Abend,

ich bin zufällig auf dieses forum gestolpert da ich mir sicher bin dass ich einen trojaner auf dem rechner habe, habe ein log mit dem Hijack gemacht und bitte euch, euch das anzuschauen falls euch was auffällt bitte noch ein tipp dazu wie ich das fixen kann.

Danke im Vorraus.

LOG:
Logfile of HijackThis v1.99.0
Scan saved at 17:48:12, on 02.02.2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\Programme\ICQLite\ICQLite.exe
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programme\Gemeinsame Dateien\CMEII\CMESys.exe
C:\Programme\Winamp\winampa.exe
C:\WINDOWS\ddqjxjwl.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\Gemeinsame Dateien\GMT\GMT.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Programme\Norton AntiVirus\navapsvc.exe
C:\Programme\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Programme\ISTsvc\istsvc.exe
C:\Dokumente und Einstellungen\Andreas Hofmann\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://x-search.cc/search.php?v=6&aff=745406
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://x-search.cc/index.php?v=6&aff=745406
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.shadow-fighters.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.couldnotfind.com/search_p...ount_id=137233
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *new-search.net*;*x-google.net*
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O1 - Hosts file is located at: C:\WINDOWS\nsdb\hosts
O1 - Hosts: 82.179.166.192 new-search.net
O1 - Hosts: 82.179.166.190 x-google.net
O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - C:\WINDOWS\wsem303.dll
O2 - BHO: WHttpHelper Class - {9896231A-C487-43A5-8369-6EC9B0A96CC0} - C:\WINDOWS\System32\WStart.dll
O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - C:\Programme\SideFind\sfbho.dll (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-B72A4567E486} - C:\PROGRA~1\ISTbar\istbar.dll (file missing)
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Programme\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [CMESys] "C:\Programme\Gemeinsame Dateien\CMEII\CMESys.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [LXYGVUTON] C:\WINDOWS\ddqjxjwl.exe
O4 - HKLM\..\Run: [IST Service] C:\Programme\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: GStartup.lnk = C:\Programme\Gemeinsame Dateien\GMT\GMT.exe
O8 - Extra context menu item: Web Rebates - file://C:\Programme\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\Programme\SideFind\sidefind.dll (file missing)
O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - ms-its:mhtml:file://C:\foo.mht!http://82.179.166.145/x15.chm::/trs15.exe
O16 - DPF: {386A771C-E96A-421F-8BA7-32F1B706892F} (Installer Class) - http://www.xxxtoolbar.com/ist/softwa...06_regular.cab
O16 - DPF: {47CEF84E-92D8-4C4A-86D7-CB982889DCC0} (FlashNet Class) - http://mp1.mplay.oberon-media.com/client/flashnet.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1106778044285
O16 - DPF: {8FA9D107-547B-4DBC-9D88-FABD891EDB0A} (shizmoo Class) - http://playroom.icq.com/odyssey_web11.cab
O18 - Filter: text/html - {4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB} - C:\WINDOWS\System32\xplugin.dll
O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe
O23 - Service: Norton AntiVirus Auto-Protect-Dienst - Symantec Corporation - C:\Programme\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection - Symantec Corporation - C:\Programme\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\GEMEIN~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\SymWSC.exe

Hallo,

Mach mal einen escan im abgesicherten Modus,geh dazu nach dieser Anleitung vor,um zu sehen ob es sich überhaupt lohnt deinen Rechner zu retten

http://www.trojaner-board.de/42731-escan-anleitung.html Anleitung

http://www.mwti.net/antivirus/free_utilities.asp Download

poste dann was gefunden wird!

Gruss

hilft wohl alles nichts: F-O-R-M-A-T-I-E-R-E-N

File C:\WINDOWS\wsem303.dll infected by "Trojan-Downloader.Win32.Dyfuca.dt" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\WStart.dll infected by "Backdoor.Agent.bc" Virus. Action Taken: No Action Taken.
File C:\PROGRA~1\GEMEIN~1\CMEII\CMESys.exe infected by "not-a-virus:AdWare.Gator.6034" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\ddqjxjwl.exe infected by "Trojan-Downloader.Win32.IstBar.go" Virus. Action Taken: No Action Taken.
File C:\Programme\ISTsvc\istsvc.exe infected by "Trojan-Downloader.Win32.IstBar.gm" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\ivlwqi.exe infected by "Trojan-Downloader.Win32.IstBar.go" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\nem220.dl$ infected by "TrojanDownloader.Win32.Dyfuca.gen" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\syvbbe.exe infected by "Trojan-Downloader.Win32.IstBar.go" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\angelex.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\exul.exe infected by "not-a-virus:AdWare.BargainBuddy.q" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\exul1.exe infected by "not-a-virus:AdWare.BargainBuddy.q" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\instsrv.exe tagged as not-a-virus:RiskWare.Tool.ServiceRunner.f. No Action Taken.
File C:\WINDOWS\System32\javexulm.vxd infected by "not-a-virus:AdWare.BargainBuddy.q" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\mac80ex.idf infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\msbe.dl$ infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\netut80ex.vxd infected by "not-a-virus:AdWare.BargainBuddy.q" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\supd160105.exe infected by "TrojanDownloader.Win32.Esepor.m" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\tksrv99.exe infected by "TrojanDownloader.Win32.Esepor.aa" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\tmksrvu.exe infected by "Trojan-Downloader.Win32.Esepor.ab" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\trkgif.exe infected by "Trojan-Clicker.Win32.VB.ex" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\tsrv1420.exe infected by "Trojan.Win32.LowZones.ae" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\ucs44.exe infected by "Backdoor.Agent.bc" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\xplugin.dll infected by "Trojan-Downloader.Win32.Esepor.ac" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\Temp\5TbJrY.exe infected by "Trojan-Downloader.Win32.IstBar.gn" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\Temp\bb.exe infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\Temp\DJnFd8.exe infected by "Trojan-Downloader.Win32.IstBar.gn" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\Temp\iinstall.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\Temp\optimize.exe infected by "Trojan-Downloader.Win32.Dyfuca.du" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\Temp\QpnrB7.exe infected by "Trojan-Downloader.Win32.IstBar.gn" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\Temp\sidefind.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\Temp\webrebates.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\TEMPOR~1\Content.IE5\4LOP2BOP\istsvc[1].exe infected by "Trojan-Downloader.Win32.IstBar.gm" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\TEMPOR~1\Content.IE5\6NIDFXLH\prompt[1].htm infected by "Trojan-Downloader.JS.IstBar.b" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\TEMPOR~1\Content.IE5\6NIDFXLH\prompt[1].php infected by "Trojan-Downloader.JS.IstBar.b" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\TEMPOR~1\Content.IE5\CP63KTAR\0006_regular[1].cab infected by "Trojan-Downloader.Win32.IstBar.gu" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\TEMPOR~1\Content.IE5\CP63KTAR\actalert[1].exe infected by "Trojan-Downloader.Win32.Dyfuca.dp" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\TEMPOR~1\Content.IE5\CP63KTAR\ggg[1].dat infected by "Trojan.Win32.LowZones.ae" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\TEMPOR~1\Content.IE5\CP63KTAR\sfbho13[1].dll infected by "not-a-virus:AdWare.ToolBar.SideFind" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\TEMPOR~1\Content.IE5\E147ULY5\optimize[1].exe infected by "Trojan-Downloader.Win32.Dyfuca.du" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\TEMPOR~1\Content.IE5\E147ULY5\sidefind13[1].dll infected by "not-a-virus:AdWare.ToolBar.SideFind" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\TEMPOR~1\Content.IE5\E147ULY5\wsem303[1].dll infected by "Trojan-Downloader.Win32.Dyfuca.dt" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\TEMPOR~1\Content.IE5\GPJG0U9U\protect[1].htm infected by "Trojan-Downloader.JS.IstBar.d" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\TEMPOR~1\Content.IE5\GPJG0U9U\protect[1].php infected by "Trojan-Downloader.JS.IstBar.d" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\TEMPOR~1\Content.IE5\GPJG0U9U\xltmks2[1].dat infected by "TrojanDownloader.Win32.Esepor.aa" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\TEMPOR~1\Content.IE5\IL8ZE9Y5\istrecover[1].exe infected by "Trojan-Downloader.Win32.IstBar.go" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\TEMPOR~1\Content.IE5\K5M3KXYF\istbar_mainstream[1].dll infected by "Trojan-Downloader.Win32.IstBar.gj" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\TEMPOR~1\Content.IE5\K5M3KXYF\ncase_new[1].exe infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\TEMPOR~1\Content.IE5\K5M3KXYF\ucs[1].dat infected by "Backdoor.Agent.bc" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\TEMPOR~1\Content.IE5\KXWL2BK1\bb[1].exe infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\TEMPOR~1\Content.IE5\KXWL2BK1\CA039875.HTM infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\TEMPOR~1\Content.IE5\KXWL2BK1\nem220[1].dll infected by "TrojanDownloader.Win32.Dyfuca.gen" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\TEMPOR~1\Content.IE5\KXWL2BK1\sidefind[1].exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\TEMPOR~1\Content.IE5\KXWL2BK1\webrebates_europe[1].exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\TEMPOR~1\Content.IE5\SB3E8UEL\hpp3n[1].hta infected by "Trojan.JS.StartPage.a" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\TEMPOR~1\Content.IE5\SB3E8UEL\trs15[1].exe infected by "TrojanDownloader.Win32.Small.yw" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\ANDREA~1\LOKALE~1\TEMPOR~1\Content.IE5\X0UCLUFL\x15[1].chm infected by "TrojanDownloader.Win32.Small.yw" Virus. Action Taken: No Action Taken.

hilft wohl alles nichts: F-O-R-M-A-T-I-E-R-E-N

Genau. Dein System ist kompromittiert; es ist nicht mehr vertrauenswürdig.
Installiere windows neu und beachte diese Anleitung

Ja leider http://www.trojaner-board.de/showthread.php?t=12154 <<lesen!!