Ja Hallo erstmal ^^
Sry wenn ich gleich zum Punkt komm
Mein Problem ist, ich hab den pc gestartet und dann lief erstmal ne DOS oberfläche aus der datei system32
Diese hab ich dann mal bei jotti scannen lassen und dabei ist das hier herausgekommen:
Service load:
0% 100%
File: system32.exe
Status:
INFECTED/MALWARE
MD5 98258751125f641a6ddaa4a560772c08
Packers detected:
PE-PACK

Scanner results
AntiVir: Found nothing
ArcaVir: Found nothing
Avast: Found nothing
AVG Antivirus: Found nothing
BitDefender:Found Backdoor.SDBot.5AB54F68
ClamAV:Found nothing
Dr.Web:Found Win32.IRC.Bot.based
F-Prot Antivirus:Found unknown virus (probable variant)
Fortinet: Found nothing
Kaspersky Anti-Virus: Found Backdoor.Win32.SdBot.gen
NOD32:Found a variant of IRC/SdBot
Norman Virus Control:

Found Sandbox: W32/Backdoor; [ General information ]

* File length: 38400 bytes.

[ Changes to filesystem ]
* Creates file C:\WINDOWS\SYSTEM\system32.exe.

[ Changes to registry ]
* Creates value "Configuration Loader"="system32.exe" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\Run".
* Creates key "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce".
* Sets value "L`aifhz}n{f`a/C`nkj}"="system32.exe" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce".
* Creates value "Configuration Loader"="system32.exe" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices".
* Creates value "L`aifhz}n{f`a/C`nkj}"="system32.exe" in key "HKCU\Software\Microsoft\Windows\CurrentVersion\Run".
* Creates value "Configuration Loader"="system32.exe" in key "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce".

[ Network services ]
* Connects to "eu.wondernet.nu" on port 6667 (TCP).
* Connects to IRC server.
* IRC: Uses nickname pmwlib.
* IRC: Uses username ouwx.
[ Security issues ]
* Possible backdoor functionality [Authenticate] port 113.

[ Process/window information ]
* Enumerates running processes.
* Will automatically restart after boot (I'll be back...).
UNA: Found nothing
VBA32: Found Backdoor.xBot.1 (paranoid heuristics) (probable variant)

Danach habich mal hijack this drüberlaufen lassen:
Logfile of HijackThis v1.99.1
Scan saved at 16:48:59, on 10.10.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe
C:\WINDOWS\System32\msnmsgr.exe
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\system32\dll\svchost.exe
C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe
C:\mysql\bin\mysqld-nt.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\explorer.exe
C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe
C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLDial.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\Programme\iPod\bin\iPodService.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\Uptime client\client.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\mIRC\mirc.exe
C:\Programme\foobar2000\foobar2000.exe
C:\Dokumente und Einstellungen\wir halt\Lokale Einstellungen\Temp\Temporäres Verzeichnis 1 für hijackthis_199.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = h**p://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://google.icq.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Programme\ICQToolbar\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {6E75472B-4B8D-4D3F-AF43-63274F846E53} - C:\WINDOWS\System32\aiec.dll (file missing)
O2 - BHO: IEMozgObj Class - {CE7C3CF0-4B15-11D1-0BED-709549C10020} - C:\WINDOWS\System32\48yp6yx1sf.dll (file missing)
O3 - Toolbar: (no name) - {5F7AB1DB-A899-46c1-8345-B72B4567EE86} - (no file)
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Programme\ICQToolbar\toolbaru.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Programme\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [Configuration Loader] system32.exe
O4 - HKLM\..\RunServices: [Configuration Loader] system32.exe
O4 - HKLM\..\RunOnce: [L`aifhz}n{f`a/C`nkj}] system32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Uptime-Project] C:\Programme\Uptime client\client.exe
O4 - HKCU\..\Run: [L`aifhz}n{f`a/C`nkj}] system32.exe
O4 - HKCU\..\RunOnce: [Configuration Loader] system32.exe
O4 - Global Startup: AOL 9.0 Tray-Symbol.lnk = C:\Programme\AOL 9.0\aoltray.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://D:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - d:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - d:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - h**p://aolcc.aol.de/computercheckup/qdiagcc.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - h**p://messenger.zone.msn.com/binary/MessengerStatsClient.cab28578.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{79C88E8C-7CE0-45CB-957E-E3899A6E8468}: NameServer = 205.188.146.145
O17 - HKLM\System\CS1\Services\Tcpip\..\{79C88E8C-7CE0-45CB-957E-E3899A6E8468}: NameServer = 205.188.146.145
O17 - HKLM\System\CS2\Services\Tcpip\..\{79C88E8C-7CE0-45CB-957E-E3899A6E8468}: NameServer = 205.188.146.145
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe
O23 - Service: Logical Disk Manager Provider (apee) - Unknown owner - C:\WINDOWS\System32\msnmsgr.exe" -netsvcs (file missing)
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: MSpack Service (MSpack) - Cat Soft - C:\WINDOWS\system32\dll\svchost.exe
O23 - Service: MySql - Unknown owner - C:\mysql\bin\mysqld-nt.exe
O23 - Service: Indexing Provider (nindex) - Unknown owner - C:\WINDOWS\System32\netz.exe" -netsvcs (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: QoS Provider (System Event) - Unknown owner - C:\WINDOWS\System32\explorer.exe" -netsvcs (file missing)


Was bedeutet das und wie kann ich mir helfen ? ^^
Lohnt überhaupt das reparieren oder lieber gleich neu aufsetzen ??

Danke schonmal für die Hilfe

[edit]
links entfernt
[/edit]

Zitat von SeggsY

Lohnt überhaupt das reparieren oder lieber gleich neu aufsetzen ??

Eine Reperatur lohnt sich nicht, da dein System aufgrund des Backdoors als kompromittiert zu betrachten ist.
Setze dein System neu auf und sichere es vor der ersten Internertverbindung vernünftig ab:

Eine Anleitung dazu gibts hier .