Bitte mal meine Logfile anschauen!
 

Hi! Ich habe ein Problem! Mein Antivirenprogramm schreibt immer eine Warnung über das Trojanische Pferd TR/Exploit.MS05-002.Ani.A. Jetzt habe ich mir HijackThis runtergeladen und weiß nicht, was ich reparieren kann und was nicht! Hoffe, dass ihr mir helfen könnt, weil ich ihn wegbekommen möchte! Danke im Voraus!

Hier mein Logfile:

Logfile of HijackThis v1.99.1
Scan saved at 21:11:05, on 19.05.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\tlntsvr.exe
C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Scan Server\bdss.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Microsoft AntiSpyware\gcasServ.exe
C:\Programme\MSN Apps\Updater\01.02.3000.1001\de-at\msnappau.exe
C:\WINDOWS\system32\mshta.exe
C:\Programme\Microsoft AntiSpyware\gcasDtServ.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
C:\Programme\ICQLite\ICQLite.exe
C:\Programme\AVPersonal\GUARDGUI.EXE
C:\PROGRA~1\Softwin\BITDEF~1\bdlite.exe
C:\Programme\AVPersonal\GUARDGUI.EXE
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Programme\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchAssistant = http://specific911.com/_start/
R1 - HKCU\Software\Microsoft\Internet Explorer,CustomizeSearch = http://specific911.com/_start/
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://specific911.com/_start/
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://specific911.com/_start/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.at
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.at
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.at
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.at
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {C0B6C5F3-C5FC-DCC2-FD6D-1F16A65205BA} - C:\WINDOWS\atliv32.dll (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\MSN Apps\MSN Toolbar\01.02.4000.1001\de\msntb.dll (file missing)
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O4 - HKLM\..\Run: [gcasServ] "C:\Programme\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [msnappau] "C:\Programme\MSN Apps\Updater\01.02.3000.1001\de-at\msnappau.exe"
O4 - HKLM\..\Run: [IEXPLORE.EXE] C:\Programme\Internet Explorer\IEXPLORE.EXE
O4 - HKLM\..\Run: [SystemBoot] mshta file:///C:/WINDOWS/winsys.hta
O4 - HKLM\..\Run: [RunOnce] C:\y.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
O4 - HKLM\..\Run: [BDNewsAgent] C:\Programme\Softwin\BitDefender Free Edition\bdnagent.exe
O4 - HKLM\..\Run: [AVSCHED32] C:\Programme\AVPersonal\AVSCHED32.EXE /min
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: ICQ 4.1.lnk = C:\Programme\ICQLite\ICQLite.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: MSN Messenger 6.2.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O12 - Plugin for .pdf: C:\Programme\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {53B8B406-42E4-4DD3-96E7-9DEC8CEB3DD8} (ICQVideoControl Class) - http://xtraz.icq.com/xtraz/activex/ICQVideoControl.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {8FA9D107-547B-4DBC-9D88-FABD891EDB0A} (shizmoo Class) - http://playroom.icq.com/odyssey_web11.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary...o.cab32846.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {FB48C7B0-EB66-4BE6-A1C5-9DDF3C37249A} (MCSendMessageHandler Class) - http://xtraz.icq.com/xtraz/activex/MISBH.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{098DF293-7FD9-4BC7-B96E-42F5DE8B115B}: NameServer = 130.244.127.161 130.244.127.169
O17 - HKLM\System\CCS\Services\Tcpip\..\{48689B9D-C0A3-4588-A1E8-C4A19F37D256}: NameServer = 195.202.128.2,195.202.128.3
O17 - HKLM\System\CS1\Services\Tcpip\..\{098DF293-7FD9-4BC7-B96E-42F5DE8B115B}: NameServer = 130.244.127.161 130.244.127.169
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\mfchf.exe (file missing)
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: CWShredder Service - InterMute, Inc. - c:\program files\InterMute\SpySubtract\CWShredder.exe
O23 - Service: Intel PDS - Unknown owner - C:\WINDOWS\system32\cba\pds.exe (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Programme\Gemeinsame

Hallo Dori,

nimm eine Datenträgerbereinigung vor (z.B. "Start-->auführen--> cleanmgr eingeben), leere den Quarantäne-Odner Deiner Antivir-Programme und
führe bitte eScan aus, halte Dich genau an die Anleitung und poste das Logfile wie unter [5] beschrieben.

dartus

P.S. eine Antivir-Guard reicht, mehrere behindern sich und bremsen das System aus.