Hallo Ich hofe mir kan hier jemand helfen, bei mit ist folgender virus aufgetaucht:

C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\xop32.exe
Infected: Backdoor.IRC.ZGE

Habe schon versucht diesen mit CCleaner zu entfernen, hilflos

HjackThis hab ich durchlaufen lassen. Es ergab sich folgende liste:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:50:30, on 14.07.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\Ati2evxx.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe
E:\Programme\Intel\Wireless\Bin\S24EvMon.exe
E:\WINDOWS\system32\Ati2evxx.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\system32\agrsmsvc.exe
E:\Programme\BrAutomation\AsTools\BrAuthorization\ BrAuthorizationSvc.exe
E:\Programme\Intel\Wireless\Bin\EvtEng.exe
E:\WINDOWS\Explorer.EXE
E:\Programme\Gemeinsame Dateien\InterVideo\RegMgr\iviRegMgr.exe
E:\Programme\Java\jre6\bin\jqs.exe
E:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
E:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
E:\WINDOWS\System32\svchost.exe
E:\Programme\Analog Devices\Core\smax4pnp.exe
E:\Programme\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE
E:\Programme\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
E:\Programme\Synaptics\SynTP\SynTPEnh.exe
E:\WINDOWS\System32\svchost.exe
E:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
E:\Programme\Intel\Wireless\Bin\RegSrvc.exe
E:\WINDOWS\system32\svchost.exe
E:\Programme\Gemeinsame Dateien\Softwin\BitDefender Communicator\xcommsvr.exe
E:\Programme\Gemeinsame Dateien\Softwin\BitDefender Scan Server\bdss.exe
E:\Programme\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
E:\Programme\Intel\Wireless\bin\ZCfgSvc.exe
E:\Programme\Intel\Wireless\Bin\ifrmewrk.exe
E:\Programme\Java\jre6\bin\jusched.exe
E:\Programme\Gemeinsame Dateien\Softwin\BitDefender Update Service\livesrv.exe
E:\Programme\Roxio\Drag-to-Disc\DrgToDsc.exe
E:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe
E:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
E:\WINDOWS\system32\RunDll32.exe
E:\Programme\Softwin\BitDefender10\bdmcon.exe
E:\Programme\Softwin\BitDefender10\bdagent.exe
E:\Programme\Hp\HP Software Update\HPWuSchd2.exe
E:\Programme\pdfforge Toolbar\SearchSettings.exe
E:\Programme\Softwin\BitDefender10\vsserv.exe
E:\Programme\Hewlett-Packard\Shared\hpqwmiex.exe
E:\WINDOWS\system32\wbem\wmiapsrv.exe
E:\WINDOWS\vsnpstd3.exe
E:\Programme\Ashampoo\Ashampoo FireWall\FireWall.exe
E:\WINDOWS\system32\ctfmon.exe
E:\Programme\Gemeinsame Dateien\LightScribe\LightScribeControlPanel.exe
E:\Programme\Messenger\msmsgs.exe
E:\Programme\Microsoft ActiveSync\wcescomm.exe
E:\Programme\Hewlett-Packard\Shared\HpqToaster.exe
E:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\ISUSPM.exe
E:\Programme\Skype\Phone\Skype.exe
E:\Programme\Intel\Wireless\Bin\Dot1XCfg.exe
E:\PROGRA~1\MICROS~2\rapimgr.exe
E:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe
E:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
E:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
E:\Programme\Softwin\BitDefender10\bdlite.exe
E:\Programme\Internet Explorer\iexplore.exe
E:\Programme\Skype\Plugin Manager\skypePM.exe
E:\WINDOWS\system32\taskmgr.exe
C:\Neuer Ordner\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.at/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hp.com/
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - E:\Programme\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.D LL
R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - E:\Programme\pdfforge Toolbar\SearchSettings.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - E:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - E:\Programme\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.D LL
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - E:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - E:\Programme\MyWebSearch\bar\1.bin\MWSBAR.DLL
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - E:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - E:\Programme\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - E:\Programme\Google\GoogleToolbarNotifier\5.1.1309 .3572\swg.dll
O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - E:\Programme\pdfforge Toolbar\WidgiToolbarIE.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - E:\Programme\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - E:\Programme\pdfforge Toolbar\SearchSettings.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - E:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugi n.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - E:\Programme\Yahoo!\Companion\Installs\cpn\YTSingl eInstance.dll
O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - E:\Programme\MyWebSearch\bar\1.bin\MWSBAR.DLL
O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - E:\Programme\pdfforge Toolbar\WidgiToolbarIE.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - E:\Programme\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - E:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SoundMAXPnP] E:\Programme\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] E:\Programme\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [PTHOSTTR] E:\Programme\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [SynTPEnh] E:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [StartCCC] E:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [Cpqset] E:\Programme\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "E:\Programme\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "E:\Programme\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Programme\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "E:\Programme\Roxio\Drag-to-Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [WatchDog] E:\Programme\InterVideo\DVD Check\DVDCheck.exe
O4 - HKLM\..\Run: [MyWebSearch Plugin] rundll32 E:\PROGRA~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL,UPF
O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "E:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=2 /w
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] E:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\Run: [SbUsb AudCtrl] RunDll32 sbusbdll.dll,RCMonitor
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "E:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BDMCon] "E:\Programme\Softwin\BitDefender10\bdmcon.exe " /reg
O4 - HKLM\..\Run: [BDAgent] "E:\Programme\Softwin\BitDefender10\bdagent.ex e"
O4 - HKLM\..\Run: [HP Software Update] E:\Programme\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SearchSettings] E:\Programme\pdfforge Toolbar\SearchSettings.exe
O4 - HKLM\..\Run: [snpstd3] E:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [Ashampoo FireWall] "E:\Programme\Ashampoo\Ashampoo FireWall\FireWall.exe" -TRAY
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LightScribe Control Panel] E:\Programme\Gemeinsame Dateien\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [MSMSGS] "E:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "E:\Programme\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] E:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKCU\..\Run: [ISUSPM] "E:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [Skype] "E:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: DVD Check.lnk = E:\Programme\InterVideo\DVD Check\DVDCheck.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Programme\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...p=ZKxdm022YYAT
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://E:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Senden an &Bluetooth-Gerät... - E:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Mobilen Favoriten erstellen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Programme\Messenger\msmsgs.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/noc...tup1.0.1.1.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - E:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - E:\Programme\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - E:\WINDOWS\system32\agrsmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - E:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - E:\Programme\Gemeinsame Dateien\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: BR.AS.VersionChangerService - Bernecker + Rainer, Industrie-Elektronik Ges.m.b.H., A-5142 Austria, Europe - E:\WINDOWS\system32\BR.AS.VersionChangerService.ex e
O23 - Service: B&R Authorization (BrAuthorizationSvcx) - Bernecker + Rainer, Industrie-Elektronik Ges.m.b.H, A-5142, Austria, Europe - E:\Programme\BrAutomation\AsTools\BrAuthorization\ BrAuthorizationSvc.exe
O23 - Service: B&R Disk Image (BrDiskImageSvcx) - Bernecker + Rainer, Industrie-Elektronik Ges.m.b.H, A-5142, Austria, Europe - E:\Programme\BrAutomation\PVI\V2.5.2\PVI\Tools\Pvi Transfer\BrDiskImageSvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - E:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - E:\Programme\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Software Updater (gusvc) - Google - E:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - E:\Programme\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Programme\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: IviRegMgr - InterVideo - E:\Programme\Gemeinsame Dateien\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - E:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - E:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - E:\Programme\Gemeinsame Dateien\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: My Web Search Service (MyWebSearchService) - MyWebSearch.com - E:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - E:\Programme\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - E:\Programme\Gemeinsame Dateien\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - E:\Programme\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - E:\Programme\Gemeinsame Dateien\SureThing Shared\stllssvr.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - E:\Programme\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - E:\Programme\Gemeinsame Dateien\Softwin\BitDefender Communicator\xcommsvr.exe

--
End of file - 14677 bytes


Ich hoffe irgnd ein schlauer Kopf kann mir hier weiterhelfen !!!

LG

http://forum.chip.de/viren-trojaner-wuermer/backdoor-irt-zge-1194863.html

Crosspostings sind nicht erwünscht und werden gelöscht!

ciao, andreas

over & out.

-> bio-tonne