Trojaner-Board - Problem mit themexp.org files :(

Betriebssystem Windows Xp Professional

Als Virus is die Datei nur aufgetreten, als ich sie runtergeladen hab...
Kam halt son Verweis von Antivir hab dann entfernen geklickt und alles war ok..

http://www.oberthal-online.de/themexp.html hab ich mal darüber gefunden...
Is soweit ich weiß Spyware...
Ok, Logfile post ichmal:

Logfile of HijackThis v1.99.1
Scan saved at 16:00:17, on 02.05.2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
c:\jetsuite\jsdaemon.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\DOKUME~1\BERIT~1.TOR\LOKALE~1\TEMP\_VWUPSRV.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programme\ICQLite\ICQLite.exe
C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\System32\devldr32.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Programme\Skype\Phone\Skype.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Programme\Winamp\winamp.exe
C:\Dokumente und Einstellungen\rolli\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.freeze.com/start.shtml
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O1 - Hosts: 70.84.252.218 onlineaccounts2.abbeynational.co.uk
O1 - Hosts: 70.84.252.218 www3.aibgbonline.co.uk
O1 - Hosts: 70.84.252.218 www.bank.alliance-leicester.co.uk
O1 - Hosts: 70.84.252.218 login.iblogin.com
O1 - Hosts: 70.84.252.218 ww2.bankofscotlandhalifax-online.co.uk
O1 - Hosts: 70.84.252.218 inet.barclays.co.uk
O1 - Hosts: 70.84.252.218 iibank.barclays.co.uk
O1 - Hosts: 70.84.252.218 iibank.cahoot.com
O1 - Hosts: 70.84.252.218 www3.coventrybuildingsociety.co.uk
O1 - Hosts: 70.84.252.218 ww.hsbc.co.uk
O1 - Hosts: 70.84.252.218 login.ebank.offshore.hsbc.co.je
O1 - Hosts: 70.84.252.218 ww3.online-offshore.lloydstsb.com
O1 - Hosts: 70.84.252.218 ww3.online-business.lloydstsb.co.uk
O1 - Hosts: 70.84.252.218 ww3.online.lloydstsb.co.uk
O1 - Hosts: 70.84.252.218 ww3.online.lloydstsb.co.uk
O1 - Hosts: 70.84.252.218 ww3.online-business.lloydstsb.co.uk
O1 - Hosts: 70.84.252.218 ob2.nationet.com
O1 - Hosts: 70.84.252.218 ww3.onlinebanking.natwestoffshore.com
O1 - Hosts: 70.84.252.218 ww1.nwolb.com
O1 - Hosts: 70.84.252.218 ww1.onlinebanking.iombank.com
O1 - Hosts: 70.84.252.218 ww1.www.rbsdigital.com
O1 - Hosts: 70.84.252.218 welcome.smile.co.uk
O1 - Hosts: 70.84.252.218 login.365online.com
O1 - Hosts: 70.84.252.218 wvw.citizensbankonline.com
O1 - Hosts: 70.84.252.218 esecure.regionsnet.com
O1 - Hosts: 70.84.252.218 rollb.associatedbank.com
O1 - Hosts: 70.84.252.218 upb.unionplanters.com
O1 - Hosts: 70.84.252.218 www.onlinebanking.huntington.com
O1 - Hosts: 70.84.252.218 inet.southtrustonlinebanking.com
O1 - Hosts: 70.84.252.218 logon.personal.wamu.com
O1 - Hosts: 70.84.252.218 login.compassweb.com
O1 - Hosts: 70.84.252.218 logon.firstmeritib.com
O1 - Hosts: 70.84.252.218 login.ccfcuonline.org
O1 - Hosts: 70.84.252.218 ww3.etimebanker.bankofthewest.com
O1 - Hosts: 70.84.252.218 ww2.onlinebanking.lasallebank.com
O1 - Hosts: 70.84.252.218 wvw.totallyfreebanking.com
O1 - Hosts: 70.84.252.218 www.online.wellsfargo.com
O1 - Hosts: 70.84.252.218 www.onlinebanking.bankofoklahoma.com
O1 - Hosts: 70.84.252.218 accounts4.keybank.com
O1 - Hosts: 70.84.252.218 logon.bankone.com
O1 - Hosts: 70.84.252.218 www.secure.tdbanknorth.com
O1 - Hosts: 70.84.252.218 www.secure.mvnt4.com
O1 - Hosts: 70.84.252.218 ww.mynfbonline.com
O1 - Hosts: 70.84.252.218 login.forumcuonline.com
O1 - Hosts: 70.84.252.218 www.eds.usersonlnet.com
O1 - Hosts: 70.84.252.218 www.onlineid.bankofamerica.com
O1 - Hosts: 70.84.252.218 wvw.e-gold.com
O1 - Hosts: 70.84.252.218 pcbs.peoples.com
O1 - Hosts: 70.84.252.218 www.global1.onlinebank.com
O1 - Hosts: 70.84.252.218 ww2.mybranch.lafcu.com
O1 - Hosts: 70.84.252.218 login.webbanking.comerica.com
O1 - Hosts: 70.84.252.218 web.banking.firsttennessee.com
O1 - Hosts: 70.84.252.218 logon.members1st.org
O1 - Hosts: 70.84.252.218 www.cib.ibanking-services.com
O1 - Hosts: 70.84.252.218 www.miwebbusbank.ebanking-services.com
O1 - Hosts: 70.84.252.218 wvw.paypal.com
O1 - Hosts: 70.84.252.218 www.signin.ebay.com
O1 - Hosts: 70.84.252.218 wvw.etrade.com
O1 - Hosts: 70.84.252.218 ww4.fleethomelink.fleet.com
O1 - Hosts: 70.84.252.218 ww3.connect.skyfi.com
O1 - Hosts: 70.84.252.218 www6.usbank.com
O1 - Hosts: 70.84.252.218 www.bvi.bancodevalencia.es
O1 - Hosts: 70.84.252.218 extrant.banesto.es
O1 - Hosts: 70.84.252.218 banesnt.banesto.es
O1 - Hosts: 70.84.252.218 activia.caixagalicia.es
O1 - Hosts: 70.84.252.218 www.bancae.caixapenedes.com
O1 - Hosts: 70.84.252.218 login.caixasabadell.net
O1 - Hosts: 70.84.252.218 oii.cajamadrid.es
O1 - Hosts: 70.84.252.218 login.cajamar.es
O1 - Hosts: 70.84.252.218 login.ccm.es
O1 - Hosts: 70.84.252.218 ww.unicaja.es
O1 - Hosts: 70.84.252.218 www5.bancopopular.es
O1 - Hosts: 70.84.252.218 ww3.bbvanet.com
O1 - Hosts: 70.84.252.218 ww.bayernlb.de
O1 - Hosts: 70.84.252.218 ww2.berliner-volksbank.de
O1 - Hosts: 70.84.252.218 ww7.homebanking-berlin.de
O1 - Hosts: 70.84.252.218 portal09.commerzbanking.de
O1 - Hosts: 70.84.252.218 www.meine.deutsche-bank.de
O1 - Hosts: 70.84.252.218 ww2.dresdner-privat.de
O1 - Hosts: 70.84.252.218 ww.e-banking.helaba.de
O1 - Hosts: 70.84.252.218 ww.hsh-nordbank.de
O1 - Hosts: 70.84.252.218 www.my.hypovereinsbank.de
O1 - Hosts: 70.84.252.218 ww3.homebanking-berlin.de
O1 - Hosts: 70.84.252.218 ww3.homebanking-berlin.de
O1 - Hosts: 70.84.252.218 www.banking.lbbw.de
O1 - Hosts: 70.84.252.218 lrp.sparkasse-banking.de
O1 - Hosts: 70.84.252.218 ww3.homebanking-niedersachsen.de
O1 - Hosts: 70.84.252.218 www.onlinebanking.norisbank.de
O1 - Hosts: 70.84.252.218 www.banking.postbank.de
O1 - Hosts: 70.84.252.218 wvw.internetbanking.gad.de
O1 - Hosts: 70.84.252.218 ww1.portal.izb.de
O1 - Hosts: 70.84.252.218 wvw.kunden-service.lbs.de
O1 - Hosts: 70.84.252.218 ibanking.seb.de
O1 - Hosts: 70.84.252.218 bw7.sparkasse-banking.de
O1 - Hosts: 70.84.252.218 ww2.homebanking-sparkasse.de
O1 - Hosts: 70.84.252.218 ww2.vr-networld-ebanking.de
O1 - Hosts: 70.84.252.218 ww.bics.fr
O1 - Hosts: 70.84.252.218 www.co.caixabank.fr
O1 - Hosts: 70.84.252.218 ww.creditmutuel.fr
O1 - Hosts: 70.84.252.218 internetbank.intesabci.it
O1 - Hosts: 70.84.252.218 ww.extensive.bancalombarda.it
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: RXResultTracker Class - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - C:\PROGRA~1\RXTOOL~1\sfcont.dll (file missing)
O2 - BHO: Microsoft Update Proxy Class - {6E28339B-7A2A-47B6-AEB2-46BA53782375} - C:\WINDOWS\System32\dllcache\msupdprx.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [IExplorer7 Java Scripting] IExplore327.exe
O4 - HKLM\..\Run: [win32 service] smss32.exe
O4 - HKLM\..\Run: [Machine Debug Manager] msdn.exe
O4 - HKLM\..\Run: [EXPLORER MICROSOFT SYSTEM] task.exe
O4 - HKLM\..\Run: [MS MSN Menssenger 7.0] MSMSN7.exe
O4 - HKLM\..\Run: [Win32 System Kernel] svchsts.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [routcnf] C:\Programme\Telekom\Eumex 504PC USB\routcnf.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\RunServices: [IExplorer7 Java Scripting] IExplore327.exe
O4 - HKLM\..\RunServices: [win32 service] smss32.exe
O4 - HKLM\..\RunServices: [Machine Debug Manager] msdn.exe
O4 - HKLM\..\RunServices: [EXPLORER MICROSOFT SYSTEM] task.exe
O4 - HKLM\..\RunServices: [MS MSN Menssenger 7.0] MSMSN7.exe
O4 - HKLM\..\RunServices: [Win32 System Kernel] svchsts.exe
O4 - HKCU\..\Run: [IExplorer7 Java Scripting] IExplore327.exe
O4 - HKCU\..\Run: [Machine Debug Manager] msdn.exe
O4 - HKCU\..\Run: [EXPLORER MICROSOFT SYSTEM] task.exe
O4 - HKCU\..\Run: [MS MSN Menssenger 7.0] MSMSN7.exe
O4 - HKCU\..\Run: [Win32 System Kernel] svchsts.exe
O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: &Search - http://kp.bar.need2find.com/KP/menusearch.html?p=KP
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/MediaAccessVerisign/ie/bridge-c18.cab
O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C:\PROGRA~1\RXTOOL~1\sfcont.dll
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: jsdaemon - JetFax, Inc. - c:\jetsuite\jsdaemon.exe
O23 - Service: Net Functions Monitoring (Netmon) - Unknown owner - C:\WINDOWS\system32\Netmon.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: AntiVir Update Temp (TmpUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\DOKUME~1\BERIT~1.TOR\LOKALE~1\TEMP\_VWUPSRV.EXE
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Soweit wird es nicht als "Virus" anerkannt, von ZoneAlarm....aber die Datei lässt sich nicht löschen...wie oben genannt...

Wenn sonst was is, einfach nomml fragen :)

thx,