Warsch en Virus drauf

codename

ICh glaube ich habe soen paar Viren od. Trojaner drauf hier meine logs :


Logfile of HijackThis v1.99.1
Scan saved at 13:17:28, on 01.07.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\Programme\Symantec AntiVirus\Rtvscan.exe
C:\Programme\Java\jre1.5.0_02\bin\jusched.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Programme\Desktop Sidebar\dsidebar.exe
C:\Programme\Valve\Steam\Steam.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\TGTSoft\StyleXP\StyleXP.exe
C:\Programme\GMX\GMX SMS-Manager\SMSMngr.exe
C:\Programme\Azureus\Azureus.exe
C:\Programme\GetRight\getright.exe
C:\Programme\Trillian\trillian.exe
C:\Programme\Java\jre1.5.0_02\bin\javaw.exe
C:\Programme\GetRight\getright.exe
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
C:\Programme\iTunes\iTunes.exe
C:\Programme\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Programme\iPod\bin\iPodService.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\findstr.exe
C:\Downloads\Sicherheit\Trojaner\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - (no file)
O2 - BHO: Idea2 SidebarBrowserMonitor Class - {45AD732C-2CE2-4666-B366-B2214AD57A49} - C:\Programme\Desktop Sidebar\sbhelp.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar1.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [SIDEBAR] "C:\Programme\Desktop Sidebar\dsidebar.exe"
O4 - HKCU\..\Run: [Steam] C:\Programme\Valve\Steam\Steam.exe -silent
O4 - HKCU\..\Run: [AntiSpyware7] "C:\Programme\Steganos AntiSpyware 7\aspy7.exe" /0
O4 - HKCU\..\Run: [SIAPRO7] "C:\Programme\Steganos Internet Anonym Pro 7\SIAPRO7.exe" -boot
O4 - HKCU\..\Run: [STYLEXP] C:\Programme\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [GMX SMS-Manager] C:\Programme\GMX\GMX SMS-Manager\SMSMngr.exe
O4 - Startup: Trillian.lnk = C:\Programme\Trillian\trillian.exe
O4 - Global Startup: Azureus.lnk = C:\Programme\Azureus\Azureus.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Programme\GetRight\getright.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Programme\Desktop Sidebar\sbhelp.dll
O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Programme\Desktop Sidebar\sbhelp.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Programme\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: StyleXPService - Unknown owner - C:\Programme\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Programme\Symantec AntiVirus\Rtvscan.exe


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Funde für "infected"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Wed Jun 29 21:26:42 2005 => C:\WINDOWS\system32\winshost.exe possibly infected and removed by background antivirus package!
Wed Jun 29 21:26:42 2005 => File C:\WINDOWS\system32\winshost.exe infected by "BkCln.Unknown" Virus! Action Taken: No Action Taken.
Wed Jun 29 21:26:43 2005 => C:\WINDOWS\system32\wiwshost.exe possibly infected and removed by background antivirus package!
Wed Jun 29 21:26:43 2005 => File C:\WINDOWS\system32\wiwshost.exe infected by "BkCln.Unknown" Virus! Action Taken: No Action Taken.
Wed Jun 29 21:27:38 2005 => File C:\DOKUME~1\DON_CO~1.MAF\LOKALE~1\TEMPOR~1\Content.IE5\01Q7G5EV\Beach[1].zip infected by "Email-Worm.Win32.Bagle.br" Virus! Action Taken: No Action Taken.
Wed Jun 29 21:31:06 2005 => File C:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\082C0000.VBN infected by "Email-Worm.Win32.Bagle.br" Virus! Action Taken: No Action Taken.
Wed Jun 29 21:31:06 2005 => File C:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\082C0001.VBN infected by "Email-Worm.Win32.Bagle.br" Virus! Action Taken: No Action Taken.
Wed Jun 29 21:35:37 2005 => File C:\Dokumente und Einstellungen\dOn_CoDeNaMe.MAFIA\Lokale Einstellungen\Temporary Internet Files\Content.IE5\01Q7G5EV\Beach[1].zip infected by "Email-Worm.Win32.Bagle.br" Virus! Action Taken: No Action Taken.
Thu Jun 30 06:58:52 2005 => File C:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\082C0000.VBN infected by "Email-Worm.Win32.Bagle.br" Virus! Action Taken: No Action Taken.
Thu Jun 30 06:58:52 2005 => File C:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\082C0001.VBN infected by "Email-Worm.Win32.Bagle.br" Virus! Action Taken: No Action Taken.
Thu Jun 30 10:46:29 2005 => Scanning File E:\Eigene Musik\iTunes\iTunes Music\Bad Religion\Stranger Than Fiction\07 Infected.mp3
Thu Jun 30 11:12:10 2005 => File E:\Torrent\Gedownloadete Torrents\Programme\WebcamXP.Pro.v1.04.790.rar infected by "Trojan-Dropper.Win32.Delf.dh" Virus! Action Taken: No Action Taken.
Thu Jun 30 11:12:32 2005 => File E:\Torrent\Gedownloadete Torrents\Programme\WinTasks Professional v4.45.rar infected by "Trojan-Dropper.Win32.Delf.dh" Virus! Action Taken: No Action Taken.
Thu Jun 30 11:31:53 2005 => Total Disinfected Files: 0


Seht ihr irgend ne bedrohung?
Ich hab auch z.b den Fehler das sehr oft bei IE6 od. Firefox steht die Seite kann nicht angezeigt werden (was sehr nervig ist) oder bei Azureus steht No Bufferspace aviable !

Wär schön wenn mir jd. helfen könnte !
greetz
codename