Trojaner-Board - Festplattenzugriff sehr hoch

Meine Festplatte wird öfters dauerhaft gelesen. Ich bin mir sehr unsicher aber ich vermute da ist ein Hacker am Werk, denn 3 Ports haben sich bei mir von selbst geöffnet. Hier mein HijackThis Logfile:

Logfile of HijackThis v1.99.1
Scan saved at 20:59:16, on 18.07.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\programme\a-squared free\a2service.exe
C:\Programme\AntiVir PersonalEdition

Classic\sched.exe
C:\Programme\AntiVir PersonalEdition

Classic\avguard.exe
C:\Programme\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Programme\Google\Common\Google

Updater\GoogleUpdaterService.exe
C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\netfxupd

ate.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Programme\Toshiba\Windows Utilities\Hotkey.exe
C:\Programme\Synaptics\SynTP\Toshiba.exe
C:\Programme\TOSHIBA\ConfigFree\NDSTray.exe
C:\Programme\AntiVir PersonalEdition

Classic\avgnt.exe
C:\Programme\Gemeinsame Dateien\Logitech\LCD

Manager\lcdmon.exe
C:\Programme\Java\jre1.6.0_01\bin\jusched.exe
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Google\GoogleToolbarNotifier\1.2.1128.54

62\GoogleToolbarNotifier.exe
C:\Programme\Gemeinsame Dateien\Logitech\LCD

Manager\Applets\LCDCountdown.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\Gemeinsame Dateien\Logitech\LCD

Manager\Applets\LCDPOP3.exe
C:\Programme\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Programme\Gemeinsame Dateien\Logitech\LCD

Manager\Applets\LCDMedia.exe
C:\Programme\Gemeinsame Dateien\Logitech\LCD

Manager\Applets\LCDClock.exe
C:\Programme\QIP\qip.exe
C:\Programme\Logitech\SetPoint\KEM.exe
C:\Programme\Xfire\xfire.exe
C:\Programme\Logitech\SetPoint\KHALMNPR.EXE
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Azureus\Azureus.exe
C:\Programme\Chat\PSP-IRC-CHANNEL\irc\mirc.exe
C:\Programme\ahead\Nero StartSmart\NeroStartSmart.exe
C:\WINDOWS\system32\imapi.exe
C:\Programme\ATITool\ATITool.exe
C:\Programme\LimeWire\LimeWire.exe
C:\Dokumente und

Einstellungen\user\Desktop\Programme\PSP.exe

R0 - HKCU\Software\Microsoft\Internet

Explorer\Main,Start Page = ***.icq.com/start
R1 -

HKCU\Software\Microsoft\Windows\CurrentVersion\Intern

et Settings,ProxyOverride = localhost
R3 - URLSearchHook: (no name) -

{0A94B116-4504-4e26-AB05-E61E474AA38B} -

C:\Programme\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL
O2 - BHO: (no name) -

{055FD26D-3A88-4e15-963D-DC8493744B1D} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper -

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -

C:\Programme\Adobe\Acrobat

7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Ask Search Assistant BHO -

{0A94B111-4504-4e26-AB05-E61E474AA38B} -

C:\Programme\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL
O2 - BHO: (no name) -

{53707962-6F74-2D53-2644-206D7942484F} - (no file)
O2 - BHO: DriveLetterAccess -

{5CA3D70E-1895-11CF-8E15-001234567890} -

C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class -

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -

C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) -

{c76a8459-1af1-46a2-94b9-96ed4eb2bb24} -

C:\WINDOWS\system32\locs32.dll (file missing)
O2 - BHO: Ask Toolbar BHO -

{F4D76F01-7896-458a-890F-E1F05C46069F} -

C:\Programme\AskPBar\bar\1.bin\ASKPBAR.DLL
O3 - Toolbar: ImageShack Toolbar -

{6932D140-ABC4-4073-A44C-D4A541665E35} -

C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.dll
O3 - Toolbar: Ask Toolbar -

{F4D76F09-7896-458a-890F-E1F05C46069F} -

C:\Programme\AskPBar\bar\1.bin\ASKPBAR.DLL
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE

C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [High Definition Audio Property

Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [DLA]

C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe

NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ehTray]

C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction

Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SynTPEnh]

C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Toshiba Hotkey Utility]

"C:\Programme\Toshiba\Windows Utilities\Hotkey.exe"

/lang DE
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir

PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [NeroFilterCheck]

C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RivaTunerStartupDaemon]

"C:\Programme\RivaTuner v2.01\RivaTuner.exe" /S
O4 - HKLM\..\Run: [Launch LCDMon]

"C:\Programme\Gemeinsame Dateien\Logitech\LCD

Manager\lcdmon.exe"
O4 - HKLM\..\Run: [Launch LGDCore]

"C:\Programme\Gemeinsame Dateien\Logitech\G-series

Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [SunJavaUpdateSched]

"C:\Programme\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client]

"C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe]

C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg]

C:\Programme\Google\GoogleToolbarNotifier\1.2.1128.54

62\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer]

C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [TOSCDSPD]

C:\Programme\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [NBJ] "C:\Programme\Ahead\Nero

BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [QIP2005] C:\Programme\QIP\qip.exe
O4 - Startup: Microsoft Office OneNote 2003

Schnellstart.lnk.disabled
O4 - Startup: OneNote 2007 Bildschirmausschnitt- und

Startprogramm.lnk = C:\Programme\Microsoft

Office\Office12\ONENOTEM.EXE
O4 - Startup: Xfire.lnk =

C:\Programme\Xfire\xfire.exe
O4 - Global Startup: Adobe Reader -

Schnellstart.lnk.disabled
O4 - Global Startup: Google Updater.lnk.disabled
O4 - Global Startup: Logitech Desktop Messenger.lnk =

C:\Programme\Logitech\Desktop

Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Logitech SetPoint.lnk =

C:\Programme\Logitech\SetPoint\KEM.exe
O8 - Extra context menu item: Nach Microsoft E&xel

exportieren -

res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Post Image to Blog -

res://C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.

dll/5003
O8 - Extra context menu item: Tag This Image -

res://C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.

dll/5002
O8 - Extra context menu item: Upload All Images to

ImageShack -

res://C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.

dll/5000
O8 - Extra context menu item: Upload Image to

ImageShack -

res://C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.

dll/5001
O9 - Extra button: (no name) -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\WINDOWS\system32\locs32.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Konsole -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\WINDOWS\system32\locs32.dll (file missing)
O9 - Extra button: An OneNote senden -

{2670000A-7350-4f3c-8081-5663EE0C6C49} -

C:\WINDOWS\system32\locs32.dll (file missing)
O9 - Extra 'Tools' menuitem: An OneNote s&enden -

{2670000A-7350-4f3c-8081-5663EE0C6C49} -

C:\WINDOWS\system32\locs32.dll (file missing)
O9 - Extra button: Research -

{92780B25-18CC-41C8-B9BE-3C9C571A8263} -

C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: ICQ Lite -

{B863453A-26C3-4e1f-A54D-A2CD196348E9} -

C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite -

{B863453A-26C3-4e1f-A54D-A2CD196348E9} -

C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: ICQ6 -

{E59EB121-F339-4851-A3BA-FE49C35617C2} -

C:\Programme\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 -

{E59EB121-F339-4851-A3BA-FE49C35617C2} -

C:\Programme\ICQ6\ICQ.exe
O9 - Extra button: Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {6932D140-ABC4-4073-A44C-D4A541665E35}

(ImageShack Toolbar) -

h**p://toolbar.imageshack.us/toolbar/ImageShackToolba

r.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000}

(Shockwave Flash Object) -

h**ps://fpdownload.macromedia.com/pub/shockwave/cabs/

flash/swflash.cab
O18 - Protocol: ms-help -

{314111C7-A502-11D2-BBCA-00C04F8EC294} -

C:\Programme\Gemeinsame Dateien\Microsoft

Shared\Help\hxds.dll
O18 - Filter hijack: text/xml -

{807563E5-5146-11D5-A672-00B0D022E945} -

C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: igfxcui -

C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: locs32 - locs32.dll (file

missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: a-squared Free Service (a2free) - Emsi

Software GmbH - c:\programme\a-squared

free\a2service.exe
O23 - Service: AntiVir PersonalEdition Classic Planer

(AntiVirScheduler) - Avira GmbH -

C:\Programme\AntiVir PersonalEdition

Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard

(AntiVirService) - Avira GmbH - C:\Programme\AntiVir

PersonalEdition Classic\avguard.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA

CORPORATION -

C:\Programme\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Google Updater Service (gusvc) -

Google - C:\Programme\Google\Common\Google

Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT)

- Macrovision Corporation - C:\Programme\Gemeinsame

Dateien\InstallShield\Driver\1150\Intel

32\IDriverT.exe
O23 - Service: Macromedia Licensing Service - Unknown

owner - C:\Programme\Gemeinsame Dateien\Macromedia

Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc)

- NVIDIA Corporation -

C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner -

C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner -

C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: TrueVector Internet Monitor (vsmon) -

Zone Labs, LLC -

C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: X10 Device Network Service (x10nets) -

X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe