Habe eine Nacht fast nicht geschlafen und zum Glück bisher noch nicht formatiert, nur Angefangen zu sichern und nachzuforschen. Die Möglichkeit mit dem Log- File kenn ich seit ca 06:00 Uhr und das Sytem würde ich gerne erhalten. Vielleicht kann ja mal einer drüberschauen. Der Viren- Scanner hat gefunden und gelöscht, aber einige Trojaner kommen immer wieder....Bitte..

Logfile of HijackThis v1.99.0
Scan saved at 07:21:50, on 16.12.2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\Jana2\janad.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\javawo.exe
D:\Programme\Thomson Multimedia\Thomson Lyra Personal Jukebox\Profiler\LYRAHDDProfilerTrayApp.exe
C:\Program Files\Windows ControlAd\WinCtlAd.exe
C:\WINDOWS\System32\tibs3.exe
D:\Programme\PestPatrol\PPControl.exe
C:\Program Files\Windows ControlAd\WinCtlAdAlt.exe
D:\Programme\PestPatrol\PPMemCheck.exe
D:\Programme\PestPatrol\CookiePatrol.exe
C:\WINDOWS\ieaq.exe
C:\WINDOWS\System32\ctfmon.exe
D:\Programme\Nikon\NkView4\NkVwMon.exe
D:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
D:\Programme\Sony Ericsson\Mobile\audevicemgr.exe
d:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\MROUTE~2.EXE
d:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\CONNMN~1.EXE
C:\Dokumente und Einstellungen\Petty\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\wkjds.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\wkjds.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\wkjds.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\wkjds.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\wkjds.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\wkjds.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\wkjds.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyServer = 192.168.1.2:3128
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {EFBBEF1A-21B6-994C-632E-201DE3EF2428} - C:\WINDOWS\system32\d3dt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [LyraPJProfiler] "D:\Programme\Thomson Multimedia\Thomson Lyra Personal Jukebox\Profiler\LYRAHDDProfilerTrayApp.exe"
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [wingm.exe] C:\WINDOWS\system32\wingm.exe
O4 - HKLM\..\Run: [Windows ControlAd] C:\Program Files\Windows ControlAd\WinCtlAd.exe
O4 - HKLM\..\Run: [salm] c:\temp\salm.exe
O4 - HKLM\..\Run: [WebRebates0] "C:\Programme\Web_Rebates\WebRebates0.exe"
O4 - HKLM\..\Run: [tibs3] C:\WINDOWS\System32\tibs3.exe
O4 - HKLM\..\Run: [ieus32.exe] C:\WINDOWS\system32\ieus32.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] D:\Programme\PestPatrol\PPControl.exe
O4 - HKLM\..\Run: [PPMemCheck] D:\Programme\PestPatrol\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] D:\Programme\PestPatrol\CookiePatrol.exe
O4 - HKLM\..\Run: [ieaq.exe] C:\WINDOWS\ieaq.exe
O4 - HKLM\..\RunOnce: [javawo.exe] C:\WINDOWS\javawo.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: NkVwMon.exe.lnk = D:\Programme\Nikon\NkView4\NkVwMon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: InterVideo WinCinema Manager.lnk = D:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: ZoneAlarm.lnk = C:\Programme\Zone Labs\ZoneAlarm\zonealarm.exe
O4 - Global Startup: Telefonverbindungsmonitor.lnk = ?
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Web Rebates - file://C:\Programme\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
O15 - Trusted Zone: *.05p.com
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.blazefind.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.flingstone.com
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.scoobidoo.com
O15 - Trusted Zone: *.searchbarcash.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.slotch.com
O15 - Trusted Zone: *.static.topconverting.com
O15 - Trusted Zone: *.05p.com (HKLM)
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted Zone: *.blazefind.com (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.flingstone.com (HKLM)
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.scoobidoo.com (HKLM)
O15 - Trusted Zone: *.searchbarcash.com (HKLM)
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O15 - Trusted Zone: *.slotch.com (HKLM)
O15 - Trusted Zone: *.static.topconverting.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: 206.161.124.130 (HKLM)
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_f...937c6314a45eb37
O16 - DPF: {386A771C-E96A-421F-8BA7-32F1B706892F} - http://www.xxxtoolbar.com/ist/softw.../0006_adult.cab
O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - D:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: Jana Server 2 - Thomas Hauck, Privat - C:\Programme\Jana2\janad.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINDOWS\system32\ZONELABS\vsmon.exe
O23 - Service: ZESOFT - Unknown - C:\WINDOWS\zeta.exe
O23 - Service: Network Security Service (NSS) - Unknown - C:\WINDOWS\netfc32.exe (file missing)[/SIZE]

Danke, Micha !

http://www.trojaner-board.de/showthread.php?t=10825