Bitte um Hilfe - Trajan Downloader Agent

Kov1234

Könnt Ihr mir helfen.?
Habe folgendes Problem:
Beim Hochstarten des Rechners, öffnet sich der IE automatisch mit einer
mns-Search-Seite und ich bekomme die Trojaner Download Agent bzw. TrojanAgent. Warnmeldungen.
Habe schon mit HijackThis gescannt => Ergebniss:

Logfile of HijackThis v1.99.1
Scan saved at 20:25:16, on 27.04.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
D:\Downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\kjucn.dll/sp.html#83556
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\kjucn.dll/sp.html#83556
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\kjucn.dll/sp.html#83556
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\kjucn.dll/sp.html#83556
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\kjucn.dll/sp.html#83556
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\kjucn.dll/sp.html#83556
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\kjucn.dll/sp.html#83556
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1A3AAC53-69B3-F769-1199-284A99589CE9} - C:\WINDOWS\winzf.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\windows\downloaded program files\googletoolbar1.dll
O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\windows\downloaded program files\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [VOBRegCheck] C:\WINDOWS\System32\VOBREGCheck.exe -CheckReg
O4 - HKLM\..\Run: [PCMService] C:\Programme\Medion Home CinemaXL\PowerCinema\PCMService.exe
O4 - HKLM\..\Run: [CloneCDTray] C:\Programme\Elaborate Bytes\CloneCD\CloneCDTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [IEXPLORE.EXE] C:\Programme\Internet Explorer\IEXPLORE.EXE
O4 - HKCU\..\Run: [HitwarePKLite] C:\Programme\Hitware Popup Killer Lite\HitwarePKLite.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Kodak EasyShare Software.lnk = C:\Programme\KODAK\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\windows\downloaded program files\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Im Cache gespeicherte Seite - res://c:\windows\downloaded program files\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Verweisseiten - res://c:\windows\downloaded program files\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Ähnliche Seiten - res://c:\windows\downloaded program files\GoogleToolbar1.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra button: MedionShop - {CCB1B892-287D-49A8-9F7F-C012D65F85E9} - http://www.medionshop.de/ (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\programme\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/de/bi.../GoogleNav.cab
O16 - DPF: {7C559105-9ECF-42B8-B3F7-832E75EDD959} (Installer Class) - http://www.xxxtoolbar.com/ist/softwa...006_cracks.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/sh...20/mcgdmgr.cab
O16 - DPF: {C1C2AC28-5E4B-4228-B7A0-05E986FFCE14} (TIBSLoader Class) - http://directplugin.com/tl4000.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Dcfssvc - Eastman Kodak Company - C:\WINDOWS\system32\drivers\dcfssvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programme\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programme\ewido\security suite\ewidoguard.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe


Das ganze habe ich im abgesicherten Modus gemacht, danach habe ich mit e´scan geprüft und die meisten infected Stellen manuell gelöscht.

Danach habe ich e´scan erneut gestartet Ergebniss:


Wed Apr 27 17:47:03 2005 => Scanning HKLM\SYSTEM\CurrentControlSet\Services\VxD
Wed Apr 27 17:47:03 2005 => Scanning File C:\WINDOWS\system32\JAVASUP.VXD
Wed Apr 27 17:47:09 2005 => System found infected with XXXToolbar Spyware/Adware ({7C559105-9ECF-42B8-B3F7-832E75EDD959})! Action taken: No Action Taken.
Wed Apr 27 17:47:09 2005 => File System Found infected by "XXXToolbar Spyware/Adware" Virus. Action Taken: No Action Taken.

Wed Apr 27 17:47:09 2005 => System found infected with Alexa Spyware/Adware ({c95fe080-8f5d-11d2-a20b-00aa003c157a})! Action taken: No Action Taken.
Wed Apr 27 17:47:09 2005 => File System Found infected by "Alexa Spyware/Adware" Virus. Action Taken: No Action Taken.

Wed Apr 27 17:47:09 2005 => Offending value found in HKLM\Software\vendor !!!
Wed Apr 27 17:47:09 2005 => System found infected with vendor Spyware/Adware! Action taken: No Action Taken.
Wed Apr 27 17:47:09 2005 => File System Found infected by "vendor Spyware/Adware" Virus. Action Taken: No Action Taken.

Wed Apr 27 17:47:09 2005 => Offending value found in HKLM\Software\Microsoft\Windows\CurrentVersion\uninstall\TwainTec !!!

Wed Apr 27 17:47:09 2005 => System found infected with TwainTec Spyware/Adware! Action taken: No Action Taken.

Wed Apr 27 17:47:09 2005 => File System Found infected by "TwainTec Spyware/Adware" Virus. Action Taken: No Action Taken.

Wed Apr 27 17:47:18 2005 => File C:\WINDOWS\kjucn.dll infected by "not-a-virus:AdWare.SearchPage" Virus. Action Taken: No Action Taken.

Wed Apr 27 17:47:19 2005 => File C:\WINDOWS\NDNuninstall5_40.exe infected by "not-a-virus:AdWare.NewDotNet" Virus. Action Taken: No Action Taken.

Wed Apr 27 17:47:19 2005 => Scanning File C:\WINDOWS\NDNuninstall5_48.exe
Wed Apr 27 17:47:19 2005 => File C:\WINDOWS\NDNuninstall5_48.exe infected by "not-a-virus:AdWare.NewDotNet" Virus. Action Taken: No Action Taken.

Wed Apr 27 17:47:19 2005 => Scanning File C:\WINDOWS\NDNuninstall5_64.exe
Wed Apr 27 17:47:19 2005 => File C:\WINDOWS\NDNuninstall5_64.exe infected by "not-a-virus:AdWare.NewDotNet" Virus. Action Taken: No Action Taken.

Wed Apr 27 17:47:19 2005 => Scanning File C:\WINDOWS\NDNuninstall6_10.exe
Wed Apr 27 17:47:19 2005 => File C:\WINDOWS\NDNuninstall6_10.exe infected by "not-a-virus:AdWare.NewDotNet" Virus. Action Taken: No Action Taken.

Wed Apr 27 17:47:19 2005 => Scanning File C:\WINDOWS\NDNuninstall6_22.exe
Wed Apr 27 17:47:19 2005 => File C:\WINDOWS\NDNuninstall6_22.exe infected by "not-a-virus:AdWare.NewDotNet" Virus. Action Taken: No Action Taken.
Wed Apr 27 17:56:23 2005 => File C:\Dokumente und Einstellungen\Istvan\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-7d9192de-5dc60f8c.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: No Action Taken.

Wed Apr 27 20:10:00 2005 => Total Objects Scanned: 68817
Wed Apr 27 20:10:00 2005 => Total Virus(es) Found: 25
Wed Apr 27 20:10:00 2005 => Total Disinfected Files: 0
Wed Apr 27 20:10:00 2005 => Total Files Renamed: 0
Wed Apr 27 20:10:00 2005 => Total Deleted Objects: 0
Wed Apr 27 20:10:00 2005 => Total Errors: 71
Wed Apr 27 20:10:00 2005 => Time Elapsed: 02:16:28
Wed Apr 27 20:10:00 2005 => ***** Scanning complete. *****
Wed Apr 27 20:10:01 2005 => Virus Database Date: 2005/04/20
Wed Apr 27 20:10:01 2005 => Virus Database Count: 126821

Nach dem normalen Neustart ist das Problem noch immer da.
Kann mir jemand dazu etwas sagen, habe ich etwas nicht gemacht?
Kann man diese Trojaner überhaupt manuell entfernen?

Danke im Voraus