Liebe Leute,
ich habe naiver Weise einen Download gestartet, welcher mich mit Trojanern nur so bombadierte. Meine Viren-Programme sind G-Data und Ad-Aware SE Personal. Beide haben getan, was sie konnten, auch was gefunden, aber damit ist es scheinbar nicht vorbei.
Beim Surfen im Internet Explorer öffnen sich nun ständig verschiedenste Seiten mit Werbung, die mir versuchen irgendetwas anzudrehen bzw. mich auf äußerst fragwürdige Sicherheitsprobleme hinweisen, in der Hoffnung ich würde ihre Software runterladen. Dazu gehört beispielsweise DriveCleaner.
Weitere Probleme habe ich nicht feststellen können, bin mir aber auch nicht sichert, ob da nicht noch mehr unterschwellig lauert.
Ich hab leider wenig Ahnung von Computern und deshalb auch keinen Schimmer was ihr genau für Daten von mir braucht und wie ich diese erstelle.
Ich erbitte eure Hilfe!

Zu meinem System: (von Belarc Advisor Current Profile.htm)

Operating System System Model
Windows XP Media Center Edition Service Pack 2 (build 2600) Packard Bell BV IMEDIA MC 9906 PB34340503
System Serial Number: 120290260318
Chassis Serial Number: 50424E
Enclosure Type: Desktop
Processor a Main Circuit Board b
2,13 gigahertz Intel Core 2 Duo
64 kilobyte primary memory cache
2048 kilobyte secondary memory cache Board: Packard Bell BV Cuba MS-7301 1.0
Bus Clock: 266 megahertz
BIOS: Phoenix Technologies, LTD W7301VP2.025 10/13/2006
Drives Memory Modules c,d
640,13 Gigabytes Usable Hard Drive Capacity
555,79 Gigabytes Hard Drive Free Space

Optiarc DVD RW AD-5170A [CD-ROM drive]
PHILIPS DROM6216 [CD-ROM drive]
ROXIO DVD-ROM EMULATOR SCSI CdRom Device [CD-ROM drive]
TP1038V FRY116S SCSI CdRom Device [CD-ROM drive]
TP1038V FRY116S SCSI CdRom Device [CD-ROM drive]
TP1038V FRY116S SCSI CdRom Device [CD-ROM drive]
TP1038V FRY116S SCSI CdRom Device [CD-ROM drive]

Generic USB CF Reader USB Device [Hard drive] -- drive 3
Generic USB MS Reader USB Device [Hard drive] -- drive 5
Generic USB SD Reader USB Device [Hard drive] -- drive 2
Generic USB SM Reader USB Device [Hard drive] -- drive 4
ST3320820AS [Hard drive] (320,07 GB) -- drive 0
ST3320820AS [Hard drive] (320,07 GB) -- drive 1 2048 Megabytes Installed Memory

Slot 'A0' has 1024 MB
Slot 'A1' has 1024 MB
Local Drive Volumes

c: (NTFS on drive 0) 320,06 GB 268,97 GB free
d: (NTFS on drive 1) 320,07 GB 286,82 GB free

Network Drives
None detected
Users (mouse over user name for details) Printers
local user accounts last logon
admin 24.03.2007 13:53:07 (admin)
Administrator 21.11.2006 12:53:50 (admin)
Ellen 24.03.2007 13:52:44 (admin)
local system accounts
ASPNET never
Gast 24.03.2007 11:46:30
Hilfeassistent never
SUPPORT_388945a0 never


Marks a disabled account; Marks a locked account HP DeskJet 970Cse on USB001

Controllers Display
Primärer IDE-Kanal [Controller] (2x)
Sekundärer IDE-Kanal [Controller] (2x)
Standard-Zweikanal-PCI-IDE-Controller
VIA Bus Master IDE Controller NVIDIA GeForce 7600 LE [Display adapter]
Philips 190S [Monitor] (19,1"vis, s/n BZ30630420545, Juli 2006)
Bus Adapters Multimedia
Roxio SoftScsi Host Adapter (X86)
SCSI/RAID Host Controller
VIA Rev 5 oder höher USB universeller Hostcontroller (4x)
VIA USB erweiterter Hostcontroller Realtek High Definition Audio
TerraTV Tuner (Philips PAL B/G)
TerraTV WDM Audio Capture
TerraTV WDM Crossbar
TerraTV WDM Video Capture
Communications Other Devices

1394-Netzwerkadapter
VIA Rhine II Fast Ethernet Adapter
primary Auto IP Address: 192.168.178.20 / 24
Gateway: 192.168.178.1
Dhcp Server: 192.168.178.1
Physical Address: 00:16:17:CE:B1:EB

Networking Dns Server: 192.168.178.1
VIA OHCI-konformer IEEE 1394-Hostcontroller
AuthenTec AES1610
HID-konformes Benutzersteuergerät
HID-konformes Gerät (2x)
USB-HID (Human Interface Device) (3x)
HID-Tastatur [Keyboard]
HID-konforme Maus [Mouse]
Standard-USB-Hub
USB-Druckerunterstützung
USB-Massenspeichergerät
USB-Root-Hub (5x)
USB-Verbundgerät
Virus Protection [Back to Top]
G DATA AntiVirenKit 2007 Version 17.0
Realtime File Scanning On

Missing Microsoft Security Hotfixes [Back to Top]

All required security hotfixes (using the 01/09/2007 Microsoft Security Bulletin Summary) have been installed.


Installed Microsoft Hotfixes [Back to Top]
.NET Framework 2.0
KB917283 on 21.11.2006 (details...)
KB922770 on 21.11.2006 (details...)
.NETFramework
1.0
KB887998 (details...)
1.1
S867460 (details...)
M886903 (details...)
Internet Explorer
SP2 (SP2)
Media Center 2005
SP4
KB900325 on 21.11.2006 (details...)
Microsoft .NET Framework 2.0
KB917283 (details...)
KB922770 (details...)
MSXML4SP2
Q927978 (details...)
SP3
KB908246 on 21.11.2006 (details...)
KB912067 on 21.11.2006 (details...)
KB914548 on 21.11.2006 (details...)
Step By Step Interactive Training
SP2
KB898458 on 21.11.2006 (details...)
Windows Media Player 10
KB911565 (details...)
KB913800 (details...)
KB917734_WMP10 (details...)
KB926251 (details...)
SP0
KB903157 on 21.11.2006 (details...)
KB910393 on 21.11.2006 (details...)
KB911565 on 21.11.2006 (details...)
KB913800 on 21.11.2006 (details...)
KB917734_WMP10 on 21.11.2006 (details...)
KB926251 on 12.12.2006 (details...)
Windows Media Player 6.4
KB925398_WMP64 (details...)
SP0
KB925398_WMP64 on 12.12.2006 (details...)
Windows Media Player
SP0
KB911564 on 21.11.2006 (details...)
Windows XP
KB923689 (details...)
SP0
KB923689 on 12.12.2006 (details...)
SP3
KB873339 on 21.11.2006 (details...)
KB885250 on 21.11.2006 (details...)
KB885835 on 21.11.2006 (details...)
KB885836 on 21.11.2006 (details...)
KB885884 on 30.11.2006 (details...)
KB886185 on 21.11.2006 (details...)
KB887472 on 21.11.2006 (details...)
KB887742 on 21.11.2006 (details...)
KB887998 on 21.11.2006 (details...)
KB888111WXPSP2 on 21.11.2006 (details...)
KB888113 on 21.11.2006 (details...)
KB888302 on 21.11.2006 (details...)
KB888795 on 21.11.2006 (details...)
KB890046 on 21.11.2006 (details...)
KB890859 on 21.11.2006 (details...)
KB891593 on 21.11.2006 (details...)
KB891781 on 21.11.2006 (details...)
KB893756 on 21.11.2006 (details...)
KB893803V2 on 21.11.2006 (details...)
KB894391 on 21.11.2006 (details...)
KB895961 on 21.11.2006 (details...)
KB896256 on 21.11.2006 (details...)
KB896358 on 21.11.2006 (details...)
KB896422 on 21.11.2006 (details...)
KB896423 on 21.11.2006 (details...)
KB896424 on 21.11.2006 (details...)
Windows XP
SP3 (continued)
KB896428 on 21.11.2006 (details...)
KB898461 on 21.11.2006 (details...)
KB899337 on 21.11.2006 (details...)
KB899510 on 21.11.2006 (details...)
KB899587 on 21.11.2006 (details...)
KB899589 on 21.11.2006 (details...)
KB899591 on 21.11.2006 (details...)
KB900485 on 21.11.2006 (details...)
KB900725 on 21.11.2006 (details...)
KB901017 on 21.11.2006 (details...)
KB901190 on 21.11.2006 (details...)
KB901214 on 21.11.2006 (details...)
KB902400 on 21.11.2006 (details...)
KB902841 on 21.11.2006 (details...)
KB904706 on 21.11.2006 (details...)
KB905414 on 21.11.2006 (details...)
KB905749 on 21.11.2006 (details...)
KB908519 on 21.11.2006 (details...)
KB908531 on 21.11.2006 (details...)
KB910437 on 21.11.2006 (details...)
KB910728 on 21.11.2006 (details...)
KB911280 on 21.11.2006 (details...)
KB911562 on 21.11.2006 (details...)
KB911567 on 21.11.2006 (details...)
KB911927 on 21.11.2006 (details...)
KB912024 on 21.11.2006 (details...)
KB912919 on 21.11.2006 (details...)
KB913446 on 21.11.2006 (details...)
KB913580 on 21.11.2006 (details...)
KB914388 on 21.11.2006 (details...)
KB914389 on 21.11.2006 (details...)
KB916595 on 21.11.2006 (details...)
KB917159 on 21.11.2006 (details...)
KB917344 on 21.11.2006 (details...)
KB917422 on 21.11.2006 (details...)
KB917953 on 21.11.2006 (details...)
KB918118 on 16.02.2007 (details...)
KB918439 on 21.11.2006 (details...)
KB918899 on 21.11.2006 (details...)
KB919007 on 21.11.2006 (details...)
KB919803 on 21.11.2006 (details...)
KB920213 on 21.11.2006 (details...)
KB920214 on 21.11.2006 (details...)
KB920670 on 21.11.2006 (details...)
KB920683 on 21.11.2006 (details...)
KB920685 on 21.11.2006 (details...)
KB920872 on 21.11.2006 (details...)
KB921398 on 21.11.2006 (details...)
KB921883 on 21.11.2006 (details...)
KB922582 on 21.11.2006 (details...)
KB922616 on 21.11.2006 (details...)
KB922760 on 21.11.2006 (details...)
KB922819 on 21.11.2006 (details...)
KB923191 on 21.11.2006 (details...)
KB923414 on 21.11.2006 (details...)
KB923694 on 12.12.2006 (details...)
KB923980 on 21.11.2006 (details...)
KB924191 on 21.11.2006 (details...)
KB924270 on 21.11.2006 (details...)
KB924496 on 21.11.2006 (details...)
KB924667 on 16.02.2007 (details...)
KB925454 on 14.12.2006 (details...)
KB925486 on 21.11.2006 (details...)
KB926255 on 12.12.2006 (details...)
KB926436 on 16.02.2007 (details...)
KB927779 on 16.02.2007 (details...)
KB927802 on 16.02.2007 (details...)
KB928090 on 16.02.2007 (details...)
KB928255 on 16.02.2007 (details...)
KB928843 on 16.02.2007 (details...)
KB929338 on 16.03.2007 (details...)
KB929969 on 10.01.2007 (details...)
KB931836 on 16.02.2007 (details...)



Click here to see all available Microsoft security hotfixes for this computer.

Marks a security hotfix (using the 01/09/2007 Microsoft Security Bulletin Summary)
Marks a hotfix that verifies correctly
Marks a hotfix that fails verification (note that failing hotfixes need to be reinstalled)
Unmarked hotfixes lack the data to allow verification


Click here for Belarc's System Management products, for large and small companies.

Software Licenses [Back to Top]

Belarc - Advisor 574bbd3d
Goto Software - Vade Retro NC
Microsoft - Internet Explorer 76497-OEM-0011903-00824 (Key: FJBM7-KW7G2-YXDGW-VHYVW-9QK9M)e
Microsoft - Office XP Professional mit FrontPage 54199-640-0000025-17342 (Key: FM9FY-TMF7Q-KCKCT-V9T29-TBBBG)
Microsoft - WebFldrs XP 12345-111-1111111-04198
Microsoft - Windows XP Media Center Edition 76497-OEM-0011903-00824 (Key: FJBM7-KW7G2-YXDGW-VHYVW-9QK9M)e
NEC Computers International - System 120290260318
Sonic - DMX C5TQGTJHJEC7NHZUM
Sony - CONNECT Auto Update CONNECT Auto Update

Software Versions (mouse over * for details, click * for location) [Back to Top]
Adobe Acrobat Version 8.0.0.0 *
Adobe LM Service Version 2.67.10.1 *
Adobe Reader Synchronizer Version 8, 0, 0, 0 *
Adobe Reader Version 8.0.0.2006102300 *
AGENTIX Software - SystemReport Utility Version 0.93b *
Alexander Roshal - WinRAR archiver Version 3.51.0.0 *
Apple Computer, Inc. - QuickTime QuickTime 6.5 *
AVK Version 14, 0, 0, 0 *
AVM Berlin - FRITZ!DSL Version 1.0.0.3 *
AVM IGD Service Version 1.00.01.2004 *
AVM Rocky Version 3.07.18.2001 *
Belarc, Inc. - Advisor Version 7.2h *
Benutzerhandbuch (PackardBell InfoCentre) *
C. Ghisler & Co. - Total Commander Version 6.55 *
Cerulean Studios - Trillian Version 3.1.0.121 *
Cinematronics - 3D-Pinball Version 5.1.2600.2180 *
Cole2k Media - Codec Pack (Advanced) Version 3.2.0.0 *
CONNECT Player Version 1,0,04,16100 *
Creatures 2 StartUp Application Version 1, 0, 0, 1 *
DivX4 Bitrate Calc *
DivXNetworks Inc. - Config App. Version 2, 0, 0, 1 *
DT Soft Ltd. - DAEMON Tools Version 4.08.0.0 *
Elaborate Bytes AG - CloneDVD Version 2, 5, 1, 1 *
Elaborate Bytes AG - CloneDVD Version 5, 1, 0, 0 *
Elaborate Bytes AG - elby CloneDVD Version 2, 9, 0, 1 *
Electronic Arts Inc. - EA Uninstall Version 1.00.00.000 *
Electronic Arts Inc. - EA Uninstall Version 1.3.0.335 *
Electronic Arts Inc. - EReg Version 1, 0, 0, 59 *
Foxit Reader Version 2, 0, 2006, 0930 *
G DATA Personal Firewall Version 1, 0, 0, 1 *
G DATA Software AG - AntiVirusKit InternetSecurity Version 17, 0, 0, 0 *
G DATA Software AG - AntiVirusKit Version 1, 5, 0, 0 *
G DATA Software AG - AVKProxy Module Version 1, 4, 0, 0 *
G DATA Software AG - AVKService Module Version 17, 0, 0, 0 *
Gameware Development Ltd - Creatures 1 Launcher Version 1, 0, 0, 2 *
Google Updater Version 2.0.734.29932.beta *
GoogleToolbarNotifier Version 1, 2, 1128, 5462 *
GSpot Codec Information Appliance Version 2, 5, 2, 1 *
Hewlett-Packard Co. - HP DeskJet A.03.01.03 *
HP DeskJet Version 2,80,0,0 *
IrfanView deinstallieren *
IrfanView Version 3.98 *
KOCH Auto Update Version 2.0.0.4 *
KsL Software - Registry First Aid Version 3.4.0.543 *
Lavasoft Ad-Aware SE SE 106 *
LimeWire PRO 4.12.3 *
Macrovision Corporation - InstallShield (R) Version 10.50 *
Microsoft (r) Windows Script Host Version 5.6.0.8820 *
Microsoft - DirectX 8 SDK Version 8.1 *
Microsoft Application Error Reporting Version 10.0.2609 *
Microsoft Clip Organizer Version 10.0.2625 *
Microsoft Corporation - ???????? 2002a Version 5.2.2801 *
Microsoft Corporation - DirectShow DirectX 9.0 *
Microsoft Corporation - Internet Explorer Version 6.00.2900.2180 *
Microsoft Corporation - Messenger Version 4.7.3001 *
Microsoft Corporation - Windows Installer - Unicode Version 3.1.4000.1823 *
Microsoft Corporation - Windows Movie Maker Version 2.1.4026.0 *
Microsoft Corporation - Windows® NetMeeting® Version 3.01 *
Microsoft Corporation - Zone.com Version 1.2.626.1 *
Microsoft Data Access Components Version 3.525.1117.0 *
Microsoft IME 2002 Version 8.1.4202.0 *
Microsoft Office Assistent zum Speichern eigener Einstellungen/Profil-Assistent Version 10.0.2609 *
Microsoft Office XP Version 10.0.2627 *
Microsoft(R) Windows Media Player Version 10.00.00.3931 *
Microsoft® .NET Framework Version 2.0.50727.42 * MicroVision Development, Inc. - SureThing CD Labeler Version 1.2.447 *
Mucky Foot Productions Ltd. StarTopia Version 1, 0, 0, 0 *
Musicmatch Jukebox Version 9.0.0.1 *
MUSICMATCH Jukebox Version 9.00.5100 *
MyDVD *
Nec Computers International - Backup UI Version 1.0.0.0 *
Need for Speed Underground 2 *
Need for Speed™ Carbon *
Nullsoft - Winamp Version 5.3.3.1100 *
NVIDIA Driver Helper Service, Version 84.66 Version 6.14.10.8466 *
OGMCalc Application Version 0, 2, 0, 1 *
On Demand Distribution - SonicSelector Version 10.00.0105 *
Packard Bell BV - Setup my PC Version 1.0.0.0 *
Packard Bell BV - Smart Restore Version 7.0.0.0 *
PhotoSuite Version 9.0.1.52 *
Piriform Ltd - CCleaner Version 1.35.0424 *
Power Tab Editor Version 1.7 Build 80 *
R.Peffer, C.Lengersdorf, F.M.Birth for TerraTec Electronic GmbH - Cinergy TV series, TValueRadio, TerraTV Radio+, TerraTV+, TerraTValue Version 3, 23, 0, 0 *
Radium MP3 codec configuration tool Version 1.0.0.0 *
RealNetworks, Inc. - RealPlayer (32-bit) Version 6.0.9.584 *
Related Designs Software GmbH - Anno 1701 V1.01 *
Roxio Creator *
Skype Version 2.0 *
SlySoft, Inc. - CloneCD Version 5, 0, 0, 1 *
SlySoft, Inc. - CloneCD Version 5, 2, 3, 1 *
SlySoft, Inc. - CloneCD Version 5.2.9.1 *
Sonic - DVDINFOPro Application V4.15 *
Sonic Solutions - Backup Executable Version 1.0.0.1 *
Sonic Solutions - CommonSDK Version 8.0.0.47 *
Sonic Solutions - CommonSDK Version 9.0.1.64 *
Sonic Solutions - CommonSDK Version 9.1.0.13 *
Sonic Solutions - Digital Media Experience Version 3.5.0.0 *
Sonic Solutions - Editors Module Version 9.0.2.39 *
Sonic Solutions - InterActual Player Version 2.60.12.0405 *
Sonic Solutions - Label Creator Version 9.0.1.71 *
Sonic Solutions - MediaCapture Version 9.0.2.61 *
Sonic Solutions - Roxio Backup Version 9.0.1.64 *
Sonic Solutions - Roxio Creator Classic Version 9.0.2.54 *
Sonic Solutions - Roxio DiscCopier Version 9.0.1.94 *
Sonic Solutions - Roxio Drive Emulator Version 9.0.1.54 *
Sonic Solutions - Roxio DVD Music Assistant Version 9.0.1.68 *
Sonic Solutions - Roxio Easy Audio Capture Version 9.0.1.68 *
Sonic Solutions - Roxio LP and Tape Assistant Version 9.0.1.68 *
Sonic Solutions - Roxio Music Disc Creator Version 9.0.1.68 *
Sonic Solutions - Roxio Retrieve Version 9.0.2.54 *
Sonic Solutions - Roxio Sound Editor Version 9.0.1.68 *
Sonic Solutions - Task Assistant Version 9.0.1.71 *
Sony Corporation - MSCSPTISRV Module Version 4.3.00.08302 *
Sony Corporation - PACSPTISVR Module Version 4.3.00.08302 *
Sony Corporation - SCSI Helper Service Version 1, 0 *
Sony Corporation - SPTISRV Module Version 4.3.00.08302 *
StatsReader Version 2, 1, 0, 0 *
Sun Microsystems, Inc. - Java(TM) 2 Platform Standard Edition 5.0 Update 9 Version 5.0.90.3 *
TerraTec Electronic GmbH - ActiveRadio Version 3, 21, 0, 0 *
TerraTec Scheduler Version 1, 18, 0, 0 *
TODO: Version 1.0.0.1 *
Total Commander Entfernen oder Reparieren *
TweakNow RegCleaner Professional Version 2.9.0.0 *
VideoLAN Team - VLC media player Version 0.8.6.0 *
Wizards to adjust .NET Framework security, assign trust to assemblies, and fix broken .NET applications. Version 1.0.5000.0 *
wocblock2 Application Version 1, 0, 0, 4 *
www.softella.com - DirectShow Filter Manager Version 1.0.0.0 *
XviD AviC FOURCC Changer *
XviD MiniCalc *

Ich hoffe ihr könnt damit schonmal irgendwas anfangen.

Vielen Dank im Voraus!

Ich bitte wirklich inständig um Hilfe Leute!
Kann mir denn da gar keiner helfen???
Ich habe bereits viele Fälle gelesen denen es genauso ging wie mir, allerdings hab ich nicht vertsanden was da abging, da ein Protokoll mit diesem HiJack...dingens erstellt wurde und auch damit geholfen...
Aber keine Ahnung was das ist und wie das geht und ob es notwendig ist.

Mal ehrlich Jungs: HILFE!!!



Peace und lange Haare

Hi,
Anleitung zu HijackThis in meiner Signatur...und ja in deinem Fall wäre es nötig

Logfile of HijackThis v1.99.1
Scan saved at 18:43:48, on 30.05.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\APPS\G DATA InternetSecurity SE\AVK\AVKService.exe
C:\APPS\G DATA InternetSecurity SE\AVK\AVKWCtl.exe
C:\Programme\FRITZ!DSL\IGDCTRL.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programme\Gemeinsame Dateien\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Gemeinsame Dateien\G DATA\AVKProxy\AVKProxy.exe
C:\WINDOWS\system32\dllhost.exe
C:\APPS\G DATA InternetSecurity SE\Firewall\GDFwSvc.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programme\Java\jre1.5.0_09\bin\jusched.exe
C:\APPS\G DATA InternetSecurity SE\AVKTray\AVKTray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Programme\RFA\rfagent.exe
C:\PROGRA~1\GEMEIN~1\TerraTec\SCHEDU~1\TTTimer.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\APPS\SMP\SmpSys.exe
C:\Programme\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\APPS\G DATA InternetSecurity SE\Firewall\GDFirewallTray.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Programme\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\WINDOWS\TEMP\win1D.tmp.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\DOKUME~1\Ellen\LOKALE~1\Temp\Rar$EX05.375\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gmx.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\ger.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
O3 - Toolbar: Cole2k Media Toolbar - {8AE33802-00D3-4F1B-B5C7-6FEE34E402CE} - C:\Programme\Cole2k Media Toolbar\v3.2.0.0\Cole2k_Media_Toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar3.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [AVKTray] "C:\APPS\G DATA InternetSecurity SE\AVKTray\AVKTray.exe"
O4 - HKLM\..\Run: [rfagent] C:\Programme\RFA\rfagent.exe
O4 - HKLM\..\Run: [pcwTempLeer] Cmd /c C:\WINDOWS\pcwTempLeer.bat
O4 - HKLM\..\Run: [TerraTec Scheduler] C:\PROGRA~1\GEMEIN~1\TerraTec\SCHEDU~1\TTTimer.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [mmtask] "C:\Programme\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [setup] rundll32.exe "C:\WINDOWS\system32\giqrmjxk.dll",realset
O4 - HKLM\..\Run: [ytgloxyp.exe] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ytgloxyp.exe
O4 - HKCU\..\Run: [SmpcSys] C:\APPS\SMP\SmpSys.exe
O4 - HKCU\..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Programme\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: G DATA Firewall Tray.lnk = C:\APPS\G DATA InternetSecurity SE\Firewall\GDFirewallTray.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\ger.htm
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.studivz.net/photouploader/ImageUploader4.cab
O16 - DPF: {938527D1-CDB7-4147-998A-B20FCA5CC976} (Cdmcco Class) - http://cafeimg.hanmail.net/activex/dmcc2.cab?Version=1,0,0,10
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVKProxy - G DATA Software AG - C:\Programme\Gemeinsame Dateien\G DATA\AVKProxy\AVKProxy.exe
O23 - Service: AVK Service (AVKService) - G DATA Software AG - C:\APPS\G DATA InternetSecurity SE\AVK\AVKService.exe
O23 - Service: AVK Wächter (AVKWCtl) - Unknown owner - C:\APPS\G DATA InternetSecurity SE\AVK\AVKWCtl.exe
O23 - Service: AVM IGD CTRL Service - AVM Berlin - C:\Programme\FRITZ!DSL\IGDCTRL.EXE
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe
O23 - Service: G DATA Personal Firewall (GDFwSvc) - Unknown owner - C:\APPS\G DATA InternetSecurity SE\Firewall\GDFwSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Programme\Gemeinsame Dateien\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Programme\Gemeinsame Dateien\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Programme\Gemeinsame Dateien\Sonic Shared\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Programme\Gemeinsame Dateien\Sonic Shared\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Programme\Gemeinsame Dateien\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Programme\Gemeinsame Dateien\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Programme\Gemeinsame Dateien\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: Sony SCSI Helper Service - Sony Corporation - C:\Programme\Gemeinsame Dateien\Sony Shared\Fsk\SonySCSIHelperService.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Programme\Gemeinsame Dateien\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Programme\Gemeinsame Dateien\SureThing Shared\stllssvr.exe



Das hab ich rausbekommen

Na dann fangen wir mal an

C:\WINDOWS\TEMP\win1D.tmp.exe

Beende den Prozess über den Taskmanager!

C:\WINDOWS\system32\giqrmjxk.dll
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ytgloxyp.exe

Alle 3 Dateien mal bei Virustotal hochladen und vollständiges Ergebnis posten.

Dann noch:

O16 - DPF: {938527D1-CDB7-4147-998A-B20FCA5CC976} (Cdmcco Class) - http://cafeimg.hanmail.net/activex/dmcc2.cab?Version=1,0,0,10

Den EIntrag mit HijackThis im abgesicherten Modus fixen.

Moin,

Ich die Datei gefixt und den Prozess gekillt, leider kam bis jetzt zwar nur eine Werbeseite (daher will ich erst mla keine voreiligen Schlüsse ziehen), trotzdem glaube ich, dass es nicht geholfen hat. Aber kann auch Zufall gewesen sein...

Ich werd jetzt erst ma zu Virustotal!

STATUS: SCANNINGFile "giqrmjxk.dll" received on 05.30.2007 at 20:14:55 (CET) is being scanned by VirusTotal in this moment. Results will be shown as they're generated.

Antivirus Version Update Result
AhnLab-V3 2007.5.30.0 05.30.2007 Win-Trojan/Virtumonde.132660
AntiVir 7.4.0.29 05.30.2007 ADSPY/Virtumonde.AR.4
Authentium 4.93.8 05.23.2007 no virus found
Avast 4.7.997.0 05.30.2007 no virus found
AVG 7.5.0.467 05.30.2007 Adware Generic2.CEU
BitDefender 7.2 05.30.2007 Trojan.Vundo.AY
CAT-QuickHeal 9.00 05.30.2007 AdWare.Virtumonde.ar (Not a Virus)
ClamAV devel-20070416 05.30.2007 Trojan.Packed-7
DrWeb 4.33 05.30.2007 Trojan.Virtumod
eSafe 7.0.15.0 05.30.2007 no virus found
eTrust-Vet 30.7.3675 05.30.2007 Win32/Vundo.CR
Ewido 4.0 05.29.2007 no virus found
FileAdvisor 1 05.30.2007 no virus found
Fortinet 2.85.0.0 05.30.2007 suspicious
F-Prot 4.3.2.48 05.30.2007 no virus found
F-Secure 6.70.13030.0 05.30.2007 W32/Vundo.gen25
Ikarus T3.1.1.8 05.30.2007 not-a-virus:AdWare.Win32.Virtumonde.ar
Kaspersky 4.0.2.24 05.30.2007 not-a-virus:AdWare.Win32.Virtumonde.ar
McAfee 5042 05.30.2007 potentially unwanted program Vundo
Microsoft 1.2503 05.29.2007 no virus found
NOD32v2 2298 05.30.2007 Win32/Adware.Virtumonde
Norman 5.80.02 05.30.2007 W32/Vundo.gen25
Panda 9.0.0.4 05.30.2007 Spyware/Virtumonde
Prevx1 V2 05.30.2007 no virus found
Sophos 4.18.0 05.28.2007 Virtumundo
Sunbelt 2.2.907.0 05.26.2007 VIPRE.Suspicious
Symantec 10 05.30.2007 Trojan.Vundo
TheHacker 6.1.6.126 05.30.2007 Adware/Virtumonde.ar
VBA32 3.12.0 05.30.2007 AdWare.Win32.Virtumonde.ar

Ich denk mal ersteres werd ich löschen!

Vielen vielen Dank!
Die verfluchten Popups sind verschwunden und die beiden Teile für Virustotal; da hattest auch Recht.

Kann gar nicht beschreiben, wie glücklich ich jetzt bin!

Bist'n Kumpel!
PEACE

Hallo ich habe jetzt genau das gleiche Problem wie mein Kollege hier unten!

Habe versucht den gleichen weg zu gehen wie ihm beschrieben wurde... aber bei mir sind schon im Task manager andere .exe geladen. Nun weis ich nicht was ich dort alles beenden muss!

Brauche dringend hilfe, da sich bei mir entweder mal einzellne Explorer Seiten öffnen oder manchmal auch 65!

hier meine Hijack File, BITTE Helft mir !

Logfile of HijackThis v1.99.1
Scan saved at 12:05:56, on 31.05.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\TuneUp Utilities 2006\WinStylerThemeSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programme\Alwil Software\Avast4\aswUpdSv.exe
C:\Programme\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\NetDrive\wdService.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Programme\Alwil Software\Avast4\ashMaiSv.exe
C:\Programme\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Programme\Microsoft IntelliType Pro\type32.exe
C:\Programme\Microsoft IntelliPoint\point32.exe
C:\Programme\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programme\TuneUp Utilities 2006\MemOptimizer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programme\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\explorer.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Dokumente und Einstellungen\Sebastian\Desktop\hijackthis\HijackThis.exe

O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [SBDrvDet] C:\Programme\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [type32] "C:\Programme\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Programme\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Programme\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\GEMEIN~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [setup] rundll32.exe "C:\WINDOWS\system32\pfxspmxi.dll",realset
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Programme\TuneUp Utilities 2006\MemOptimizer.exe" autostart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Schnellstart.lnk = C:\Programme\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Add to AMV Converter... - C:\Programme\MP3 Player Utilities 4.04\AMVConverter\grab.html
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Programme\MP3 Player Utilities 4.04\MediaManager\grab.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Prog'Z\PartyPoker\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Prog'Z\PartyPoker\PartyPoker\RunApp.exe
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O23 - Service: Adobe LM Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programme\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programme\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programme\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programme\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Programme\TuneUp Utilities 2006\WinStylerThemeSvc.exe
O23 - Service: WebDrive Service (WebDriveService) - Unknown owner - C:\Programme\NetDrive\wdService.exe

THX Till_Tomorrow

@Till_Tomorrow:
Mach bitte einen eigenen Thread auf!

@moloin:
Hast du die Dateien denn schon entfernt?
Deine Pop-Ups sind jetzt vielleicht weg, dein System ist aber nicht sauber.

Vundofix Anleitung

Einmal Vundofix laufen lassen.
Dann ein neues Logfile.