Laie braucht Hilfe!

cherrydoll

Hallo,

ich hab ein furchtbares Problem. Beim PC (1 1/2 Jahre jung) scheint mit so ziemlich allem infiziert zu sein was es gibt... Hab anscheinend einige Backdoorprgramme (Wörter in Texten werden bei mir einfach so als Links unterlegt zB. "bed" oder "credit" oder "marketing" und beim draufklicken gelange ich zu www.searchmiracle.com), weiters hab ich immer beim Hochfahren ein Programm oben namens "Click Me" das sich immer neu installiert wenn ich es deinstalliere.

Ausserdem ist mein PC super, super, super langsam und kaum mehr zu gebrauchen. Ich bin ein totaler Laie in solchen Sachen, brauche dringend Hilfe!

Hab Anti Vir installiert und MicroWorld AntiVirus und AntiVir findet immer nur TR/StartPage.nk.8.A und die Virus Log Information von Micro World lautet (kA ob euch das helfen kann):

File C:\windows\System32\ncsvc32.exe infected by "Backdoor.Win32.Agobot.gen" Virus! Action Taken: No Action Taken.
File C:\windows\System32\tsk.exe infected by "Backdoor.Win32.Rbot.gen" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\ELITET~1\ELITET~2.DLL tagged as "not-a-virus:AdWare.ToolBar.EliteBar.af". Action Taken: No Action Taken.
File C:\WINDOWS\ELITES~1\ELITES~1.DLL tagged as "not-a-virus:AdWare.ToolBar.EliteBar.z". Action Taken: No Action Taken.
File C:\WINDOWS\ELITET~1\ELITET~2.DLL tagged as "not-a-virus:AdWare.ToolBar.EliteBar.af". Action Taken: No Action Taken.
File C:\WINDOWS\ELITES~1\ELITES~1.DLL tagged as "not-a-virus:AdWare.ToolBar.EliteBar.z". Action Taken: No Action Taken.
File C:\windows\system32\ncsvc32.exe infected by "Backdoor.Win32.Agobot.gen" Virus! Action Taken: No Action Taken.
File C:\windows\system32\tsk.exe infected by "Backdoor.Win32.Rbot.gen" Virus! Action Taken: No Action Taken.
File C:\windows\system32\wuadampr.exe infected by "Backdoor.Win32.Rbot.gen" Virus! Action Taken: No Action Taken.
Object "Alexa Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "BlazeFind Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "ElitebarBHO Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "ElitebarBHO Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "istbar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "EliteBar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\AdManCtlX.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\AdManCtlX.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\DIMM.DLL". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Gemeinsame Dateien\InstallShield\engine\6\Intel 32\ILog.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\DOKUME~1\Madeau\LOKALE~1\Temp\_ISTMP4.DIR\_ISTMP0.DIR\FileGrp\Msvcrt10.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\system32\AXDist.exe". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{04B29FDD-F820-45CF-AD60-233FC7392676}" refers to invalid object "C:\Programme\Logitech\ImageStudio\WASpLf.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0DED49D5-A8B7-4d5d-97A1-12B0C195874D}" refers to invalid object "BdaPlgin.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6}" refers to invalid object "C:\WINDOWS\Downloaded Program Files\AdManCtlX.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{88E729D6-BDC1-11D1-BD2A-00C04FB9603F}" refers to invalid object "fde.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B0693766-5278-4ec6-B9E1-3CE40560EF5A}" refers to invalid object "CaPlgin.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{D98E820F-6ACD-4dc0-921E-9841E3D8B4A7}" refers to invalid object "I:\player\WMMP.EXE". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{F4C6D6E0-A8FB-4281-BE24-1662D646FE2B}" refers to invalid object "I:\player\WMMP.EXE". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{F83865C0-92C3-11d3-B41E-0010DC973BDB}" refers to invalid object "CamExL20.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{F83865C2-92C3-11d3-B41E-0010DC973BDB}" refers to invalid object "CamExL20.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{F83865C3-92C3-11d3-B41E-0010DC973BDB}" refers to invalid object "CamExL20.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{FBE840E5-13A5-4cff-B2A9-4D1E64A17FF2}" refers to invalid object "I:\player\WMMP.EXE". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{FD0A5AF3-B41D-11d2-9C95-00C04F7971E0}" refers to invalid object "BdaPlgin.ax". Action Taken: No Action Taken.
Entry "HKCR\CDDBControlApple.CddbFullName.1" refers to invalid object "{63338267-37c4-44cf-8e46-756fbe9c8fdc}". Action Taken: No Action Taken.
Entry "HKCR\CDDBControlApple.FullName" refers to invalid object "{63338267-37c4-44cf-8e46-756fbe9c8fdc}". Action Taken: No Action Taken.
Entry "HKCR\UpViewSvr.UpViewProxy" refers to invalid object "{4B120618-33E1-4D98-B83F-0A3A9989B8B8}". Action Taken: No Action Taken.
Entry "HKCR\UpViewSvr.UpViewProxy.1" refers to invalid object "{4B120618-33E1-4D98-B83F-0A3A9989B8B8}". Action Taken: No Action Taken.
File C:\windows\System32\ehyuen.exe infected by "Backdoor.Win32.PoeBot.b" Virus! Action Taken: No Action Taken.
File C:\windows\System32\elitehhr32.exe infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\windows\System32\msweb.scr infected by "Backdoor.Win32.Rbot.gen" Virus! Action Taken: No Action Taken.
File C:\windows\System32\rdriv.sys infected by "Trojan.Win32.Rootkit.k" Virus! Action Taken: No Action Taken.
File C:\windows\System32\risolsv32.dll infected by "Trojan-Downloader.Win32.Small.atj" Virus! Action Taken: No Action Taken.
File C:\windows\System32\rxhost.exe infected by "Backdoor.Win32.Rbot.gen" Virus! Action Taken: No Action Taken.
File C:\windows\System32\sndloader.exe.poly infected by "Backdoor.Win32.Agobot.gen" Virus! Action Taken: No Action Taken.
File C:\windows\System32\svhost.exe.poly infected by "Backdoor.Win32.Agobot.gen" Virus! Action Taken: No Action Taken.
File C:\DOKUME~1\Madeau\LOKALE~1\Temp\uninstall.exe tagged as "not-a-virus:AdWare.ToolBar.EliteBar.q". Action Taken: No Action Taken.
File C:\DOKUME~1\Madeau\LOKALE~1\TEMPOR~1\Content.IE5\SZ8FEFYB\EliteBar60[1].dll tagged as "not-a-virus:AdWare.ToolBar.EliteBar.af". Action Taken: No Action Taken.
File C:\DOKUME~1\Madeau\LOKALE~1\TEMPOR~1\Content.IE5\WNPBAEJP\protector[1].exe infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.




Bitte, bitte, bitte helft mir. Brauch den PC unbedingt zum Arbeiten aber momentan kann ich GAR nichts mehr machen, weil er so langsam ist.

Danke!


**edit: Das Log von diesem Hjiack Ding

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\windows\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\windows\System32\svchost.exe
C:\windows\Explorer.EXE
C:\Programme\iTunes\iTunesHelper.exe
C:\Programme\QuickTime\qttask.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Programme\Logitech\Video\LogiTray.exe
C:\windows\System32\ncsvc32.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\MSN Messenger\MsnMsgr.Exe
C:\Programme\iPod\bin\iPodService.exe
C:\Programme\Logitech\Video\FxSvr2.exe
C:\windows\System32\ctfmon.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\windows\System32\tsk.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Dokumente und Einstellungen\Madeau\Lokale Einstellungen\Temp\Temporäres Verzeichnis 1 für hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchmiracle.com/sp.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINDOWS\ELITET~1\ELITET~2.DLL
O2 - BHO: &EliteSideBar - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - C:\WINDOWS\EliteSideBar\EliteSideBar 08.dll
O4 - HKLM\..\Run: [iTunesHelper] C:\Programme\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Programme\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Programme\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [Nvidia Control Panel] ncsvc32.exe
O4 - HKLM\..\Run: [Microsoft Update] tsk.exe
O4 - HKLM\..\RunServices: [MSSWINHELP] wuadampr.exe
O4 - HKLM\..\RunServices: [Nvidia Control Panel] ncsvc32.exe
O4 - HKLM\..\RunServices: [Microsoft Update] tsk.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] C:\Programme\Logitech\Video\ManifestEngine.exe boot
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Update] tsk.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\windows\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\windows\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/GamesUnlimited/ie/bridge-c6.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by18fd.bay18.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {E6A3C1E2-F792-483E-9133-596215172BE9} (AcceptLang Class) - http://runonce.msn.com/setacceptlang.cab
O23 - Service: Microsoft SVHOST Configuration Service (a3) - Unknown owner - C:\WINDOWS\System32\svhost.exe" -service (file missing)
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: AVP-SE - Unknown owner - C:\WINDOWS\System32\avp-32.exe" -service (file missing)
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Sound Loader (SndMgr) - Unknown owner - C:\WINDOWS\System32\sndloader.exe" -service (file missing)
_____________
Anm.
Aktive Links editiert!
Beachte zukünftig die Hinweise dieser Anleitung: HiJackThis.


LG Cidre
S-Mod TB