Trojaner?

YaGo2k4

hier der neue highjackthis log:
Logfile of HijackThis v1.99.1
Scan saved at 22:34:08, on 31.05.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
C:\Programme\Norton Personal Firewall\NISUM.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Norton Personal Firewall\ccPxySvc.exe
C:\Programme\Norton AntiVirus\navapsvc.exe
C:\Programme\Norton AntiVirus\SAVScan.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\Mixer.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\Programme\teamspeak2_RC2\TeamSpeak.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\WINDOWS\netls.exe
C:\Dokumente und Einstellungen\Michael\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tnt-base.de/phpkit/includ...path=start.php
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll
O2 - BHO: Class - {EB3D8D2D-50C0-C45C-AAF4-AC97F26F8602} - C:\WINDOWS\addax.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [ccApp] C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [ccRegVfy] C:\Programme\Gemeinsame Dateien\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [netls.exe] C:\WINDOWS\netls.exe
O4 - HKLM\..\RunOnce: [d3fr.exe] C:\WINDOWS\system32\d3fr.exe
O4 - HKLM\..\RunOnce: [d3jw32.exe] C:\WINDOWS\d3jw32.exe
O4 - HKLM\..\RunOnce: [apiwa32.exe] C:\WINDOWS\system32\apiwa32.exe
O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\d3fr.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Proxy Service (ccPxySvc) - Symantec Corporation - C:\Programme\Norton Personal Firewall\ccPxySvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
O23 - Service: Indexdienst (cisvc) - Unknown owner - C:\WINDOWS\System32\cisvc.exe (file missing)
O23 - Service: Norton AntiVirus Auto-Protect-Dienst (navapsvc) - Symantec Corporation - C:\Programme\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Personal Firewall Accounts Manager (NISUM) - Symantec Corporation - C:\Programme\Norton Personal Firewall\NISUM.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Programme\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\GEMEIN~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Programme\TuneUp Utilities 2004\WinStylerThemeSvc.exe

und hier der escan log:
File C:\WINDOWS\addax.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\d3fr.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\d3jw32.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\apiwa32.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\sysuf.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken.
File C:\Dokumente und Einstellungen\Michael\Desktop\aida32ee_393\aida32.bin tagged as not-a-virus:Tool.Win32.AIDA.3862. No Action Taken.
File C:\Dokumente und Einstellungen\Michael\Desktop\aida32ee_393\aida32.exe tagged as not-a-virus:Tool.Win32.AIDA.3862. No Action Taken.
File C:\Dokumente und Einstellungen\Michael\Desktop\aida32ee_393\aida_directx.dll tagged as not-a-virus:Tool.Win32.AIDA.3862. No Action Taken.
Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "SrchAsst Spyware/Adware" found in File System! Action Taken: No Action Taken.
Entry "HKCR\CLSID\{88E729D6-BDC1-11D1-BD2A-00C04FB9603F}" refers to invalid object "fde.dll". Action Taken: No Action Taken.
File C:\WINDOWS\addwc32.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\d3fz.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\d3wx32.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\ieea.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\javayh.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\msoj.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\netjz.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\tmp.hta infected by "Trojan-Downloader.VBS.Psyme.at" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\winlo.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\javaai.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\mfcol32.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\ntgy32.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\systk.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken.
File C:\DOKUME~1\Michael\LOKALE~1\TEMPOR~1\Content.IE5\05Y3GDAZ\wbk2C.tmp infected by "Exploit.VBS.Phel.i" Virus! Action Taken: No Action Taken.
File C:\DOKUME~1\Michael\LOKALE~1\TEMPOR~1\Content.IE5\2DB4H0J2\hohoteens[1].htm infected by "Trojan-Clicker.HTML.IFrame.a" Virus! Action Taken: No Action Taken.
File C:\DOKUME~1\Michael\LOKALE~1\TEMPOR~1\Content.IE5\7T9Y8XYB\cmdexe[1].htm infected by "Exploit.VBS.Phel.i" Virus! Action Taken: No Action Taken.
File C:\DOKUME~1\Michael\LOKALE~1\TEMPOR~1\Content.IE5\BRH3JL8W\blank[1].htm infected by "Trojan-Clicker.HTML.IFrame.a" Virus! Action Taken: No Action Taken.
File C:\DOKUME~1\Michael\LOKALE~1\TEMPOR~1\Content.IE5\BRH3JL8W\cj[1].htm infected by "Trojan.JS.Seeker" Virus! Action Taken: No Action Taken.
File C:\DOKUME~1\Michael\LOKALE~1\TEMPOR~1\Content.IE5\GP2NKDQB\test3[1].htm infected by "Trojan-Clicker.JS.Linker.j" Virus! Action Taken: No Action Taken.
File C:\DOKUME~1\Michael\LOKALE~1\TEMPOR~1\Content.IE5\HCJWRSNO\1[1].htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
File C:\DOKUME~1\Michael\LOKALE~1\TEMPOR~1\Content.IE5\MTN0L8RM\ohi-ahi[1].htm infected by "Trojan.JS.Seeker" Virus! Action Taken: No Action Taken.
File C:\DOKUME~1\Michael\LOKALE~1\TEMPOR~1\Content.IE5\OZR3ICPH\pop[1].htm infected by "Trojan.JS.Seeker" Virus! Action Taken: No Action Taken.
File C:\DOKUME~1\Michael\LOKALE~1\TEMPOR~1\Content.IE5\SJ7J2KTX\wow[1].htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
File C:\c.vbs infected by "Trojan-Downloader.VBS.Small.f" Virus! Action Taken: No Action Taken.

vielen dank schonmal
Gruß Yago