Trojaner-Board - so schnell gehts

Hallo,

so langsam komme ich weiter:

logfile HJT im Normalmodus:
Logfile of HijackThis v1.98.2
Scan saved at 12:04:24, on 02/11/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\Ati2evxx.exe
C:\Programme\Symantec AntiVirus\DefWatch.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Programme\Symantec AntiVirus\Rtvscan.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Programme\Iomega\AutoDisk\ADService.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\atiptaxx.exe
C:\Programme\Dell\AccessDirect\dadapp.exe
C:\Programme\Synaptics\SynTP\SynTPLpr.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\Iomega\AutoDisk\ADUserMon.exe
C:\Programme\Iomega\DriveIcons\ImgIcon.exe
C:\Programme\Iomega\DriveIcons\deskup.exe
C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Programme\FarStone\VirtualDrive\vdtask.exe
C:\Programme\Java\j2re1.4.2_03\bin\jusched.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\WINNT\system32\carpserv.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Programme\FarStone\VirtualDrive\Netsrv.exe
C:\WINNT\system32\internat.exe
C:\Programme\D\D-Info\dinfostarter.exe
C:\WINNT\system32\svchostes.exe
D:\D\Downloads und Programme\Hijack this\entzippt\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [DadApp] C:\Programme\Dell\AccessDirect\dadapp.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ADUserMon] C:\Programme\Iomega\AutoDisk\ADUserMon.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Programme\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [Deskup] C:\Programme\Iomega\DriveIcons\deskup.exe /IMGSTART
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [Virtual Drive] "C:\Programme\FarStone\VirtualDrive\vdtask.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [Sygate Personal Firewall] sys.exe
O4 - HKLM\..\Run: [Start Upping] svchostes.exe
O4 - HKLM\..\RunServices: [Sygate Personal Firewall] sys.exe
O4 - HKLM\..\RunServices: [Start Upping] svchostes.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [Sygate Personal Firewall] sys.exe
O4 - HKCU\..\Run: [Start Upping] svchostes.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: D-Info Starter.lnk = C:\Programme\D\D-Info\dinfostarter.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {0A10045F-B8E6-11D1-BC4D-006008CCB} (ActiveProject Authentication Control v9.0.1) - https://m.m.com/M/en-us/atx.cab
O16 - DPF: {0A100525-B8E6-11D1-BC4D-006008CCB} (ActiveProject Version Control v9.0.1) - https://m.m.com/M/en-us/verctrl.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989D} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://pinpoint.webex.com/client/la...ex/ieatgpc.cab

und resultate von escan im abgesicherten modus:
File C:\WINNT\system32\svchostes.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.

File C:\WINNT\system32\svchostes.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.

File C:\WINNT\system32\svchostes.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.

File C:\WINNT\system32\svchostes.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.

File C:\WINNT\system32\IExplore32b.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.

File C:\WINNT\system32\svchostes.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.

File C:\WINNT\system32\IExplore32b.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.

File C:\WINNT\Downloaded Program Files\ieatgpc.dll tagged as not-a-virus:AdWare.WebEx. No Action Taken.

File C:\Dokumente und Einstellungen\Default User\Lokale Einstellungen\Temporary Internet Files\Content.IE5\A54HEPSF\loud[2].exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken.

File C:\Dokumente und Einstellungen\Default User\Lokale Einstellungen\Temporary Internet Files\Content.IE5\IFS9CHGF\mm[1].exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken.

File C:\Dokumente und Einstellungen\jd\Lokale Einstellungen\Temporary Internet Files\Content.IE5\KXUNWDEB\lca[1].exe infected by "Trojan.Win32.LowZones.d" Virus. Action Taken: No Action Taken.

File C:\Dokumente und Einstellungen\jd\Lokale Einstellungen\Temporary Internet Files\Content.IE5\KXUN41E7\mt[1].exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken.

File C:\Dokumente und Einstellungen\jd\Lokale Einstellungen\Temporary Internet Files\Content.IE5\KXUN41E7\gamma[1].exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken.

File C:\Dokumente und Einstellungen\jd\Lokale Einstellungen\Temporary Internet Files\Content.IE5\GHUROHYJ\mm[1].exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken.

File C:\Dokumente und Einstellungen\jd\Lokale Einstellungen\Temporary Internet Files\Content.IE5\GHUROHYJ\loud[1].exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken.

File C:\Programme\Iomega\System32\Win2kDrivers.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

File C:\Programme\Iomega\DriveIcons\imghr.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

File C:\patch2.exe infected by "Trojan.Win32.LowZones.d" Virus. Action Taken: No Action Taken.

File C:\iel.exe infected by "Trojan.Win32.LowZones.d" Virus. Action Taken: No Action Taken.

File C:\Recycled\Dc202.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.

File C:\Daten\d\Server\Technik\Install\Tools\vnc_x86_win32\vncviewer\vncviewer.exe tagged as not-a-virus:RiskWare.RemoteAdmin.WinVNC.333. No Action Taken.

File C:\Daten\d\Server\Service\DE\ADMIN\VPTOOLS\SCANPROT.DOT tagged as not-a-virus:Tool.Macro.ScanProt. No Action Taken.

Scheint ja so einiges los zu sein auf meinem Rechenr. Mal sehen was die experde dazu sage! Bin für jede Hilfe dankbar!

Gruss
Joschi