Verschiedene Viren.. u.a. IE öffnet Werbung

--dennis--

Hallo,
ich will den PC von eienr guten Freundin von Viren befreien, IE öffnet einfach werbung, Firefox lädt nicht alles.. alles is extram lahm.. sie hatte nichtmal ein Antivirusprogramm auf dem PC.. sie hat jetzt Antivir und es wurde einiges gelöscht aber ein paar Viren krieg ich nicht weg.. hab leider net soviel Ahnung darum hoffe ich auf eine detailierte Lösung.. danke im vorraus =)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:05:47, on 12.08.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 SP2 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\JANINE\System32\smss.exe
C:\WINDOWS\JANINE\system32\winlogon.exe
C:\WINDOWS\JANINE\system32\services.exe
C:\WINDOWS\JANINE\system32\lsass.exe
C:\WINDOWS\JANINE\system32\svchost.exe
C:\WINDOWS\JANINE\System32\svchost.exe
C:\WINDOWS\JANINE\system32\LEXBCES.EXE
C:\WINDOWS\JANINE\system32\spoolsv.exe
C:\WINDOWS\JANINE\system32\LEXPPS.EXE
C:\Programme\Bonjour\mDNSResponder.exe
C:\WINDOWS\JANINE\system32\cisvc.exe
C:\WINDOWS\JANINE\SmFuaW5l\command.exe
C:\Programme\LogMeIn\x86\RaMaint.exe
C:\Programme\LogMeIn\x86\LogMeIn.exe
C:\Programme\LogMeIn\x86\LMIGuardian.exe
C:\Programme\Microsoft LifeCam\MSCamS32.exe
C:\Programme\Network Monitor\netmon.exe
C:\WINDOWS\JANINE\system32\nvsvc32.exe
C:\Programme\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\JANINE\system32\svchost.exe
C:\WINDOWS\JANINE\system32\wscntfy.exe
C:\WINDOWS\JANINE\explorer.exe
C:\WINDOWS\JANINE\SPOOLSV.EXE
C:\Programme\Gemeinsame Dateien\Ulead Systems\AutoDetector\monitor.exe
C:\windows\janine\system32\spywinclean.exe
C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
C:\Programme\QuickTime\QTTask.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\WINDOWS\JANINE\mrofinu572.exe
C:\WINDOWS\JANINE\vVX1000.exe
C:\Programme\LogMeIn\x86\LogMeInSystray.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\WINDOWS\JANINE\system32\Rundll32.exe
C:\DOKUME~1\Jani\ANWEND~1\WNSXS~1\explorer.exe
C:\Dokumente und Einstellungen\Jani\Anwendungsdaten\SpeedRunner\SpeedRunner.exe
C:\Dokumente und Einstellungen\Jani\Anwendungsdaten\Microsoft\Windows\lyxst.exe
C:\Programme\LogMeIn\x86\LMIGuardian.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\iPod\bin\iPodService.exe
C:\Dokumente und Einstellungen\Jani\Anwendungsdaten\?asks\w?wexec.exe
C:\Programme\Sakora\Sakora.exe
C:\Programme\Beepworld Surveyreminder\surveyreminder.exe
C:\WINDOWS\JANINE\system32\cidaemon.exe
C:\Programme\MSN Messenger\usnsvc.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\WINDOWS\JANINE\System32\Rundll32.exe
C:\Programme\LogMeIn\x86\LogMeIn.exe
C:\Programme\LogMeIn\x86\LMIGuardian.exe
C:\WINDOWS\JANINE\system32\notepad.exe
C:\Programme\MSN Messenger\msnmsgr.exe
C:\WINDOWS\JANINE\system32\rsvp.exe
C:\Programme\Safari\Safari.exe
C:\Dokumente und Einstellungen\Jani\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearshare.com/sidebar.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.arcor.de
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.arcor.de
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.arcor.de
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.arcor.de
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.arcor.de
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = *janine+BuraK*
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: {1A03F196-9617-4CA0-842B-A83CEECB022B} - - (no file)
F2 - REG:system.ini: Shell=explorer.exe C:\WINDOWS\JANINE\SPOOLSV.EXE
F2 - REG:system.ini: UserInit=C:\WINDOWS\JANINE\system32\userinit.exe,C:\WINDOWS\JANINE\system32\ntos.exe,
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - (no file)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file)
O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Programme\Dealio\kb102\Dealio.dll
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Programme\Gemeinsame Dateien\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [SpyClean] c:\windows\janine\system32\spywinclean.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\JANINE\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [RemoteControl] C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [LanguageShortcut] C:\Programme\CyberLink\PowerDVD\Language\Language.exe
O4 - HKLM\..\Run: [Power Scan] C:\Programme\Power Scan\powerscan.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\JANINE\mrofinu572.exe 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C88332017491394662E901F3D2933202228B284662E901F3D29332022288670A26F362E9AEE45B6C46E45F351E8360 9DBBFD577E6FD967002BA754E6C5813C477ACE
O4 - HKLM\..\Run: [LifeCam] "C:\Programme\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\JANINE\vVX1000.exe
O4 - HKLM\..\Run: [bend logo clock film] C:\Dokumente und Einstellungen\All Users.JANINE\Anwendungsdaten\Frag great bend logo\Test Seek.exe
O4 - HKLM\..\Run: [{88a8ff9f-fb79-bb73-8a35-eda82a61d2d6}] C:\WINDOWS\JANINE\System32\Rundll32.exe "C:\WINDOWS\JANINE\system32\rkohtvinxjjspfzam.dll" DllStart
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Programme\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [BM1f182cd4] Rundll32.exe "C:\WINDOWS\JANINE\system32\ljnuiwci.dll",s
O4 - HKLM\..\RunOnce: [SVCHOST] C:\WINDOWS\JANINE\SPOOLSV.EXE Load
O4 - HKCU\..\Run: [userinit] C:\WINDOWS\JANINE\system32\ntos.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [slide.exe] C:\Programme\Slide\Slide.exe
O4 - HKCU\..\Run: [AdobeUpdater] C:\Programme\Gemeinsame Dateien\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [Nwla] "C:\DOKUME~1\Jani\ANWEND~1\WNSXS~1\explorer.exe" -vt yazb
O4 - HKCU\..\Run: [Htbkv] "C:\Dokumente und Einstellungen\Jani\Eigene Dateien\F?nts\i?xplore.exe"
O4 - HKCU\..\Run: [SpeedRunner] C:\Dokumente und Einstellungen\Jani\Anwendungsdaten\SpeedRunner\SpeedRunner.exe
O4 - HKCU\..\Run: [SfKg6wIP] C:\Dokumente und Einstellungen\Jani\Anwendungsdaten\Microsoft\Windows\lyxst.exe
O4 - HKCU\..\Run: [Gkduwad] "C:\Dokumente und Einstellungen\Jani\Anwendungsdaten\?ppPatch\r?ndll32.exe"
O4 - HKCU\..\Run: [Vishekkj] C:\WINDOWS\JANINE\?ymbols\w?crtupd.exe
O4 - HKCU\..\Run: [Cuna] C:\WINDOWS\JANINE\?ssembly\w?wexec.exe
O4 - HKCU\..\Run: [Vgb] C:\WINDOWS\JANINE\system32\s?curity\w?aclt.exe
O4 - HKCU\..\Run: [Hjoveb] C:\WINDOWS\JANINE\system32\?ssembly\?vchost.exe
O4 - HKCU\..\Run: [Once part] C:\DOKUME~1\Jani\ANWEND~1\BODY2C~1\Funk hope face.exe
O4 - HKCU\..\Run: [Dzew] "C:\Dokumente und Einstellungen\Jani\Anwendungsdaten\??stem32\r?gedit.exe"
O4 - HKCU\..\Run: [Pdgbad] "C:\Dokumente und Einstellungen\Jani\Eigene Dateien\?icrosoft.NET\w?aclt.exe"
O4 - HKCU\..\Run: [Afdt] "C:\Dokumente und Einstellungen\Jani\Anwendungsdaten\??curity\n?tepad.exe"
O4 - HKCU\..\Run: [Hqwgw] C:\WINDOWS\JANINE\system32\?racle\?vchost.exe
O4 - HKCU\..\Run: [Gjmecs] C:\WINDOWS\JANINE\??crosoft\m?config.exe
O4 - HKCU\..\Run: [Iib] "C:\Dokumente und Einstellungen\Jani\Anwendungsdaten\?asks\w?wexec.exe"
O4 - HKCU\..\Run: [Sakora] C:\Programme\Sakora\Sakora.exe
O4 - HKCU\..\Run: [ICQ] "C:\Programme\ICQ6\ICQ.exe" silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\JANINE\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\JANINE\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\JANINE\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\JANINE\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Beepworld Surveyreminder.lnk = C:\Programme\Beepworld Surveyreminder\surveyreminder.exe
O4 - Startup: fdfdfdfdgffhkkilop.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Programme\MP3 Player Utilities 3.74\AMVConverter\grab.html
O8 - Extra context menu item: Add to AMV Converter... - C:\Programme\MP3 Player Utilities 4.04\AMVConverter\grab.html
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Programme\Dealio\kb102\res\DealioSearch.html
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Programme\MP3 Player Utilities 3.74\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Programme\Bonjour\ExplorerPlugin.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Programme\Dealio\kb102\Dealio.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\janine\system32\nwprovau.dll
O10 - Unknown file in Winsock LSP: rsvp32_2.dll
O10 - Unknown file in Winsock LSP: rsvp32_2.dll
O10 - Unknown file in Winsock LSP: rsvp32_2.dll
O10 - Unknown file in Winsock LSP: rsvp32_2.dll
O10 - Unknown file in Winsock LSP: rsvp32_2.dll
O10 - Unknown file in Winsock LSP: rsvp32_2.dll
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Unknown file in Winsock LSP: rsvp32_2.dll
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Fun Web Products Installer Start) - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.15.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game07.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {DA511858-B44C-439E-A0EA-704ED20035E7} (EphoxEditLive4.EditLive) - http://www.beepworld.de/hp/activexeditor/editlive4.cab
O16 - DPF: {E55FD215-A32E-43FE-A777-A7E8F165F551} (Flatcast Viewer 4.15) - http://data.flatcast.com/NpFv415.dll
O20 - AppInit_DLLs: C:\WINDOWS\JANINE\system32\msqrzqr.dll
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe (file missing)
O23 - Service: Symantec Network Proxy (ccProxy) - Unknown owner - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccProxy.exe (file missing)
O23 - Service: Symantec Password Validation (ccPwdSvc) - Unknown owner - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe (file missing)
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\JANINE\SmFuaW5l\command.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: IS Service (ISSVC) - Unknown owner - C:\Programme\Norton Internet Security\ISSVC.exe (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\JANINE\system32\LEXBCES.EXE
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Programme\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Programme\LogMeIn\x86\LogMeIn.exe
O23 - Service: Norton AntiVirus Auto-Protect-Dienst (navapsvc) - Unknown owner - C:\Programme\Norton Internet Security\Norton AntiVirus\navapsvc.exe (file missing)
O23 - Service: Network Monitor - Unknown owner - C:\Programme\Network Monitor\netmon.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\JANINE\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Programme\CyberLink\Shared files\RichVideo.exe
O23 - Service: SAVScan - Unknown owner - C:\Programme\Norton Internet Security\Norton AntiVirus\SAVScan.exe (file missing)
O23 - Service: ScriptBlocking Service (SBService) - Unknown owner - C:\PROGRA~1\GEMEIN~1\SYMANT~1\SCRIPT~1\SBServ.exe (file missing)
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\JANINE\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe (file missing)
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Unknown owner - C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe (file missing)
O24 - Desktop Component 0: (no name) - http://www.bravo.de/online/bildDB/10117_485.jpg

--
End of file - 14295 bytes