Habe laufend irgendwelche Internetseiten auf dem PC
Hier mein HIjack log file

Logfile of HijackThis v1.99.0
Scan saved at 10:30:10, on 14.02.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Java\j2re1.4.2_06\bin\jusched.exe
C:\WINDOWS\System32\mshelp32.exe
C:\WINDOWS\System32\IKAutoUp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\Messenger\MSMSGS.EXE
C:\Dokumente und Einstellungen\AV1\Anwendungsdaten\sstr.exe
C:\WINDOWS\System32\??rvices.exe
C:\Programme\Ulead Systems\Ulead PhotoImpact\ABMTSR.EXE
C:\IKARUS\GUARDNT\guardnt.exe
C:\Programme\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\Programme\WinZip\WZQKPICK.EXE
C:\Programme\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\high\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O2 - BHO: (no name) - {A708A39C-8DA7-4e36-B3B0-0A1FFAFD4B6D} - C:\WINDOWS\system32\javafix3.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [USSShReg] C:\PROGRA~1\ULEADS~1\ULEADP~1\SSaver\Ussshreg.exe /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [mshelp32] C:\WINDOWS\System32\mshelp32.exe
O4 - HKLM\..\Run: [ControlPanel] C:\WINDOWS\System32\cmd32.exe internat.dll,LoadKeyboardProfile
O4 - HKLM\..\Run: [nufevo] c:\windows\system32\nufevo.exe
O4 - HKLM\..\Run: [Ikarus-AutoUpdate] C:\WINDOWS\System32\IKAutoUp.exe /LOG
O4 - HKLM\..\Run: [Guard NT] C:\IKARUS\GUARDNT\GuardNT.exe /STARTDLG /CPYTOKEN
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [msjava critical update] c:\windows\jjfixer.exe
O4 - HKCU\..\Run: [Pae] C:\Dokumente und Einstellungen\AV1\Anwendungsdaten\sstr.exe
O4 - HKCU\..\Run: [Qgxdnmmd] C:\WINDOWS\System32\??rvices.exe
O4 - Startup: VNC.lnk = C:\Programme\WinVNC\WinVNC.exe
O4 - Global Startup: Album Fast Start.lnk = C:\Programme\Ulead Systems\Ulead PhotoImpact\ABMTSR.EXE
O4 - Global Startup: AutoCAD-Startbeschleuniger.lnk = C:\Programme\Gemeinsame Dateien\Autodesk Shared\acstart16.exe
O4 - Global Startup: VNC.lnk = C:\Programme\WinVNC\WinVNC.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1095698426162
O16 - DPF: {74F5614A-8A8C-43B4-8CC2-4B4EFAF4A6C5} (TSCCInstall Class) - http://www.techsmith.com/codec/tsccinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D3405E49-9480-4700-82BA-A164EB856361}: NameServer = 213.33.99.70,80.120.17.70
O18 - Filter: text/html - {BDDAD968-807C-4473-92F8-FCE1101E4C80} - C:\Dokumente und Einstellungen\AV1\Lokale Einstellungen\Anwendungsdaten\microsoft\internet explorer\V0.26.dat
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Programme\Gemeinsame Dateien\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Guard NT - Ikarus Software Wien - C:\IKARUS\GUARDNT\guardnt.exe

@harry21

Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Dein Windows ist nich auf dem neuesten Stand.

C:\WINDOWS\System32\mshelp32.exe
C:\Dokumente und Einstellungen\AV1\Anwendungsdaten\sstr.exe

Malware. Prozesse aufsuchen und beenden.

C:\WINDOWS\System32\??rvices.exe

Was soll das?

O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch

Fixen

O4 - HKLM\..\Run: [mshelp32] C:\WINDOWS\System32\mshelp32.exe

Fixen.

O4 - HKLM\..\Run: [nufevo] c:\windows\system32\nufevo.exe

Fixen

O4 - HKCU\..\Run: [Pae] C:\Dokumente und Einstellungen\AV1\Anwendungsdaten\sstr.exe
O4 - HKCU\..\Run: [Qgxdnmmd] C:\WINDOWS\System32\??rvices.exe

Fixen.
Über meine Kristallkugel sehe ich, dass du an einem Firmen-PC ein Haufen Müll gesammelt hast.
Ich bin zu 99% sicher, dass auch das Fixen der zitierten Einträge nichts bringt, ergo - PC muss neu formatiert werden.

Was meinst du mit

Was soll das?? bei ??rvices.exe

nagut dann erklär ich das ganze eben neu....
ich vermute einen rbot..
lass die datei mshlp32.exe im ordner c:\windows\system32 bei http://virusscan.jotti.org/de überprüfen und poste das ergebnis.
er meint, wieso deine datei ??rvices.exe heißt und nicht services.exe.
ich vermute dort auch einen backdoor..

Hier das Ergebnis



Service load: 0% 100%

File: mshelp32.exe
Status: INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
Packers detected: FSG

AntiVir TR/Dldr.Banker.IV.2 (0.34 seconds taken)
Avast No viruses found (1.53 seconds taken)
AVG Antivirus No viruses found (0.79 seconds taken)
BitDefender Trojan.Proxy.Small.AN (0.45 seconds taken)
ClamAV Trojan.Downloader.Small-4 (0.57 seconds taken)
Dr.Web Trojan.Proxy.127 (0.82 seconds taken)
F-Prot Antivirus W32/Backdoor.NI (0.08 seconds taken)
Fortinet No viruses found (0.38 seconds taken)
Kaspersky Anti-Virus Trojan-Proxy.Win32.Small.an (1.00 seconds taken)
mks_vir Trojan.Proxy.Small.An (0.21 seconds taken)
NOD32 Win32/TrojanProxy.Small.AN (0.46 seconds taken)
Norman Virus Control Sandbox: W32/Malware; [ General information ]

* File might be compressed.
* File length: 10096 bytes.

[ Changes to filesystem ]
* Creates file C:\WINDOWS\SYSTEM\mshelp32.exe.
* Creates file C:\sample.bat.

[ Changes to registry ]
* Creates value "mshelp32"="C:\WINDOWS\SYSTEM\mshelp32.exe" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\Run".

[ Security issues ]
* Possible backdoor functionality [UNKNOWN] port 8885.
* Possible backdoor functionality [UNKNOWN] port 8886.

[ Process/window information ]
* Creates a mutex En_6.
* Will automatically restart after boot (I'll be back...). (1.11 seconds taken)

Statistics
Last piece of malware found was TR/Dldr.Banker.IV.2 in mshelp32.exe, detected by:

Scanner Malware name Time taken
AntiVir TR/Dldr.Banker.IV.2 0.34 seconds
Avast X 1.53 seconds
AVG Antivirus X 0.78 seconds
BitDefender Trojan.Proxy.Small.AN 0.45 seconds
ClamAV Trojan.Downloader.Small-4 0.97 seconds
Dr.Web Trojan.Proxy.127 0.82 seconds
F-Prot Antivirus W32/Backdoor.NI 0.08 seconds
Fortinet X 0.38 seconds
Kaspersky Anti-Virus Trojan-Proxy.Win32.Small.an 1.00 seconds
mks_vir Trojan.Proxy.Small.An 0.21 seconds
NOD32 Win32/TrojanProxy.Small.AN 0.46 seconds
Norman Virus Control Sandbox: W32/Malware 1.11 seconds



Service statistics:

587 files (481 of those unique) have been uploaded & scanned since 14/02/2005, the day of the last database purge.
144 of those 481 files contained a virus or any other form of malware.
This page has been visited 860 times in this time period.
This service managed to spot 9 pieces of malware no vendor used knew about at the time of uploading.
The service also warned against 84 suspicious files without any help from scanner results.
However, 0 files reported to be OK were found out to be malware later (this is checked daily).
As far as can be told, all this together makes this service 100.00% accurate. However, since it is very well possible malware has been uploaded no scanner knows about at this time, this number is to be taken with a proper amount of skepticism.

No I am not sitting still! A new, better version of this service is being developed.
If you have suggestions and/or comments, please send me them!

ohoh ein backdoor..
ich wusste es. zwar kein rbot aber trotzdem schlimm...
dein system ist kompromittiert; es ist nicht mehr vertrauenswürdig.
installiere windows neu und beachte diese Anleitung