Also ich habe folgendes Problem: es poppen bei mir wenn ich firefox benutzte ständig irgend welche werbefenster auf, viele beinhalten garnichts und sind nur weiß, und andere enthalten fehlermeldung. Ich habe als Antivirenprogramm kaspersky IS 2009 das sperrt zwar einige von den seiten aber die meisten nicht und diese antipopup-addon für firefox macht auch nichts, ich kann die adressen eingeben aber es bringt nichts. ich hab heute mal HijackThis installiert und durchlaufen lassen aber ich kenn mich damit nicht aus und wäre sehr erfreut darüber wenn mir jemand sagen könnte was ich da ankreuzen soll, damit mein problem gelöst wird.

ich habe die sufu benutzt und auch die anleitung gelesen aber die helfen mir nicht weiter

hier mein log von hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:11:30, on 26.12.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20583)
Boot mode: Normal

Running processes:
C:\WINDOOF.0\System32\smss.exe
C:\WINDOOF.0\system32\winlogon.exe
C:\WINDOOF.0\system32\services.exe
C:\WINDOOF.0\system32\lsass.exe
C:\WINDOOF.0\system32\Ati2evxx.exe
C:\WINDOOF.0\system32\svchost.exe
C:\WINDOOF.0\System32\svchost.exe
C:\WINDOOF.0\system32\Ati2evxx.exe
C:\WINDOOF.0\system32\spoolsv.exe
C:\WINDOOF.0\Explorer.EXE
C:\WINDOOF.0\RTHDCPL.EXE
C:\WINDOOF.0\system32\rundll32.exe
C:\WINDOOF.0\system32\ctfmon.exe
C:\Programme\DAEMON Tools Lite\daemon.exe
E:\programme\steam\steam.exe
C:\Programme\GIGA F-Tasten\GIGA F-Tasten.exe
C:\Programme\Secunia\PSI\psi.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\WINDOOF.0\system32\PnkBstrA.exe
C:\WINDOOF.0\system32\svchost.exe
C:\WINDOOF.0\system32\wbem\wmiapsrv.exe
C:\WINDOOF.0\System32\svchost.exe
C:\WINDOOF.0\system32\rundll32.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.de/
R3 - URLSearchHook: (no name) - - (no file)
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [prunnet] "C:\WINDOOF.0\system32\prunnet.exe"
O4 - HKLM\..\Run: [ec2f3a9e] rundll32.exe "C:\WINDOOF.0\system32\cfkagiyd.dll",b
O4 - HKLM\..\Run: [AVP] "C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOOF.0\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Programme\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Steam] "e:\programme\steam\steam.exe" -silent
O4 - HKCU\..\Run: [GIGA F-Tasten] C:\Programme\GIGA F-Tasten\GIGA F-Tasten.exe
O4 - HKCU\..\Run: [prunnet] "C:\WINDOOF.0\system32\prunnet.exe"
O4 - HKCU\..\Run: [gadcom] "C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\gadcom\gadcom.exe" 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C8833201749139
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [IE7] rundll32 advpack.dll,LaunchINFSection IE7.inf,FirstUserStart (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: Secunia PSI.lnk = C:\Programme\Secunia\PSI\psi.exe
O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O9 - Extra button: Statistik für den Schutz des Web-Datenverkehrs - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOOF.0\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOOF.0\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O15 - Trusted Zone: *.amaena.com
O15 - Trusted Zone: *.antimalwareguard.com
O15 - Trusted Zone: *.antispyexpert.com
O15 - Trusted Zone: *.avsystemcare.com
O15 - Trusted Zone: *.gomyhit.com
O15 - Trusted Zone: *.imageservr.com
O15 - Trusted Zone: *.imagesrvr.com
O15 - Trusted Zone: *.onerateld.com
O15 - Trusted Zone: *.safetydownload.com
O15 - Trusted Zone: *.spyguardpro.com
O15 - Trusted Zone: *.storageguardsoft.com
O15 - Trusted Zone: *.trustedantivirus.com
O15 - Trusted Zone: *.virusremover2008.com
O15 - Trusted Zone: *.virusschlacht.com
O15 - Trusted Zone: *.amaena.com (HKLM)
O15 - Trusted Zone: *.antimalwareguard.com (HKLM)
O15 - Trusted Zone: *.antispyexpert.com (HKLM)
O15 - Trusted Zone: *.avsystemcare.com (HKLM)
O15 - Trusted Zone: *.gomyhit.com (HKLM)
O15 - Trusted Zone: *.imageservr.com (HKLM)
O15 - Trusted Zone: *.imagesrvr.com (HKLM)
O15 - Trusted Zone: *.onerateld.com (HKLM)
O15 - Trusted Zone: *.safetydownload.com (HKLM)
O15 - Trusted Zone: *.spyguardpro.com (HKLM)
O15 - Trusted Zone: *.storageguardsoft.com (HKLM)
O15 - Trusted Zone: *.trustedantivirus.com (HKLM)
O15 - Trusted Zone: *.virusremover2008.com (HKLM)
O15 - Trusted Zone: *.virusschlacht.com (HKLM)
O20 - AppInit_DLLs: ,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KAS PER~1\kloehk.dll lvbwvv.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOOF.0\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOOF.0\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOOF.0\system32\PnkBstrA.exe

--
End of file - 6498 bytes

falls es noch fragen gibt stellt mir die und ich werde schnellst möglich darauf antworten. ich bedanke mich schon mal im voraus.

ich hab jetzt noch malewarebytes drüber laufen lassen, es hat etwas gefunden aber es poppt immer noch auf.

Malwarebytes' Anti-Malware 1.31
Datenbank Version: 1550
Windows 5.1.2600 Service Pack 2

26.12.2008 17:24:33
mbam-log-2008-12-26 (17-24-33).txt

Scan-Methode: Vollständiger Scan (C:\|E:\|)
Durchsuchte Objekte: 127831
Laufzeit: 26 minute(s), 59 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 3
Infizierte Registrierungsschlüssel: 14
Infizierte Registrierungswerte: 5
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 11

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
C:\WINDOOF.0\system32\cfkagiyd.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOOF.0\system32\khfdCrRj.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOOF.0\system32\lvbwvv.dll (Trojan.Vundo) -> Delete on reboot.

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0e6f9743-43d5-4b43-a71f-32439d8f1c8b} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{0e6f9743-43d5-4b43-a71f-32439d8f1c8b} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2efcbe0f-0c63-4bd2-9405-3b92a6c9278e} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2efcbe0f-0c63-4bd2-9405-3b92a6c9278e} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2efcbe0f-0c63-4bd2-9405-3b92a6c9278e} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\xpre (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ec2f3a9e (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gadcom (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\prunnet (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\prunnet (Trojan.Agent) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\WINDOOF.0\system32\khfdCrRj.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOOF.0\system32\jRrCdfhk.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOOF.0\system32\jRrCdfhk.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOOF.0\system32\lvbwvv.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOOF.0\system32\cfkagiyd.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOOF.0\system32\dyigakfc.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Temporary Internet Files\Content.IE5\XJE01CQL\upd105320[1] (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Temporary Internet Files\Content.IE5\XJE01CQL\index[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{47C4A0C2-4774-485E-ABB3-365F6B5EAB28}\RP43\A0016584.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOOF.0\system32\tifkljty.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOOF.0\system32\drivers\etc\services (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.