Hilfe: Trojaner ohne Ende auf der Platte

Jogi63

Wer kann mir helfen?

1. Mein IE wird entführt: www.onemoresearch.net kommt immer wieder als Startseite, obwohl sie nicht eingerichtet ist.

2. Shopping wizzard, home search assistant und search extender sind als Programme installiert und ich kann sie nicht löschen.

3. Mehrere Antivirenprogramme können die Trojaner ( Iefeat-U, D-Loader-Y, Iefeat-Gen) nicht löschen, vermutlich weil ihre Trägerdateien vom System benötigt werden.

1000 Dank im voraus.

Habe ein Logfile of HijackThis v1.99.0
Scan saved at 20:50:15, on 22.01.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Sophos\AutoUpdate\ALsvc.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\System32\cisvc.exe
C:\Programme\Sophos\Control Center\LMSessn.exe
C:\Programme\Microsoft SQL Server\MSSQL$SOPHOS\Binn\sqlservr.exe
C:\Programme\Sophos\Control Center\Sdbnsrvc.exe
C:\Programme\Sophos\Control Center\Library\bin\SchdSrvc.exe
C:\Programme\Sophos\Remote Management System\RouterNT.exe
C:\Programme\Sophos\Control Center\CertificationManagerServiceNT.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Sophos\Sophos Anti-Virus\SWEEPSRV.SYS
C:\Programme\Sophos\Remote Management System\ManagementAgentNT.exe
C:\Programme\Sophos\Remote Management System\ALCAgent.exe
C:\WINDOWS\appqe.exe
C:\Programme\Sophos\AutoUpdate\almon.exe
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programme\Pinnacle\Pinnacle PCTV Sat\Remote\Remoterm.exe
C:\Programme\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Programme\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\T-Eumex KommunikationsCenter\strtfx.exe
C:\Programme\T-Eumex KommunikationsCenter\sndml.exe
C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\Telekom\T-Eumex 520PC\Capictrl.exe
C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Programme\Pinnacle\Shared Files\Programs\Scheduler\PCLEScheduler.exe
C:\Programme\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\WINDOWS\System32\wisptis.exe
C:\Programme\Sophos\Sophos Anti-Virus\wsweepnt.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Dokumente und Einstellungen\Besitzer\Eigene Dateien\downloads\Sicherheit\hijack\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.popupsearches.com/sidesearch.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\jxzne.dll/sp.html#75034
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\jxzne.dll/sp.html#75034
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\jxzne.dll/sp.html#75034
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\jxzne.dll/sp.html#75034
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\jxzne.dll/sp.html#75034
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\jxzne.dll/sp.html#75034
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\jxzne.dll/sp.html#75034
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {7E5DA506-8E62-2871-824D-057117148321} - C:\WINDOWS\winwm.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PCTVRemote] C:\Programme\Pinnacle\Pinnacle PCTV Sat\Remote\Remoterm.exe
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [MMTray] C:\Programme\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [SetIcon] C:\Program Files\SMSC\Seticon.exe
O4 - HKLM\..\Run: [mmtask] C:\Programme\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [strtfx] "C:\Programme\T-Eumex KommunikationsCenter\strtfx.exe"
O4 - HKLM\..\Run: [sndml] "C:\Programme\T-Eumex KommunikationsCenter\sndml.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [JavaUpdate0.07] C:\WINDOWS\System32\cirotsog.exe
O4 - Global Startup: AutoUpdate Monitor.lnk = C:\Programme\Sophos\AutoUpdate\ALMon.exe
O4 - Global Startup: CAPIControl.lnk = ?
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Pinnacle PCTV Scheduler.lnk = C:\Programme\Pinnacle\Shared Files\Programs\Scheduler\PCLEScheduler.exe
O4 - Global Startup: Service Manager.lnk = C:\Programme\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: (HKLM)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1095247678340
O23 - Service: Sophos AutoUpdate Service - Unknown - C:\Programme\Sophos\AutoUpdate\ALsvc.exe
O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Sophos Session Manager - TODO: <Company name> - C:\Programme\Sophos\Control Center\LMSessn.exe
O23 - Service: Macromedia Licensing Service - Unknown - C:\Programme\Gemeinsame Dateien\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Sophos Database Notification Service - Sophos Plc - C:\Programme\Sophos\Control Center\Sdbnsrvc.exe
O23 - Service: Sophos Enterprise Manager Scheduler - Unknown - C:\Programme\Sophos\Control Center\Library\bin\SchdSrvc.exe
O23 - Service: Sophos Agent - SOPHOS Plc - C:\Programme\Sophos\Remote Management System\ManagementAgentNT.exe
O23 - Service: Sophos AutoUpdate Agent - Unknown - C:\Programme\Sophos\Remote Management System\ALCAgent.exe
O23 - Service: Sophos Message Router - SOPHOS Plc - C:\Programme\Sophos\Remote Management System\RouterNT.exe
O23 - Service: Sophos SBE Certification Manager - SOPHOS Plc - C:\Programme\Sophos\Control Center\CertificationManagerServiceNT.exe
O23 - Service: Sophos SBE ManagementService - Sophos Plc - C:\Programme\Sophos\Control Center\SbeMss.exe
O23 - Service: Sophos Anti-Virus - Sophos Plc - C:\Programme\Sophos\Sophos Anti-Virus\SWEEPSRV.SYS
O23 - Service: Network Security Service (NSS) - Unknown - C:\WINDOWS\system32\sysgq32.exe (file missing)