VIELE TAUSEND PFERDE und mehr... HHHIILLFFFEE!

ninja-2

Hallo!
Weiß nicht mehr weiter!

Logfile of HijackThis v1.97.7
Scan saved at 01:25:40, on 04.01.04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\PROGRAMME\GEMEINSAME DATEIEN\PCSUITE\DATALAYER\DATALAYER.EXE
C:\PROGRAMME\GEMEINSAME DATEIEN\NOKIA\TOOLS\NCLTRAY.EXE
C:\WINDOWS\RunDLL.exe
C:\PROGRAMME\SPYWARE DOCTOR\SWDOCTOR.EXE
C:\WINDOWS\DESKTOP\MAPOCHAR.EXE
C:\PROGRAMME\GEMEINSAME DATEIEN\PCSUITE\SERVICES\SERVICELAYER.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\WINOA386.MOD
C:\PROGRAMME\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAMME\BOUNCER\BOUNCER.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.werbeagentur.de/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:4001
F0 - system.ini: Shell=c:\windows\Explorer.exe
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [NvColorInit] RUNDLL32.EXE NVQTWK.DLL,NvColorInit
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [WinDSL MTU-Adjust] WinDSL_MTU.exe
O4 - HKLM\..\Run: [CriticalUpdate] c:\windows\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [DataLayer] C:\Programme\Gemeinsame Dateien\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [Nokia Tray Application] C:\Programme\Gemeinsame Dateien\Nokia\Tools\NclTray.exe
O4 - HKLM\..\Run: [Bouncer RunStartup] C:\Programme\Bouncer\liveupdate.exe 110
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\Run: [Spyware Doctor] "C:\PROGRAMME\SPYWARE DOCTOR\SWDOCTOR.EXE" /Q
O4 - HKCU\..\RunServices: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\RunServices: [Spyware Doctor] "C:\PROGRAMME\SPYWARE DOCTOR\SWDOCTOR.EXE" /Q
O4 - Startup: tmpdelis.bat
O4 - Startup: Verknüpfung mit mapOchar.exe.lnk = C:\WINDOWS\Desktop\mapOchar.exe
O4 - Startup: tmpdelis.PIF = ?
O4 - Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: JAP.lnk = C:\Programme\Jap\jap.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: eBay - Homepage (HKLM)
O9 - Extra button: Spyware Doctor (HKLM)
O10 - Unknown file in Winsock LSP: c:\windows\system\aklsp.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab

-----------------------------------------
Auszug aus escan:
File C:\WINDOWS\SYSTEM\IPSCLASS.DLL tagged as not-a-virus:AdWare.Look2Me.r. No Action Taken.
File C:\WINDOWS\SYSTEM\IX32.DLL tagged as not-a-virus:AdWare.Look2Me.r. No Action Taken.
File C:\WINDOWS\SYSTEM\MBWSOSP.DLL tagged as not-a-virus:AdWare.Look2Me.r. No Action Taken.
File C:\WINDOWS\SYSTEM\OJE2CONV.DLL tagged as not-a-virus:AdWare.Look2Me.r. No Action Taken.
File C:\WINDOWS\SYSTEM\DXKAPI16.DLL tagged as not-a-virus:AdWare.Look2Me.r. No Action Taken.
File C:\WINDOWS\SYSTEM\CDUSALGO.DLL tagged as not-a-virus:AdWare.Look2Me.r. No Action Taken.
File C:\WINDOWS\SYSTEM\RKFEDIT.DLL tagged as not-a-virus:AdWare.Look2Me.r. No Action Taken.
File C:\WINDOWS\SYSTEM\SHMSCRPT.DLL tagged as not-a-virus:AdWare.Look2Me.r. No Action Taken.
File C:\WINDOWS\SYSTEM\LILMA90N.DLL tagged as not-a-virus:AdWare.Look2Me.r. No Action Taken.
File C:\WINDOWS\SYSTEM\RFSAPI16.DLL tagged as not-a-virus:AdWare.Look2Me.r. No Action Taken.
File C:\WINDOWS\SYSTEM\MT3216.DLL tagged as not-a-virus:AdWare.Look2Me.r. No Action Taken.
File C:\WINDOWS\SYSTEM\IPSCLASS.DLL tagged as not-a-virus:AdWare.Look2Me.r. No Action Taken.
File C:\WINDOWS\SYSTEM\HRD.DLL tagged as not-a-virus:AdWare.Look2Me.r. No Action Taken.
File C:\WINDOWS\SYSTEM\mhtext35.dll tagged as not-a-virus:AdWare.Look2Me.r. No Action Taken.
File C:\WINDOWS\SYSTEM\MFYUV.DLL tagged as not-a-virus:AdWare.Look2Me.r. No Action Taken.
File C:\WINDOWS\SYSTEM\emlate32.dll tagged as not-a-virus:AdWare.Look2Me.r. No Action Taken.
File C:\WINDOWS\SYSTEM\DQLMSC32.dll tagged as not-a-virus:AdWare.Look2Me.r. No Action Taken.
File C:\WINDOWS\SYSTEM\OUMREG.DLL tagged as not-a-virus:AdWare.Look2Me.r. No Action Taken.
File C:\WINDOWS\SYSTEM\p2esocks_1023.dll infected by "Trojan.Win32.P2E.aj" Virus. Action Taken: File Deleted.
File C:\WINDOWS\SYSTEM\IX32.DLL tagged as not-a-virus:AdWare.Look2Me.r. No Action Taken.
File C:\WINDOWS\SYSTEM\auist5.dll tagged as not-a-virus:AdWare.Look2Me.r. No Action Taken.
File C:\WINDOWS\SYSTEM\THbctde.dll tagged as not-a-virus:AdWare.Look2Me.r. No Action Taken.

Komplettes log FOLGT!
------------------------------------------------------------------
Bazooka meldet alle i.O.
----------------------------------
CWShredder 2.12 meldet:
CWS.BootConf und CWS.Cvchost32 gefunden. Kann nicht reparieren. CH.. liegt aber nicht im win-Verzeichnis!
---------------------------------
Es kommen sporadische Seiten wie z.B.
loadingwebsite.com und mediabuy-nic...
----------------------------------
Norton AV startet nicht mehr. Aus DOS scannt er brav, findet aber nicht...
----------------------------------
Meine onlinebanking-Konten können nicht mehr aufgerufen werden... SORGE?
--------------------------------------------------
Trotz DSL: Alles super langsam!
--------------------------------------------------
SpyBouncer meldet noch 6 weitere Trojas
coolwebsearch etc.. Muss nochmal laufen lassen. FOLGT!
------------------------------------------------
SpywareDoctor:

VirtualBouncer
akamaidownloadv3.com
IEPLUGIN
SurfSideKick2


LOG:

Scan Results:
scan start: 04.01.04 01:29:14
scan stop: 04.01.04 01:38:40
scanned items: 131484
found items: 40
found and ignored: 0
tools used: General Scanner, Process Scanner, Hosts scanner, LSP Scanner, Registry Scanner, Cookie Scanner, Browser Defaults, Favorites and ZoneMap Scanner, Browser Scanner, Disk Scanner



Infection Name Location Risk
EasyWebSearch HKCU\Software\SurfSideKick2 High
EasyWebSearch HKCU\Software\SurfSideKick2\Internet Explorer High
Virtual Bouncer HKCR\ChilkatZip.ChilkatEnum Medium
Virtual Bouncer HKCR\ChilkatZip.ChilkatEnum.1 Medium
Virtual Bouncer HKCR\ChilkatZip.ChilkatZip Medium
Virtual Bouncer HKCR\ChilkatZip.ChilkatZip.1 Medium
Virtual Bouncer HKCR\ChilkatZip.ChilkatZip2 Medium
Virtual Bouncer HKCR\ChilkatZip.ChilkatZip2.1 Medium
Virtual Bouncer HKCR\ChilkatZip.ChilkatZipEntry Medium
Virtual Bouncer HKCR\ChilkatZip.ChilkatZipEntry.1 Medium
Virtual Bouncer HKCR\ChilkatZip.ChilkatZipEntry2 Medium
Virtual Bouncer HKCR\ChilkatZip.ChilkatZipEntry2.1 Medium
Virtual Bouncer HKCR\clsid\{18BBDF4D-611D-41CE-A7E7-B2DD23C250D1} Medium
Virtual Bouncer HKCR\clsid\{8551311D-F3BF-4718-AD66-96E302500735} Medium
Virtual Bouncer HKCR\clsid\{CE23505D-68FB-4C49-AE4B-D4F1CF86A2C4} Medium
Virtual Bouncer HKCR\clsid\{DB90DEA9-0897-4B02-9FE0-1E321A22EAB0} Medium
Virtual Bouncer HKCR\clsid\{DB92433D-1902-4789-BAFC-B46B0DCDEBB7} Medium
Virtual Bouncer HKCR\clsid\{EC352548-52B5-41AC-B8C1-8CB561ECF7AD} Medium
Virtual Bouncer HKCR\Interface\{13C243A0-50E9-43F4-8E5B-9FF857C3A0B5} Medium
Virtual Bouncer HKCR\Interface\{4340DF8E-D7A3-4675-BE74-80077B2B3E81} Medium
Virtual Bouncer HKCR\Interface\{4A277E1B-B130-4E4A-92AE-8712F4A150BD} Medium
Virtual Bouncer HKCR\Interface\{4B795337-D704-49C7-8CA1-D65722B28EBD} Medium
Virtual Bouncer HKCR\Interface\{6D37DED8-1944-4E32-93FD-B9610E0AD8E3} Medium
Virtual Bouncer HKCR\Interface\{8DD9B882-0041-449D-A0BD-77A87119AD90} Medium
Virtual Bouncer HKCR\Interface\{92DD4B20-DE93-4F74-8BCA-EC7F88FDAC5D} Medium
Virtual Bouncer HKCR\Interface\{950695DA-8F77-4852-AD93-8C1E64995D4B} Medium
Virtual Bouncer HKCR\TypeLib\{6F65ED0D-066E-4C92-B442-2704E7B64111} Medium
Virtual Bouncer HKLM\SOFTWARE\Chilkat Software, Inc.\ChilkatZip.ChilkatZip Medium
akamai.downloadv3.com {469C7080-8EC8-43A6-AD97-45848113743C} High
akamai.downloadv3.com {EEECA057-AD0F-44A7-8BE5-8634CEDBDBD1} High
Virtual Bouncer {18BBDF4D-611D-41CE-A7E7-B2DD23C250D1} Medium
Virtual Bouncer {8551311D-F3BF-4718-AD66-96E302500735} Medium
Virtual Bouncer {CE23505D-68FB-4C49-AE4B-D4F1CF86A2C4} Medium
Virtual Bouncer {DB90DEA9-0897-4B02-9FE0-1E321A22EAB0} Medium
Virtual Bouncer {DB92433D-1902-4789-BAFC-B46B0DCDEBB7} Medium
Virtual Bouncer {EC352548-52B5-41AC-B8C1-8CB561ECF7AD} Medium
IEPlugin C:\WINDOWS\Profiles\Burkhard\Anwendungsdaten\Sskknwrd.dll Medium
EasyWebSearch C:\WINDOWS\Profiles\Burkhard\Anwendungsdaten\Sskuknwrd.dll High

---------------------------------------------
Trotz sorgfältiger registry Entfernung im abges. Modus keine Erfolge!
Bitte helft mir! DANKE!