msclt.exe erlaubt mir net mal hijackthis.exe zu starten
sowie nortan antivirus
sicherheitscenter zeigt mir net was aktiv oder inaktiv ist
die automatischen updates wurden au ausgeschaltet

spybot hat zwar einige dateien gelöscht,trotzdem gehts nachm neustart immer noch nicht

Hilft mia bitte

Benenn die Datei Hijackthis.exe in prüfung.com um. Wichtig ist, dass Du die Dateinamenserweiterung EXE in COM änderst. Versuch dann die prüfung.com zu starten.

oh cool,jetzt gehts

Logfile of HijackThis v1.99.1
Scan saved at 23:04:23, on 11.05.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5335.0005)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\msclt.exe
D:\PROGRA~1\Sony\SsAAD.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Programme\MessengerPlus! 3\MsgPlus.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Programme\Microsoft AntiSpyware\gcasDtServ.exe
C:\Programme\Logitech\Video\FxSvr2.exe
C:\Programme\Logitech\Video\LogiTray.exe
C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
D:\Programme\Winamp\winampa.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe
C:\Programme\MSN Messenger\msnmsgr.exe
C:\Programme\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Programme\Norton AntiVirus\SAVScan.exe
E:\Programme\CASIO\Photo Loader\Plauto.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\OpenOffice.org 2.0\program\soffice.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Programme\OpenOffice.org 2.0\program\soffice.BIN
C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\SymWSC.exe
C:\Programme\Gemeinsame Dateien\Sony Shared\AVLib\SSScsiSV.exe
C:\Programme\ICQLite\ICQLite.exe
D:\Programme\Xfire\Xfire.exe
C:\Programme\Windows Media Player\wmplayer.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\AntiVir PersonalEdition Classic\avcenter.exe
C:\Programme\AntiVir PersonalEdition Classic\avscan.exe
C:\Dokumente und Einstellungen\kInd pro\Desktop\prüfung.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://web.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=55245&clcid={SUB_CLCID}
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = daft
F2 - REG:system.ini: Shell=Explorer.exe msclt.exe
O1 - Hosts: 203.19.94.55 downloads-eu1.kaspersky-labs.com
O1 - Hosts: 69.137.136.205 downloads-eu2.kaspersky-labs.com
O1 - Hosts: 248.118.104.157 downloads-eu3.kaspersky-labs.com
O1 - Hosts: 121.181.83.62 downloads-eu4.kaspersky-labs.com
O1 - Hosts: 168.221.140.193 downloads-us1.kaspersky-labs.com
O1 - Hosts: 47.158.148.70 downloads-us2.kaspersky-labs.com
O1 - Hosts: 169.137.168.251 downloads-us3.kaspersky-labs.com
O1 - Hosts: 242.167.49.219 downloads-us4.kaspersky-labs.com
O1 - Hosts: 112.150.34.141 ftp.avp.com
O1 - Hosts: 98.246.49.24 ftp.ca.com
O1 - Hosts: 160.52.225.212 ftp.customer.symantec.com
O1 - Hosts: 244.251.176.18 ftp.dispatch.mcafee.com
O1 - Hosts: 7.52.247.68 ftp.download.mcafee.com
O1 - Hosts: 3.33.85.162 ftp.downloads1.kaspersky-labs.com
O1 - Hosts: 246.117.14.124 ftp.downloads2.kaspersky-labs.com
O1 - Hosts: 119.117.250.252 ftp.downloads3.kaspersky-labs.com
O1 - Hosts: 239.141.22.119 ftp.downloads4.kaspersky-labs.com
O1 - Hosts: 27.4.175.94 ftp.downloads-eu1.kaspersky-labs.com
O1 - Hosts: 11.164.254.28 ftp.downloads-eu2.kaspersky-labs.com
O1 - Hosts: 202.21.241.78 ftp.downloads-eu3.kaspersky-labs.com
O1 - Hosts: 240.162.129.174 ftp.downloads-eu4.kaspersky-labs.com
O1 - Hosts: 55.71.251.174 ftp.downloads-us1.kaspersky-labs.com
O1 - Hosts: 102.172.110.129 ftp.downloads-us2.kaspersky-labs.com
O1 - Hosts: 183.110.169.31 ftp.downloads-us3.kaspersky-labs.com
O1 - Hosts: 104.235.26.3 ftp.downloads-us4.kaspersky-labs.com
O1 - Hosts: 84.52.211.144 ftp.grisoft.com
O1 - Hosts: 126.25.139.194 ftp.kaspersky.com
O1 - Hosts: 161.102.103.166 ftp.kaspersky-labs.com
O1 - Hosts: 128.72.185.162 ftp.liveupdate.symantec.com
O1 - Hosts: 48.51.185.82 ftp.liveupdate.symantecliveupdate.com
O1 - Hosts: 38.61.167.215 ftp.mast.mcafee.com
O1 - Hosts: 159.38.105.252 ftp.mcafee.com
O1 - Hosts: 143.188.251.66 ftp.my-etrust.com
O1 - Hosts: 187.129.137.5 ftp.nai.com
O1 - Hosts: 200.169.127.209 ftp.networkassociates.com
O1 - Hosts: 114.105.102.163 ftp.norton.com
O1 - Hosts: 3.34.238.145 ftp.rads.mcafee.com
O1 - Hosts: 102.100.220.43 ftp.sandbox.norman.com
O1 - Hosts: 107.93.88.17 ftp.secure.nai.com
O1 - Hosts: 130.162.63.135 ftp.securityresponse.symantec.com
O1 - Hosts: 164.33.206.30 ftp.symantec.com
O1 - Hosts: 197.157.141.108 ftp.symantecliveupdate.com
O1 - Hosts: 96.14.189.112 ftp.symatec.com
O1 - Hosts: 67.137.190.166 ftp.trendmicro.com
O1 - Hosts: 62.12.201.154 ftp.uk.trendmicro-europe.com
O1 - Hosts: 24.128.95.199 ftp.update.symantec.com
O1 - Hosts: 156.60.96.22 ftp.updates.symantec.com
O1 - Hosts: 225.157.204.243 ftp.updates1.kaspersky-labs.com
O1 - Hosts: 152.154.87.213 ftp.updates2.kaspersky-labs.com
O1 - Hosts: 246.0.190.157 ftp.updates3.kaspersky-labs.com
O1 - Hosts: 140.41.176.171 ftp.updates4.kaspersky-labs.com
O1 - Hosts: 41.101.17.30 ftp.us.mcafee.com
O1 - Hosts: 145.111.242.134 ftp.viruslist.com
O1 - Hosts: 92.225.229.219 norton.com
O1 - Hosts: 242.129.142.45 pandasoftware.com
O1 - Hosts: 212.218.13.140 sandbox.norman.com
O1 - Hosts: 198.45.102.1 securityresponse.symantec.com
O1 - Hosts: 114.22.71.217 symantec.com
O1 - Hosts: 102.17.154.38 symantecliveupdate.com
O1 - Hosts: 29.67.54.100 symatec.com
O1 - Hosts: 230.95.18.148 uk.trendmicro-europe.com
O1 - Hosts: 151.136.16.54 updates1.kaspersky-labs.com
O1 - Hosts: 85.195.111.27 updates2.kaspersky-labs.com
O1 - Hosts: 11.7.70.38 updates3.kaspersky-labs.com
O1 - Hosts: 217.7.20.105 updates4.kaspersky-labs.com
O1 - Hosts: 178.25.234.93 virusscan.jotti.org
O1 - Hosts: 37.190.42.75 virustotal.com
O1 - Hosts: 119.24.3.180 www.customer.symantec.com
O1 - Hosts: 99.25.236.90 www.dispatch.mcafee.com
O1 - Hosts: 80.6.81.110 www.download.mcafee.com
O1 - Hosts: 221.121.234.121 www.downloads1.kaspersky-labs.com
O1 - Hosts: 181.233.180.149 www.downloads2.kaspersky-labs.com
O1 - Hosts: 148.125.233.115 www.downloads3.kaspersky-labs.com
O1 - Hosts: 107.53.60.119 www.downloads4.kaspersky-labs.com
O1 - Hosts: 96.69.129.51 www.downloads-eu1.kaspersky-labs.com
O1 - Hosts: 57.201.48.60 www.downloads-eu2.kaspersky-labs.com
O1 - Hosts: 154.57.13.41 www.downloads-eu3.kaspersky-labs.com
O1 - Hosts: 28.57.201.46 www.downloads-eu4.kaspersky-labs.com
O1 - Hosts: 16.53.114.177 www.downloads-us1.kaspersky-labs.com
O1 - Hosts: 139.223.133.68 www.downloads-us2.kaspersky-labs.com
O1 - Hosts: 141.133.245.81 www.downloads-us3.kaspersky-labs.com
O1 - Hosts: 201.70.130.134 www.downloads-us4.kaspersky-labs.com
O1 - Hosts: 15.84.134.236 www.kaspersky-labs.com
O1 - Hosts: 214.233.95.96 www.liveupdate.symantec.com
O1 - Hosts: 218.208.163.51 www.liveupdate.symantecliveupdate.com
O1 - Hosts: 231.70.223.149 www.mast.mcafee.com
O1 - Hosts: 200.2.175.212 www.norton.com
O1 - Hosts: 240.142.21.67 www.pandasoftware.com
O1 - Hosts: 172.193.21.189 www.rads.mcafee.com
O1 - Hosts: 30.159.189.67 www.sandbox.norman.com
O1 - Hosts: 212.113.199.28 www.secure.nai.com
O1 - Hosts: 66.204.1.153 www.securityresponse.symantec.com
O1 - Hosts: 46.62.58.163 www.symantec.com
O1 - Hosts: 77.159.175.159 www.symantecliveupdate.com
O1 - Hosts: 198.10.251.109 www.symatec.com
O1 - Hosts: 203.233.166.49 www.uk.trendmicro-europe.com
O1 - Hosts: 11.198.28.26 www.update.symantec.com
O1 - Hosts: 185.75.140.29 www.updates.symantec.com
O1 - Hosts: 0.211.102.180 www.updates1.kaspersky-labs.com
O1 - Hosts: 171.169.175.233 www.updates2.kaspersky-labs.com
O1 - Hosts: 131.65.54.30 www.updates3.kaspersky-labs.com
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll (file missing)
O3 - Toolbar: gulli - real underground toolbar - {de1f0316-a350-4dbf-940f-13198f71b6cf} - C:\Programme\gulli - real underground\tbgul0.dll
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SsAAD.exe] D:\PROGRA~1\Sony\SsAAD.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Regwarner] D:\Programme\XP-Clean\RegWarner.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Programme\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [AceGain LiveUpdate] F:\Programme\AceGain\LiveUpdate\LiveUpdate.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programme\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Programme\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Programme\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [WinampAgent] D:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Zone Labs Client] C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [start] D:\Programme\XP-Clean\xpclean.exe /s
O4 - HKLM\..\Run: [Microsoft client for NT] msclt.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\RunServices: [Microsoft client for NT] msclt.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Microsoft client for NT] msclt.exe
O4 - HKCU\..\RunServices: [Microsoft client for NT] msclt.exe
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Programme\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Photo Loader resident.lnk = E:\Programme\CASIO\Photo Loader\Plauto.exe
O8 - Extra context menu item: Download with Go!Zilla - file://l:\Programme\Go!Zilla\download-with-gozilla.html
O8 - Extra context menu item: Download with Star Downloader - L:\Programme\Star Downloader\sdie.htm
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll (file missing)
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: http://www.bets4all.com
O15 - Trusted Zone: http://www.uni-protokolle.de
O16 - DPF: {0DD4ADBE-E91D-48CC-9A04-87EA1674E385} (PerfTesAXDemo Control) - http://gamer.ubicom.com/benchmarks/PerfTestCliActiveXproj_aug23.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Basic) - http://www.bets4all.com/bets/agency/bet/ScriptX.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1129319211796
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{00BAC764-E3F5-4A63-A28D-B3FBC0A6027F}: NameServer = 195.50.140.178 195.50.140.114
O17 - HKLM\System\CS2\Services\Tcpip\..\{00BAC764-E3F5-4A63-A28D-B3FBC0A6027F}: NameServer = 195.50.140.178 195.50.140.114
O20 - AppInit_DLLs: MsgPlusLoader.dll
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Programme\Gemeinsame Dateien\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norton AntiVirus Auto-Protect-Dienst (navapsvc) - Symantec Corporation - C:\Programme\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Programme\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Programme\Gemeinsame Dateien\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SAVScan - Symantec Corporation - C:\Programme\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\GEMEIN~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Programme\Gemeinsame Dateien\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Programme\Gemeinsame Dateien\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Hallo Daft,

Du hast DEN in Deinem System.
Daher mein Rat da es sich um einen Backdoor handelt:

Neuinstallation

dartus

hach lol
amazing
naja danke

hi, ich bin neu hier....... ich brauche hilfe....... undzwar: wenn ich mein pc starte, bekomme ich die warnung, "msclt.exe konnte nicht gefunden werden usw.......... " könnte ihr mir helfen

Zitat von PlaYar

hi, ich bin neu hier....... ich brauche hilfe....... undzwar: wenn ich mein pc starte, bekomme ich die warnung, "msclt.exe konnte nicht gefunden werden usw.......... " könnte ihr mir helfen

Ja, man kann Dir helfen. Aber erst nachdem Du die NUB umgesetzt hast.

gleiche Probleme wie playar....

bitte um hilfe...

achso hier HijackThis:



Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Programme\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
C:\Programme\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\SMSC\SetIcon.exe
C:\Programme\Home Cinema\PowerCinema\PCMService.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\meine Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\meine Programme\Winamp\Winampa.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\ICQLite\ICQLite.exe
C:\Programme\Outlook Express\msimn.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Programme\AntiVir PersonalEdition Classic\update.exe
C:\DOKUME~1\SEBAST~1\LOKALE~1\Temp\Temporäres Verzeichnis 1 für hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://studip.rz.uos.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.aldi.com/
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
F2 - REG:system.ini: Shell=Explorer.exe msclt.exe
O1 - Hosts: 26.50.116.181 downloads-eu1.kaspersky-labs.com
O1 - Hosts: 44.209.116.150 downloads-eu2.kaspersky-labs.com
O1 - Hosts: 102.87.47.249 downloads-eu3.kaspersky-labs.com
O1 - Hosts: 82.96.4.77 downloads-eu4.kaspersky-labs.com
O1 - Hosts: 129.244.4.139 downloads-us1.kaspersky-labs.com
O1 - Hosts: 48.129.2.191 downloads-us2.kaspersky-labs.com
O1 - Hosts: 186.218.180.253 downloads-us3.kaspersky-labs.com
O1 - Hosts: 236.220.23.67 downloads-us4.kaspersky-labs.com
O1 - Hosts: 252.159.195.123 ftp.avp.com
O1 - Hosts: 143.209.202.28 ftp.ca.com
O1 - Hosts: 75.230.62.234 ftp.customer.symantec.com
O1 - Hosts: 11.197.14.126 ftp.dispatch.mcafee.com
O1 - Hosts: 125.1.217.82 ftp.download.mcafee.com
O1 - Hosts: 101.199.189.229 ftp.downloads1.kaspersky-labs.com
O1 - Hosts: 64.3.7.213 ftp.downloads2.kaspersky-labs.com
O1 - Hosts: 35.111.246.162 ftp.downloads3.kaspersky-labs.com
O1 - Hosts: 34.162.215.129 ftp.downloads4.kaspersky-labs.com
O1 - Hosts: 148.85.2.99 ftp.downloads-eu1.kaspersky-labs.com
O1 - Hosts: 138.105.29.13 ftp.downloads-eu2.kaspersky-labs.com
O1 - Hosts: 202.238.186.108 ftp.downloads-eu3.kaspersky-labs.com
O1 - Hosts: 47.183.145.130 ftp.downloads-eu4.kaspersky-labs.com
O1 - Hosts: 159.49.1.154 ftp.downloads-us1.kaspersky-labs.com
O1 - Hosts: 167.17.148.160 ftp.downloads-us2.kaspersky-labs.com
O1 - Hosts: 72.143.59.186 ftp.downloads-us3.kaspersky-labs.com
O1 - Hosts: 139.191.238.158 ftp.downloads-us4.kaspersky-labs.com
O1 - Hosts: 30.68.184.54 ftp.grisoft.com
O1 - Hosts: 188.81.73.75 ftp.kaspersky.com
O1 - Hosts: 146.146.184.0 ftp.kaspersky-labs.com
O1 - Hosts: 246.158.132.78 ftp.liveupdate.symantec.com
O1 - Hosts: 84.44.229.158 ftp.liveupdate.symantecliveupdate.com
O1 - Hosts: 253.122.118.66 ftp.mast.mcafee.com
O1 - Hosts: 230.241.234.189 ftp.mcafee.com
O1 - Hosts: 95.62.125.250 ftp.my-etrust.com
O1 - Hosts: 89.228.76.221 ftp.nai.com
O1 - Hosts: 222.164.94.68 ftp.networkassociates.com
O1 - Hosts: 60.24.131.238 ftp.norton.com
O1 - Hosts: 250.233.182.229 ftp.rads.mcafee.com
O1 - Hosts: 185.12.200.193 ftp.sandbox.norman.com
O1 - Hosts: 132.206.126.125 ftp.secure.nai.com
O1 - Hosts: 171.73.83.187 ftp.securityresponse.symantec.com
O1 - Hosts: 207.207.52.109 ftp.symantec.com
O1 - Hosts: 51.112.127.54 ftp.symantecliveupdate.com
O1 - Hosts: 3.95.74.232 ftp.symatec.com
O1 - Hosts: 191.66.230.253 ftp.trendmicro.com
O1 - Hosts: 17.0.48.110 ftp.uk.trendmicro-europe.com
O1 - Hosts: 160.2.12.98 ftp.update.symantec.com
O1 - Hosts: 146.227.206.235 ftp.updates.symantec.com
O1 - Hosts: 197.231.3.118 ftp.updates1.kaspersky-labs.com
O1 - Hosts: 93.156.118.197 ftp.updates2.kaspersky-labs.com
O1 - Hosts: 193.147.153.49 ftp.updates3.kaspersky-labs.com
O1 - Hosts: 129.149.135.120 ftp.updates4.kaspersky-labs.com
O1 - Hosts: 91.43.74.228 ftp.us.mcafee.com
O1 - Hosts: 212.104.46.254 ftp.viruslist.com
O1 - Hosts: 131.105.182.74 norton.com
O1 - Hosts: 122.28.68.15 pandasoftware.com
O1 - Hosts: 103.97.11.77 sandbox.norman.com
O1 - Hosts: 234.1.249.240 securityresponse.symantec.com
O1 - Hosts: 202.93.254.164 symantec.com
O1 - Hosts: 128.176.249.172 symantecliveupdate.com
O1 - Hosts: 146.97.137.2 symatec.com
O1 - Hosts: 88.53.126.238 uk.trendmicro-europe.com
O1 - Hosts: 83.254.168.143 updates1.kaspersky-labs.com
O1 - Hosts: 196.246.192.221 updates2.kaspersky-labs.com
O1 - Hosts: 23.150.123.41 updates3.kaspersky-labs.com
O1 - Hosts: 209.44.156.193 updates4.kaspersky-labs.com
O1 - Hosts: 28.30.22.200 virusscan.jotti.org
O1 - Hosts: 172.237.165.111 virustotal.com
O1 - Hosts: 113.25.113.57 www.customer.symantec.com
O1 - Hosts: 102.121.178.111 www.dispatch.mcafee.com
O1 - Hosts: 103.43.46.70 www.download.mcafee.com
O1 - Hosts: 17.161.0.236 www.downloads1.kaspersky-labs.com
O1 - Hosts: 221.123.181.235 www.downloads2.kaspersky-labs.com
O1 - Hosts: 166.140.65.131 www.downloads3.kaspersky-labs.com
O1 - Hosts: 13.17.39.118 www.downloads4.kaspersky-labs.com
O1 - Hosts: 189.156.78.163 www.downloads-eu1.kaspersky-labs.com
O1 - Hosts: 189.8.244.136 www.downloads-eu2.kaspersky-labs.com
O1 - Hosts: 66.215.39.36 www.downloads-eu3.kaspersky-labs.com
O1 - Hosts: 185.107.73.75 www.downloads-eu4.kaspersky-labs.com
O1 - Hosts: 121.238.147.220 www.downloads-us1.kaspersky-labs.com
O1 - Hosts: 88.93.245.247 www.downloads-us2.kaspersky-labs.com
O1 - Hosts: 11.139.228.147 www.downloads-us3.kaspersky-labs.com
O1 - Hosts: 19.142.118.166 www.downloads-us4.kaspersky-labs.com
O1 - Hosts: 100.68.188.5 www.kaspersky-labs.com
O1 - Hosts: 200.18.112.231 www.liveupdate.symantec.com
O1 - Hosts: 64.19.72.40 www.liveupdate.symantecliveupdate.com
O1 - Hosts: 177.88.36.166 www.mast.mcafee.com
O1 - Hosts: 13.49.20.164 www.norton.com
O1 - Hosts: 185.85.53.56 www.pandasoftware.com
O1 - Hosts: 204.189.128.234 www.rads.mcafee.com
O1 - Hosts: 55.116.178.53 www.sandbox.norman.com
O1 - Hosts: 104.214.120.246 www.secure.nai.com
O1 - Hosts: 123.103.241.247 www.securityresponse.symantec.com
O1 - Hosts: 247.31.99.154 www.symantec.com
O1 - Hosts: 223.6.189.143 www.symantecliveupdate.com
O1 - Hosts: 74.25.32.238 www.symatec.com
O1 - Hosts: 124.243.104.44 www.uk.trendmicro-europe.com
O1 - Hosts: 12.195.137.225 www.update.symantec.com
O1 - Hosts: 236.74.47.101 www.updates.symantec.com
O1 - Hosts: 119.78.82.88 www.updates1.kaspersky-labs.com
O1 - Hosts: 185.234.46.222 www.updates2.kaspersky-labs.com
O1 - Hosts: 137.231.15.95 www.updates3.kaspersky-labs.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\meine Programme\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar1.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SetIcon] \Program Files\SMSC\SetIcon.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PCMService] "C:\Programme\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Zone Labs Client] C:\meine Programme\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\meine Programme\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunServices: [Microsoft client for NT] msclt.exe
O4 - HKCU\..\Run: [updateMgr] C:\Programme\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
O4 - HKCU\..\RunServices: [Microsoft client for NT] msclt.exe
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O8 - Extra context menu item: &Google-Suche - res://c:\programme\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: &Ins Deutsche übersetzen - res://c:\programme\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Im Cache gespeicherte Seite - res://c:\programme\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Verweisseiten - res://c:\programme\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Ähnliche Seiten - res://c:\programme\google\GoogleToolbar1.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: @C:\Programme\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Programme\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra button: MedionShop - {3FD261A4-796F-4A71-91C1-705EFF6B8B29} - http://www.medionshop.de/ (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com/
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1134842576125
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Programme\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Programme\CyberLink\Shared Files\RichVideo.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

@bastiiii

Bitte erstelle einen neuen Beitrag zu deinem Problem! Da es sonst hier zu unübersichtlich wird...
Beachte auch du dabei die NUB´s und editiere alle persönlichen bzw. aktiven Links!

Gruß
Daniel

Hallo,
och, ich finde da müßen wir eigentlich gar nicht viel rummachen, gleiches Problem-->gleiche Lösung.


Grüße Wildone

Das kommt davon wenn man nur einen Teil des Beitrages liest und nicht bis ganz nach unten scrollt...

ich hatte das gleiche problem ich habe alle hosts gefixt und habe mit security task manager den process beendet

Hallo,
damit bekämpfst du aber nur die eigentlich Ursache, was schon alles auf dem System verändert wurde, oder welches Hintertürchen geöffnet wurde weißt du nicht. Ansonsten kannst du ja die Links in der Anleitung durchlesen warum bei Backdoorbefall ein Neuaufsetzen die sinnvollste Lösung ist.
Sollte eigentlich bei diesen Eigenschaften:

Zitat von Sophos

* Ermöglicht Dritten den Zugriff auf den Computer
* Verändert Daten auf dem Computer
* Lädt Code aus dem Internet herunter
* Speichert Tastenfolgen
* Installiert sich in der Registrierung
* Wird für DOS-Attacken verwendet
* Hinterlässt nicht infizierte Dateien auf dem Computer

jedem klar sein.



Grüße Wildone

sry, bin neu hier.. hab das gleiche problem :
Nach reboot kommt die meldung : msclt.exe konnte nicht gefunden werden!

Also HJT sagt:

Logfile of HijackThis v1.99.1
Scan saved at 20:19:47, on 01.06.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
C:\Programme\Winamp\winampa.exe
C:\Programme\SlySoft\AnyDVD\AnyDVD.exe
C:\Programme\SlySoft\CloneCD\CloneCDTray.exe
C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Programme\Logitech\Video\LogiTray.exe
C:\Programme\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\Programme\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Programme\iPod\bin\iPodService.exe
C:\Programme\ATI Technologies\ATI.ACE\CLI.exe
C:\Programme\VIA\RAID\raid_tool.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\Logitech\Video\FxSvr2.exe
C:\Programme\Valve\Steam\Steam.exe
D:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F2 - REG:system.ini: Shell=Explorer.exe msclt.exe
O1 - Hosts: 152.128.24.39 avp.com
O1 - Hosts: 208.231.182.10 ca.com
O1 - Hosts: 184.114.205.239 customer.symantec.com
O1 - Hosts: 66.55.244.50 dispatch.mcafee.com
O1 - Hosts: 77.15.220.16 download.mcafee.com
O1 - Hosts: 121.0.162.110 downloads1.kaspersky-labs.com
O1 - Hosts: 80.9.162.24 downloads2.kaspersky-labs.com
O1 - Hosts: 236.26.234.153 downloads3.kaspersky-labs.com
O1 - Hosts: 9.191.31.40 downloads4.kaspersky-labs.com
O1 - Hosts: 66.61.220.48 downloads-eu1.kaspersky-labs.com
O1 - Hosts: 106.158.125.108 downloads-eu2.kaspersky-labs.com
O1 - Hosts: 176.138.64.184 downloads-eu3.kaspersky-labs.com
O1 - Hosts: 6.76.50.234 downloads-eu4.kaspersky-labs.com
O1 - Hosts: 121.102.244.117 downloads-us1.kaspersky-labs.com
O1 - Hosts: 4.44.159.155 downloads-us2.kaspersky-labs.com
O1 - Hosts: 108.32.231.106 downloads-us3.kaspersky-labs.com
O1 - Hosts: 58.45.212.90 downloads-us4.kaspersky-labs.com
O1 - Hosts: 125.105.150.177 f-secure.com
O1 - Hosts: 64.112.88.31 ftp.avp.com
O1 - Hosts: 239.32.157.29 ftp.ca.com
O1 - Hosts: 39.175.127.14 ftp.customer.symantec.com
O1 - Hosts: 138.231.221.176 ftp.dispatch.mcafee.com
O1 - Hosts: 51.134.218.210 ftp.download.mcafee.com
O1 - Hosts: 217.14.48.98 ftp.downloads1.kaspersky-labs.com
O1 - Hosts: 44.126.179.201 ftp.downloads2.kaspersky-labs.com
O1 - Hosts: 15.72.36.173 ftp.downloads3.kaspersky-labs.com
O1 - Hosts: 185.241.142.0 ftp.downloads4.kaspersky-labs.com
O1 - Hosts: 220.185.214.252 ftp.downloads-eu1.kaspersky-labs.com
O1 - Hosts: 210.57.78.2 ftp.downloads-eu2.kaspersky-labs.com
O1 - Hosts: 248.72.209.218 ftp.downloads-eu3.kaspersky-labs.com
O1 - Hosts: 191.46.217.113 ftp.downloads-eu4.kaspersky-labs.com
O1 - Hosts: 150.206.126.245 ftp.downloads-us1.kaspersky-labs.com
O1 - Hosts: 35.252.214.119 ftp.downloads-us2.kaspersky-labs.com
O1 - Hosts: 135.10.171.120 ftp.downloads-us3.kaspersky-labs.com
O1 - Hosts: 27.65.118.254 ftp.downloads-us4.kaspersky-labs.com
O1 - Hosts: 90.105.155.40 ftp.f-secure.com
O1 - Hosts: 111.122.206.64 ftp.grisoft.com
O1 - Hosts: 24.164.40.224 ftp.kaspersky.com
O1 - Hosts: 209.74.66.159 ftp.kaspersky-labs.com
O1 - Hosts: 133.34.117.82 ftp.liveupdate.symantec.com
O1 - Hosts: 167.4.128.89 ftp.liveupdate.symantecliveupdate.com
O1 - Hosts: 123.178.183.25 ftp.mast.mcafee.com
O1 - Hosts: 238.17.11.123 ftp.mcafee.com
O1 - Hosts: 77.27.252.36 ftp.my-etrust.com
O1 - Hosts: 39.156.83.183 ftp.nai.com
O1 - Hosts: 63.231.27.99 ftp.networkassociates.com
O1 - Hosts: 210.23.225.121 ftp.norton.com
O1 - Hosts: 14.25.152.210 ftp.rads.mcafee.com
O1 - Hosts: 6.135.149.87 ftp.sandbox.norman.com
O1 - Hosts: 4.26.51.75 ftp.secure.nai.com
O1 - Hosts: 130.167.232.78 ftp.securityresponse.symantec.com
O1 - Hosts: 31.10.242.39 ftp.sophos.com
O1 - Hosts: 231.217.209.204 ftp.symantec.com
O1 - Hosts: 200.212.75.185 ftp.symantecliveupdate.com
O1 - Hosts: 116.229.39.143 ftp.symatec.com
O1 - Hosts: 156.27.79.140 ftp.trendmicro.com
O1 - Hosts: 205.11.157.80 ftp.uk.trendmicro-europe.com
O1 - Hosts: 61.106.112.254 ftp.update.symantec.com
O1 - Hosts: 102.222.83.64 ftp.updates.symantec.com
O1 - Hosts: 188.70.86.32 ftp.updates1.kaspersky-labs.com
O1 - Hosts: 100.2.103.212 ftp.updates2.kaspersky-labs.com
O1 - Hosts: 146.129.60.107 ftp.updates3.kaspersky-labs.com
O1 - Hosts: 40.26.39.100 ftp.updates4.kaspersky-labs.com
O1 - Hosts: 159.226.230.196 ftp.us.mcafee.com
O1 - Hosts: 211.40.198.19 ftp.viruslist.com
O1 - Hosts: 200.164.38.214 grisoft.com
O1 - Hosts: 111.37.47.142 kaspersky.com
O1 - Hosts: 26.54.102.47 kaspersky-labs.com
O1 - Hosts: 18.247.81.28 liveupdate.symantec.com
O1 - Hosts: 128.214.84.55 liveupdate.symantecliveupdate.com
O1 - Hosts: 165.171.152.113 mast.mcafee.com
O1 - Hosts: 139.128.16.246 mcafee.com
O1 - Hosts: 48.12.98.229 my-etrust.com
O1 - Hosts: 201.29.235.170 nai.com
O1 - Hosts: 55.253.6.236 networkassociates.com
O1 - Hosts: 43.145.196.167 norton.com
O1 - Hosts: 171.50.242.96 pandasoftware.com
O1 - Hosts: 247.20.95.14 rads.mcafee.com
O1 - Hosts: 230.40.216.34 sandbox.norman.com
O1 - Hosts: 215.212.94.208 secure.nai.com
O1 - Hosts: 62.248.227.129 securityresponse.symantec.com
O1 - Hosts: 107.250.192.7 sophos.com
O1 - Hosts: 27.253.134.0 symantec.com
O1 - Hosts: 233.101.121.146 symantecliveupdate.com
O1 - Hosts: 46.62.210.214 symatec.com
O1 - Hosts: 100.73.13.150 trendmicro.com
O1 - Hosts: 172.174.230.213 uk.trendmicro-europe.com
O1 - Hosts: 128.24.74.53 update.symantec.com
O1 - Hosts: 30.194.101.20 updates.symantec.com
O1 - Hosts: 214.58.4.169 updates1.kaspersky-labs.com
O1 - Hosts: 187.207.3.226 updates2.kaspersky-labs.com
O1 - Hosts: 212.18.108.46 updates3.kaspersky-labs.com
O1 - Hosts: 93.57.156.36 updates4.kaspersky-labs.com
O1 - Hosts: 52.93.240.41 us.mcafee.com
O1 - Hosts: 249.243.230.226 viruslist.com
O1 - Hosts: 133.84.176.185 virusscan.jotti.org
O1 - Hosts: 53.211.35.188 virustotal.com
O1 - Hosts: 63.169.125.135 www.avp.com
O1 - Hosts: 126.178.112.35 www.ca.com
O1 - Hosts: 235.205.110.231 www.customer.symantec.com
O1 - Hosts: 62.215.158.229 www.dispatch.mcafee.com
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Zango Search Assistant Helper - {56F1D444-11BF-4879-A12B-79CF0177F038} - c:\programme\zango\zangohook.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {F8E5CA21-C27B-43e7-B2BE-4CA93C9F9A1F} - (no file)
O3 - Toolbar: Zango Toolbar - {EA0D26BD-9029-431A-86E0-83152D67828A} - C:\Program Files\Zango Programs\Zango Toolbar\ZangoTB.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [Verknüpfung mit der High Definition Audio-Eigenschaftenseite] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [AnyDVD] C:\Programme\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Programme\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [Microsoft client for NT] msclt.exe
O4 - HKLM\..\Run: [kav] "C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Programme\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Programme\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Programme\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunServices: [Microsoft client for NT] msclt.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Programme\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [Microsoft client for NT] msclt.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] C:\Programme\Logitech\Video\ManifestEngine.exe boot
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Steam] C:\Programme\Valve\Steam\\Steam.exe -silent
O4 - HKCU\..\RunServices: [Microsoft client for NT] msclt.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Programme\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Programme\VIA\RAID\raid_tool.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Web-Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1148231634265
O17 - HKLM\System\CCS\Services\Tcpip\..\{35A67340-6B42-4810-8305-2EA28958B56C}: NameServer = 195.58.160.194,195.58.161.122
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: StyleXPService - Unknown owner - C:\Programme\TGTSoft\StyleXP\StyleXPService.exe

Wär nett wenn ihr mir helfen könntet, mfg

Zitat von Wildone

Hallo,
damit bekämpfst du aber nur die eigentlich Ursache, was schon alles auf dem System verändert wurde, oder welches Hintertürchen geöffnet wurde weißt du nicht. Ansonsten kannst du ja die Links in der Anleitung durchlesen warum bei Backdoorbefall ein Neuaufsetzen die sinnvollste Lösung ist.
Sollte eigentlich bei diesen Eigenschaften:

Zitat:
Zitat von Sophos
* Ermöglicht Dritten den Zugriff auf den Computer
* Verändert Daten auf dem Computer
* Lädt Code aus dem Internet herunter
* Speichert Tastenfolgen
* Installiert sich in der Registrierung
* Wird für DOS-Attacken verwendet
* Hinterlässt nicht infizierte Dateien auf dem Computer
jedem klar sein.

Du weißt ja was kommt--> Neuaufsetzen

Sorry,
Gruß
Daniel