Trojaner-Board - Trojaner nach low level Format immer noch nicht weg!

Mal ein HiJackthis Log file:
Code:
Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 14:10:03, on 17.06.2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.20815)

Boot mode: Normal
 

Running processes:

I:\WINXP\System32\smss.exe

I:\WINXP\system32\csrss.exe

I:\WINXP\system32\winlogon.exe

I:\WINXP\system32\services.exe

I:\WINXP\system32\lsass.exe

I:\WINXP\system32\svchost.exe

I:\WINXP\system32\svchost.exe

I:\WINXP\System32\svchost.exe

I:\WINXP\system32\svchost.exe

I:\WINXP\system32\svchost.exe

I:\Programme\Alwil Software\Avast4\aswUpdSv.exe

I:\Programme\Alwil Software\Avast4\ashServ.exe

I:\WINXP\Explorer.EXE

I:\WINXP\system32\spoolsv.exe

I:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe

I:\Programme\Mamutu\a2service.exe

I:\WINXP\system32\nvsvc32.exe

I:\WINXP\system32\svchost.exe

I:\WINXP\system32\RUNDLL32.EXE

I:\Programme\FlashGet\FlashGet.exe

I:\Programme\Analog Devices\Core\smax4pnp.exe

I:\Programme\Analog Devices\SoundMAX\smax4.exe

I:\Programme\QuickTime\qttask.exe

I:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

I:\PROGRAMME\MAMUTU\mamutu.exe

I:\Programme\Winamp\winampa.exe

I:\WINXP\system32\ctfmon.exe

I:\Programme\Alwil Software\Avast4\ashMaiSv.exe

I:\Programme\Skype\Phone\Skype.exe

I:\Programme\Alwil Software\Avast4\ashWebSv.exe

I:\Programme\MSN Messenger\MsnMsgr.Exe

I:\Programme\AOL 9.0\aoltray.exe

I:\Programme\Pidgin\pidgin.exe

I:\WINXP\System32\alg.exe

I:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe

I:\Programme\Skype\Plugin Manager\skypePM.exe

I:\Programme\Trillian\trillian.exe

I:\PROGRA~1\MOZILL~1\FIREFOX.EXE

I:\Programme\Microsoft Office\Office12\WINWORD.EXE

I:\WINXP\system32\cmd.exe

I:\PROGRA~1\MICROS~1\Office12\OUTLOOK.EXE

I:\WINXP\system32\notepad.exe

I:\Programme\Trend Micro\HijackThis\HijackThis.exe

I:\WINXP\system32\wbem\wmiprvse.exe
 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = hxxp://go.microsoft.com/fwlink/?LinkId=74005

R3 - URLSearchHook: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - I:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - I:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - I:\Programme\FlashGet\jccatch.dll

O2 - BHO: Burn4Free Toolbar Helper - {60BF5EE3-0105-4858-AD98-17C19F86B042} - I:\Programme\Burn4Free Toolbar\v3.3.0.0\Burn4Free_Toolbar.dll

O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - I:\Programme\FlashGet\getflash.dll

O3 - Toolbar: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - I:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: Burn4Free Toolbar - {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} - I:\Programme\Burn4Free Toolbar\v3.3.0.0\Burn4Free_Toolbar.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE I:\WINXP\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE I:\WINXP\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [Flashget] "I:\Programme\FlashGet\FlashGet.exe" /min

O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe

O4 - HKLM\..\Run: [SoundMAXPnP] I:\Programme\Analog Devices\Core\smax4pnp.exe

O4 - HKLM\..\Run: [SoundMAX] "I:\Programme\Analog Devices\SoundMAX\smax4.exe" /tray

O4 - HKLM\..\Run: [JMB36X Configure] I:\WINXP\system32\JMRaidTool.exe boot

O4 - HKLM\..\Run: [QuickTime Task] "I:\Programme\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [NeroFilterCheck] I:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [avast!] I:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [Mamutu Guard] "I:\PROGRAMME\MAMUTU\mamutu.exe" /silent

O4 - HKLM\..\Run: [AOLDialer] I:\Programme\Gemeinsame Dateien\AOL\ACS\AOLDial.exe

O4 - HKLM\..\Run: [WinampAgent] I:\Programme\Winamp\winampa.exe

O4 - HKCU\..\Run: [ctfmon.exe] I:\WINXP\system32\ctfmon.exe

O4 - HKCU\..\Run: [Skype] "I:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [Spark] I:\Programme\Spark\Spark.exe

O4 - HKCU\..\Run: [Yahoo! Pager] "I:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet

O4 - HKCU\..\Run: [MsnMsgr] "I:\Programme\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')

O4 - Startup: Pidgin.lnk = I:\Programme\Pidgin\pidgin.exe

O4 - Global Startup: AOL 9.0 Tray-Symbol.lnk = I:\Programme\AOL 9.0\aoltray.exe

O8 - Extra context menu item: &Alles mit FlashGet laden - I:\Programme\FlashGet\jc_all.htm

O8 - Extra context menu item: &Mit FlashGet laden - I:\Programme\FlashGet\jc_link.htm

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://I:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - I:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - I:\WINXP\system32\Shdocvw.dll

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - I:\Programme\FlashGet\FlashGet.exe

O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - I:\Programme\FlashGet\FlashGet.exe

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINXP\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINXP\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Programme\Messenger\msmsgs.exe

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - I:\Programme\Yahoo!\Common\yinsthelper.dll

O17 - HKLM\System\CCS\Services\Tcpip\..\{3947DB32-FF1E-44A6-BBFE-3C0F9A753AA1}: NameServer = 192.168.178.1

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - I:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL

O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - I:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - I:\Programme\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - I:\Programme\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - I:\Programme\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - I:\Programme\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - I:\Programme\MAGIX\Common\Database\bin\fbserver.exe

O23 - Service: Mamutu Service (Mamutu) - Emsi Software GmbH - I:\Programme\Mamutu\a2service.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - I:\WINXP\system32\nvsvc32.exe
 

--

End of file - 8254 bytes
Ich hoffe auf Hilfe!

//EDIT:

Es wurde grade wieder mein Mail und MSN PW geändert...