Mein IE öffnet ständig irgendwelche Seiten.
Habe es schon mit Spybot, Pest Patrol und Kaspersky versucht.
Kein Erfolg.
Wäre nett wenn sich das mal jemand anschauen könnte.

Danke


Logfile of HijackThis v1.99.1
Scan saved at 17:33:50, on 28.06.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\csrss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\Ati2evxx.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\Programme\FRITZ!DSL\IGDCTRL.EXE
E:\WINDOWS\system32\cisvc.exe
E:\Programme\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro 5\kavmm.exe
E:\WINDOWS\system32\locator.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\system32\wdfmgr.exe
E:\WINDOWS\System32\alg.exe
E:\WINDOWS\system32\Ati2evxx.exe
E:\WINDOWS\Explorer.EXE
E:\Programme\PTBSync\PTBSync.exe
E:\PROGRA~1\MICROS~4\GAMECO~1\common\swtrayv4.exe
E:\Programme\Java\jre1.5.0_03\bin\jusched.exe
E:\Programme\ATI Technologies\ATI.ACE\cli.exe
E:\Programme\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro 5\kav.exe
E:\Programme\PestPatrol\PPControl.exe
E:\Programme\PestPatrol\PPMemCheck.exe
E:\Programme\PestPatrol\CookiePatrol.exe
E:\Program Files\WheresJames\StartupMgr\StartupMgr.exe
E:\Programme\FRITZ!DSL\FwebProt.exe
E:\Programme\FRITZ!DSL\StCenter.exe
E:\Programme\ATI Technologies\ATI.ACE\cli.exe
E:\Programme\ATI Technologies\ATI.ACE\cli.exe
E:\Programme\eMule\emule.exe
E:\Programme\Internet Explorer\IEXPLORE.EXE
F:\Jo\hijack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.google.de/advanced_search?hl=de
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [PTBSync] E:\Programme\PTBSync\PTBSync.exe /Start
O4 - HKLM\..\Run: [SideWinderTrayV4] E:\PROGRA~1\MICROS~4\GAMECO~1\common\swtrayv4.exe
O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Programme\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "E:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ATICCC] "E:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [KAV50] "E:\Programme\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro 5\kav.exe" -run -n PersonalPro -v 5.0.0.0
O4 - HKLM\..\Run: [Kaspersky] C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\KAV Personal Pro\5.0\Save Kaspersky.bat
O4 - HKLM\..\Run: [.nvsvc] E:\WINDOWS\system\smss.exe /w
O4 - HKLM\..\Run: [PestPatrolRegistration] E:\Programme\PestPatrol\Register.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] E:\Programme\PestPatrol\PPControl.exe
O4 - HKLM\..\Run: [PPMemCheck] E:\Programme\PestPatrol\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] E:\Programme\PestPatrol\CookiePatrol.exe
O4 - HKLM\..\Run: [dmpmu.exe] E:\WINDOWS\system32\dmpmu.exe
O4 - HKCU\..\Run: [WheresJames Startup Manager] E:\Program Files\WheresJames\StartupMgr\StartupMgr.exe
O4 - Startup: ClearProg.lnk = ?
O4 - Startup: FRITZ!DSL Protect.lnk = E:\Programme\FRITZ!DSL\FwebProt.exe
O4 - Startup: FRITZ!DSL Startcenter.lnk = E:\Programme\FRITZ!DSL\StCenter.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = E:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Programme\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Programme\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Programme\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: e:\programme\fritz!dsl\sarah.dll
O10 - Unknown file in Winsock LSP: e:\programme\fritz!dsl\sarah.dll
O10 - Unknown file in Winsock LSP: e:\programme\fritz!dsl\sarah.dll
O10 - Unknown file in Winsock LSP: e:\programme\fritz!dsl\sarah.dll
O10 - Unknown file in Winsock LSP: e:\programme\fritz!dsl\sarah.dll
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - h**p://creative.com/su/ocx/15015/CTSUEng.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://h**p://update.microsoft.com/w...?1134762811156
O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} (AxisMediaControl Class) - http://h**p://pleasurecam.pleasuredo...ctivex/AMC.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - h**p://creative.com/su/ocx/15021/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{06EB00F5-535F-4435-8012-F555A730B879}: NameServer = 85.255.114.62,85.255.112.70
O17 - HKLM\System\CCS\Services\Tcpip\..\{62A6143D-8787-49E2-BE9B-530FB8E56E69}: NameServer = 85.255.114.62,85.255.112.70
O17 - HKLM\System\CCS\Services\Tcpip\..\{E59E5480-C9A8-40A7-80D1-5EA0FAC8D34E}: NameServer = 85.255.114.62,85.255.112.70
O17 - HKLM\System\CS1\Services\Tcpip\..\{06EB00F5-535F-4435-8012-F555A730B879}: NameServer = 192.168.1.11
O17 - HKLM\System\CS2\Services\Tcpip\..\{06EB00F5-535F-4435-8012-F555A730B879}: NameServer = 85.255.114.62,85.255.112.70
O17 - HKLM\System\CS3\Services\Tcpip\..\{06EB00F5-535F-4435-8012-F555A730B879}: NameServer = 85.255.114.62,85.255.112.70
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "E:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - E:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - E:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - E:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVM IGD CTRL Service - AVM Berlin - E:\Programme\FRITZ!DSL\IGDCTRL.EXE
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - E:\Programme\Gemeinsame Dateien\AVM\de_serv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: KLBLMain - Unknown owner - E:\Programme\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro 5\kavmm.exe" -run bl -n PersonalPro -v 5.0.0.0 -ttsr 10000000 (file missing)

Hallo wotan,

lass vorab folgende Datei bei Virustotal auswerten:

E:\WINDOWS\system\smss.exe

Meiner Ansicht nach sollte es sich dabei um diesen handeln --> Troj/IRCBot-FP
Sollte dies der Fall sein, bleibt dir nur eine Neuinstallation.

Gruß
Daniel

Hallo Sunny,
danke für die schnelle Antwort.
Ich hoffe du meinst E:\WINDOWS\System32\smss.exe?
Virus Total war ohne Ergebniss.
Hast du noch nen Tip oder meinst du ich soll Formatieren?
Danke vorab