H I L F E !!!!

wittl

hier mein logfile


Logfile of HijackThis v1.99.1

Scan saved at 08:09:12, on 14.05.2005

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)



Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\Mixer.exe

C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

C:\WINDOWS\System32\rbehby.exe

C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe

C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe

C:\Programme\Java\jre1.5.0_02\bin\jusched.exe

C:\WINDOWS\System32\combo.exe

C:\WINDOWS\System32\combop.exe

C:\WINDOWS\System32\ctfmon.exe

C:\Programme\Messenger\MSMSGS.EXE

C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe

C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\uaae.exe

C:\WINDOWS\System32\w?auboot.exe

C:\Programme\Hewlett-Packard\AiO\hp psc 900 series\Bin\hpobrt07.exe

C:\unzipped\SpySub.exe

C:\Programme\AVPersonal\AVWUPSRV.EXE

C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe

C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\System32\svchost.exe

C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe

C:\Programme\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe

C:\Programme\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe

C:\Programme\Internet Explorer\IEXPLORE.EXE

C:\WINDOWS\System32\rundll32.exe

C:\WINDOWS\System32\scombop.exe

C:\WINDOWS\System32\scombo.exe

C:\WINDOWS\Downloaded Program Files\gdnFR1882.exe

C:\PROGRA~1\WINZIP\winzip32.exe

C:\unzipped\hijackthis\HijackThis.exe



R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = h**p://w-find.com/sp.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://w-find.com/index.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://w-find.com/index.htm

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = h**p://w-find.com/sp.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = h**p://w-find.com/index.htm

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = h**p=proxy.btx.dtag.de:80;ftp=ftp_proxy.btx.dtag.de:80

R3 - Default URLSearchHook is missing

O2 - BHO: DLMaxObj Class - {00000000-59D4-4008-9058-080011001200} - C:\WINDOWS\dlmax.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: Loader Class - {2E246FAE-8420-11D9-870D-000C2917DE7F} - C:\WINDOWS\SYSTEM\Loader.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar2.dll

O2 - BHO: (no name) - {FD38F908-6792-4B3E-B87B-68F3ED234D92} - C:\WINDOWS\System32\rvyrhlu.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll

O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup

O4 - HKLM\..\Run: [RFTOCTIW] C:\WINDOWS\RFTOCTIW.exe

O4 - HKLM\..\Run: [Overnet] C:\Programme\Overnet\Overnet.exe -t

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [susp] C:\WINDOWS\susp.exe

O4 - HKLM\..\Run: [PSDrvCheck] C:\WINDOWS\System32\PSDrvCheck.exe

O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

O4 - HKLM\..\Run: [kjgqdhxu] C:\WINDOWS\System32\rbehby.exe

O4 - HKLM\..\Run: [iKeyWorks] C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe

O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe

O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_02\bin\jusched.exe

O4 - HKLM\..\Run: [combo.exe] combo.exe

O4 - HKLM\..\Run: [combop.exe] combop.exe

O4 - HKLM\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\MSMSGS.EXE" /background

O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet

O4 - HKCU\..\Run: [iwjwdsx] c:\windows\hrhcaah.exe

O4 - HKCU\..\Run: [tojugec] c:\windows\dvljfdl.exe

O4 - HKCU\..\Run: [xomjgnr] c:\windows\dvljfdl.exe

O4 - HKCU\..\Run: [xrokubu] c:\windows\dvljfdl.exe

O4 - HKCU\..\Run: [vhvyrcv] c:\windows\dvljfdl.exe

O4 - HKCU\..\Run: [tmxdwwi] c:\windows\dvljfdl.exe

O4 - HKCU\..\Run: [ivttyed] c:\windows\dvljfdl.exe

O4 - HKCU\..\Run: [qlqcntk] c:\windows\dvljfdl.exe

O4 - HKCU\..\Run: [oqbdafu] c:\windows\dvljfdl.exe

O4 - HKCU\..\Run: [vvslmab] c:\windows\dvljfdl.exe

O4 - HKCU\..\Run: [xsrcvcs] c:\windows\dvljfdl.exe

O4 - HKCU\..\Run: [pouikhm] c:\windows\dvljfdl.exe

O4 - HKCU\..\Run: [rgduiqu] c:\windows\dvljfdl.exe

O4 - HKCU\..\Run: [yvpiobd] c:\windows\uoitaxf.exe

O4 - HKCU\..\Run: [retosmh] c:\windows\uoitaxf.exe

O4 - HKCU\..\Run: [rmlowxj] c:\windows\uoitaxf.exe

O4 - HKCU\..\Run: [rtwixof] c:\windows\uoitaxf.exe

O4 - HKCU\..\Run: [khbxnsa] c:\windows\uoitaxf.exe

O4 - HKCU\..\Run: [legfbum] c:\windows\uoitaxf.exe

O4 - HKCU\..\Run: [vjrptmw] c:\windows\uoitaxf.exe

O4 - HKCU\..\Run: [Atro] C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\uaae.exe

O4 - HKCU\..\Run: [Fsv] C:\WINDOWS\System32\w?auboot.exe

O4 - HKCU\..\Run: [rmldjcl] c:\windows\nijicaw.exe

O4 - HKCU\..\Run: [vksxrnl] c:\windows\cufgmhx.exe

O4 - HKCU\..\Run: [dgbemex] c:\windows\tntnmum.exe

O4 - HKCU\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe

O4 - Startup: Microsoft-Indexerstellung.lnk = Programme\Office\FINDFAST.EXE

O4 - Startup: Office-Start.lnk = Programme\Office\OSA.EXE

O4 - Startup: winupdate07214383[1].exe

O4 - Global Startup: HPAiODevice(hp psc 900 series) - 1.lnk = C:\Programme\Hewlett-Packard\AiO\hp psc 900 series\Bin\hpobrt07.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: SpySubtract.lnk = C:\unzipped\SpySub.exe

O8 - Extra context menu item: &Google Search - res://c:\programme\google\GoogleToolbar2.dll/cmsearch.html

O8 - Extra context menu item: Bild in &Microsoft PhotoDraw öffnen - res://c:\PROGRA~1\MICROS~2\office\1031\phdintl.dll/phdContext.htm

O8 - Extra context menu item: Im Cache gespeicherte Seite - res://c:\programme\google\GoogleToolbar2.dll/cmcache.html

O8 - Extra context menu item: Verweisseiten - res://c:\programme\google\GoogleToolbar2.dll/cmbacklinks.html

O8 - Extra context menu item: Ähnliche Seiten - res://c:\programme\google\GoogleToolbar2.dll/cmsimilar.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll

O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll

O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe

O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE

O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE

O9 - Extra button: Microsoft AntiSpyware helper - {6B507339-F456-4D55-B681-4EF9DEA2D213} - (no file) (HKCU)

O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {6B507339-F456-4D55-B681-4EF9DEA2D213} - (no file) (HKCU)

O10 - Unknown file in Winsock LSP: c:\windows\system32\fltmgr.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\fltmgr.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\fltmgr.dll

O16 - DPF: {0E0CC6B0-79FA-7411-4EBF-4F63547F7D1E} - h**p://69.50.182.94/1/gdnFR1882.exe

O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - h**p://static.windupdates.com/cab/MediaAccessVerisign/ie/bridge-c18.cab

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - h**p://imgfarm.com/images/nocache/funwebproducts/SmileyCentralInitialSetup1.0.0.6.cab

O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - h**p://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-17.cab

O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - h**p://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab

O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - h**p://tools.ebayimg.com/eps/activex/EPSControl_v1-32.cab

O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE