Hab mir was eingefangen!!!

Petepower

Hallo liebe Leute!!
Ich hab mir irgendwas böses gefangen. Hab die bekannten Programme "Shopping Wizard" und "Search Extender" installiert und bei jedem Hochfahren werden zig Trojaner von AntiVir gemeldet. Den Dienst "Network Security Systems" hab ich durch umbenennen der Datei ausgeschaltet, aber das hat mich nicht viel weiter gebracht. Könnte sich vielleicht jemand mein Log File ansehen??
Fänd ich überaus nett!!!


ogfile of HijackThis v1.99.1
Scan saved at 21:29:32, on 28.12.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\Explorer.EXE
C:\Programme\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://lookfor.cc/sp.php?pin=77035
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://lookfor.cc/sp.php?pin=77035
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://lookfor.cc?pin=77035
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lookfor.cc?pin=77035
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://lookfor.cc/sp.php?pin=77035
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://lookfor.cc/sp.php?pin=77035
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://lookfor.cc/sp.php?pin=77035
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://lookfor.cc?pin=77035
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: PreispiratenSearchURL - {0B660087-931C-4056-A04F-0423890E40B6} - C:\Programme\Preispiraten\Preispiraten2\PPSearchURL.dll (file missing)
O2 - BHO: Class - {13C0C175-BA97-9320-6817-42907F58C423} - C:\WINDOWS.0\ieez32.dll (file missing)
O2 - BHO: Class - {466F3B48-F256-0899-86BD-9AD314309C86} - C:\WINDOWS.0\system32\addar32.dll
O2 - BHO: Class - {4FA5C2D4-C75C-8572-E711-533677A6478A} - C:\WINDOWS.0\system32\mfcpd.dll
O2 - BHO: Class - {69CF4CDD-EB75-9AD5-2257-AD6261A4249B} - C:\WINDOWS.0\atlsz32.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Class - {7D77B0F8-737F-41DF-09D3-21204F9B4E08} - C:\WINDOWS.0\system32\crex32.dll (file missing)
O2 - BHO: metaspinner media GmbH - {84B94901-3645-4D80-A6B7-4D0050B19455} - C:\Programme\Preispiraten\Preispiraten2\IEButtonAmazonInterface.dll (file missing)
O2 - BHO: Class - {9E7FD323-2369-149B-7AE7-D46D0682EB58} - C:\WINDOWS.0\system32\apiig.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Class - {B286CA54-ADE9-E3BF-432F-01F77EBD74EE} - C:\WINDOWS.0\msje32.dll
O2 - BHO: Class - {C402EE2D-29CD-E397-89AC-E7CDD1D33F47} - C:\WINDOWS.0\system32\atllk32.dll (file missing)
O2 - BHO: metaspinner media GmbH - {CD9B7762-DFBC-42B1-BB30-02A78287B456} - C:\Programme\Preispiraten\Preispiraten2\IEButtonEBayInterface.dll (file missing)
O2 - BHO: metaspinner media GmbH - {D3AA56A9-8137-4950-A6F9-D0190A82AF2A} - C:\Programme\Preispiraten\Preispiraten2\IEButtonPPInterface.dll (file missing)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS.0\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS.0\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS.0\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [WinDSL MTU-Adjust] WinDSL_MTU.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS.0\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ElbyCheckElbyCDFL] "C:\Programme\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [CloneDVDElbyDelay] "C:\Programme\Elaborate Bytes\CloneDVD\ElbyCheck.exe" /L ElbyDelay
O4 - HKLM\..\Run: [AVGCtrl] "C:\Programme\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS.0\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS.0\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ipwr.exe] C:\WINDOWS.0\ipwr.exe
O4 - HKLM\..\Run: [102.tmp] C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\102.tmp.exe
O4 - HKLM\..\Run: [103.tmp] C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\103.tmp.exe
O4 - HKLM\..\Run: [ControlPanel] C:\WINDOWS.0\system32\per.exe internat.dll,LoadKeyboardProfile
O4 - HKLM\..\Run: [102.tmp.exe] C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\102.tmp.exe
O4 - HKLM\..\Run: [103.tmp.exe] C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\103.tmp.exe
O4 - HKLM\..\Run: [5.tmp] C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\5.tmp.exe
O4 - HKLM\..\Run: [5.tmp.exe] C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\5.tmp.exe
O4 - HKLM\..\Run: [8.tmp] C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\8.tmp.exe
O4 - HKLM\..\Run: [8.tmp.exe] C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\8.tmp.exe
O4 - HKLM\..\Run: [10.tmp] C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\10.tmp.exe
O4 - HKLM\..\Run: [10.tmp.exe] C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\10.tmp.exe
O4 - HKLM\..\Run: [19.tmp] C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\19.tmp.exe
O4 - HKLM\..\Run: [19.tmp.exe] C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\19.tmp.exe
O4 - HKLM\..\Run: [2E.tmp] C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\2E.tmp.exe
O4 - HKLM\..\Run: [2E.tmp.exe] C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\2E.tmp.exe
O4 - HKLM\..\Run: [48.tmp] C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\48.tmp.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS.0\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Recherche-Assistent - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=www.web.de
O23 - Service: Network Security Service (NSS) ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS.0\system32\ipgb32.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAMME\AVPERSONAL\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS.0\system32\nvsvc32.exe


Besten Dank schonmal und gutes Nächtle!!