Infiziert mit Würmen & Co. - HJT - EScan Files - Kontrolle

Turgay57

Hallo liebe Leute,

ich bin am verzweifeln.Hab seit Tagen hartnäckige Würmer auf meinem PC.Es öffnen sich manchmal einfach Popups von unbekannten seiten, obwohl ich nicht im Internet bin.
Und in meiner Taskleiste rechts unten , ist regelmäßig ein gelbes Dreieck mit Ausrufezeichen und Meldung.und regelmäßig bekomme ich die meldung von ANTIVIR :


C:\WINDOWS\SYSTEM32\HP9AD4.TMP

Enthält Signatur des Wurmes WORM/Ider.A.Rkit

Da ich mir sichergehen wollte , poste ich mal meine E-Scan Virus log information und Hijackthis.Was ist alles zu machen?

infected-Einträge:

Mon Jan 02 01:26:29 2006 => System found infected with coolwebsearch Spyware/Adware ({0e1230f8-ea50-42a9-983c-d22abc2eed3b})! Action taken: No Action Taken.
Mon Jan 02 01:26:31 2006 => Offending Key found: HKCU\Software\gnu !!!
Mon Jan 02 01:26:31 2006 => Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken


Mon Jan 02 01:26:32 2006 => Offending file found: C:\WINDOWS\iun6002.exe
Mon Jan 02 01:26:32 2006 => System found infected with zipitpro Spyware/Adware (iun6002.exe)! Action taken: No Action Taken.
Mon Jan 02 01:26:33 2006 => Offending file found: C:\WINDOWS\System32\nvctrl.exe
Mon Jan 02 01:26:33 2006 => System found infected with trojan.zlob.e Browser Hijacker (nvctrl.exe)! Action taken: No Action Taken.

Mon Jan 02 01:26:43 2006 => Offending file found: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\norton systemworks\norton utilities\norton disk doctor.lnk
Mon Jan 02 01:26:43 2006 => System found infected with powerreg scheduler Spyware/Adware (norton disk doctor.lnk)! Action taken: No Action Taken.

Mon Jan 02 01:26:43 2006 => Offending file found: C:\Dokumente und Einstellungen\All Users\Startmenü\programme\norton systemworks\norton utilities\norton disk doctor.lnk

Mon Jan 02 01:26:43 2006 => System found infected with powerreg scheduler Spyware/Adware (norton disk doctor.lnk)! Action taken: No Action Taken.

Mon Jan 02 01:26:44 2006 => Offending file found: C:\WINDOWS\iun6002.exe
Mon Jan 02 01:26:44 2006 => System found infected with zipitpro Spyware/Adware (C:\WINDOWS\iun6002.exe)! Action taken: No Action Taken.

--

Mon Jan 02 02:26:38 2006 => Scanning Folder: C:\Programme\Norton SystemWorks\*.*
Mon Jan 02 02:26:38 2006 => Scanning Folder: C:\Programme\Norton SystemWorks\Norton Antivirus\*.*
Mon Jan 02 02:26:38 2006 => Scanning Folder: C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\*.*
Mon Jan 02 02:26:39 2006 => Scanning File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\68271F03
Mon Jan 02 02:26:39 2006 => File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\68271F03 infected by "Worm.Win32.Lovesan.a" Virus! Action Taken: No Action Taken.

Mon Jan 02 02:26:39 2006 => Scanning File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\41315B06.zip
Mon Jan 02 02:26:39 2006 => File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\41315B06.zip infected by "Trojan.Java.ClassLoader.o" Virus! Action Taken: No Action Taken.

Mon Jan 02 02:26:39 2006 => Scanning File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\102F40A5
Mon Jan 02 02:26:39 2006 => File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\102F40A5 infected by "Email-Worm.Win32.NetSky.q" Virus! Action Taken: No Action Taken.

Mon Jan 02 02:26:39 2006 => Scanning File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\098D5232.class
Mon Jan 02 02:26:39 2006 => File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\098D5232.class infected by "Trojan-Dropper.Java.Small.d" Virus! Action Taken: No Action Taken.

Mon Jan 02 02:26:39 2006 => Scanning File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\72833282.class
Mon Jan 02 02:26:39 2006 => File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\72833282.class infected by "Exploit.Java.Bytverify" Virus! Action Taken: No Action Taken.

Mon Jan 02 02:26:39 2006 => Scanning File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\20A65905.class
Mon Jan 02 02:26:39 2006 => File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\20A65905.class infected by "Trojan.Java.ClassLoader.Dummy.d" Virus! Action Taken: No Action Taken.

Mon Jan 02 02:26:39 2006 => Scanning File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\6AB0334B
Mon Jan 02 02:26:39 2006 => File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\6AB0334B infected by "Email-Worm.Win32.NetSky.q" Virus! Action Taken: No Action Taken.

Mon Jan 02 02:26:39 2006 => Scanning File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\72E75241.class
Mon Jan 02 02:26:39 2006 => File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\72E75241.class infected by "Trojan.Java.ClassLoader.Dummy.a" Virus! Action Taken: No Action Taken.

Mon Jan 02 02:26:39 2006 => Scanning File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\55421BC7.class
Mon Jan 02 02:26:39 2006 => File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\55421BC7.class infected by "Trojan.Java.ClassLoader.d" Virus! Action Taken: No Action Taken.

Mon Jan 02 02:26:39 2006 => Scanning File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\018D6C6E.class
Mon Jan 02 02:26:39 2006 => File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\018D6C6E.class infected by "Trojan.Java.ClassLoader.d" Virus! Action Taken: No Action Taken.

Mon Jan 02 02:26:39 2006 => Scanning File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\24485157
Mon Jan 02 02:26:39 2006 => File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\24485157 infected by "Email-Worm.Win32.NetSky.q" Virus! Action Taken: No Action Taken.

Mon Jan 02 02:26:39 2006 => Scanning File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\76BE6890
Mon Jan 02 02:26:39 2006 => File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\76BE6890 infected by "Email-Worm.Win32.NetSky.q" Virus! Action Taken: No Action Taken.

Mon Jan 02 02:26:39 2006 => Scanning File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\2B20100A.class
Mon Jan 02 02:26:40 2006 => File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\2B20100A.class infected by "Trojan.Java.ClassLoader.b" Virus! Action Taken: No Action Taken.

Mon Jan 02 02:26:40 2006 => Scanning File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\79D82038.class
Mon Jan 02 02:26:40 2006 => File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\79D82038.class infected by "Trojan.Java.ClassLoader.Dummy.a" Virus! Action Taken: No Action Taken.

Mon Jan 02 02:26:40 2006 => Scanning File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\396B61CE.class
Mon Jan 02 02:26:40 2006 => File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\396B61CE.class infected by "Trojan.Java.ClassLoader.u" Virus! Action Taken: No Action Taken.

Mon Jan 02 02:26:40 2006 => Scanning File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\74143CE5
Mon Jan 02 02:26:40 2006 => File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\74143CE5 tagged as "not-a-virus:Porn-Dialer.Win32.Intexdial". Action Taken: No Action Taken.

Mon Jan 02 02:26:40 2006 => Scanning File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\5E165F12.zip
Mon Jan 02 02:26:40 2006 => File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\5E165F12.zip infected by "Trojan.Java.ClassLoader.o" Virus! Action Taken: No Action Taken.

Mon Jan 02 02:26:40 2006 => Scanning File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\5F3223D9.class
Mon Jan 02 02:26:40 2006 => File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\5F3223D9.class infected by "Trojan.Java.ClassLoader.d" Virus! Action Taken: No Action Taken.

tagged-einträge:

Mon Jan 02 01:34:12 2006 => File C:\WINDOWS\system32\dosxpd.exe tagged as "not-a-virus:AdWare.Win32.Msnagent.a". Action Taken: No Action Taken.

Mon Jan 02 01:34:15 2006 => File C:\WINDOWS\system32\fixmapirs.exe tagged as "not-a-virus:AdWare.Win32.FindSpy.a". Action Taken: No Action Taken.

Mon Jan 02 01:43:22 2006 => File C:\WINDOWS\Downloaded Program Files\imloader.exe tagged as not-a-virusownloader.Win32.ImLoader.b. No Action Taken.

Mon Jan 02 02:26:40 2006 => Scanning File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\74143CE5
Mon Jan 02 02:26:40 2006 => File C:\Programme\Norton SystemWorks\Norton Antivirus\Quarantine\74143CE5 tagged as "not-a-virus:Porn-Dialer.Win32.Intexdial". Action Taken: No Action Taken.




HIJACKTHIS - LOG :
Logfile of HijackThis v1.99.1
Scan saved at 03:16:34, on 02.01.2006
Platform: Windows XP (WinNT 5.01.2600)


Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Gemeinsame Dateien\AccSys\AccWLSvc.exe
C:\PROGRAMME\AVPERSONAL\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\WINDOWS\System32\mssearchnet.exe
C:\WINDOWS\System32\nvctrl.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\WLAN Monitor\wlconfig.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\Winamp\winampa.exe
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\AT-AR215\AT-AR215 USB ADSL WAN Adapter\dslmon.exe
C:\Programme\Wireless\IEEE802.11g WLAN USB Adapter\OdHost.exe
C:\Programme\Wireless\IEEE802.11g WLAN USB Adapter\WLUSBCfg.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Dokumente und Einstellungen\**\Eigene Dateien\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.t-online.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.arcor.de
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.arcor.de
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.arcor.de
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.arcor.de
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Arcor AG & Co. KG
O2 - BHO: HomepageBHO - {e0103cd4-d1ce-411a-b75b-4fec072867f4} - C:\WINDOWS\System32\hp9AD4.tmp
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WLAN Quick-Starter] "C:\Programme\WLAN Quick-Starter\WLAN Quick-Starter.exe" -update
O4 - HKLM\..\Run: [wlconfig] C:\Programme\WLAN Monitor\wlconfig.exe -autostart
O4 - HKLM\..\Run: [AVGCtrl] "C:\Programme\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: DSLMON.lnk = ?
O4 - Global Startup: Zahlungserinnerung.lnk = C:\HCWLIGHT\wzed.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: IEEE 802.11g USB Adapter Utility.lnk = C:\Programme\Wireless\IEEE802.11g WLAN USB Adapter\Startup.exe
O8 - Extra context menu item: &Google Search - res://C:\Programme\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Programme\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Programme\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Programme\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Programme\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Programme\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O16 - DPF: {26CBF141-7D0F-46E1-AA06-718958B6E4D2} - http://download.ebay.com/turbo_lister/DE/install.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://tatlises.com.tr/player/ampx_en_dl.cab
O20 - AppInit_DLLs: MsgPlusLoader.dll
O23 - Service: AccSys WiFi Server (AccWLSvc) - AccSys GmbH - C:\Programme\Gemeinsame Dateien\AccSys\AccWLSvc.exe
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAMME\AVPERSONAL\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe


Ich hoffe ihr könnt mir helfen? Wie werde ich am besten diese Würmer los`? Was kann ich z.B. mit KillBox löschen? Oder bringt das nicht bzw. muss was anderes machen??

Ich warte auf eure Antwort!