TrustInPopups und vieles mehr...

Vidar

Hallo, folgendes Problem, unten rechts bei der Uhrzeit ist ein Roter Kreis mit einem Kreuz drinn, eine Toolbar hat sich installiert und Antivir hat unter anderem folgendes gesammelt: TR/Dldr.Small. ddp. 1, 2 und 4 ; EXP/Agent.B ; TR/Dldr.Small cwj.4 ; TR/Dldr.WarSpy.K ; 3 verdächtige Dateien im Ordner Programm Files\Trustin Bar\ mit dem Namen trustin.dll und nochmal eine Datei mit dem Namen trustincontext.dll im Ordner Programm Files\TrustIn Contextual. Im Taskmanager laufen folgende Prozesse:56e415ee.exe, agent.exe, alg.exe, AOLLacsd.exe, aoltray.exe, avcenter.exe, avgnt.exe, avguard.exe,csrss.exe, explorer.exe, firefox.exe, HijackThis.exe, issch.exe, IPUSPM.exe, issch.exe, lsass.exe, ISUSPM.exe, jusched.exe, lsass.exe, notepad.exe, qttask.exe, sched.exe, services.exe, SMAgent.exe, smss.exe, StarWindService.exe, 6 mal svchost.exe unter den Usernamen System, Network service, local service und system. Des weiteren laufen System, System Idle Process, taskmgr.exe, TrustInPopups.exe, winampa.exe, winlogon.exe, wmiprvse.exe, wscntfy.exe, wuauclt.exe. Betriebssystem ist Win XP Proffesional in Englisch. Hier noch das HijackThis Log...

Logfile of HijackThis v1.99.1
Scan saved at 19:13:13, on 15.07.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\spoolsv.exe
E:\Documents and Settings\Benutzer\My Documents\Winamp\winampa.exe
E:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
E:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
E:\Program Files\QuickTime\qttask.exe
E:\WINDOWS\system32\56e415ee.exe
E:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
E:\Program Files\TrustIn Popups\TrustInPopups.exe
E:\Program Files\AOL 9.0\aoltray.exe
E:\Program Files\AntiVir PersonalEdition Classic\sched.exe
E:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
E:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
E:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
E:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\wscntfy.exe
E:\WINDOWS\system32\wuauclt.exe
E:\Program Files\Mozilla Firefox\firefox.exe
e:\program files\common files\installshield\updateservice\isuspm.exe
E:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
E:\DOCUME~1\Benutzer\LOCALS~1\Temp\Rar$EX00.187\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = C:\WINDOWS\local.html
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - E:\Program Files\ICQToolbar\toolbaru.dll
O2 - BHO: SpoofBHO Class - {07A78AEA-4A54-4967-9A60-4B68592D30C7} - E:\WINDOWS\se_spoof.dll
O2 - BHO: ChangerBHO Class - {0D4C7057-EAD2-44C6-AD18-9092905F28F1} - E:\WINDOWS\system32\avifileb.dll
O2 - BHO: WeeklyExecuter Class - {590FFB84-6A29-4797-9C0E-B15DF2C4CDCB} - E:\WINDOWS\inetloader.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: TrustIn Bar Activator Class - {da7ff3f8-08be-4cac-bc00-94d91c6ae7f4} - E:\Program Files\trustin bar\trustin.dll
O2 - BHO: ContextualAds Class - {FE6C16C4-16AD-47B6-B250-26AD1829E49A} - E:\Program Files\TrustIn Contextual\trustincontext.dll (file missing)
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - E:\Program Files\ICQToolbar\toolbaru.dll
O3 - Toolbar: TrustIn Bar - {a19ef336-01d4-48e6-926a-fe7e1c747aed} - E:\Program Files\trustin bar\trustin.dll
O4 - HKLM\..\Run: [WinampAgent] E:\Documents and Settings\Benutzer\My Documents\Winamp\winampa.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ISUSPM Startup] E:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "E:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ICQ Lite] "E:\Program Files\ICQLite\ICQLite.exe" -minimize
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [AOLDialer] E:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [56e415ee.exe] E:\WINDOWS\system32\56e415ee.exe
O4 - HKLM\..\Run: [avgnt] "E:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [TrustIn Popups] "E:\Program Files\TrustIn Popups\TrustInPopups.exe"
O4 - HKCU\..\Run: [56e415ee.exe] E:\Documents and Settings\Benutzer\Local Settings\Application Data\56e415ee.exe
O4 - HKCU\..\Run: [Trust Cleaner] E:\Program Files\Trust Cleaner\TrustCleaner.exe
O4 - HKCU\..\RunOnce: [ICQ Lite] E:\Program Files\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: AOL 9.0 Tray-Symbol.lnk = E:\Program Files\AOL 9.0\aoltray.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://E:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - E:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - E:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - E:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - E:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - E:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - E:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: RadClock - Unknown owner - E:\WINDOWS\system32\RadClock.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - E:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - E:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

Über jede noch so kleine Hilfe bin ich dankbar.