Trojaner-Board - Bitte Mal Logfile betrachten

Hallo Leute
Nachdem ich seit Tagen bemüht bin mein System zu säubern habe ich als letzte Maßnahme auch noch Hijack laufen lassen. Hier mein Logfile, mit Bitte um Rat.
Gruß
Rainer

Logfile of HijackThis v1.99.1
Scan saved at 11:04:03, on 09.07.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Programme\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Programme\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\Programme\Norton AntiVirus\navapsvc.exe
C:\Programme\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SCARDS32.EXE
C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Programme\Home Cinema\PowerCinema\PCMService.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
F:\install\Smaller Note\note.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Programme\Logitech\MouseWare\System\em_exec.exe
C:\Tools\Spybot - Search & Destroy\SpybotSD.exe
C:\Tools\totalcmd\TOTALCMD.EXE
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Programme\Messenger\msmsgs.exe
C:\DOKUME~1\Rainer\LOKALE~1\Temp\Temporäres Verzeichnis 1 für hijackthis_199.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.medion.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gswcom.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.aldi.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Tools\SPYBOT~1\SDHelper.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\Tools\FlashGet\jccatch.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar2.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Tools\FlashGet\fgiebar.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Keyboard Status] C:\PROGRA~1\Medion\KeyStat\KeyStat.exe
O4 - HKLM\..\Run: [AntivirusRegistration] c:\programme\antivirus offer\etrust antivirus registration\EzAntivirusRegistrationCheck.exe
O4 - HKLM\..\Run: [PCMService] "C:\Programme\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [CloneCDTray] "C:\Programme\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programme\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [AOLMIcon] C:\Programme\Gemeinsame Dateien\AOLSHARE\AOLMIcon.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: A Smaller Note 99.lnk = F:\install\Smaller Note\note.exe
O4 - Startup: mwadvanced_deu.exe
O4 - Global Startup: BlueSoleil.lnk = C:\Programme\IVT Corporation\BlueSoleil\BlueSoleil.exe
O8 - Extra context menu item: &Google Search - res://c:\programme\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Alles mit FlashGet laden - C:\Tools\FlashGet\jc_all.htm
O8 - Extra context menu item: Im Cache gespeicherte Seite - res://c:\programme\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Mit FlashGet laden - C:\Tools\FlashGet\jc_link.htm
O8 - Extra context menu item: Verweisseiten - res://c:\programme\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Ähnliche Seiten - res://c:\programme\google\GoogleToolbar2.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Tools\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Tools\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com/
O16 - DPF: {4418DD4D-7265-4C32-BC0A-3FDB3C2DA938} (Protecter Class) - http://www.slotchbar.com/ist/softwar...ct_regular.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1106843944468
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Programme\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Norton AntiVirus Auto-Protect-Dienst (navapsvc) - Symantec Corporation - C:\Programme\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Programme\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programme\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\GEMEIN~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: CHIPDRIVE SCARD Service (TWKSCARDSRV) - SCM Microsystems - C:\WINDOWS\SCARDS32.EXE
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Wichtige Info vergessen:
Hatte zuletzt noch "switp.exe" vom System geschmissen und im Windowsverzeichnis die Dateien "swita.dat + switb.dat" gelöscht.

Mit E-scan anscheinend erstmal grausiges Ergebnis

Hier das Logfile

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Funde für "infected"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Sun Jul 10 08:48:50 2005 => System found infected with CWS.therealsearch Spyware/Adware (waol.exe)! Action taken: No Action Taken.
Sun Jul 10 09:58:14 2005 => File
Sun Jul 10 10:28:49 2005 => Total Disinfected Files: 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Funde für "tagged"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Sun Jul 10 08:58:02 2005 => File C:\Programme\eMule\Incoming\ADAware SE Pro 1.06+language Pack.rar tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 08:59:48 2005 => File C:\Programme\eMule\Incoming\FlashGet.v1.65.Incl.Keymaker-AGAiN.rar tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 08:59:50 2005 => File C:\Programme\eMule\Incoming\GameHouse Luxor + Crack By Tony Tango (2005).rar tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 09:00:45 2005 => File C:\Programme\eMule\Incoming\Moorhuhn_praesentiert_Hank_XXL-Vollversion.rar tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 09:00:45 2005 => File C:\Programme\eMule\Incoming\Pc Game - Pinball Pro Pinball - Timeshock (By Soopajud).rar tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 09:07:40 2005 => File C:\Programme\Medion\medionmusic_manager_gold\uninstall.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 09:07:44 2005 => File C:\Programme\Medion\medionmusic_Suite\uninstall.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 09:13:34 2005 => File C:\Programme\Musicmatch\Musicmatch Jukebox\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 09:13:51 2005 => File C:\Programme\Musicmatch\Musicmatch Update\MMJB\TDM\TDMInstall.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 09:13:56 2005 => File C:\Programme\Musicmatch\Musicmatch Update\TDM\TDMInstall.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 09:14:09 2005 => File C:\Programme\Norton AntiVirus\Quarantine\18C33847.vir tagged as "not-a-virus:AdWare.Atlas.e". Action Taken: No Action Taken.
Sun Jul 10 09:16:40 2005 => File C:\Tools\Lavasoft\Ad-Aware SE Professional\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 09:16:42 2005 => File C:\Tools\Lavasoft RegHance\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 09:34:36 2005 => File C:\WINDOWS\system32\Macromed\Shockwave 8\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 09:39:58 2005 => File D:\addon\programs\musicmaker.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 09:40:12 2005 => File D:\Tools\AOL\AOLSetup.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 09:41:17 2005 => File D:\Tools\Home Cinema\MusicMatch\Deu\MMSetup.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 09:41:19 2005 => File D:\Tools\Home Cinema\MusicMatch\Enu\MMSetup.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 09:41:26 2005 => File D:\Tools\Home Cinema\MusicMatch\Esp\MMSetup.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 09:41:34 2005 => File D:\Tools\Home Cinema\MusicMatch\Fra\MMSetup.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 09:41:43 2005 => File D:\Tools\Home Cinema\MusicMatch\Ita\MMSetup.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 09:43:39 2005 => File D:\Tools\Medion Music\setup.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 09:52:09 2005 => File F:\Datenbunker\Downloads\Firefox\fgf165.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 09:52:30 2005 => File F:\Datenbunker\Downloads\no1cdrip.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 09:52:46 2005 => File F:\Datenbunker\Downloads\software\bom2011_setup.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 09:52:48 2005 => File F:\Datenbunker\Downloads\software\fgf150.exe tagged as "not-a-virus:AdWare.Cydoor". Action Taken: No Action Taken.
Sun Jul 10 09:53:19 2005 => File F:\Datenbunker\incoming\Audiograbber 1.82 Multi Language + Keygen + Lame 3.93.1 + Fraunhofer IIS MP3.rar tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 09:53:20 2005 => File F:\Datenbunker\incoming\Audiograbber.v1.82.2.Multilingual.WinALL.Cracked-ViRiLiTY.[shared.via.Sharelive.com] [found via www.fileDonkey.com].rar tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 10:04:21 2005 => File F:\Downloads\fgf165.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 10:05:17 2005 => File F:\Incoming\ADAware SE Pro 1.06+language Pack.rar tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 10:06:57 2005 => File F:\Incoming\FlashGet.v1.65.Incl.Keymaker-AGAiN.rar tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 10:06:59 2005 => File F:\Incoming\GameHouse Luxor + Crack By Tony Tango (2005).rar tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 10:07:51 2005 => File F:\Incoming\Moorhuhn_praesentiert_Hank_XXL-Vollversion.rar tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 10:07:51 2005 => File F:\Incoming\Pc Game - Pinball Pro Pinball - Timeshock (By Soopajud).rar tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 10:08:21 2005 => File F:\install\adaware\Ad-Aware SE Professional v1.06r1.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 10:08:22 2005 => File F:\install\adaware\pllangs.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 10:08:56 2005 => File F:\install\pinball\big race usa\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 10:09:39 2005 => File F:\install\pinball\FantasticJourney\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 10:10:04 2005 => File F:\kleine games\Adventure Inlay 1.00.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 10:10:27 2005 => File F:\kleine games\Gamehouse Feeding Frenzy + Keygen.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 10:10:27 2005 => File F:\kleine games\Gamehouse Iggle Pop + crack.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 10:10:29 2005 => File F:\kleine games\GameHouse Platypus v1.13b + keygen.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 10:10:30 2005 => File F:\kleine games\Gamehouse.Tumblebugs.[FullVersion].EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 10:10:37 2005 => File F:\kleine games\Jewel.Quest.v1.206.Cracked.WinALL-F4CG.rar tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 10:15:42 2005 => File F:\spiele\Hank\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 10:17:10 2005 => File F:\spiele\Luxor\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sun Jul 10 10:28:07 2005 => File F:\spiele\Tumblebugs\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Statisktiken:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Sun Jul 10 10:28:49 2005 => Total Virus(es) Found: 50
Sun Jul 10 10:28:49 2005 => Total Errors: 366
Sun Jul 10 10:28:49 2005 => Time Elapsed: 01:40:42
Sun Jul 10 10:28:49 2005 => Total Objects Scanned: 110124
Sun Jul 10 08:35:55 2005 => Virus Database Date: 2005/06/24
Sun Jul 10 08:45:04 2005 => Virus Database Date: 2005/06/24
Sun Jul 10 10:28:49 2005 => Virus Database Date: 2005/06/24
Sun Jul 10 10:30:20 2005 => Virus Database Date: 2005/06/24
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
~~~~~~~ © Haui ;-) ~~~~~~~
~~~~~~~ Dank an Cidre ~~~~~~~