Großes Trojanerproblem

fa1th1337

Sry,habe ich nicht gewusst,werde die Dateien gleich wieder überprüfen lassen.

Erst einmal Danke für die Mühe die du dir bis jetzt schon gemacht hast.

Hier ist der listing log:

RapidShare: 1-Click Webhosting

und hier der mbam log:

Malwarebytes' Anti-Malware 1.12
Datenbank Version: 729

Scan Art: Komplett Scan (C:\|D:\|)
Objekte gescannt: 244079
Scan Dauer: 58 minute(s), 15 second(s)

Infizierte Speicher Prozesse: 0
Infizierte Speicher Module: 3
Infizierte Registrierungsschlüssel: 11
Infizierte Registrierungswerte: 3
Infizierte Datei Objekte der Registrierung: 1
Infizierte Verzeichnisse: 0
Infizierte Dateien: 7

Infizierte Speicher Prozesse:
(Keine Malware Objekte gefunden)

Infizierte Speicher Module:
C:\WINDOWS\system32\effunfvl.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\system32\vtUnkjHA.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\system32\urqNEWNF.dll (Trojan.Vundo) -> Unloaded module successfully.

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6640c70c-31ee-4755-a839-7f0531d4f2bb} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6640c70c-31ee-4755-a839-7f0531d4f2bb} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5c060fe2-b3ca-47dd-b68e-bd1a6e297226} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5c060fe2-b3ca-47dd-b68e-bd1a6e297226} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\urqnewnf (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1c84c6c0 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BM1fb7f55c (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{5c060fe2-b3ca-47dd-b68e-bd1a6e297226} (Trojan.Vundo) -> Quarantined and deleted successfully.

Infizierte Datei Objekte der Registrierung:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\vtunkjha -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
(Keine Malware Objekte gefunden)

Infizierte Dateien:
C:\WINDOWS\system32\effunfvl.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\lvfnuffe.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vtUnkjHA.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\AHjknUtv.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\AHjknUtv.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pnpefqpb.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\urqNEWNF.dll (Trojan.Vundo) -> Delete on reboot.


EDIT:Hier die Virustotal Ergebnisse:

ONFORMAT.INI

File size: 765 bytes
MD5...: 73dbb188735bb169ab6761ee04503c22
SHA1..: 6b300d27ee5cf3d31c0c1035040dfea2209ca986
SHA256: 46e02fea4dd805cd6048fb4c49e9786294bff11e5c49ef8305621608230c8420
SHA512: dad6fa9a0982707f3df90228c1d2d7aecf600b13326c914221cefba83291d526
a474ced67bc5b6b4838c8322bda0565a35188645a22a92c49da60f0489a4b204
PEiD..: -
PEInfo: -

ONBRV2CL.INI

File size: 3375 bytes
MD5...: 7f8994a45addbb7c20410967bf75f1f7
SHA1..: 5a24b437501e77f4a927cebd3bc577fce36b4b55
SHA256: 78a574f978ee05e09d44c4f095875e9fe81e5676e1103e381c391617777d19d7
SHA512: be0d91a07907623888e43f09f69d2dbd7543f2698b99ea8e8017943126eab61f
fff1ba3330d5cc5857c2b47f34ccea9efdc2f169cf12ac6e6a58ff5aa1f04b5c
PEiD..: -
PEInfo: -

ONBLV2CL.INI

File size: 364 bytes
MD5...: 357a65ef2b2aa6cb36b08d7c2802a046
SHA1..: afe72b5a6583f45d2a288f2799d052ae3f467849
SHA256: 563870d1bfee8cc4425faf16613edaeb05a818cecc8d09fc24597494b17d82b6
SHA512: de5521379fee86721ea6ba5a8044f3d691cca9ca940b46d1948b74726a20571c
3507f4b9652e7928ead6bbff47f8a4fed927e4554921c707cbefa9a76aecc66d
PEiD..: -
PEInfo: -

ONBV2VER.INI

File size: 45 bytes
MD5...: fab4c45c47e4b870ffd841f0acf88535
SHA1..: 57d18a3f0880f5d36c710eb4902475cac22cdf65
SHA256: 79cd93c7dd882bc92106b9e709941249b674ce518b3c8387282b44b3a46f0b1f
SHA512: 3b82a26cc31a10acd9405a5086a7cbff06a63017b4bc79f378cdb5a73b6a4328
d599d54b85e01af2725a6c4e7904216b30628f5b56217f47715ee57269cbde70
PEiD..: -
PEInfo: -

OV2INSTX.DLL

File size: 24576 bytes
MD5...: a2121933c225b982d99a1c59d771f4e2
SHA1..: ad0100f89442e49773553b934141c96d8bc1061c
SHA256: 8bb4ad48c8c2de06bf38d6f82c3563cc1f4bf60644a9aec2ecf7aa1987a41001
SHA512: 3bc8bcfb25216224d02c1e1e64ce6b630204cc9a0df87484ea739b24899f7a4d
1733a3b9d1badbcdfb508ceab54e1962f68428e7e04eea92087f01b4418acb84
PEiD..: Armadillo v1.xx - v2.xx
PEInfo: PE Structure information


Die Dateien sollten zu OnBelay v2 gehören, denke ich mal, also sollte nichts böses sein.