Trojaner-Board - hab mir wohl was eingefangen...könntet ihr bitte mal über die log sehen

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - hab mir wohl was eingefangen...könntet ihr bitte mal über die log sehen (https://www.trojaner-board.de/94542-hab-mir-wohl-eingefangen-koenntet-bitte-mal-log-sehen.html)

hab mir wohl was eingefangen...könntet ihr bitte mal über die log sehen

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 05:44:58, on 7.1.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Mozilla Firefox\plugin-container.exe
C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Downloads\HiJackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.live.com/sphome.aspx
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.live.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.live.com/sphome.aspx
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = hxxp://www.google.de/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:8074
O1 - Hosts: en in
O2 - BHO: (no name) - {0B521BB6-1517-628B-D95D-54C41AE7FE7C} - c:\windows\system32\uwdegsbp.dll (file missing)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Searchqu Toolbar - {7FF99715-3016-4381-84CE-E4E4C9673020} - C:\PROGRA~1\WI9130~1\ToolBar\SearchquDx.dll (file missing)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: GamesBarBHO Class - {CB0D163C-E9F4-4236-9496-0597E24B23A5} - C:\Programme\GamesBar\2.0.1.55\oberontb.dll (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Bandoo IE Plugin - {EB5CEE80-030A-4ED8-8E20-454E9C68380F} - C:\Programme\Fun4IM\Plugins\IE\ieplugin.dll (file missing)
O3 - Toolbar: GamesBar - {6F282B65-56BF-4BD1-A8B2-A4449A05863D} - C:\Programme\GamesBar\2.0.1.55\oberontb.dll (file missing)
O3 - Toolbar: Searchqu Toolbar - {7FF99715-3016-4381-84CE-E4E4C9673020} - C:\PROGRA~1\WI9130~1\ToolBar\SearchquDx.dll (file missing)
O4 - HKLM\..\Run: [AzMixerSel] C:\Programme\Realtek\Audio\Drivers\AzMixerSel.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Programme\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Tmemocije] rundll32.exe "C:\WINDOWS\esri32.dll",Startup
O4 - HKLM\..\Policies\Explorer\Run: [e7lye] C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\y03h3x.exe
O4 - HKLM\..\Policies\Explorer\Run: [bnype] C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\9gke.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {1A93C934-025B-4c3a-B38E-9654A7003239} - C:\Programme\GamesBar\2.0.1.55\oberontb.dll (file missing)
O9 - Extra 'Tools' menuitem: GamesBar - {1A93C934-025B-4c3a-B38E-9654A7003239} - C:\Programme\GamesBar\2.0.1.55\oberontb.dll (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: START_PAGE_URL=about:blank
O20 - AppInit_DLLs: c:\progra~1\fun4im\bndhook.dll
O23 - Service: ABBYY FineReader 9.0 Sprint Licensing Service (ABBYY.Licensing.FineReader.Sprint.9.0) - ABBYY - C:\Programme\Gemeinsame Dateien\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
O23 - Service: FSPro Filter Service (fsproflt) - FSPro Labs - C:\WINDOWS\system32\fsproflt.exe
O23 - Service: Fun4IM Coordinator - Unknown owner - C:\PROGRA~1\Fun4IM\Bandoo.exe (file missing)
O23 - Service: GtDetectSc - OptionNV - C:\Programme\Option\Acer 3G Connection Manager\GtDetectSc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

--
End of file - 5454 bytes

vielen Dank schonmal....achja...ist im abgesicherten modus...anders läuft der lap zur zeit nicht:-(((

hier die log im normalen modus
ständig geht ein fenster auf mit windows security alert

HiJackthis Logfile:

Code:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 06:26:16, on 7.1.2011

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\9gke.exe

C:\WINDOWS\system32\rundll32.exe

C:\Programme\Gemeinsame Dateien\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\fsproflt.exe

C:\Programme\IncrediMail\bin\ImApp.exe

C:\Programme\Option\Acer 3G Connection Manager\GtDetectSc.exe

C:\Programme\Java\jre6\bin\jqs.exe

C:\WINDOWS\System32\svchost.exe

C:\Programme\IncrediMail\bin\IncMail.exe

C:\WINDOWS\System32\svchost.exe

C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\9gke.exe

C:\WINDOWS\system32\rundll32.exe

C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\yptmhbrqy\noxqxkalajb.exe

C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\Dra.exe

C:\WINDOWS\Dsumub.exe

C:\PROGRA~1\WI9130~1\Datamngr\DATAMN~1.EXE

C:\WINDOWS\system32\rundll32.exe

C:\PROGRA~1\Fun4IM\Bandoo.exe

C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\Dq9.exe

C:\Programme\Internet Explorer\iexplore.exe

C:\Programme\OfferBox\OfferBox.exe

C:\WINDOWS\System32\wbem\wmiprvse.exe

C:\Programme\CCleaner\CCleaner.exe

C:\Programme\Mozilla Firefox\firefox.exe

C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Downloads\avira_antivir_personal_de609.exe

C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\RarSFX0\presetup.exe

C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Downloads\HiJackThis.exe

C:\WINDOWS\System32\msiexec.exe

C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\RarSFX0\setup.exe
 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.live.com/sphome.aspx

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.live.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.live.com/sphome.aspx

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = hxxp://www.google.de/

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:8074

O1 - Hosts: en in

O2 - BHO: (no name) - {0B521BB6-1517-628B-D95D-54C41AE7FE7C} - c:\windows\system32\uwdegsbp.dll (file missing)

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: streHelper Class - {3CF35D77-1CC9-4d88-8C14-0E2F9C017B6F} - C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\StreamedBid\streamedbie.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Searchqu Toolbar - {7FF99715-3016-4381-84CE-E4E4C9673020} - C:\PROGRA~1\WI9130~1\ToolBar\SearchquDx.dll (file missing)

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: GamesBarBHO Class - {CB0D163C-E9F4-4236-9496-0597E24B23A5} - C:\Programme\GamesBar\2.0.1.55\oberontb.dll (file missing)

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O2 - BHO: Bandoo IE Plugin - {EB5CEE80-030A-4ED8-8E20-454E9C68380F} - C:\Programme\Fun4IM\Plugins\IE\ieplugin.dll

O2 - BHO: OfferBox - {FC0D62C2-9640-4AEB-A5D5-CF25DF11FA8C} - C:\Programme\OfferBox\OfferBoxBHO.dll

O3 - Toolbar: GamesBar - {6F282B65-56BF-4BD1-A8B2-A4449A05863D} - C:\Programme\GamesBar\2.0.1.55\oberontb.dll (file missing)

O3 - Toolbar: Searchqu Toolbar - {7FF99715-3016-4381-84CE-E4E4C9673020} - C:\PROGRA~1\WI9130~1\ToolBar\SearchquDx.dll (file missing)

O4 - HKLM\..\Run: [AzMixerSel] C:\Programme\Realtek\Audio\Drivers\AzMixerSel.exe

O4 - HKLM\..\RunOnce: [removeSearchqudatamngr] cmd.exe /c RD /S /Q "C:\Programme\Windows Searchqu Toolbar"

O4 - HKLM\..\RunOnce: [removeSearchqutoolbar] cmd.exe /c RD /S /Q "C:\Programme\Windows Searchqu Toolbar\ToolBar"

O4 - HKCU\..\Run: [IncrediMail] C:\Programme\IncrediMail\bin\IncMail.exe /c

O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [Tmemocije] rundll32.exe  "C:\WINDOWS\esri32.dll",Startup

O4 - HKCU\..\Run: [gppqlpvm] C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\yptmhbrqy\noxqxkalajb.exe

O4 - HKCU\..\Run: [JP595IR86O] C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\Dq9.exe

O4 - HKLM\..\Policies\Explorer\Run: [e7lye] C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\y03h3x.exe

O4 - HKLM\..\Policies\Explorer\Run: [bnype] C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\9gke.exe

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {1A93C934-025B-4c3a-B38E-9654A7003239} - C:\Programme\GamesBar\2.0.1.55\oberontb.dll (file missing)

O9 - Extra 'Tools' menuitem: GamesBar - {1A93C934-025B-4c3a-B38E-9654A7003239} - C:\Programme\GamesBar\2.0.1.55\oberontb.dll (file missing)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O14 - IERESET.INF: START_PAGE_URL=about:blank

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - hxxp://download.mcafee.com/molbin/iss-loc/mcfscan/3,0,0,6218/mcfscan.cab

O20 - AppInit_DLLs:  c:\progra~1\fun4im\bndhook.dll 

O23 - Service: ABBYY FineReader 9.0 Sprint Licensing Service (ABBYY.Licensing.FineReader.Sprint.9.0) - ABBYY - C:\Programme\Gemeinsame Dateien\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe

O23 - Service: FSPro Filter Service (fsproflt) - FSPro Labs - C:\WINDOWS\system32\fsproflt.exe

O23 - Service: Fun4IM Coordinator - Bandoo Media Inc. - C:\PROGRA~1\Fun4IM\Bandoo.exe

O23 - Service: GtDetectSc - OptionNV - C:\Programme\Option\Acer 3G Connection Manager\GtDetectSc.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
 

--

End of file - 7306 bytes

--- --- ---

wäre für hilfe sehr dankbar