und? was sagen die experten?

Schau, ob Du die datei:

C:\Users\Mau\AppData\Roaming\WindowsUpd.ese\WinUpd.exe
         

noch findest?

Mach einen Rootkitscan mit GMER und poste das Log.

Du kannst noch einen Onlinescan mit Bitdefender machen und schaun was der sagt.

Gruss Swiss

Zitat von Swiss

Schau, ob Du die datei:

C:\Users\Mau\AppData\Roaming\WindowsUpd.ese\WinUpd.exe
         

noch findest?

Also die finde ich nicht mehr. Hier das Log von GMER:

 GMER 1.0.15.15011 [dp7ddp68.exe] - http://www.gmer.net
Rootkit scan 2009-07-30 12:06:23
Windows 6.0.6002 Service Pack 2


---- System - GMER 1.0.15 ----

SSDT            \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys                                                             ZwTerminateProcess [0x938B6DF0]

---- Kernel code sections - GMER 1.0.15 ----

.text           ntkrnlpa.exe!KeSetEvent + 621                                                                                  826BDD64 4 Bytes  [F0, 6D, 8B, 93]

---- User IAT/EAT - GMER 1.0.15 ----

IAT             C:\Windows\system32\services.exe[608] @ C:\Windows\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW]   00130002
IAT             C:\Windows\system32\services.exe[608] @ C:\Windows\system32\services.exe [KERNEL32.dll!CreateProcessW]         00130000
IAT             C:\Windows\Explorer.EXE[3612] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown]                          [74987817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3612] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage]                           [749DA86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3612] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI]                       [7498BB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3612] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode]                 [7497F695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3612] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup]                           [749875E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3612] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC]                        [7497E7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3612] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM]            [749B8395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3612] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream]               [7498DA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3612] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight]                       [7497FFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3612] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth]                        [7497FF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3612] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage]                         [749771CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3612] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM]                 [74A0CAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3612] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile]                    [749AC8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3612] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics]                       [7497D968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3612] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree]                                 [74976853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3612] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc]                                [7497687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3612] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode]                   [74982AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\tdx \Device\Tcp                                                                                        aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice  \Driver\tdx \Device\Udp                                                                                        aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice  \FileSystem\fastfat \Fat                                                                                       fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg             HKLM\SOFTWARE\Classes\CLSID\{B6A930A0-A4F5-43A5-9B4E-6189A6C2B9E8}@y!s!\24!r!s!`!\30!y!\24!\24!t!\30!c!y!s!d!  19583823

---- EOF - GMER 1.0.15 ----