - HKCU\..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\WMPNSCFG.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: &ICQ Toolbar Search - res://D:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML

O8 - Extra context menu item: Easy-WebPrint - Drucken - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html

O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html

O8 - Extra context menu item: Easy-WebPrint - Vorschau - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html

O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Programme\ICQLite\ICQLite.exe (file missing)

O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Programme\ICQLite\ICQLite.exe (file missing)

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programme\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Programme\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programme\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programme\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - D:\Music\MAGIX\Common\Database\bin\fbserver.exe

O23 - Service: GoogleDesktopManager - Google - C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

O23 - Service: Spyware Terminator Clam Service (sp_clamsrv) - Crawler.com - C:\Programme\WinClamAVShield\sp_clamsrv.exe

O23 - Service: UPnPService - Magix AG - C:\Programme\Gemeinsame Dateien\MAGIX Shared\UPnPService\UPnPService.exe
 

--

End of file - 8925 bytes

Malwarebytes Anti-Malware

Code:

Malwarebytes' Anti-Malware 1.20

Datenbank Version: 964

Windows 5.1.2600 Service Pack 2
 

19:05:00 18.07.2008

mbam-log-7-18-2008 (19-05-00).txt
 

Scan Art: Komplett Scan (C:\|D:\|E:\|K:\|)

Objekte gescannt: 163003

Scan Dauer: 1 hour(s), 2 minute(s), 5 second(s)
 

Infizierte Speicher Prozesse: 0

Infizierte Speicher Module: 2

Infizierte Registrierungsschlüssel: 10

Infizierte Registrierungswerte: 21

Infizierte Datei Objekte der Registrierung: 2

Infizierte Verzeichnisse: 0

Infizierte Dateien: 71
 

Infizierte Speicher Prozesse:

(Keine Malware Objekte gefunden)
 

Infizierte Speicher Module:

C:\WINDOWS\system32\fycxcvrh.dll (Trojan.Vundo) -> Unloaded module successfully.

C:\WINDOWS\system32\awtutuSl.dll (Trojan.Vundo) -> Unloaded module successfully.
 

Infizierte Registrierungsschlüssel:

HKEY_CLASSES_ROOT\CLSID\{9a50b2af-3b2b-47dd-aecd-5d80a886f504} (Trojan.Vundo) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9a50b2af-3b2b-47dd-aecd-5d80a886f504} (Trojan.Vundo) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\awtutusl (Trojan.Vundo) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\syncrosoft emu (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{e3f6657a-57aa-46ef-b08c-74e60be0d363} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{6fc95eaf-4eab-473a-9c16-24162a7c56b5} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.
 

Infizierte Registrierungswerte:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d438412a (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingb147 (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingd4649 (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletinga5759 (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingc1129 (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{9a50b2af-3b2b-47dd-aecd-5d80a886f504} (Trojan.Vundo) -> Delete on reboot.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingb7831 (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingd2834 (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletinga8753 (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingc6811 (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletinga3078 (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingc8770 (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingb5140 (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingd785 (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletinga2763 (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingc6631 (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bmd70b72b6 (Trojan.Agent) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bf (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> Quarantined and deleted successfully.
 

Infizierte Datei Objekte der Registrierung:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\yayywmmc  -> Delete on reboot.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyDocs (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
 

Infizierte Verzeichnisse:

(Keine Malware Objekte gefunden)
 

Infizierte Dateien:

C:\WINDOWS\system32\dacslxem.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\mexlscad.ini (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\datelbkv.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\vkbletad.ini (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\elqgpsvq.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\qvspgqle.ini (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\fycxcvrh.dll (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\hrvcxcyf.ini (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\lgclfhfa.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\afhflcgl.ini (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\mkxojegf.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\fgejoxkm.ini (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\naqvclqq.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\qqlcvqan.ini (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\nmspdjeb.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\bejdpsmn.ini (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\qkkcfdna.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\andfckkq.ini (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\xjlgbldy.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\ydlbgljx.ini (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\yayyWmMC.dll_old (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\CMmWyyay.ini (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\CMmWyyay.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\yhybnvcx.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\xcvnbyhy.ini (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\yppcdaem.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\meadcppy.ini (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\yscivibd.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\dbivicsy.ini (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\awtutuSl.dll (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\paoqdrey.dll_old (Trojan.Vundo) -> Delete on reboot.

C:\Dokumente und Einstellungen\Björn\Eigene Dateien\Daten\Neuer Ordner\MMHIPHOP2\addon\Firebird\setup.exe (Adware.Agent) -> Quarantined and deleted successfully.

C:\Dokumente und Einstellungen\Björn\Eigene Dateien\Daten\Neuer Ordner\MMHIPHOP2\addon\ods\setup.exe (Adware.Agent) -> Quarantined and deleted successfully.

C:\Dokumente und Einstellungen\Björn\Lokale Einstellungen\Temporary Internet Files\Content.IE5\GJ5PUVPX\CAHMQXGE (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Dokumente und Einstellungen\Björn\Lokale Einstellungen\Temporary Internet Files\Content.IE5\GPUNWTYV\kb671231[2] (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Dokumente und Einstellungen\Björn\Lokale Einstellungen\Temporary Internet Files\Content.IE5\ZWRDN1X6\CAUDMBM3 (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Dokumente und Einstellungen\Björn\Lokale Einstellungen\Temporary Internet Files\Content.IE5\ZWRDN1X6\kb456456[1] (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Programme\Syncrosoft\POS\H2O\Uninst.exe (Adware.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{7788FD14-876F-47C9-A850-9BDEAB400FCE}\RP311\A0068563.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{7788FD14-876F-47C9-A850-9BDEAB400FCE}\RP311\A0068566.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{7788FD14-876F-47C9-A850-9BDEAB400FCE}\RP311\A0068582.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{7788FD14-876F-47C9-A850-9BDEAB400FCE}\RP311\A0068603.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{7788FD14-876F-47C9-A850-9BDEAB400FCE}\RP311\A0068619.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{7788FD14-876F-47C9-A850-9BDEAB400FCE}\RP311\A0068621.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{7788FD14-876F-47C9-A850-9BDEAB400FCE}\RP311\A0068685.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{7788FD14-876F-47C9-A850-9BDEAB400FCE}\RP311\A0068687.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{7788FD14-876F-47C9-A850-9BDEAB400FCE}\RP312\A0068774.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{7788FD14-876F-47C9-A850-9BDEAB400FCE}\RP312\A0068776.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{7788FD14-876F-47C9-A850-9BDEAB400FCE}\RP314\A0069914.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{7788FD14-876F-47C9-A850-9BDEAB400FCE}\RP314\A0069928.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\eqqixsmk.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\jyopct.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\okbgmh.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\vfewcfsw.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

D:\Mai 2007\4 Internet\IE7\Update\Update_IE7_x86.exe (Rogue.Installer) -> Quarantined and deleted successfully.

D:\Mai 2007\5 Programme\Ahead.Nero.Premium.Edition.v7.8.5.0\nero_keygen.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.

D:\Music\MAGIX\Common\Database\addoninstall.exe (Adware.Agent) -> Quarantined and deleted successfully.

D:\Music\MAGIX\Foto_Manager_2007\addoninstall.exe (Adware.Agent) -> Quarantined and deleted successfully.

D:\Music\MAGIX\MusicMakerHipHopEdition2\addoninstall.exe (Adware.Agent) -> Quarantined and deleted successfully.

D:\Music\MAGIX\Music_Manager_2007\addoninstall.exe (Adware.Agent) -> Quarantined and deleted successfully.

D:\Music\Steinberg\Cubase SX 3\open_cubasesx3_application_data_folder.exe (Adware.Agent) -> Quarantined and deleted successfully.

D:\Programme\Music\MAGIX\Goya_burnR\addoninstall.exe (Adware.Agent) -> Quarantined and deleted successfully.

D:\Programme\Music\MAGIX\Goya_burnR_mxcdr\addoninstall.exe (Adware.Agent) -> Quarantined and deleted successfully.

D:\Programme\Music\MAGIX\Online_Druck_Service\addoninstall.exe (Adware.Agent) -> Quarantined and deleted successfully.

D:\Programme\Musik\MAGIX\MusicStudio12deluxe\addoninstall.exe (Adware.Agent) -> Quarantined and deleted successfully.

D:\Programme\Musik\MAGIX\Music_Manager_2006\addoninstall.exe (Adware.Agent) -> Quarantined and deleted successfully.

D:\Programme\Musik\MAGIX\SamplitudeMusicStudio2008\addoninstall.exe (Adware.Agent) -> Quarantined and deleted successfully.

D:\Programme\Musik\MAGIX\Samplitude_SE_No9\addoninstall.exe (Adware.Agent) -> Quarantined and deleted successfully.

K:\Programme\Musik\MAGiX.Music.Studio.Deluxe.v12.DVD.ISO-TBE\MS12DLXE\addon\Firebird\setup.exe (Adware.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\BMd70b72b6.xml (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\BMd70b72b6.txt (Trojan.Vundo) -> Quarantined and deleted successfully.

Ich hoffe das ist richtig so und es hilft euch und mir weiter.

MfG Znake