Hallo!
Ich bräuchte einen Rat, und zwar öffnen sich bei firefox häufig ganz automatisch irgendwelche neuen Internetseiten.
Hier mein Logfile.
Liebe Grüße.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:29:54, on 24.09.2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\AVEO\AveoCap\AveoSTI.exe
C:\Program Files\System Control Manager\MGSysCtrl.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Protector Suite QL\psqltray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Users\***\AppData\Local\koake.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Windows\system32\wuauclt.exe
C:\Program Files\Adobe\Acrobat 5.0\Reader\AcroRd32.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O1 - Hosts: ::1 localhost
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [AveoSTI.exe] C:\Program Files\AVEO\AveoCap\AveoSTI.exe
O4 - HKLM\..\Run: [QuickFinder Scheduler] "C:\Program Files\WordPerfect Office X3\Programs\QFSCHD130.EXE"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup
O4 - HKLM\..\Run: [AuditVista]
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [MGSysCtrl] C:\Program Files\System Control Manager\MGSysCtrl.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [koake] "c:\users\schulte\appdata\local\koake.exe" koake
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Senden an &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Öffnen mit WordPerfect - C:\Program Files\WordPerfect Office X3\Programs\WPLauncher.hta
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{5835E060-3734-4F16-8E11-162A643ED7A9}: NameServer = 192.168.2.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: SCM Driver Daemon (NishService) - Unknown owner - C:\Program Files\System Control Manager\edd.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

--
End of file - 7941 bytes

Diese Dateien bei Virustotal hochladen und den vollständigen bericht posten!

C:\Users\***\AppData\Local\koake.exe
C:\Program Files\AVEO\AveoCap\AveoSTI.exe

hey,
vielen dank für die schnelle antwort.
hier der hoffentlich vollständige bericht =)
lg

1.
Datei koake.exe empfangen 2008.09.24 19:08:46 (CET)
Ergebnis: 2/36 (5.56%)

Antivirus Version letzte aktualisierung Ergebnis
AhnLab-V3 2008.9.25.0 2008.09.24 -
AntiVir 7.8.1.34 2008.09.24 -
Authentium 5.1.0.4 2008.09.23 -
Avast 4.8.1195.0 2008.09.24 -
AVG 8.0.0.161 2008.09.24 -
BitDefender 7.2 2008.09.24 -
CAT-QuickHeal 9.50 2008.09.24 -
ClamAV 0.93.1 2008.09.24 -
DrWeb 4.44.0.09170 2008.09.24 -
eSafe 7.0.17.0 2008.09.24 -
eTrust-Vet 31.6.6103 2008.09.24 -
Ewido 4.0 2008.09.24 -
F-Prot 4.4.4.56 2008.09.23 -
F-Secure 8.0.14332.0 2008.09.24 -
Fortinet 3.113.0.0 2008.09.23 -
GData 19 2008.09.24 -
Ikarus T3.1.1.34.0 2008.09.24 -
K7AntiVirus 7.10.470 2008.09.24 -
Kaspersky 7.0.0.125 2008.09.24 -
McAfee 5390 2008.09.23 -
Microsoft 1.3903 2008.09.24 -
NOD32 3468 2008.09.24 -
Norman 5.80.02 2008.09.24 -
Panda 9.0.0.4 2008.09.24 -
PCTools 4.4.2.0 2008.09.24 -
Prevx1 V2 2008.09.24 Suspicious
Rising 20.63.22.00 2008.09.24 -
Sophos 4.33.0 2008.09.24 -
Sunbelt 3.1.1667.1 2008.09.24 -
Symantec 10 2008.09.24 -
TheHacker 6.3.0.9.092 2008.09.24 -
TrendMicro 8.700.0.1004 2008.09.24 -
VBA32 3.12.8.5 2008.09.23 -
ViRobot 2008.9.24.1390 2008.09.24 -
VirusBuster 4.5.11.0 2008.09.24 -
Webwasher-Gateway 6.6.2 2008.09.24 Win32.Vulnerable.gen!High (suspicious)
weitere Informationen
File size: 258048 bytes
MD5...: c7277c0cb339a2b47dc82d3779fa4a5b
SHA1..: 98f43c8d6c33faea00e7560b8ce3123ea90d4fb8
SHA256: 7a962f3f9bb6f7f638cf9be7bd8e72c58028046f9f64508dd1e05e55edd6bea4
SHA512: 84b3f7276454270f735276c8ca57967dce620bfd89a93c26030957c396d01b16
94ee20b6fe69a4239297d67d84fe9d6515dbb7e81cfa56b85b6079b2fa84b067
PEiD..: Armadillo v1.71
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x43ae69
timedatestamp.....: 0x422321ca (Mon Feb 28 13:51:06 2005)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x39ffc 0x3a000 7.42 32393fda35413680d013a7a2dc2efe35
.rdata 0x3b000 0x1104 0x2000 3.57 d2b012544633aac154746ea6fa7e02b2
.data 0x3d000 0x1e4c 0x2000 4.00 637431773541c807d39e370f02729745

( 10 imports )
> KERNEL32.dll: GetModuleHandleA, GetVersionExA, VirtualProtect, FindFirstFileExW, IsDBCSLeadByteEx, VirtualUnlock, GetVolumeInformationW, CreateDirectoryA, CreateProcessA, GetThreadContext, RaiseException, ReleaseMutex, DeleteCriticalSection, SetCurrentDirectoryA, GetCommState, EnumResourceNamesA, GetStartupInfoA, GetLogicalDriveStringsA, GetFileType, GetProcessTimes, CreateDirectoryExA, QueryDosDeviceA, lstrlenA, VirtualAlloc
> USER32.dll: ToUnicodeEx, GetClassInfoExW, SetWindowLongW, GetClipboardOwner, GetScrollBarInfo, SubtractRect, SendMessageTimeoutA, DispatchMessageA, GetClipboardViewer, GetDlgItemInt, GetWindowTextLengthW, CharLowerBuffW, GetAncestor, SetWinEventHook, EqualRect, GetMenu, MessageBoxExA, CharPrevA, SetCapture, DrawTextA, MessageBoxW, MessageBeep, CreateDialogIndirectParamW, MsgWaitForMultipleObjects, SetMenuItemInfoW, SetPropA, wsprintfW, ChangeDisplaySettingsExA, SetCursor, SetWindowPos, GetWindowContextHelpId, IsClipboardFormatAvailable, UnregisterDeviceNotification, PtInRect, GetMessagePos, GetMenuItemInfoA, GetWindow, AppendMenuW, CopyAcceleratorTableA, SwitchDesktop, InvalidateRgn, DrawIcon, InSendMessage, EndDeferWindowPos, InsertMenuItemW, GetFocus, GetClipboardFormatNameW, CheckMenuRadioItem, GetScrollPos
> GDI32.dll: GetTextFaceA, StartDocW, PlayEnhMetaFileRecord, SetTextJustification, BitBlt, TranslateCharsetInfo
> comdlg32.dll: GetFileTitleW, ReplaceTextW, FindTextA
> ADVAPI32.dll: RegLoadKeyA, DuplicateTokenEx, LookupPrivilegeNameA, EnumServicesStatusA, DeleteAce, ImpersonateSelf, DeleteService, CryptExportKey, CryptEncrypt, GetSidLengthRequired, GetSecurityDescriptorDacl, OpenProcessToken, RegCloseKey, FreeSid, SetPrivateObjectSecurity, ClearEventLogW, RegFlushKey, RegQueryInfoKeyA, AddAce, UnlockServiceDatabase, SetThreadToken, ChangeServiceConfigA, IsValidSid, CryptSetKeyParam, RegQueryInfoKeyW, CryptDecrypt, GetSidIdentifierAuthority, CryptAcquireContextW, CreateProcessAsUserA, RegRestoreKeyW, RevertToSelf, CryptHashData, BuildSecurityDescriptorW, RegEnumKeyW, GetExplicitEntriesFromAclW, OpenSCManagerA, CreatePrivateObjectSecurity
> SHELL32.dll: DragAcceptFiles, DragFinish, FindExecutableW, SHGetSpecialFolderPathW
> ole32.dll: OleIsRunning, OleConvertIStorageToOLESTREAM
> OLEAUT32.dll: -, -, -
> SHLWAPI.dll: SHGetValueA, StrDupW, SHStrDupW, StrChrIW, StrChrA, PathRelativePathToA, PathAddBackslashW, PathGetDriveNumberA, PathAddBackslashA, SHQueryValueExW, StrCatBuffW
> MSVCRT.dll: __set_app_type, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, _acmdln, exit, _XcptFilter, _exit, _except_handler3, _controlfp, __p__fmode

( 0 exports )

2.
Datei AveoSTI.exe empfangen 2008.09.24 19:05:12 (CET)
Ergebnis: 0/36 (0.00%)

Antivirus Version letzte aktualisierung Ergebnis
AhnLab-V3 2008.9.25.0 2008.09.24 -
AntiVir 7.8.1.34 2008.09.24 -
Authentium 5.1.0.4 2008.09.23 -
Avast 4.8.1195.0 2008.09.24 -
AVG 8.0.0.161 2008.09.24 -
BitDefender 7.2 2008.09.24 -
CAT-QuickHeal 9.50 2008.09.24 -
ClamAV 0.93.1 2008.09.24 -
DrWeb 4.44.0.09170 2008.09.24 -
eSafe 7.0.17.0 2008.09.24 -
eTrust-Vet 31.6.6103 2008.09.24 -
Ewido 4.0 2008.09.24 -
F-Prot 4.4.4.56 2008.09.23 -
F-Secure 8.0.14332.0 2008.09.24 -
Fortinet 3.113.0.0 2008.09.23 -
GData 19 2008.09.24 -
Ikarus T3.1.1.34.0 2008.09.24 -
K7AntiVirus 7.10.470 2008.09.24 -
Kaspersky 7.0.0.125 2008.09.24 -
McAfee 5390 2008.09.23 -
Microsoft 1.3903 2008.09.24 -
NOD32 3468 2008.09.24 -
Norman 5.80.02 2008.09.24 -
Panda 9.0.0.4 2008.09.24 -
PCTools 4.4.2.0 2008.09.24 -
Prevx1 V2 2008.09.24 -
Rising 20.63.22.00 2008.09.24 -
Sophos 4.33.0 2008.09.24 -
Sunbelt 3.1.1667.1 2008.09.24 -
Symantec 10 2008.09.24 -
TheHacker 6.3.0.9.092 2008.09.24 -
TrendMicro 8.700.0.1004 2008.09.24 -
VBA32 3.12.8.5 2008.09.23 -
ViRobot 2008.9.24.1390 2008.09.24 -
VirusBuster 4.5.11.0 2008.09.24 -
Webwasher-Gateway 6.6.2 2008.09.24 -
weitere Informationen
File size: 24576 bytes
MD5...: f3d102f9c848d3b1758090137c6a642b
SHA1..: 6705dd061fbca39a337e4a615f096d92fbd64e6e
SHA256: 880de72fca0ddb84a7269bb84804093ddfce24f1907449ee705abc1e41ac1aa7
SHA512: 496899ea6b07a894c9eea529ed22dc675f4ba9c3b7a23427a5eb4eb0fe1a87e8
2717abe5c4d30be94768d2ff8237b2741d396ebec99fdc0be888d7b96c5ac395
PEiD..: Armadillo v1.71
TrID..: File type identification
Win64 Executable Generic (80.9%)
Win32 Executable Generic (8.0%)
Win32 Dynamic Link Library (generic) (7.1%)
Generic Win/DOS Executable (1.8%)
DOS Executable Generic (1.8%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x401cd0
timedatestamp.....: 0x47302c8c (Tue Nov 06 08:57:48 2007)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xfb2 0x1000 5.61 0dfaba3606b9c81a956348c1eb82fd46
.rdata 0x2000 0xcd8 0x1000 4.30 4ab2558cd87f219fcee9f53fce390075
.data 0x3000 0x180 0x1000 0.24 b10f1a9c63bad67184a03846216cf557
.rsrc 0x4000 0x1a28 0x2000 3.42 bf9f2ad3cf0873f70cfbb839f801a22f

( 4 imports )
> MFC42.DLL: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
> MSVCRT.dll: __p__commode, __p__fmode, __set_app_type, _except_handler3, _controlfp, __setusermatherr, _initterm, __getmainargs, _acmdln, exit, _XcptFilter, _exit, _onexit, __dllonexit, __CxxFrameHandler, _setmbcp, _adjust_fdiv
> KERNEL32.dll: CloseHandle, CreateMutexA, GetProcAddress, LoadLibraryA, CreateProcessA, GetModuleFileNameA, GetModuleHandleA, GetStartupInfoA, GetLastError
> USER32.dll: AppendMenuA, GetSystemMenu, DrawIcon, GetClientRect, GetSystemMetrics, IsIconic, PostMessageA, SetForegroundWindow, GetSubMenu, LoadMenuA, GetCursorPos, SetWindowPos, GetWindowRect, FindWindowA, EnableWindow, LoadIconA, SendMessageA

( 0 exports )

kann mir denn niemand hier weiterhelfen?
lg

ich würde mich freuen, wenn mir noch jemand helfen könnte...

EDIT by [GC]Sunny

siehe hier -> http://www.trojaner-board.de/57188-i...en-popups.html