Trojaner im Haus

ORCA58

Liebe Leute
hab mir auch so einen Trojaner eingefangen.
Habe Spybot S&D laufen lassen: nichts gefunden.
Habe ad-aware laufen lassen, konnte aber das Problem nicht lösen.

hier nun log-file von HJT:

Logfile of HijackThis v1.99.1
Scan saved at 22:54:37, on 11.07.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\HP\hpcoretech\hpcmpmgr.exe
C:\Programme\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\Bluewin\Quick Help\SmartBridge\MotiveSB.exe
C:\Programme\QuickTime\qttask.exe
C:\WINDOWS\system32\rmctrl.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\Programme\Bluewin\Firewall\fwstatus.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\hookdump.exe
C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\iplc32.exe
C:\Programme\Bluewin\Quick Help\bin\mpbtn.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Dokumente und Einstellungen\Claude\Eigene Dateien\Downloads\HijackThis1991.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.bluewin.ch
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\hvbmf.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\hvbmf.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\hvbmf.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\hvbmf.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\hvbmf.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\hvbmf.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\hvbmf.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Class - {55B602D6-4282-BE22-DEE6-C95DFCA166A1} - C:\WINDOWS\d3qc32.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar2.dll
O2 - BHO: Class - {E14C016F-0342-89AD-D475-D4092601854E} - C:\WINDOWS\system32\javazi.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Programme\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [TkBellExe] C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe -osboot
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programme\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [HP Software Update] "C:\Programme\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\Bluewin\Quick Help\SmartBridge\MotiveSB.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RemoteControl] C:\WINDOWS\system32\rmctrl.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\Symantec AntiVirus\VPTray.exe
O4 - HKLM\..\Run: [iexplore.exe] C:\Programme\Internet Explorer\iexplore.exe
O4 - HKLM\..\Run: [iplc32.exe] C:\WINDOWS\system32\iplc32.exe
O4 - HKLM\..\Run: [NAVNet] "C:\DOKUME~1\Claude\LOKALE~1\Temp\405.tmp" /m
O4 - HKLM\..\RunOnce: [ipve32.exe] C:\WINDOWS\ipve32.exe
O4 - HKLM\..\RunOnce: [appag.exe] C:\WINDOWS\appag.exe
O4 - HKLM\..\RunOnce: [sdkyw32.exe] C:\WINDOWS\system32\sdkyw32.exe
O4 - HKLM\..\RunOnce: [netxp.exe] C:\WINDOWS\netxp.exe
O4 - HKLM\..\RunOnce: [appbb.exe] C:\WINDOWS\system32\appbb.exe
O4 - HKLM\..\RunOnce: [apptj.exe] C:\WINDOWS\apptj.exe
O4 - HKLM\..\RunOnce: [mspy.exe] C:\WINDOWS\system32\mspy.exe
O4 - HKLM\..\RunOnce: [appph32.exe] C:\WINDOWS\appph32.exe
O4 - HKLM\..\RunOnce: [apizu32.exe] C:\WINDOWS\system32\apizu32.exe
O4 - HKLM\..\RunOnce: [mfcds.exe] C:\WINDOWS\mfcds.exe
O4 - HKLM\..\RunOnce: [netlx32.exe] C:\WINDOWS\system32\netlx32.exe
O4 - HKLM\..\RunOnce: [appbl32.exe] C:\WINDOWS\appbl32.exe
O4 - HKLM\..\RunOnce: [iptj.exe] C:\WINDOWS\system32\iptj.exe
O4 - HKLM\..\RunOnce: [atlct.exe] C:\WINDOWS\atlct.exe
O4 - HKLM\..\RunOnce: [javaim.exe] C:\WINDOWS\system32\javaim.exe
O4 - HKLM\..\RunOnce: [appbm32.exe] C:\WINDOWS\appbm32.exe
O4 - HKLM\..\RunOnce: [apibd32.exe] C:\WINDOWS\system32\apibd32.exe
O4 - HKLM\..\RunOnce: [appvo32.exe] C:\WINDOWS\appvo32.exe
O4 - HKLM\..\RunOnce: [mfchp32.exe] C:\WINDOWS\system32\mfchp32.exe
O4 - HKLM\..\RunOnce: [ntal.exe] C:\WINDOWS\system32\ntal.exe
O4 - HKLM\..\RunOnce: [sdkou.exe] C:\WINDOWS\sdkou.exe
O4 - HKLM\..\RunOnce: [netrd32.exe] C:\WINDOWS\netrd32.exe
O4 - HKLM\..\RunOnce: [mfcer.exe] C:\WINDOWS\system32\mfcer.exe
O4 - HKLM\..\RunOnce: [atluj.exe] C:\WINDOWS\atluj.exe
O4 - HKLM\..\RunOnce: [sdkvs.exe] C:\WINDOWS\system32\sdkvs.exe
O4 - HKLM\..\RunOnce: [javalq32.exe] C:\WINDOWS\javalq32.exe
O4 - HKLM\..\RunOnce: [javamg.exe] C:\WINDOWS\javamg.exe
O4 - HKLM\..\RunOnce: [atlwn32.exe] C:\WINDOWS\atlwn32.exe
O4 - HKCU\..\Run: [fwstatus.exe] C:\Programme\Bluewin\Firewall\fwstatus.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [Intel system tool] C:\WINDOWS\system32\hookdump.exe
O4 - Startup: StartupCleaner.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quick Help.lnk = C:\Programme\Bluewin\Quick Help\bin\matcli.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &Google Search - res://c:\programme\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Im Cache gespeicherte Seite - res://c:\programme\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Verweisseiten - res://c:\programme\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Ähnliche Seiten - res://c:\programme\google\GoogleToolbar2.dll/cmsimilar.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: ConferenceRoom Java Client - http://irc2.bluewin.ch/java/cr.cab
O16 - DPF: {1E8E209A-6120-4EF1-B0B6-A65191D905B9} (CInstallManager Class) - http://www.stream-it.bluewin.ch/Installs/InstallManager.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqemea/downloads/sysinfo.cab
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/de/big/1.1.62-big/GoogleNav.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{AEB0576E-4A8C-48B6-9C4B-9B0CDAFE08C3}: NameServer = 195.186.4.107 195.186.1.107
O23 - Service: Network Security Service ( 11Fßä #•ºÄÖ`I) - Unknown owner - C:\WINDOWS\ipve32.exe" /s (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Programme\Symantec AntiVirus\DefWatch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Programme\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Programme\Symantec AntiVirus\Rtvscan.exe


Besten Dank für eure Hilfe.
ORCA
_______________
Anm.
Aktive Links editiert!
Beachte zukünftig die Hinweise dieser Anleitung: HiJackThis.


LG Cidre
S-Mod TB