TR/Vundo.gen & TR/Crypt.F.Gen etc...

Matthjias

Servus,

ich habe schon seit mehrere Monaten diese Viren und vielleicht auch noch ein paar andere am PC.
Ist zwar nur auf meinem 2. Computer aber den will man ja auch noch benutzen und nicht die ganze Zeit nur stehen lassen oder?

Da ich mich mit HijackThis mal garnicht auskenne, könntet ihr mir vielleicht helfen und noch mehr Probleme feststellen und dann auch noch Helfen sie zu Beseitigen. Ich habe schon in der Suche TR/Vundo.gen eingegeben... aber bei über 140 Seiten und dann noch als nicht gerade qualifizierter Computerkenner ^^ halfen die mir nciht sehr viel weiter

Mein HijackThis Log-File:

Logfile of HijackThis v1.99.1
Scan saved at 00:03:35, on 03.02.2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\system32\rundll32.exe
E:\WINDOWS\Explorer.EXE
E:\Programme\AntiVir PersonalEdition Classic\sched.exe
E:\Programme\AntiVir PersonalEdition Classic\avguard.exe
E:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe
E:\WINDOWS\TWF0dGhpYXM\command.exe
E:\WINDOWS\System32\CTsvcCDA.EXE
E:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
E:\Programme\Network Monitor\netmon.exe
E:\WINDOWS\System32\svchost.exe
E:\Programme\HHVcdV7Sys\VC7SecS.exe
E:\WINDOWS\winmgr.exe
C:\Programme\Gadu-Gadu\gg.exe
E:\PROGRA~1\MSNMES~1\msnmsgr.exe
E:\WINDOWS\System32\ctfmon.exe
E:\WINDOWS\System32\svchost.exe
E:\Programme\AntiVir PersonalEdition Classic\avcenter.exe
E:\Programme\AntiVir PersonalEdition Classic\avscan.exe
E:\Programme\Internet Explorer\IEXPLORE.EXE
E:\WINDOWS\TEMP\syst.exe
F:\Programme\LeechGet 2004\LeechGet.exe
E:\Dokumente und Einstellungen\***\Desktop\Minigames\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.arcor.de
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.arcor.de
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.arcor.de
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.arcor.de
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.arcor.de
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.arcor.de
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.msgplus.net/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [LXBUCATS] rundll32

E:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBUtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [DllRunning] rundll32.exe "E:\WINDOWS\System32\xpuddvtn.dll",setvm
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Programme\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [msnmsgr] "E:\PROGRA~1\MSNMES~1\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] E:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel -

res://E:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Mit dem LeechGet Wizard laden - file://F:\Programme\LeechGet

2004\\Wizard.html
O8 - Extra context menu item: Mit LeechGet herunterladen - file://F:\Programme\LeechGet

2004\\AddUrl.html
O8 - Extra context menu item: Mit LeechGet parsen - file://F:\Programme\LeechGet 2004\\Parser.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

E:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

E:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Mobilen Favoriten erstellen - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} -

E:\Programme\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\Programme\Microsoft

ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Mobilen Favoriten erstellen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} -

E:\Programme\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - F:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} -

F:\Programme\ICQLite\ICQLite.exe
O12 - Plugin for .fpx: C:\\Program Files\\Internet Explorer\\PLUGINS\\NPRVRT32.dll
O12 - Plugin for .ivr: C:\\Program Files\\Internet Explorer\\PLUGINS\\NPRVRT32.dll
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) -

http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -

http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) -

https://signup.msn.com/pages/MsnInstC.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) -

http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-48.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -

http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -

http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1133279943042
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -

http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1133279918937
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -

http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -

http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) -

http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -

http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) -

http://player.virtools.com/downloads/player/Install2.5/Installer.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - E:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - E:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - E:\Programme\Gemeinsame Dateien\Adobe Systems

Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - E:\Programme\AntiVir PersonalEdition

Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - AVIRA GmbH -

E:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - E:\Programme\IVT

Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Command Service (cmdService) - Unknown owner - E:\WINDOWS\TWF0dGhpYXM\command.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd -

E:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation -

E:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - E:\Programme\iPod\bin\iPodService.exe
O23 - Service: lxbu_device - Lexmark International, Inc. - E:\WINDOWS\System32\lxbucoms.exe
O23 - Service: Network Monitor - Unknown owner - E:\Programme\Network Monitor\netmon.exe
O23 - Service: NtDIC(ntdic) (NtDIC) - Unknown owner - E:\WINDOWS\system32\icntrl.exe (file missing)
O23 - Service: NTFS File Location Service (NTFSFLS) - Unknown owner - E:\WINDOWS\system32\ntfsloc.exe

(file missing)
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - Unknown owner -

F:\Programme\TuneUp Utilities 2006\WinStylerThemeSvc.exe (file missing)
O23 - Service: Virtual CD v7 Management Service (VC7SecS) - H+H Software GmbH -

E:\Programme\HHVcdV7Sys\VC7SecS.exe
O23 - Service: Microsoft Windows Man Service (Windows Man Service) - Unknown owner -

E:\WINDOWS\winmgr.exe
O23 - Service: Microsoft Windows Spool Service (Windows Spool Service) - Unknown owner -

E:\WINDOWS\wdfmgr.exe (file missing)




....

Mein PC ist schon ziemlich im ar*** ^^

aber geht es den noch irgendwie zu retten OHNE ihn zu formatieren?



Hoffe um schnelle, Professionelle Antwort

Gruß
Matze