worm.win32.netsky virus-bitte hilfe ich bin ein noob am pc

griesi

Das sind die Logfile von Hijackthis:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:30:25, on 16.03.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programme\Analog Devices\SoundMAX\Smax4.exe
C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Programme\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\ICQ6\ICQ.exe
C:\Programme\WinTV\Ir.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\Opera 9.5 beta\opera.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Dokumente und Einstellungen\Maurice\Lokale Einstellungen\Temporary Internet Files\Content.IE5\8A96PLAD\HiJackThis202[1].exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://s2.cookingluck.com/?pid=6082&v=16
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
R3 - URLSearchHook: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: e404mgr Class - {03B902B1-9B25-4173-9468-56775C85A8D4} - (no file)
O2 - BHO: XTTBPos00 Class - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\Programme\ICQToolbar\toolbaru.dll
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {27A82D47-9A2A-4B39-B4EC-792BBDFD03FA} - C:\WINDOWS\system32\xxyabba.dll
O2 - BHO: {b9c9357c-a368-6858-a094-15047d103ad7} - {7da301d7-4051-490a-8586-863ac7539c9b} - C:\WINDOWS\system32\jbgocsej.dll
O2 - BHO: (no name) - {8113C5EB-207E-4435-8802-0D7DC01B8148} - C:\WINDOWS\system32\awvvu.dll (file missing)
O2 - BHO: e404mgr Class - {8F10DE2B-E923-4548-B524-4D9C5FA80777} - (no file)
O2 - BHO: (no name) - {92bc82bd-48e9-43b4-87de-eec11ad188db} - C:\WINDOWS\system32\fxthakjv.dll
O2 - BHO: e404mgr Class - {A3D76B96-30B9-4DCC-9B3D-D12E31280D29} - (no file)
O2 - BHO: (no name) - {C2A1C5CB-C0EF-4689-9436-F62CCA1C5383} - (no file)
O2 - BHO: (no name) - {DBAF0D5D-8195-4CBC-AA29-B6F7EA37E35E} - C:\WINDOWS\system32\mlljk.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O3 - Toolbar: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AsusStartupHelp] C:\Programme\ASUS\AASP\1.00.15\AsRunHelp.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMAX] "C:\Programme\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [SchedullingAgent] c:\windows\system32\schedullingagent.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [OutpostFeedBack] C:\Programme\Agnitum\Outpost Firewall 1.0\feedback.exe /dumps_startup
O4 - HKLM\..\Run: [outpost_uninst] C:\DOKUME~1\Maurice\LOKALE~1\Temp\_uninstop.exe /u
O4 - HKLM\..\Run: [980f2201] rundll32.exe "C:\WINDOWS\system32\nyiqlkte.dll",b
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programme\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [BM9b3c119d] Rundll32.exe "C:\WINDOWS\system32\ahmqwafq.dll",s
O4 - HKLM\..\RunServices: [SchedullingAgent] c:\windows\system32\schedullingagent.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ICQ] "C:\Programme\ICQ6\ICQ.exe" silent
O4 - HKLM\..\Policies\Explorer\Run: [some] C:\Programme\NetProject\scit.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: AutoStart IR.lnk = C:\Programme\WinTV\Ir.exe
O9 - Extra button: Outpost Firewall Pro Quick Tune - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.explorertool.net/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.explorertool.net/redirect.php (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programme\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{19087BE4-96B4-4EA9-8076-776407D4DF7F}: NameServer = 85.255.115.42,85.255.112.19
O17 - HKLM\System\CCS\Services\Tcpip\..\{211C5DD3-A9BB-444F-8938-57F893A24729}: NameServer = 85.255.115.42,85.255.112.19
O17 - HKLM\System\CCS\Services\Tcpip\..\{32E27AD4-9C0A-46D9-B48D-56EE72E8D323}: NameServer = 85.255.115.42,85.255.112.19
O17 - HKLM\System\CCS\Services\Tcpip\..\{791524BB-A140-4D28-ABCF-93D16DFC9711}: NameServer = 85.255.115.42,85.255.112.19
O17 - HKLM\System\CCS\Services\Tcpip\..\{925020B3-07E7-4132-ABE0-826F6E565B75}: NameServer = 85.255.115.42,85.255.112.19
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.115.42 85.255.112.19
O17 - HKLM\System\CS2\Services\Tcpip\..\{19087BE4-96B4-4EA9-8076-776407D4DF7F}: NameServer = 85.255.115.42,85.255.112.19
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.115.42 85.255.112.19
O17 - HKLM\System\CS3\Services\Tcpip\..\{19087BE4-96B4-4EA9-8076-776407D4DF7F}: NameServer = 85.255.115.42,85.255.112.19
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.42 85.255.112.19
O20 - AppInit_DLLs: C:\Programme\Agnitum\Outpost Firewall 1.0\wl_hook.dll
O20 - Winlogon Notify: xxyabba - C:\WINDOWS\SYSTEM32\xxyabba.dll
O21 - SSODL: RomKernel - {b9e25b8a-147f-4c89-a00f-e1438bde0c09} - (no file)
O21 - SSODL: DriveDrv - {71ceb41f-e852-4be4-bef3-ac4cc6694e11} - (no file)
O21 - SSODL: bokpkov - {6BAC3981-E1AB-40DB-BBA7-CA25979DAAEE} - C:\WINDOWS\bokpkov.dll
O21 - SSODL: altvxvm - {1B800427-A35D-4E91-9FAA-66EDD47B4633} - C:\WINDOWS\altvxvm.dll
O22 - SharedTaskScheduler: djuka - {ee9f7cf5-cd49-4cd8-8ba6-1514e7a5c22c} - (no file)
O22 - SharedTaskScheduler: auras - {f0d4f88e-e1f8-460f-a41c-6cfb7f73af79} - (no file)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

--
End of file - 8506 bytes