Bin ich sauber?
 

Hallo bin neu aber voll mit??????????
Bitte schaut ihr euch das an:
Danke!
Logfile of HijackThis v1.99.1
Scan saved at 09:56:02, on 10.03.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\spoolsv.exe
G:\WINDOWS\Explorer.EXE
D:\XP Programme\AVPersonal\AVGUARD.EXE
D:\XP Programme\AVPersonal\AVWUPSRV.EXE
G:\WINDOWS\System32\GEARSec.exe
G:\WINDOWS\System32\nvsvc32.exe
G:\WINDOWS\System32\oodag.exe
G:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe
G:\Programme\HHVcdV6Sys\VC6SecS.exe
G:\WINDOWS\system32\sstray.exe
D:\XPPROG~1\HotKeys\Ikeymain.exe
D:\XP Programme\DU Meter\DUMeter.exe
D:\XP Programme\NetPumper\NetPumperIEProxy.exe
G:\WINDOWS\system32\rundll32.exe
G:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
D:\XP Programme\AVPersonal\AVGNT.EXE
G:\WINDOWS\system32\RUNDLL32.EXE
D:\XP Programme\HDD Health\hddhealth.exe
D:\XP Programme\FlashSwitch\FlashSw.exe
G:\Dokumente und Einstellungen\RL.RL-7WCSJFOWRLZP\Desktop\salt-water Leecher.exe
G:\Programme\Internet Explorer\iexplore.exe
G:\Programme\Internet Explorer\iexplore.exe
G:\Programme\Internet Explorer\iexplore.exe
D:\XP Programme\FlashGet\flashget.exe
D:\XPPROG~1\NETPUM~1\NETPUM~1.EXE
C:\Downloads\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\XP Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: MyBHO Class - {46B9D770-1B7D-45D1-81B4-AC07B2F127EF} - D:\XPPROG~1\FLASHS~1\FlashBHO.dll
O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - G:\Programme\NewDotNet\newdotnet6_38.dll
O2 - BHO: (no name) - {535D815B-CCCC-DF05-1FA0-3EB36CC0706E} - G:\WINDOWS\system32\jopeuot.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\XPPROG~1\FLASHGET\jccatch.dll
O2 - BHO: (no name) - {F2A4407B-FFBC-4A1F-A18A-0F68C3E0FC9E} - G:\WINDOWS\system32\lemiai.dll (file missing)
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\XPPROG~1\FLASHGET\fgiebar.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - D:\XP Programme\Roboform\RoboForm.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE G:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [iKeyWorks] D:\XPPROG~1\HotKeys\Ikeymain.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [DU Meter] D:\XP Programme\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [NetPumper] "D:\XP Programme\NetPumper\NetPumperIEProxy.exe"
O4 - HKLM\..\Run: [New.net Startup] rundll32 G:\PROGRA~2\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup -s
O4 - HKLM\..\Run: [TkBellExe] "G:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVGCtrl] D:\XP Programme\AVPersonal\AVGNT.EXE /min
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE G:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [HDDHealth] D:\XP Programme\HDD Health\hddhealth.exe -wl
O4 - HKCU\..\RunOnce: [ICQ Lite] D:\XP Programme\ICQLite\ICQLite.exe -trayboot
O4 - Startup: FlashSwitch.lnk = D:\XP Programme\FlashSwitch\FlashSw.exe
O8 - Extra context menu item: &NeoTrace It! - D:\PROGRA~1\NEOTRA~1\NTXcontext.htm
O8 - Extra context menu item: Alles mit FlashGet laden - D:\XP Programme\FlashGet\jc_all.htm
O8 - Extra context menu item: Allow Popups - D:\XP Programme\Popup Ad Filter\WhiteGetUrl.js
O8 - Extra context menu item: Download with NetPumper - D:\XP Programme\NetPumper\AddUrl.htm
O8 - Extra context menu item: Mit FlashGet laden - D:\XP Programme\FlashGet\jc_link.htm
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://D:\XPPROG~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: RF - &Formular speichern - file://D:\XP Programme\Roboform\RoboFormComSavePass.html
O8 - Extra context menu item: RF - &Identitäten - file://D:\XP Programme\Roboform\RoboFormComEditIdent.html
O8 - Extra context menu item: RF - &PassCards - file://D:\XP Programme\Roboform\RoboFormComEditPass.html
O8 - Extra context menu item: RF - Formular ausf&üllen - file://D:\XP Programme\Roboform\RoboFormComFillForms.html
O9 - Extra button: Ausfüllen - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\XP Programme\Roboform\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: RF - Formular ausf&üllen - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\XP Programme\Roboform\RoboFormComFillForms.html
O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\XP Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\XP Programme\ICQLite\ICQLite.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\XPPROG~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\XPPROG~1\FLASHGET\flashget.exe
O9 - Extra button: NeoTrace It! - {9885224C-1217-4c5f-83C2-00002E6CEF2B} - D:\PROGRA~1\NEOTRA~1\NTXtoolbar.htm (HKCU)
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O16 - DPF: {3AF4DACE-36ED-42EF-9DFC-ADC34DA30CFF} (PatchInstaller.Installer) - file://I:\content\include\XPPatchInstaller.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1108464621390
O16 - DPF: {F49DA492-7B88-463F-B389-CA9A02F6DA76} - http://www.seagate.com/support/disc/...npseatools.cab
O16 - DPF: {FCF289D4-0AC8-4ED8-BE31-E8AF09606AB5} (download_35mb_com.applet) - http://download.35mb.com/images/downloadapplet.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9EB28576-4826-48B9-87FD-4BA4F59C0AB0}: NameServer = 195.3.96.67 195.3.96.68
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - D:\XP Programme\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - D:\XP Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: GEARSecurity - GEAR Software - G:\WINDOWS\System32\GEARSec.exe
O23 - Service: NetMeeting-Remotedesktop-Freigabe (mnmsrvc) - Unknown owner - G:\WINDOWS\System32\mnmsrvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - G:\WINDOWS\System32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - G:\WINDOWS\System32\oodag.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Unknown owner - D:\XPPROG~1\OUTPOS~1.0\outpost.exe (file missing)
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - G:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: Virtual CD v6 Management Service (VC6SecS) - H+H Software GmbH - G:\Programme\HHVcdV6Sys\VC6SecS.exe

Nun, nein...

O2 - BHO: (no name) - {F2A4407B-FFBC-4A1F-A18A-0F68C3E0FC9E} - G:\WINDOWS\system32\lemiai.dll (file missing)

O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net

um ein paar weitere nette Dinge zu erwähnen, bitte mit eScan brav Dein System scannen und Log hier posten....

vvvvvvvvvvv Lies mich ich bin eine Signatur vvvvvvvvvv

Also BÖSE IST:

O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - G:\Programme\NewDotNet\newdotnet6_38.dll

O4 - HKLM\..\Run: [New.net Startup] rundll32 G:\PROGRA~2\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup -s

O10 - Hijacked Internet access by New.Net (4 mal)

das sind BÖSe dateien :) :)

Und wie wär´s mal mit ner Anweisung, wie man New.Net wegbringt?

@Superfast:
also, zuerst LSP-Fix runterladen, im abgesicherten Modus laufen lassen und damit die Winsocks reparieren.
Dann erst mit HJT die Bösen fixen.
Warum?
Weil New.Net die Winsocks zerstören kann und nach dem einfachen "Fixen" plötzlich keine I-Net-Verbindung mehr hergestellt werden kann...und dann?

cacatoa