Brauche mal bitte Hilfe

fuchsmaster

Wir haben drei Rechner am Router. Einer saugt bei emule. Jetzt haben alle Trojaner und sonst was drauf.
Hab HijackThis schon mal durchlaufen lassen. Und eScan läuft auch gerade.

Antivir findet zwei TR/Drop.VB.fit2 und TR/Dldr.IstBar.ET.1

den ersten konnt ich glaube ich löschen. Den anderen nicht.

Hier mal die Auswertung von Hijackthis:

Logfile of HijackThis v1.98.2
Scan saved at 18:32:02, on 23.05.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\Programme\ScanSoft\OmniPageSE\opware32.exe
D:\Programme\AVPersonal\AVGNT.EXE
D:\WINDOWS\system32\ctfmon.exe
D:\Programme\AVPersonal\AVWUPSRV.EXE
D:\WINDOWS\system32\cisvc.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\wscntfy.exe
C:\eMule.de\emule.exe
D:\WINDOWS\system32\cidaemon.exe
D:\Programme\AVPersonal\AVGUARD.EXE
D:\Programme\Internet Explorer\iexplore.exe
D:\Programme\Trojan Guarder Gold Version\Trojan Guarder.exe
C:\Downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = h**p://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.internetcologne.de
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://www.internetcologne.de
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.internetcologne.de
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = h**p://www.google.com/keyword/%s
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [WinDSL MTU-Adjust] WinDSL_MTU.exe
O4 - HKLM\..\Run: [Omnipage] D:\Programme\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [AVGCtrl] D:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - Startup: PowerReg SchedulerV2.exe
O4 - Global Startup: Trojan Guarder Gold Version.lnk = D:\Programme\Trojan Guarder Gold Version\Trojan Guarder.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programme\Messenger\msmsgs.exe
O12 - Plugin for .mp3: D:\Programme\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .mpeg: D:\Programme\Internet Explorer\PLUGINS\npqtplugin3.dll
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - h**p://static.windupdates.com/cab/DownloadsUnlimited/ie/bridge-c46.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - h**p://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097853534536
O16 - DPF: {E795CA75-530A-4981-80F2-0C9EF7CF0F58} (vcload) - h**p://secure.goodthinxx.com/vcloadgt.cab


Das findet eScan bis jetzt:

Object "BlazeFind Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "D:\WINDOWS\Downloaded Program Files\eBayFile.Fil". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Battlefield 1942\Mods\bf1942\Archives\bf1942\levels\Uninstall.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:Maps\Uninstall.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "D:\WINDOWS\System32\COMCTL32.OCA". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "D:\WINDOWS\System32\COMDLG32.OCA". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "D:\WINDOWS\Downloaded Program Files\eBayFile.Fil". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Adobe\Photoshop Album\Kataloge\My Catalog.psa". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{11556518-F20D-49EC-A531-E0BDDD5E6660}" refers to invalid object "D:\WINDOWS\system32\NVCPL.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{1440AD10-6AA8-11D1-B6F9-00A024DDAFD1}" refers to invalid object "C:\Westwood\SUN\blowfish.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5B693D57-8C39-4FB8-9407-25C481620165}" refers to invalid object "D:\PROGRA~1\MSI\LIVEUP~1\MSIDev.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{65C96C85-6C55-446D-B88E-F51BDDF11D83}" refers to invalid object "D:\PROGRA~1\MSI\LIVEUP~1\MSIDev.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{83D4679F-B6D7-11D2-BF36-00C04FB90A03}" refers to invalid object "D:\PROGRA~1\MESSEN~1\rtcimsp.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{88E729D6-BDC1-11D1-BD2A-00C04FB9603F}" refers to invalid object "fde.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{94BF6C82-F075-11D4-AB95-000102B2D025}" refers to invalid object "E:\Installer\Core\MDMDptch.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{99180163-DA16-101A-935C-444553540000}" refers to invalid object "recncl.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A70C977A-BF00-412C-90B7-034C51DA2439}" refers to invalid object "D:\WINDOWS\system32\NVCPL.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B45A4A81-86DA-11D1-B706-00A024DDAFD1}" refers to invalid object "C:\Westwood\SUN\game.exe". Action Taken: No Action Taken.
Entry "HKCR\ActMsg.Session" refers to invalid object "{3FA7DEB3-6438-101B-ACC1-00AA00423326}". Action Taken: No Action Taken.
Entry "HKCR\Alg.AlgSetup" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken.
Entry "HKCR\Alg.AlgSetup.1" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken.
Entry "HKCR\MailFileAtt" refers to invalid object "{00020D05-0000-0000-C000-000000000046}". Action Taken: No Action Taken.
Entry "HKCR\mapifvbx.object" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken.
Entry "HKCR\mapifvbx.object.1" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken.
Entry "HKCR\Plenoptic.Plenoptic" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.
Entry "HKCR\Plenoptic.Plenoptic.1" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.
Entry "HKCR\RTCCore.RTCClient" refers to invalid object "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action Taken: No Action Taken.
Entry "HKCR\RTCCore.RTCClient.1" refers to invalid object "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action Taken: No Action Taken.
Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.
Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr.1" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.

Weiß jmd Rat?

Danke für jede Hilfe. Die Rechner sind alle sau langsam geworden im Netz. Das stinkt.

Was kann ich tun, das dies zukünftig nicht mehr passiert?

mfg Sebastian

_____________
Anm.
Aktive Links editiert!
Beachte die Hinweise dieser Anleitung: HiJackThis
Danke Rene-gad!

LG Cidre
S-Mod TB