hallo
men antivir hat mir heute den TR/Forten.Java.2' trojaner angezeigt,leider konnte ich den nicht löschen kann mir vielleicht jemand weiterhelfen ?


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:04:41, on 10.09.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Alwil Software\Avast4\aswUpdSv.exe
C:\Programme\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
c:\programme\gemeinsame dateien\logitech\lvmvfm\LVPrcSrv.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\AGRSMMSG.exe
C:\PROGRA~1\Medion\KeyStat\KeyStat.exe
C:\WINDOWS\system32\LXSUPMON.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Programme\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Programme\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\Programme\Alwil Software\Avast4\ashMaiSv.exe
C:\Programme\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\KN_DSL\KN_DSL.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\MSN Messenger\usnsvc.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer von KielNET-DSL
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar1.dll
O2 - BHO: XBTP01621 - {F6104497-54FD-4688-9162-5115CC8AB0FB} - C:\PROGRA~1\BEARSH~1\BEARSH~2\MediaBar.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Programme\BearShare applications\BearShare MediaBar\MediaBar.dll (file missing)
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Keyboard Status] C:\PROGRA~1\Medion\KeyStat\KeyStat.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.kielnet-internet.de
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1106843944468
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://static.ak.schuelervz.net/photouploader/ImageUploader4.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u1-windows-i586-jc.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CC32E40C-7D6A-4C7B-8C3B-8923F7D8B79E}: NameServer = 89.27.130.33 89.27.130.34
O18 - Protocol: bw+0 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {A561CF73-11E3-4F87-8186-7CBF383D19A4} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programme\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programme\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programme\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programme\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Programme\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\programme\gemeinsame dateien\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Programme\Gemeinsame Dateien\Logitech\SrvLnch\SrvLnch.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 20798 bytes

Hallo derf.

Du saugst über Bearshare? Böser Fehler! da kommt ******* mit..

-Deinstalliere Bearshare über die Systemsteuerung und erstelle ein neues HJT logFile.

Gruß

Undoreal

irgendwie mag sich das über die systemsteuerung nicht deinstallieren lassen ist auch keinerlei angabe über die größe des programmes mehr vorhanden.wahrscheinlich hab ich es schonmal falsch deinstalliert ???

Hallo derf,

wo hat Antivir den Trojaner denn gefunden?

Wenn im Java- Cache, dann leere diesen über Systemsteuerung-> Java (Java ist ausserdem nicht mehr ganz aktuell-> 1.0.62)

Wenn im IE- Cache, denn leere diesen über Extras-> Browserverlauf im IE

Suche mit der Windows- Dateisuche nach dem Begriff "bearshare" und lösche alles was angezeigt wird manuell. Säubere anschliessend dein System mit dem CCleaner Download. Die Registry- Säuberung unter "Probleme" bitte mehrfach laufen lassen bis nichts mehr gefunden wird.

Ausserdem laufen bei Dir zwei Virenscanner. Entscheide dich für einen.

Gruß Jaipur

irgendwie mag sich das über die systemsteuerung nicht deinstallieren lassen ist auch keinerlei angabe über die größe des programmes mehr vorhanden.

Alles kein Problem. Das ist häufig so.

Gehe vor wie folgt:

-Deaktiviere die Systemwiederherstellung auf allen Laufwerken.

-Deinstalliere Java über die Systemsteuerung.

-Fixe mit HJT folgende Einträge:

* R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = Search *

* R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = Search *

* O2 - BHO: XBTP01621 - {F6104497-54FD-4688-9162-5115CC8AB0FB} - C:\PROGRA~1\BEARSH~1\BEARSH~2\MediaBar.dll (file missing) *

* O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Programme\BearShare applications\BearShare MediaBar\MediaBar.dll (file missing) *

-Run Combofix. Poste den erscheinenden Text.

-Durchsuche mit Lavasoft und Spybot-S&D sowie deinem AV-Prog (alle drei mit aktuellen Signaturen!) dein System jeweils 2x. Erst im normalen und dann im abgesicherten Modus (F8 beim Hochfahren).

-Räume mit cCleaner auf ( die Registry musst du mehrmals durchsuchen und bereinigen lassen).

-Poste ein frisches HijackThis log sowie einen iClean Bericht (Prog in eigenem Ordner öffnen->"Yes"->File->Report).

-Danach machst du einen eScan nach Anleitung in meiner Signatur und postest das log.

Gruß

Undoreal

wie ist das mit dem fixen in HJT gemeint (bitte um genauere erklärung) ?

das ist jetzt das ergebnis nach combofix...
2007-09-10 21:30 <DIR> d-------- C:\Programme\Lavasoft
2007-09-10 21:30 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Lavasoft
2007-09-10 21:29 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2007-09-10 21:20 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Spybot - Search & Destroy
2007-09-10 21:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-09-10 20:42 <DIR> dr-h----- C:\DOKUME~1\ADMINI~1\Anwendungsdaten
2007-09-10 20:42 <DIR> dr------- C:\DOKUME~1\ADMINI~1\Startmen�
2007-09-10 20:42 <DIR> dr------- C:\DOKUME~1\ADMINI~1\Favoriten
2007-09-10 20:42 <DIR> dr------- C:\DOKUME~1\ADMINI~1\Eigene Dateien
2007-09-10 20:42 <DIR> d--h----- C:\DOKUME~1\ADMINI~1\Vorlagen
2007-09-10 20:42 <DIR> d--h----- C:\DOKUME~1\ADMINI~1\Netzwerkumgebung
2007-09-10 20:42 <DIR> d--h----- C:\DOKUME~1\ADMINI~1\Lokale Einstellungen
2007-09-10 20:42 <DIR> d--h----- C:\DOKUME~1\ADMINI~1\Druckumgebung
2007-09-10 20:42 <DIR> d---s---- C:\DOKUME~1\ADMINI~1\UserData
2007-09-10 20:42 <DIR> d-------- C:\DOKUME~1\ADMINI~1\WINDOWS
2007-09-10 20:42 <DIR> d-------- C:\DOKUME~1\ADMINI~1\ANWEND~1\You've Got Pictures Screensaver
2007-09-10 20:42 <DIR> d-------- C:\DOKUME~1\ADMINI~1\ANWEND~1\Real
2007-09-10 20:42 <DIR> d-------- C:\DOKUME~1\ADMINI~1\ANWEND~1\CyberLink
2007-09-10 20:42 <DIR> d-------- C:\DOKUME~1\ADMINI~1\ANWEND~1\AOL
2007-09-10 20:33 <DIR> d-------- C:\Programme\CCleaner
2007-09-10 19:18 <DIR> d-------- C:\VundoFix Backups
2007-09-10 18:52 <DIR> d-a------ C:\WINDOWS\zts2.exe
2007-09-10 18:52 <DIR> d-a------ C:\WINDOWS\system32\vcmgcd32.dll
2007-09-10 18:52 <DIR> d-a------ C:\WINDOWS\system32\iifgfgf.dll
2007-09-10 18:52 <DIR> d-a------ C:\WINDOWS\rundll16.exe
2007-09-10 18:52 <DIR> d-a------ C:\WINDOWS\rundl132.dll
2007-09-10 18:52 <DIR> d-a------ C:\WINDOWS\logo1_.exe
2007-09-10 18:49 153,600 --a------ C:\WINDOWS\R.COM
2007-09-10 18:49 140,800 --a------ C:\WINDOWS\system32\T.COM
2007-09-10 17:38 <DIR> d-------- C:\Programme\Trend Micro
2007-09-09 21:03 <DIR> d-------- C:\Programme\Avira
2007-09-09 21:03 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Avira
2007-09-08 18:38 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Comodo
2007-09-08 18:03 <DIR> d-------- C:\Programme\Alwil Software
2007-09-07 21:45 <DIR> d-a------ C:\DOKUME~1\ALLUSE~1\ANWEND~1\TEMP
2007-09-07 21:45 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Escape From Paradise
2007-09-02 12:46 <DIR> d-------- C:\Programme\HP DeskJet 690C Series
2007-09-01 14:44 <DIR> d-------- C:\DOKUME~1\FRDRIC~1\Shared
2007-09-01 14:44 <DIR> d-------- C:\DOKUME~1\FRDRIC~1\Incomplete
2007-08-31 19:32 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\AntiVir PersonalEdition Classic
2007-08-31 19:18 17,222,360 --a------ C:\Programme\antivir_workstation_win704u_de_h.exe
2007-08-21 14:29 <DIR> d-------- C:\Programme\MSXML 4.0

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-11 18:15 17408 --a------ C:\WINDOWS\system32\drivers\USBCRFT.SYS
2007-09-10 21:13 --------- d-------- C:\Programme\ICQToolbar
2007-09-05 20:40 --------- d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Skype
2007-09-01 14:58 --------- d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\QuickTime
2007-08-21 15:37 --------- d-------- C:\Programme\ICQ6
2007-08-07 13:58 8320 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-08-07 13:56 9344 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys
2007-08-04 16:12 --------- d-------- C:\Programme\Windows Media Components
2007-08-04 00:10 5541 --a------ C:\Programme\musicmaker.ini
2007-08-04 00:10 --------- d-------- C:\Programme\My Record
2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll
2007-07-25 23:15 --------- d-------- C:\Programme\My Audio Video
2007-07-20 21:56 --------- d-------- C:\Programme\Visuals
2007-07-19 17:54 --------- d-------- C:\Programme\VideoEffects
2007-07-19 17:54 --------- d-------- C:\Programme\AudioEffects
2007-07-19 17:54 --------- d-------- C:\Programme\3DAudio
2007-07-19 17:51 63 --a------ C:\Programme\check.ini
2007-07-19 17:51 489 --a------ C:\Programme\INSTALL1.LOG
2007-07-19 17:51 4500 --a------ C:\Programme\e-mode-mgxstart.ini
2007-07-19 17:51 437 --a------ C:\Programme\unwise.ini
2007-07-19 17:51 4335 --a------ C:\Programme\e-mode.ini
2007-07-19 17:51 211709 --a------ C:\Programme\INSTALL.LOG
2007-07-19 17:51 157 --a------ C:\Programme\Validation.ini
2007-07-19 17:51 14870 --a------ C:\Programme\register.rtf
2007-07-19 17:51 --------- d-------- C:\Programme\Tutorials
2007-07-19 17:51 --------- d-------- C:\Programme\Icons
2007-07-19 17:51 --------- d-------- C:\Programme\Gemeinsame Dateien\MAGIX Shared
2007-07-19 17:51 --------- d-------- C:\Programme\Bitmaps
2007-07-19 17:50 --------- d-------- C:\Programme\RegModule
2007-07-19 17:50 --------- d-------- C:\Programme\RealDlls
2007-07-19 17:50 --------- d-------- C:\Programme\qmp2
2007-07-19 17:48 --------- d-------- C:\Programme\Medion
2007-07-19 01:05 2402087 --a------ C:\Audacity_Portable_1.2.6_R2.paf.exe
2007-07-12 22:44 --------- d--h----- C:\Programme\InstallShield Installation Information
2007-07-12 22:43 12451864 --a------ C:\install_pro7_icq6.exe
2007-07-11 14:37 6272 --a------ C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-07-06 18:34 108144 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2007-06-26 08:08 1104896 --a------ C:\WINDOWS\system32\msxml3.dll
2007-06-24 16:39 15732984 --a------ C:\Google_Earth_BZXW.exe
2007-06-19 15:31 282112 --a------ C:\WINDOWS\system32\gdi32.dll
2007-06-13 15:21 1036288 --a------ C:\WINDOWS\explorer.exe
2007-06-12 21:11 5976576 --a------ C:\Programme\icq5_1_german_setup3000.exe
2007-05-12 14:28 25842760 --a------ C:\Programme\wmp11-windowsxp-x86-DE-DE.exe
2005-01-05 14:12 4140682 --a------ C:\Programme\hrpjna01.W03
2005-01-05 14:12 29044736 --a------ C:\Programme\hrpjna01.W02
2005-01-05 14:12 29044736 --a------ C:\Programme\hrpjna01.dat
2004-12-17 11:31 3172 --a------ C:\Programme\unlock.rtf
2004-12-17 11:31 2640 --a------ C:\Programme\unlock_free.rtf
2004-12-13 16:48 8980 --a------ C:\Programme\license.txt
2004-12-10 13:46 13815 --a------ C:\Programme\order.rtf
2004-12-09 18:36 86016 --a------ C:\Programme\MagixOFA-ger.dll
2004-12-09 18:35 589824 --a------ C:\Programme\MagixOFA.dll
2004-12-07 15:24 2609768 --a------ C:\Programme\musicmaker.hlp
2004-12-07 15:23 3479 --a------ C:\Programme\musicmaker.cnt
2004-11-30 15:49 1241 --a------ C:\Programme\e-mode-upgradedlg-free.rtf
2004-11-30 15:46 4933 --a------ C:\Programme\e-mode-upgradedlg-OEM.rtf
2004-11-30 15:46 4933 --a------ C:\Programme\e-mode-upgradedlg-full.rtf
2004-11-30 11:58 188416 --a------ C:\Programme\mgxstart.exe
2004-11-22 11:19 8806400 --a------ C:\Programme\musicmaker.exe
2004-10-18 16:15 212992 --a------ C:\Programme\eModeUpgradeDlg.dll
2004-08-20 09:49 204800 --a------ C:\Programme\softupdate.exe
2004-08-18 10:38 17135 --a------ C:\Programme\support.rtf
2004-08-10 09:45 233472 --a------ C:\Programme\MXTLC.dll
2004-08-06 14:19 73076 --a------ C:\Programme\AMRencoder_upgrade.rtf
2004-05-18 10:48 139264 --a------ C:\Programme\unwise.exe
2004-04-15 14:48 32768 --a------ C:\Programme\MagixUpdater.exe
2004-03-17 17:23 147456 --a------ C:\Programme\instslct.exe
2003-10-20 10:29 49152 --a------ C:\Programme\MDLL32.DLL
2003-10-20 10:25 53248 --a------ C:\Programme\unwise.adf
2003-08-14 17:38 73112 --a------ C:\Programme\mp3encoder_upgrade.rtf
2003-05-21 16:22 28672 --a------ C:\Programme\Validation.exe
2003-04-03 10:09 49152 --a------ C:\Programme\CPUINF32.DLL
2003-02-20 07:51 28672 --a------ C:\Programme\HHWMPrxy.dll
2003-02-12 10:20 28672 --a------ C:\Programme\explore.exe
2002-08-22 09:30 10593 --a------ C:\Programme\soundpools.dat
2002-06-24 11:00 86016 --a------ C:\Programme\samsigPX.dll
2002-06-24 11:00 86016 --a------ C:\Programme\samsigP5.dll
2002-06-24 11:00 204800 --a------ C:\Programme\samsigW7.dll
2002-06-24 11:00 20480 --a------ C:\Programme\SAMSIG.DLL
2002-06-24 11:00 192512 --a------ C:\Programme\samsigA6.dll
2002-06-24 11:00 163840 --a------ C:\Programme\samsigM6.dll
2002-06-24 11:00 155648 --a------ C:\Programme\samsigM5.dll
2002-06-24 11:00 147456 --a------ C:\Programme\samsigP6.dll
2002-02-18 10:06 6034 --a------ C:\Programme\uninstall.ini
2001-08-30 16:29 122880 --a------ C:\Programme\HHWMPrxy7.dll
2001-08-04 16:29 204847 --a------ C:\Programme\tts.dll
2001-06-14 10:16 761856 --a------ C:\Programme\MumaIplW7.dll
2001-06-14 10:16 757760 --a------ C:\Programme\MumaIplA6.dll
2001-06-14 10:16 724992 --a------ C:\Programme\MumaIplM6.dll
2001-06-14 10:16 667648 --a------ C:\Programme\MumaIplPX.dll
2001-06-14 10:16 647168 --a------ C:\Programme\MumaIplP6.dll
2001-06-14 10:16 20480 --a------ C:\Programme\MumaIpl.dll
2001-05-10 16:26 638976 --a------ C:\Programme\PlayRIplPX.dll
2005-02-21 15:07:39 56 --sh--r C:\WINDOWS\system32\41D12D28A0.sys
2005-02-06 13:08:44 8 --sh--r C:\WINDOWS\system32\D5D86239B1.sys
2005-02-21 15:07:39 6,266 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot_2007-09-10_211038.09 )))))))))))))))))))))))))))))))))))))))))
.
----a-w 7,680 2007-04-13 13:19:52 C:\WINDOWS\system32\lsdelete.exe
----atw 16,384 2007-09-10 19:32:37 C:\WINDOWS\temp\Perflib_Perfdata_3a9c.dat
.
.
(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.

*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-01-12 22:05]
"Dit"="Dit.exe" [2004-07-20 19:18 C:\WINDOWS\Dit.exe]
"Cmaudio"="cmicnfg.cpl" []
"AGRSMMSG"="AGRSMMSG.exe" [2004-10-08 11:50 C:\WINDOWS\AGRSMMSG.exe]
"Keyboard Status"="C:\PROGRA~1\Medion\KeyStat\KeyStat.exe" [2005-01-25 12:03]
"LXSUPMON"="C:\WINDOWS\system32\LXSUPMON.exe" [2002-03-08 04:02]
"avgnt"="C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-08-31 12:25]
"QuickTime Task"="C:\Programme\QuickTime\qttask.exe" [2005-02-06 14:52]
"PCMService"="C:\Programme\Home Cinema\PowerCinema\PCMService.exe" [2005-02-21 19:08]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50]
"LVCOMSX"="C:\Programme\Gemeinsame Dateien\Logitech\LComMgr\LVComSX.exe" [2006-06-26 10:33]
"LogitechQuickCamRibbon"="C:\Programme\Logitech\QuickCam10\QuickCam10.exe" [2006-06-26 10:34]
"LogitechCommunicationsManager"="C:\Programme\Gemeinsame Dateien\Logitech\LComMgr\Communications_Helper.exe" [2006-06-26 09:46]
"Adobe Reader Speed Launcher"="C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"Adobe Photo Downloader"="C:\Programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-16 11:45]
"AAWTray"="C:\Programme\Lavasoft\Ad-Aware 2007\AAWTray.exe" [2007-08-08 15:53]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Programme\MSN Messenger\msnmsgr.exe" [2007-01-19 13:55]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00]
"LDM"="C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-06-05 16:48]
"WMPNSCFG"="C:\Programme\Windows Media Player\WMPNSCFG.exe" [2006-11-03 09:56]
"SpybotSD TeaTimer"="C:\Programme\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]

C:\DOKUME~1\ALLUSE~1\STARTM~1\PROGRA~1\AUTOST~1\
BlueSoleil.lnk - C:\Programme\IVT Corporation\BlueSoleil\BlueSoleil.exe [2005-02-21 15:46:21]
Logitech Desktop Messenger.lnk - C:\Programme\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2007-06-05 16:48:17]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AOL ACS"=2 (0x2)

R2 HPFECP16;HPFECP16;C:\WINDOWS\system32\drivers\HPFECP16.SYS
R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys
R3 cmudax;C-Media High Definition Audio Interface;C:\WINDOWS\system32\drivers\cmudax.sys
R3 wbscr;Winbond Smartcard Reader for I/O;C:\WINDOWS\system32\drivers\wbscr.sys
R3 XUIF;X10 USB Wireless Transceiver;C:\WINDOWS\system32\Drivers\x10ufx2.sys
S3 BTNetFilter;Bluetooth Network Filter;\??\C:\WINDOWS\system32\drivers\BTNetFilter.sys
S3 CardReaderFilter;Card Reader Filter;\??\C:\WINDOWS\system32\Drivers\USBCRFT.SYS
S3 NTSIM;NTSIM;\??\C:\WINDOWS\system32\ntsim.sys


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0f039ae1-8468-11d9-8a72-001109df9636}]
AutoRun\command- L:\OEMBranding.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{176ebe7a-8522-11d9-8a7e-001109df94c7}]
AutoRun\command- K:\OEMBranding.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b60dc10a-85ba-11d9-8a81-001109df94c7}]
AutoRun\command- L:\OEMBranding.exe

.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-11 18:21:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-11 18:22:24
C:\ComboFix-quarantined-files.txt ... 2007-09-11 18:22
C:\ComboFix2.txt ... 2007-09-10 21:10
.

Hallo Derf.

Dein Rechner ist so dermaßen verseucht mit einem Mix aus Sality-Virus, Trojan-Downloadern und Maleware, dass ich eine Bereinigung nicht empfehlen kann. a) würde diese sehr viel Zeit in Anspruch nehmen und b) könnte dein System nie wieder als vertrauenswürdig eingestuft werden.. Den Mist hast du dir wahrscheinlich über P2P FileSharing eingezogen.

Einer der Schädlinge besitzt Keylogger Funktionen. Du solltest d.h. alle Accounts die du seit dem 10.Sep. benutzt hast als ausspioniert ansehen und die Zugangsdaten von einem anderen Rechner aus ändern!

Wir können eine Bereinigung versuchen aber das wird lange dauern und nerven..

Wenn du dich für die sichere Methode entscheidest findest du einen Link zum Neuaufsetzten in meiner Signatur.

Gruß

Undoreal

so ich habe jetzt mal eine Neuinstallation von windows vorgenommen hat es was geholfen ? Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:33:01, on 13.09.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLDial.exe
C:\PROGRA~1\Medion\KeyStat\KeyStat.exe
C:\Programme\Home Cinema\PowerCinema\PCMService.exe
C:\PROGRA~1\CA\ETRUST~1\realmon.exe
C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLacsd.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Programme\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Programme\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Programme\CA\eTrust Antivirus\InoRpc.exe
C:\Programme\CA\eTrust Antivirus\InoRT.exe
C:\Programme\CA\eTrust Antivirus\InoTask.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Programme\MSN Messenger\msnmsgr.exe
C:\Programme\MSN Messenger\usnsvc.exe
C:\Programme\ICQ6\ICQ.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\Windows Media Player\wmplayer.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [Keyboard Status] C:\PROGRA~1\Medion\KeyStat\KeyStat.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AntivirusRegistration] c:\programme\antivirus offer\etrust antivirus registration\EzAntivirusRegistrationCheck.exe
O4 - HKLM\..\Run: [PCMService] "C:\Programme\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [AOLMIcon] C:\Programme\Gemeinsame Dateien\AOLSHARE\AOLMIcon.exe
O4 - HKCU\..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BlueSoleil.lnk = C:\Programme\IVT Corporation\BlueSoleil\BlueSoleil.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Programme\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com/
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1106843944468
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CC32E40C-7D6A-4C7B-8C3B-8923F7D8B79E}: NameServer = 89.27.130.33 89.27.130.34
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\GEMEIN~1\aol\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Programme\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Programme\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Programme\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Programme\CA\eTrust Antivirus\InoTask.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 8851 bytes
erf

Hast du nach der Anleitung in meiner Signatur neuaufgesetzt? Dann ist dein Rechner auf jeden Fall clean!

mfg

Undoreal