Brauche Hilfe...Trojaner jaben mein PC besetzt

Chris4

Habe hier mal EScan gemacht und HijakThis:

EScan:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Infektionsmeldungen
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Fri Jun 02 21:38:05 2006 => System found infected with smitfraud Browser Hijacker (online security guide.url)! Action taken: No Action Taken.
Fri Jun 02 21:38:05 2006 => System found infected with smitfraud Browser Hijacker (security troubleshooting.url)! Action taken: No Action Taken.
Sun Jun 04 10:10:55 2006 => System found infected with smitfraud Browser Hijacker (ot.ico)! Action taken: No Action Taken.
Sun Jun 04 10:10:56 2006 => System found infected with smitfraud Browser Hijacker (antivirus test online.url)! Action taken: No Action Taken.
Sun Jun 04 10:11:01 2006 => System found infected with smitfraud Browser Hijacker (online security guide.url)! Action taken: No Action Taken.
Sun Jun 04 10:11:01 2006 => System found infected with smitfraud Browser Hijacker (security troubleshooting.url)! Action taken: No Action Taken.
~~~~~~~~~~~
Dateien
~~~~~~~~~~~
~~~~ Infected files
~~~~~~~~~~~
Fri Jun 02 22:34:59 2006 => Scanning File E:\Eigene Dateien\Eigene Musik\Marilyn Manson\1999 IDLTD (But the Drugs Like Me) (Single)\04 IDLTD (Infected By the Scourge of the Earth).mp3
Sun Jun 04 11:03:16 2006 => Scanning File E:\Eigene Dateien\Eigene Musik\Marilyn Manson\1999 IDLTD (But the Drugs Like Me) (Single)\04 IDLTD (Infected By the Scourge of the Earth).mp3
~~~~~~~~~~~
~~~~ Offending files
~~~~~~~~~~~
Fri Jun 02 21:38:05 2006 => Offending file found: C:\Dokumente und Einstellungen\All Users\Startmenü\online security guide.url
Fri Jun 02 21:38:05 2006 => Offending file found: C:\Dokumente und Einstellungen\All Users\Startmenü\security troubleshooting.url
Sun Jun 04 10:10:55 2006 => Offending file found: C:\WINDOWS\system32\ot.ico
Sun Jun 04 10:10:56 2006 => Offending file found: C:\Dokumente und Einstellungen\Admin Christian\Favoriten\antivirus test online.url
Sun Jun 04 10:11:01 2006 => Offending file found: C:\Dokumente und Einstellungen\All Users\Startmenü\online security guide.url
Sun Jun 04 10:11:01 2006 => Offending file found: C:\Dokumente und Einstellungen\All Users\Startmenü\security troubleshooting.url
~~~~~~~~~~~
~~~~ Tagged files
~~~~~~~~~~~
Fri Jun 02 22:27:57 2006 => File E:\Eigene Dateien\Downloads\BSINSTALLDE521.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.bo". Action Taken: No Action Taken.
Fri Jun 02 22:31:21 2006 => File E:\Eigene Dateien\Downloads\netpumper-1.25.1-setup-NP_0094.exe tagged as "not-a-virus:AdWare.Win32.Lop.ag". Action Taken: No Action Taken.
Fri Jun 02 22:35:49 2006 => File E:\Eigene Dateien\ICQ Lite\323118767\LL_Cool_J_297162848\vnc-3.3.7-x86_win32.exe tagged as not-a-virus:RemoteAdmin.Win32.WinVNC-based.c. No Action Taken.
Sun Jun 04 10:56:20 2006 => File E:\Eigene Dateien\Downloads\BSINSTALLDE521.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.bo". Action Taken: No Action Taken.
Sun Jun 04 11:00:07 2006 => File E:\Eigene Dateien\Downloads\netpumper-1.25.1-setup-NP_0094.exe tagged as "not-a-virus:AdWare.Win32.Lop.ag". Action Taken: No Action Taken.
Sun Jun 04 11:03:36 2006 => File E:\Eigene Dateien\ICQ Lite\***\***\vnc-3.3.7-x86_win32.exe tagged as not-a-virus:RemoteAdmin.Win32.WinVNC-based.c. No Action Taken.
~~~~~~~~~~~
Ordner
~~~~~~~~~~~
~~~~~~~~~~~
Registry
~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Statistiken:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Fri Jun 02 23:28:16 2006 => Total Errors: 20
Sun Jun 04 11:49:25 2006 => Total Errors: 30
Fri Jun 02 23:28:16 2006 => Time Elapsed: 01:46:21
Sun Jun 04 11:49:25 2006 => Time Elapsed: 01:34:10
Fri Jun 02 23:28:16 2006 => Total Objects Scanned: 100705
Sun Jun 04 11:49:25 2006 => Total Objects Scanned: 101471
Fri Jun 02 21:27:01 2006 => Virus Database Date: 5/29/2006
Fri Jun 02 21:28:28 2006 => Virus Database Date: 5/29/2006
Fri Jun 02 21:29:07 2006 => Virus Database Date: 6/2/2006
Fri Jun 02 21:35:39 2006 => Virus Database Date: 6/2/2006
Fri Jun 02 23:28:16 2006 => Virus Database Date: 6/2/2006
Fri Jun 02 23:35:57 2006 => Virus Database Date: 6/2/2006
Sat Jun 03 00:06:24 2006 => Virus Database Date: 6/2/2006
Sun Jun 04 10:08:31 2006 => Virus Database Date: 6/2/2006
Sun Jun 04 11:49:25 2006 => Virus Database Date: 6/2/2006
Sun Jun 04 13:19:49 2006 => Virus Database Date: 6/2/2006
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


HiJackThis:

Logfile of HijackThis v1.99.1
Scan saved at 13:23:08, on 04.06.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
P:\PROGRAMME\TUNEUP UTILITIES 2006\WinStylerThemeSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programme\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\ANYCOM\Blue USB-120-240\bin\btwdins.exe
C:\WINDOWS\system32\cisvc.exe
C:\Programme\T-Online\Dialerschutz-Software\DFInject.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programme\Gemeinsame Dateien\MicroWorld\Agent\MWASER.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Programme\Gemeinsame Dateien\MicroWorld\Agent\MWAgent.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Dokumente und Einstellungen\Admin Christian\Desktop\HijackThis.exe
C:\Programme\ICQLite\ICQLite.exe

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Nothing - {6ab7158b-4bff-4160-ad7d-4d622df548cf} - C:\WINDOWS\system32\hp100.tmp
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NVMixerTray] "C:\Programme\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Zone Labs Client] C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [T-Online Dialerschutz-Software] "C:\Programme\T-Online\Dialerschutz-Software\Defender.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Senden an &Bluetooth - C:\Programme\ANYCOM\Blue USB-120-240\btsendto_ie_ctx.htm
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\ANYCOM\Blue USB-120-240\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\ANYCOM\Blue USB-120-240\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Programme\ANYCOM\Blue USB-120-240\bin\btwdins.exe
O23 - Service: Dialerschutz Dienst (DFSVC) - Unknown owner - C:\Programme\T-Online\Dialerschutz-Software\DFInject.exe
O23 - Service: MWAgent - MicroWorld Technologies Inc. - C:\Programme\Gemeinsame Dateien\MicroWorld\Agent\MWASER.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - P:\PROGRAMME\TUNEUP UTILITIES 2006\WinStylerThemeSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

MFG
Christian