Verschiedene Trojaner
 

VERSCHIEDEN TROJANER

Hallo Leute! Ein bekannte hat ein Problem an seinem Laptop mit XP!

Hier die Hijack.log

Logfile of HijackThis v1.99.1
Scan saved at 12:54:06, on 23.02.2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\System32\LckFldService.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
D:\PROGRA~1\ZONELA~1\ZONEAL~1\zapro.exe
D:\Programme\WinRAR\WinRAR.exe
D:\DOKUME~1\f\LOKALE~1\Temp\Rar$EX00.323\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://D:\DOKUME~1\f\LOKALE~1\Temp\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lookfor.cc?pin=12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://lookfor.cc/sp.php?pin=12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://D:\DOKUME~1\f\LOKALE~1\Temp\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = wic-adu-05:8080
O2 - BHO: {1E1B286C-88FF-11D2-8D96-D7ACAC95951F} - {0E234239-88FF-11D2-8446-D7234234421F} - D:\WINDOWS\System32\msasmsn4.dll
O2 - BHO: (no name) - {40ADEB7D-C2AB-4E9B-9B16-09D45E8B9834} - D:\WINDOWS\System32\ojnc.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AVGCtrl] D:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [MSConfig] D:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [Zone Labs Client] D:\PROGRA~1\Zone Labs\ZoneAlarm\zapro.exe
O4 - HKCU\..\Run: [BirthdayReminder] F:\hier isses\BirthdayReminder.exe /remind
O4 - HKCU\..\Run: [UIWatcher] D:\PROGRA~1\ASHAMPOO\ASHAMP~1\UnInstaller Suite\UIWatcher.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programme\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programme\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra button: Add bid - {866875B8-9855-48f8-BAAB-8002C325BE69} - D:\Programme\Paragon\Last Minute Gebot\plmg.exe (HKCU)
O9 - Extra 'Tools' menuitem: Add bid - {866875B8-9855-48f8-BAAB-8002C325BE69} - D:\Programme\Paragon\Last Minute Gebot\plmg.exe (HKCU)
O16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:\Recycled\Q330995.exe
O16 - DPF: {563EC66E-5A1B-51D2-1DB0-5080C83DA4EB} - ms-its:mhtml:file://C:ie.mht!http://69.50.164.12/exp/mht/sext07.c...aInstaller.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{731ECF12-2C67-4C2C-B4CC-24855C2C3E08}: NameServer = 192.168.1.1
O18 - Filter: text/html - {0A04FBF1-EB3A-4007-A195-E1105EA782FB} - D:\WINDOWS\System32\ojnc.dll
O18 - Filter: text/plain - {0A04FBF1-EB3A-4007-A195-E1105EA782FB} - D:\WINDOWS\System32\ojnc.dll
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - D:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - D:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - D:\PROGRAMME\FRITZ!\de_serv.exe
O23 - Service: LckFldService - Unknown owner - D:\WINDOWS\System32\LckFldService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - D:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe

Escan kann ich nicht laufen lassen, da es in der Freeware Version nur LW C:\ scannt. Ich habe das Betriebssystem aber auf D:\