log von blink1213

blink1213

hoi Leute also ich hab au AntiVir und die updates bringen im mom auch nichts gegen meine viren also ich dnek ma ich hab dne Rechner ziemlich voll damit obwohl ich regelmäßig AntiVir durchlaufen lasse. ich hab mal eScan durchlaufen lassen und cih hoffe ihr könnt mir helfen

File C:\dokume~1\admini~1\lokale~1\temp\msbb.exe infected by "not-a-virus:AdvWare.180Solutions" Virus. Action Taken: No Action Taken.
File c:\dokume~1\admini~1\lokale~1\temp\msbbhook.dll infected by "not-a-virus:AdvWare.180Solutions" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\nvms.dll infected by "not-a-virus:AdvWare.BargainBuddy.j" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\mscb.dll infected by "not-a-virus:AdvWare.BargainBuddy.j" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\apuc.dll infected by "not-a-virus:AdvWare.BargainBuddy.j" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\msbe.dll infected by "not-a-virus:AdvWare.BargainBuddy.j" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\installer[ygh-10002,de].exe tagged as not-a-virus:RiskWare.Dialer.Stardialer. No Action Taken.
File C:\WINDOWS\multiplayercheats[mys-10050,de,1].exe tagged as not-a-virus:PornWare.Dialer.Star. No Action Taken.
File C:\WINDOWS\preInsTT.exe infected by "not-a-virus:AdvWare.BiSpy.f" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\msbe.dll infected by "not-a-virus:AdvWare.BargainBuddy.j" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\nvms.dll infected by "not-a-virus:AdvWare.BargainBuddy.j" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\mscb.dll infected by "not-a-virus:AdvWare.BargainBuddy.j" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\exdl.exe infected by "not-a-virus:AdvWare.BargainBuddy.j" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\TFTP232 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\TFTP2692 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\apuc.dll infected by "not-a-virus:AdvWare.BargainBuddy.j" Virus. Action Taken: No Action Taken.

und dann habbi noch Hijack durchlaufen lassen und das zeigt er an

ogfile of HijackThis v1.98.2
Scan saved at 12:15:26, on 21.10.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\dokume~1\admini~1\lokale~1\temp\msbb.exe
C:\Programme\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Programme\Logitech\MouseWare\system\em_exec.exe
C:\PROGRA~1\MOZILLA.ORG\MOZILLA\MOZILLA.EXE
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\ntvdm.exe
C:\WINDOWS\System32\mqsvc.exe
C:\WINDOWS\System32\mqtgsvc.exe
C:\T-ONLINE\BSW4\ToDuCAlC.EXE
c:\t-online\browser\browser.exe
C:\Programme\AVPersonal\AVWIN.EXE
C:\WINDOWS\TEMP\mwavscan.com
C:\WINDOWS\TEMP\kavss.exe
C:\Programme\NaviSearch\bin\nls.exe
C:\WINDOWS\System32\exdl.exe
C:\Programme\Microsoft Office\Office\WINWORD.EXE
C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\Temporäres Verzeichnis 2 für hijackthis1982.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://69.50.191.52/668/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://69.50.191.52/668/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://69.50.191.52/668/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://69.50.191.52/668/sp.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://69.50.191.52/668/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://69.50.191.52/668/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://69.50.191.52/668/sp.php
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Programme\MyWay\myBar\1.bin\MYBAR.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\System32\nvms.dll
O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\System32\mscb.dll
O2 - BHO: Url Catcher - {CE31A1F7-3D90-4874-8FBE-A5D97F8BC8F1} - C:\WINDOWS\System32\apuc.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Programme\MyWay\myBar\1.bin\MYBAR.DLL
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [msbb] c:\dokume~1\admini~1\lokale~1\temp\msbb.exe
O4 - HKLM\..\Run: [Security iGuard] C:\Programme\Security iGuard\Security iGuard.exe
O4 - HKLM\..\Run: [MMTray] C:\Programme\Musicmatch\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [AVGCtrl] "C:\Programme\AVPersonal\AVGNT.EXE" /min
O4 - HKCU\..\Run: [LDM] C:\Programme\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programme\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O13 - DefaultPrefix: http://69.50.191.50/?
O13 - WWW Prefix: http://69.50.191.50/?
O14 - IERESET.INF: START_PAGE_URL=about:blank
O16 - DPF: {00000000-CDDC-0704-0B53-2C8830E9FAEC} (IELoaderCtl Class) - http://install.global-netcom.de/ieloader.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab28177.cab
O16 - DPF: {11111111-1111-1111-1111-111111111123} - its:mhtml:file://C:.mht!http://69.50.191.52/668/b.chm::/b.exe
O16 - DPF: {1E50B82A-0D78-48B9-97EC-391B2F81CE8A} (IELoaderCtl Class) - http://acxd.freeload.cc/ieloader.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab28177.cab
O16 - DPF: {30000273-8230-4DD4-BE4F-6889D1E74167} - http://download.abetterinternet.com/...14006/thin.cab
O16 - DPF: {67B15B0B-160C-4579-95AF-858169659092} (IELoaderCtl Class) - http://freeload.cc/secure/ieloader.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab28177.cab
O16 - DPF: {8FA9D107-547B-4DBC-9D88-FABD891EDB0A} (shizmoo Class) - http://playroom.icq.com/odyssey_web11.cab
O16 - DPF: {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} (brdg Class) - http://www2.flingstone.com/cab/2000X.../bridge-c1.cab
O16 - DPF: {E0B795B4-FD95-4ABD-A375-27962EFCE8CF} (StarInstall Control) - http://install.stardialer.de/StarInstall.ocx
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab28578.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D58ABC7E-204E-41A3-8BA6-80E0C9D3D939}: NameServer = 217.237.151.225 217.237.150.225