Trojan-Dropper.win32.droco.a
 

Habe mir glaub ich den o.g. Trojaner eingefangen. Werde den einfach nicht mehr los.
Verwende Windows 7 Home Premium und Kaspersky 2010 9.0.0.736

Kaspersky löscht immer wieder die Datei Win32kjp.exe in C:\Users\[User]\AppData\Roaming

Die Datei wird aber sofort danach wieder erzeugt. Der eigentlich Schädling muss irgendwo anders sitzen.

Versuche gerade mit Stinger, Spybot und Kaspersky Ihn zu erwischen! :teufel2:

Kann mir vielleicht jemand helfen?!

HiJack Logfile
----

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:27:14, on 10.12.2009
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
C:\Program Files\cFosSpeed\cfosspeed.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Program Files\VMware\VMware Workstation\vmware-tray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\System32\spool\drivers\w32x86\3\E_FATIAIE.EXE
C:\Program Files\ShortCut\ShortCut.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Users\Soulfly\Downloads\stinger1001688.exe
C:\Program Files\VMware\VMware Workstation\vmware.exe
C:\Program Files\VMware\VMware Workstation\vmware-vmx.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {EEE6C35D-6118-11DC-9C72-001320C79847} - (no file)
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Netviewer Support - {4BE8B65B-EE14-40C1-B6BB-31E494FE6EBA} - C:\PROGRA~1\NETVIE~1\Support\Plugin\IEPLUG~1\NVIEPL~1.DLL
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll
O3 - Toolbar: &Netviewer Support - {E1F9EDE7-EF90-4A65-A5A4-D2FFEEA5D469} - C:\PROGRA~1\NETVIE~1\Support\Plugin\IEPLUG~1\NVIEPL~1.DLL
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"
O4 - HKLM\..\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe
O4 - HKLM\..\Run: [SPIRunE] Rundll32 SPIRunE.dll,RunDLLEntry
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [OODefragTray] C:\Program Files\OO Software\Defrag\oodtray.exe
O4 - HKLM\..\Run: [ooccctrl.exe] C:\Program Files\OO Software\CleverCache\ooccctrl.exe /tasktray
O4 - HKLM\..\Run: [vmware-tray] "C:\Program Files\VMware\VMware Workstation\vmware-tray.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3715] command.com /c del "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware Cease\Spyware Cease on the Web.lnk"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2346] cmd.exe /c del "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware Cease\Spyware Cease on the Web.lnk"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9945] command.com /c del "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware Cease\Spyware Cease.lnk"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5092] cmd.exe /c del "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware Cease\Spyware Cease.lnk"
O4 - HKLM\..\RunOnce: [SpybotDeletingA6629] command.com /c del "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware Cease\Uninstall Spyware Cease.lnk"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5488] cmd.exe /c del "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware Cease\Uninstall Spyware Cease.lnk"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2971] command.com /c del "C:\Program Files\Spyware Cease\md5.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC146] cmd.exe /c del "C:\Program Files\Spyware Cease\md5.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA5715] command.com /c del "C:\Program Files\Spyware Cease\SpywareCease.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC981] cmd.exe /c del "C:\Program Files\Spyware Cease\SpywareCease.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9542] command.com /c del "C:\Windows\System32\drivers\RKHit.sys"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2472] cmd.exe /c del "C:\Windows\System32\drivers\RKHit.sys"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9728] command.com /c del "C:\Program Files\Spyware Cease\SpywareCease.url"
O4 - HKLM\..\RunOnce: [SpybotDeletingC6289] cmd.exe /c del "C:\Program Files\Spyware Cease\SpywareCease.url"
O4 - HKLM\..\RunOnce: [SpybotDeletingA6744] command.com /c del "C:\Users\Administrator\Desktop\Spyware Cease.lnk"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8077] cmd.exe /c del "C:\Users\Administrator\Desktop\Spyware Cease.lnk"
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\RunOnce: [SpybotDeletingB47] command.com /c del "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware Cease\Spyware Cease on the Web.lnk"
O4 - HKCU\..\RunOnce: [SpybotDeletingD2528] cmd.exe /c del "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware Cease\Spyware Cease on the Web.lnk"
O4 - HKCU\..\RunOnce: [SpybotDeletingB2536] command.com /c del "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware Cease\Spyware Cease.lnk"
O4 - HKCU\..\RunOnce: [SpybotDeletingD8190] cmd.exe /c del "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware Cease\Spyware Cease.lnk"
O4 - HKCU\..\RunOnce: [SpybotDeletingB1809] command.com /c del "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware Cease\Uninstall Spyware Cease.lnk"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6675] cmd.exe /c del "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware Cease\Uninstall Spyware Cease.lnk"
O4 - HKCU\..\RunOnce: [SpybotDeletingB3493] command.com /c del "C:\Program Files\Spyware Cease\md5.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD8042] cmd.exe /c del "C:\Program Files\Spyware Cease\md5.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7594] command.com /c del "C:\Program Files\Spyware Cease\SpywareCease.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1004] cmd.exe /c del "C:\Program Files\Spyware Cease\SpywareCease.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingB968] command.com /c del "C:\Windows\System32\drivers\RKHit.sys"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6139] cmd.exe /c del "C:\Windows\System32\drivers\RKHit.sys"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8481] command.com /c del "C:\Program Files\Spyware Cease\SpywareCease.url"
O4 - HKCU\..\RunOnce: [SpybotDeletingD8193] cmd.exe /c del "C:\Program Files\Spyware Cease\SpywareCease.url"
O4 - HKCU\..\RunOnce: [SpybotDeletingB1170] command.com /c del "C:\Users\Administrator\Desktop\Spyware Cease.lnk"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7751] cmd.exe /c del "C:\Users\Administrator\Desktop\Spyware Cease.lnk"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-21-2821139029-4029557933-3937362591-1000\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User 'Soulfly')
O4 - S-1-5-21-2821139029-4029557933-3937362591-1000 Startup: ShortCut.lnk = C:\Program Files\ShortCut\ShortCut.exe (User 'Soulfly')
O4 - S-1-5-21-2821139029-4029557933-3937362591-1000 User Startup: ShortCut.lnk = C:\Program Files\ShortCut\ShortCut.exe (User 'Soulfly')
O4 - Startup: ShortCut.lnk = C:\Program Files\ShortCut\ShortCut.exe
O8 - Extra context menu item: add to &BOM - C:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: An vorhandenes PDF anfügen - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - d:\games\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware workstation\vsocklib.dll
O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware workstation\vsocklib.dll
O13 - Gopher Prefix:
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} (Creative Software AutoUpdate) - http://ccfiles.creative.com/Web/softwareupdate/su/ocx/15101/CTSUEng.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15109/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5B6D15EF-24DE-483B-930A-8D154B04D4D9}: NameServer = 192.168.0.1
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: haufereader - (no CLSID) - (no file)
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O22 - SharedTaskScheduler: Deskscapes - {EC654325-1273-C2A9-2B7C-45D29BCE68FB} - C:\PROGRA~1\Stardock\OBJECT~1\DESKSC~1\deskscapes.dll (file missing)
O22 - SharedTaskScheduler: Stardock Vista ControlPanel Extension - {EC654325-1273-C2A9-2B7C-45D29BCE68FD} - (no file)
O22 - SharedTaskScheduler: StardockDreamController - {EC654325-1273-C2A9-2B7C-45D29BCE68FF} - (no file)
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe
O23 - Service: Acronis Nonstop Backup service (afcdpsrv) - Acronis - C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - C:\Program Files\cFosSpeed\spd.exe
O23 - Service: Creative ALchemy AL6 Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: Dragon Age: Origins - Inhaltsupdater (DAUpdaterSvc) - BioWare - D:\Games\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Haufe iDesk-Service in c:\Program Files\Haufe\iDesk\iDeskService\Zope (HRService) - Unknown owner - c:\Program Files\Haufe\iDesk\iDeskService\iDeskService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: O&O CleverCache - O&O Software GmbH - C:\Program Files\OO Software\CleverCache\ooccag.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\Program Files\OO Software\Defrag\oodag.exe
O23 - Service: Sony Ericsson OMSI download service (OMSI download service) - Unknown owner - C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
O23 - Service: StarMoney 7.0 OnlineUpdate - Star Finanz - Software Entwicklung und Vertriebs GmbH - C:\Program Files\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\Windows\system32\vmnetdhcp.exe
O23 - Service: VMware USB Arbitration Service (VMUSBArbService) - VMware, Inc. - C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\Windows\system32\vmnat.exe

--
End of file - 17583 bytes

Keiner eine Idee?

Habe schon das Internet durchsucht aber konnte nichts genaues finden.

Alle %Temp% Ordner schon gesäubert. Ausserdem hat er sich in c:\windows\pchealth\ eingepflanzt. Wurde von mir ebenfalls gelöscht.

Nur hier wird immer noch die Datei erzeugt. Muss also noch irgendwo anders sitzen!

Schade, keine Antworten.

Hoffe es hat sich bei mir erledigt!
Alles nochmal gescannt mit Kaspersky, Counterspy und Dos-Anti-Vir.

Wurde nichts mehr gefunden und die o.g. Datei taucht auch nicht mehr auf!

Hallo ich bin registriert bei knuddels.de und habe mir wohl einen versteckten trojaner eingefangen.Leider hat mein antivierus scan (avira antivir controll center)keinen virus gefunden sondern zeigt mir nur 3 warnungen an.Ich kann mein Betriebssystem auch nicht neu setzen weil meine CD kaputt gemacht wurde. Jetzt weiß ich nicht wie ich den von meinen Rechner runter bekomme kann mir da jemand helfen?

Achtung falls du noch mal on kommst Spyware cease ist ein schädliches Programm was sich als Spam und virenschutz ausgibt. Hatte nur probs damit. Falls du nochmal reinschaust hau das unbedingt raus!!!!

gibt auch ne anleitung unter:

http://www.trojaner-board.de/69644-spyware-cease.html

schau mal rein.

Mfg Badabus