hab ein mittelgrosses problem

wenn ich eine verbindung zum internet habe und den internet explorer starte bekomme ich von antivir laufend trojanermeldungen - ich kann danach aber mit verschiedenen programmen nicht finden
anbei mein log mit bitte um hilfe


Logfile of HijackThis v1.99.0
Scan saved at 12:02:02, on 13.06.2005
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\ibmpmsvc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\WINNT\System32\Ati2evxx.exe
C:\Inoculan\GetBBS.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\Cisco Systems\VPN Client\cvpnd.exe
C:\Programme\CA\SharedComponents\DesktopCommonServices\DMPrimer\dmprimer.exe
C:\WINNT\system32\hidserv.exe
C:\Inoculan\INOJOBSV.EXE
C:\WINNT\LogWatNT.exe
C:\Programme\CA\Unicenter Remote Control\rcHost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\TNGSD\BIN\SDSERV.EXE
C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\TNGSD\BIN\TRIGGAG.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\UMCSTUB.EXE
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\TNGSD\BIN\triggusr.exe
C:\WINNT\AGRSMMSG.exe
C:\WINNT\USBNUMP.exe
C:\WINNT\system32\CNOServerLauncher.exe
C:\Programme\CA\Unicenter Asset Management\Agents\amagent.exe
C:\SxpInst\sxplog32.exe
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\WINNT\system32\internat.exe
C:\Inoculan\realmon.exe
C:\Programme\CA\Unicenter Asset Management\Agents\umcliwnt.exe
C:\Programme\CA\Unicenter Asset Management\Agents\cam.exe
C:\Programme\CA\Unicenter Asset Management\Agents\bin\caftf.exe
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOKUME~1\gbrauch\LOKALE~1\Temp\HijackThis.exe


R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Class - {5DCB7C15-BEDD-230C-CB3F-FD2CE2AA0CC2} - C:\WINNT\system32\sdkcu32.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SDJobCheck] triggusr.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NUMPADL] USBNUMP.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CnOServerLauncher] CNOServerLauncher.exe
O4 - HKLM\..\Run: [Sxplog] C:\SxpInst\sxpstub.exe
O4 - HKLM\..\Run: [CA-AMAgent] C:\Programme\CA\Unicenter Asset Management\Agents\amagent.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [iexplore.exe] C:\Programme\Internet Explorer\iexplore.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Global Startup: Realtime Monitor.LNK = C:\Inoculan\realmon.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O14 - IERESET.INF: START_PAGE_URL=http://info01/logon.asp
O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://C:\foo.mht!http://bin.wordsx.cc/u18pVyJpRO4-YJDdotbJ.chm::/on-line.exe
O16 - DPF: {11111111-1111-1111-1111-111191113457} - file://c:\ied_s7.cab
O16 - DPF: {11111111-1111-1111-1111-511111193457} - file://c:\x.cab
O16 - DPF: {11111111-1111-1111-1111-511111193458} - file://c:\x.cab
O16 - DPF: {11111111-1111-1111-1114-511155593469} - file://c:\x.cab
O16 - DPF: {24311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-17.cab
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - http://www.moviegroup.tv/activex/DownloadMgr.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = stgkk.sozvers.at
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = stgkk.sozvers.at
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = stgkk.sozvers.at
O23 - Service: Asset Management Agent - Computer Associates International, Inc. - C:\WINNT\UMCSTUB.EXE
O23 - Service: AntiVir Service - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - Unknown - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: AutoDownload Server - Computer Associates - C:\Inoculan\GetBBS.EXE
O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: CA-License Client - Unknown - C:\WINNT\Lic98Rmt.exe
O23 - Service: CA-License Server - Unknown - C:\WINNT\Lic98RmtD.exe
O23 - Service: Cisco Systems, Inc. VPN Service - Cisco Systems, Inc. - C:\Programme\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Verwaltungsdienst für die Verwaltung logischer Datenträger - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: DM Primer - Computer Associates - C:\Programme\CA\SharedComponents\DesktopCommonServices\DMPrimer\dmprimer.exe
O23 - Service: IBM PM Service - Unknown - C:\WINNT\System32\ibmpmsvc.exe
O23 - Service: InoculateIT E-mail Server - Unknown - C:\Inoculan\INEXCHSV.EXE
O23 - Service: InoculateIT Server - Unknown - C:\Inoculan\INOJOBSV.EXE
O23 - Service: Event Log Watch - Unknown - C:\WINNT\LogWatNT.exe
O23 - Service: Unicenter Remote Control Host - Computer Associates International, Inc. - C:\Programme\CA\Unicenter Remote Control\rcHost.exe
O23 - Service: Unicenter Software Delivery - Computer Associates International, Inc. - C:\TNGSD\BIN\SDSERV.EXE
O23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINNT\system32\ZoneLabs\vsmon.exe

vielen dank
_____________
Anm.
Aktive Links editiert!
Beachte zukünftig die Hinweise dieser Anleitung: HiJackThis.


LG Cidre
S-Mod TB

@ Wurzel98!

Hallo

1.) Dein System ist nicht upgedatet

2.) Veraltetes HijackThis nochmals scannen mit der neuesten Version

2.) Welche Funde meldet dein Scanner? Logfile wäre interessant.

3.) Scanne mit eScan nach dieser Anleitung und poste uns danach die Funde

hallo - anbei der neue logfile - kann zur zeit escan leider
nicht herunterladen vielleicht hilft schon diese datei sonst liefere ich
den rest noch nach


Logfile of HijackThis v1.99.1
Scan saved at 12:59:14, on 13.06.2005
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\ibmpmsvc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\WINNT\System32\Ati2evxx.exe
C:\Inoculan\GetBBS.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\Cisco Systems\VPN Client\cvpnd.exe
C:\Programme\CA\SharedComponents\DesktopCommonServices\DMPrimer\dmprimer.exe
C:\WINNT\system32\hidserv.exe
C:\Inoculan\INOJOBSV.EXE
C:\WINNT\LogWatNT.exe
C:\Programme\CA\Unicenter Remote Control\rcHost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\TNGSD\BIN\SDSERV.EXE
C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\TNGSD\BIN\TRIGGAG.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\UMCSTUB.EXE
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\TNGSD\BIN\triggusr.exe
C:\WINNT\AGRSMMSG.exe
C:\WINNT\USBNUMP.exe
C:\WINNT\system32\CNOServerLauncher.exe
C:\Programme\CA\Unicenter Asset Management\Agents\amagent.exe
C:\SxpInst\sxplog32.exe
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\WINNT\system32\internat.exe
C:\Inoculan\realmon.exe
C:\Programme\CA\Unicenter Asset Management\Agents\umcliwnt.exe
C:\Programme\CA\Unicenter Asset Management\Agents\cam.exe
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOKUME~1\gbrauch\LOKALE~1\Temp\HijackThis.exe
C:\Programme\CA\Unicenter Asset Management\Agents\camclose.exe
C:\Programme\CA\Unicenter Asset Management\Agents\SWMSPWNT.EXE


R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Class - {5DCB7C15-BEDD-230C-CB3F-FD2CE2AA0CC2} - C:\WINNT\system32\sdkcu32.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SDJobCheck] triggusr.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NUMPADL] USBNUMP.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CnOServerLauncher] CNOServerLauncher.exe
O4 - HKLM\..\Run: [Sxplog] C:\SxpInst\sxpstub.exe
O4 - HKLM\..\Run: [CA-AMAgent] C:\Programme\CA\Unicenter Asset Management\Agents\amagent.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [iexplore.exe] C:\Programme\Internet Explorer\iexplore.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Global Startup: Realtime Monitor.LNK = C:\Inoculan\realmon.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O14 - IERESET.INF: START_PAGE_URL=http://info01/logon.asp
O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://C:\foo.mht!h**p://bin.wordsx.cc/u18pVyJpRO4-YJDdotbJ.chm::/on-line.exe
O16 - DPF: {11111111-1111-1111-1111-111191113457} - file://c:\ied_s7.cab
O16 - DPF: {11111111-1111-1111-1111-511111193457} - file://c:\x.cab
O16 - DPF: {11111111-1111-1111-1111-511111193458} - file://c:\x.cab
O16 - DPF: {11111111-1111-1111-1114-511155593469} - file://c:\x.cab
O16 - DPF: {24311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - h**p://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-17.cab
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - h**p://www.moviegroup.tv/activex/DownloadMgr.cab

O20 - Winlogon Notify: nwprovau - C:\WINNT\SYSTEM32\nwprovau.dll
O23 - Service: Asset Management Agent (AmoAgent) - Computer Associates International, Inc. - C:\WINNT\UMCSTUB.EXE
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: AutoDownload Server - Computer Associates - C:\Inoculan\GetBBS.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: CA-License Client (CA_LIC_CLNT) - Unknown owner - C:\WINNT\Lic98Rmt.exe
O23 - Service: CA-License Server (CA_LIC_SRVR) - Unknown owner - C:\WINNT\Lic98RmtD.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Programme\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Verwaltungsdienst für die Verwaltung logischer Datenträger (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: DM Primer (DMPrimer) - Unknown owner - C:\Programme\CA\SharedComponents\DesktopCommonServices\DMPrimer\dmprimer.exe" -DMPRIMER_SERVICE_: (file missing)
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINNT\System32\ibmpmsvc.exe
O23 - Service: InoculateIT E-mail Server - Unknown owner - C:\Inoculan\INEXCHSV.EXE
O23 - Service: InoculateIT Server - Unknown owner - C:\Inoculan\INOJOBSV.EXE
O23 - Service: Event Log Watch (LogWatch) - Unknown owner - C:\WINNT\LogWatNT.exe
O23 - Service: Unicenter Remote Control Host (rcHost) - Computer Associates International, Inc. - C:\Programme\CA\Unicenter Remote Control\rcHost.exe
O23 - Service: Unicenter Software Delivery (SDService) - Computer Associates International, Inc. - C:\TNGSD\BIN\SDSERV.EXE
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINNT\system32\ZoneLabs\vsmon.exe

Hallo,

wechsel in den abgesicherten Modus http://www.systemwiederherstellung-d...indows-xp.html und fixe folgende Einträge (Scan mit HJT, Häckchen vor Eintrag und auf fix checked klicken):

R3 - Default URLSearchHook is missing
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O14 - IERESET.INF: START_PAGE_URL=http://info01/logon.asp
O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://C:\foo.mht!h**p://bin.wordsx.cc/u18pVyJpRO4-YJDdotbJ.chm::/on-line.exe
O16 - DPF: {11111111-1111-1111-1111-111191113457} - file://c:\ied_s7.cab
O16 - DPF: {11111111-1111-1111-1111-511111193457} - file://c:\x.cab
O16 - DPF: {11111111-1111-1111-1111-511111193458} - file://c:\x.cab
O16 - DPF: {11111111-1111-1111-1114-511155593469} - file://c:\x.cab
O16 - DPF: {24311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - h**p://www.moviegroup.tv/activex/DownloadMgr.cab

Lösche manuell:
c:\ied_s7.cab
c:\x.cab
c:\ex.cab
c:\eied_s7.cab
C:\foo.mht
C:\WINNT\web\related.htm

Papierkorb leeren

Neustart

Versuch nochmals Escan zu laden und dann entspr. der Anleitung auszuführen.

Windowsupdate nicht vergessen.

dartus

hallo

hab die anweisungen soweit ausgeführt - die meisten Dateien waren aber nicht mehr vorhanden - konnte ich daher auch nicht löschen - hab die einträge aber gefixt
nur R3 - Default URLSearchHook is missing kam nicht im abgesicherten modus - hab es dann im normalmodus probiert


anbei nun das ergebnis von escan und nochmals von hijacker - na bravo
ich hoffe man kann trotzdem noch etwas retten...



File C:\WINNT\system32\sdkcu32.dll infected by "Trojan-Downloader.Win32.Agent.pe" Virus! Action Taken: No Action Taken.
File C:\WINNT\system32\sdkcu32.dll infected by "Trojan-Downloader.Win32.Agent.pe" Virus! Action Taken: No Action Taken.
Object "Alexa Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "SrchAsst Spyware/Adware" found in File System! Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\System32\VB6DE.DLL". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "c:\Programme\COMPlus Applications\{F45247C1-F382-4D68-B234-FF13EB2299FC}\APL27.tmp". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "c:\Programme\COMPlus Applications\{6AD394AE-11DF-4642-8FA9-86822F29836A}\APL18B.tmp". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "c:\Programme\COMPlus Applications\{75AEF4CC-AB33-4308-8702-7DADE3BEFDCA}\APL183.tmp". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\system32\WinDmy.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\inotes.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\WMDownload.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{00025E15-0000-0000-C000-000000000046}" refers to invalid object "C:\Programme\Gemeinsame Dateien\Microsoft Shared\DAO\dao3032.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{00025E19-0000-0000-C000-000000000046}" refers to invalid object "C:\Programme\Gemeinsame Dateien\Microsoft Shared\DAO\dao3032.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{00025E43-0000-0000-C000-000000000046}" refers to invalid object "C:\Programme\Gemeinsame Dateien\Microsoft Shared\DAO\dao3032.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{00025E4C-0000-0000-C000-000000000046}" refers to invalid object "C:\Programme\Gemeinsame Dateien\Microsoft Shared\DAO\dao3032.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{00025E55-0000-0000-C000-000000000046}" refers to invalid object "C:\Programme\Gemeinsame Dateien\Microsoft Shared\DAO\dao3032.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{00025E5F-0000-0000-C000-000000000046}" refers to invalid object "C:\Programme\Gemeinsame Dateien\Microsoft Shared\DAO\dao3032.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{00025E68-0000-0000-C000-000000000046}" refers to invalid object "C:\Programme\Gemeinsame Dateien\Microsoft Shared\DAO\dao3032.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{00025E7A-0000-0000-C000-000000000046}" refers to invalid object "C:\Programme\Gemeinsame Dateien\Microsoft Shared\DAO\dao3032.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{00025E8B-0000-0000-C000-000000000046}" refers to invalid object "C:\Programme\Gemeinsame Dateien\Microsoft Shared\DAO\dao3032.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{000C0A0A-0000-0000-C000-000000000046}" refers to invalid object "pj8od8.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{000C0A18-0000-0000-C000-000000000046}" refers to invalid object "pj8od8.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{000C0A19-0000-0000-C000-000000000046}" refers to invalid object "pj8od8.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{00100000-B1BA-11CE-ABC6-F5B2E79D9E3F}" refers to invalid object "C:\WINNT\system32\ltocx10n.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{1075828A-F3C7-11D2-B649-006008703901}" refers to invalid object "C:\ArCon\Programm\acShape.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{20CCA4B7-CFE1-11d3-B03F-00A0C9251384}" refers to invalid object "C:\ArCon\Programm\Preview.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{2DE506B9-4320-11d3-8E42-002035221EDA}" refers to invalid object "\tcshellex.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{3A2C42D1-606F-11D2-B52A-006008703901}" refers to invalid object "C:\ArCon\Programm\acShape.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{44BE1747-DC65-4261-904F-17CA43E212B4}" refers to invalid object "E:\launch.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{4CF9DCC3-AB2B-11D2-9F1E-00A0C92BA442}" refers to invalid object "C:\TNGRCO\pvsinku.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{54645654-2225-4455-44A1-9F4543D34545}" refers to invalid object "C:\WINNT\system32\vbsys2.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{6B3DA95A-F19B-11D2-B642-006008703901}" refers to invalid object "C:\ArCon\Programm\acShape.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{9869EFB4-18E9-11D3-A837-00104B9E30B5}" refers to invalid object "C:\DOKUME~1\Test\LOKALE~1\Temp\CmdLineExt02.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{98FC482F-E003-49ad-98A3-55021098C562}" refers to invalid object "C:\ArCon\Programm\FenZeiOCX.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{99180163-DA16-101A-935C-444553540000}" refers to invalid object "recncl.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{9BC1DF15-0290-11D5-BD0E-00C04F0E0588}" refers to invalid object "C:\Programme\CA\eTrust\Antivirus\OemComNA.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A4845882-333F-11D0-B724-00AA0062CBB7}" refers to invalid object "C:\WINNT\System32\WBEM\WBEMSTUB.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A6616B31-4860-41E2-98E3-CA7649AF172F}" refers to invalid object "E:\launch.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{CB00FE85-E29C-11d2-AD84-00A0C9251384}" refers to invalid object "C:\ArCon\Programm\Preview.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{CB00FE86-E29C-11d2-AD84-00A0C9251384}" refers to invalid object "C:\ArCon\Programm\Preview.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{DA17724B-90FF-11d3-AF94-00A0C9251384}" refers to invalid object "C:\ArCon\Programm\Preview.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{DCED20BE-3645-11D4-BC95-00C04F0E0588}" refers to invalid object "C:\Programme\CA\eTrust\Antivirus\InoShell.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E07D3492-32B5-11D0-B724-00AA0062CBB7}" refers to invalid object "C:\WINNT\System32\WBEM\WBEMSTUB.DLL". Action Taken: No Action Taken.
Entry "HKCR\ActMsg.Session" refers to invalid object "{3FA7DEB3-6438-101B-ACC1-00AA00423326}". Action Taken: No Action Taken.
Entry "HKCR\MailFileAtt" refers to invalid object "{00020D05-0000-0000-C000-000000000046}". Action Taken: No Action Taken.
Entry "HKCR\mapifvbx.object" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken.
Entry "HKCR\mapifvbx.object.1" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken.
Entry "HKCR\Plenoptic.Plenoptic" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.
Entry "HKCR\Plenoptic.Plenoptic.1" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.
Entry "HKCR\SAPGUI.ResourceManagerDefault" refers to invalid object "{00100000-2003-1003-8D59-B2E1C7CAA060". Action Taken: No Action Taken.
Entry "HKCR\WMDMPDAExplorer.WMDMPDAExplorer" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.
Entry "HKCR\WMDMPDAExplorer.WMDMPDAExplorer.1" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.
File C:\WINNT\system32\WinDmy.dll.tcf tagged as "not-a-virus:AdWare.Mirar.a". Action Taken: No Action Taken.
File C:\DOKUME~1\gbrauch\LOKALE~1\Temp\hijackthis.log infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
File C:\Dokumente und Einstellungen\gbrauch\Eigene Dateien\Downloads\Ad_ware52\adware_dt.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Dokumente und Einstellungen\gbrauch\Eigene Dateien\Downloads\gozilla.exe tagged as "not-a-virus:AdWare.Aureate.a". Action Taken: No Action Taken.
File C:\Dokumente und Einstellungen\gbrauch\Lokale Einstellungen\Temp\hijackthis.log infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
File C:\WINNT\Downloaded Program Files\MirarSetup.exe tagged as "not-a-virus:AdWare.SaveNow.bj". Action Taken: No Action Taken.
File C:\WINNT\Downloaded Program Files\ON-LINE.EXE.in2 infected by "Trojan-Downloader.Win32.Agent.hr" Virus! Action Taken: No Action Taken.
File C:\WINNT\system32\WinDmy.dll.tcf tagged as "not-a-virus:AdWare.Mirar.a". Action Taken: No Action Taken.
File D:\Herold\Unlock.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.



Logfile of HijackThis v1.99.1
Scan saved at 15:18:38, on 13.06.2005
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\ibmpmsvc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\WINNT\System32\Ati2evxx.exe
C:\Inoculan\GetBBS.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\Cisco Systems\VPN Client\cvpnd.exe
C:\Programme\CA\SharedComponents\DesktopCommonServices\DMPrimer\dmprimer.exe
C:\WINNT\system32\hidserv.exe
C:\Inoculan\INOJOBSV.EXE
C:\WINNT\LogWatNT.exe
C:\Programme\CA\Unicenter Remote Control\rcHost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\TNGSD\BIN\SDSERV.EXE
C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\TNGSD\BIN\TRIGGAG.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\UMCSTUB.EXE
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\TNGSD\BIN\triggusr.exe
C:\WINNT\AGRSMMSG.exe
C:\WINNT\USBNUMP.exe
C:\WINNT\system32\CNOServerLauncher.exe
C:\SxpInst\sxplog32.exe
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\WINNT\system32\internat.exe
C:\Inoculan\realmon.exe
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOKUME~1\gbrauch\LOKALE~1\Temp\HijackThis.exe


F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Class - {5DCB7C15-BEDD-230C-CB3F-FD2CE2AA0CC2} - C:\WINNT\system32\sdkcu32.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SDJobCheck] triggusr.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NUMPADL] USBNUMP.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CnOServerLauncher] CNOServerLauncher.exe
O4 - HKLM\..\Run: [Sxplog] C:\SxpInst\sxpstub.exe
O4 - HKLM\..\Run: [CA-AMAgent] C:\Programme\CA\Unicenter Asset Management\Agents\amagent.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [iexplore.exe] C:\Programme\Internet Explorer\iexplore.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Global Startup: Realtime Monitor.LNK = C:\Inoculan\realmon.exe
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - h**p://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-17.cab

O20 - Winlogon Notify: nwprovau - C:\WINNT\SYSTEM32\nwprovau.dll
O23 - Service: Asset Management Agent (AmoAgent) - Computer Associates International, Inc. - C:\WINNT\UMCSTUB.EXE
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: AutoDownload Server - Computer Associates - C:\Inoculan\GetBBS.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: CA-License Client (CA_LIC_CLNT) - Unknown owner - C:\WINNT\Lic98Rmt.exe
O23 - Service: CA-License Server (CA_LIC_SRVR) - Unknown owner - C:\WINNT\Lic98RmtD.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Programme\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Verwaltungsdienst für die Verwaltung logischer Datenträger (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: DM Primer (DMPrimer) - Unknown owner - C:\Programme\CA\SharedComponents\DesktopCommonServices\DMPrimer\dmprimer.exe" -DMPRIMER_SERVICE_: (file missing)
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINNT\System32\ibmpmsvc.exe
O23 - Service: InoculateIT E-mail Server - Unknown owner - C:\Inoculan\INEXCHSV.EXE
O23 - Service: InoculateIT Server - Unknown owner - C:\Inoculan\INOJOBSV.EXE
O23 - Service: Event Log Watch (LogWatch) - Unknown owner - C:\WINNT\LogWatNT.exe
O23 - Service: Unicenter Remote Control Host (rcHost) - Computer Associates International, Inc. - C:\Programme\CA\Unicenter Remote Control\rcHost.exe
O23 - Service: Unicenter Software Delivery (SDService) - Computer Associates International, Inc. - C:\TNGSD\BIN\SDSERV.EXE
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINNT\system32\ZoneLabs\vsmon.exe

Bitte nochmals um Durchsicht der Logfiles