Viren, Malware, Spyware, bitte um Hilfe!

Erika Ma

der computer meiner eltern ist befallen von mehreren viren und malware/spyware. ich weiss mir nicht mehr zu helfen, sie haben schon etwas rausgeschlöscht aber es kommt immer wieder neues. ich poste hier die HijackThis file, malwarebytes file und den antivir report. auch die alten.
für hilfe wäre ich sehr dankbar

liebste grüsse
erika

p.s.: der computer hat mich bis jetzt die logfiles nicht posten lassen. es kam dann immer "fehler, verbindung fehlgsechlagen"

Avira AntiVir Personal
Report file date: Wednesday, December 22, 2010 14:27

Scanning for 2285269 virus strains and unwanted programs.

Licensee : Avira AntiVir Personal - FREE Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows XP
Windows version : (Service Pack 3) [5.1.2600]
Boot mode : Normally booted
Username : SYSTEM
Computer name : EUGEN

Version information:
BUILD.DAT : 9.0.0.429 21701 Bytes 06.10.2010 10:04:00
AVSCAN.EXE : 9.0.3.10 466689 Bytes 13.10.2009 10:26:33
AVSCAN.DLL : 9.0.3.0 40705 Bytes 27.02.2009 09:58:24
LUKE.DLL : 9.0.3.2 209665 Bytes 20.02.2009 10:35:49
LUKERES.DLL : 9.0.2.0 12033 Bytes 27.02.2009 09:58:52
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 06:35:52
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 11:27:27
VBASE002.VDF : 7.11.0.1 2048 Bytes 14.12.2010 11:27:27
VBASE003.VDF : 7.11.0.2 2048 Bytes 14.12.2010 11:27:27
VBASE004.VDF : 7.11.0.3 2048 Bytes 14.12.2010 11:27:27
VBASE005.VDF : 7.11.0.4 2048 Bytes 14.12.2010 11:27:27
VBASE006.VDF : 7.11.0.5 2048 Bytes 14.12.2010 11:27:27
VBASE007.VDF : 7.11.0.6 2048 Bytes 14.12.2010 11:27:27
VBASE008.VDF : 7.11.0.7 2048 Bytes 14.12.2010 11:27:27
VBASE009.VDF : 7.11.0.8 2048 Bytes 14.12.2010 11:27:27
VBASE010.VDF : 7.11.0.9 2048 Bytes 14.12.2010 11:27:28
VBASE011.VDF : 7.11.0.10 2048 Bytes 14.12.2010 11:27:28
VBASE012.VDF : 7.11.0.11 2048 Bytes 14.12.2010 11:27:28
VBASE013.VDF : 7.11.0.52 128000 Bytes 16.12.2010 23:28:28
VBASE014.VDF : 7.11.0.91 226816 Bytes 20.12.2010 11:26:32
VBASE015.VDF : 7.11.0.122 136192 Bytes 21.12.2010 13:26:24
VBASE016.VDF : 7.11.0.123 2048 Bytes 21.12.2010 13:26:24
VBASE017.VDF : 7.11.0.124 2048 Bytes 21.12.2010 13:26:24
VBASE018.VDF : 7.11.0.125 2048 Bytes 21.12.2010 13:26:24
VBASE019.VDF : 7.11.0.126 2048 Bytes 21.12.2010 13:26:24
VBASE020.VDF : 7.11.0.127 2048 Bytes 21.12.2010 13:26:24
VBASE021.VDF : 7.11.0.128 2048 Bytes 21.12.2010 13:26:24
VBASE022.VDF : 7.11.0.129 2048 Bytes 21.12.2010 13:26:25
VBASE023.VDF : 7.11.0.130 2048 Bytes 21.12.2010 13:26:25
VBASE024.VDF : 7.11.0.131 2048 Bytes 21.12.2010 13:26:25
VBASE025.VDF : 7.11.0.132 2048 Bytes 21.12.2010 13:26:25
VBASE026.VDF : 7.11.0.133 2048 Bytes 21.12.2010 13:26:25
VBASE027.VDF : 7.11.0.134 2048 Bytes 21.12.2010 13:26:25
VBASE028.VDF : 7.11.0.135 2048 Bytes 21.12.2010 13:26:25
VBASE029.VDF : 7.11.0.136 2048 Bytes 21.12.2010 13:26:25
VBASE030.VDF : 7.11.0.137 2048 Bytes 21.12.2010 13:26:25
VBASE031.VDF : 7.11.0.141 20480 Bytes 22.12.2010 13:26:25
Engineversion : 8.2.4.126
AEVDF.DLL : 8.1.2.1 106868 Bytes 06.11.2010 13:33:01
AESCRIPT.DLL : 8.1.3.48 1286524 Bytes 03.12.2010 12:17:36
AESCN.DLL : 8.1.7.2 127349 Bytes 23.11.2010 20:14:38
AESBX.DLL : 8.1.3.2 254324 Bytes 23.11.2010 20:14:40
AERDL.DLL : 8.1.9.2 635252 Bytes 06.11.2010 13:33:01
AEPACK.DLL : 8.2.4.5 512375 Bytes 16.12.2010 23:28:37
AEOFFICE.DLL : 8.1.1.10 201084 Bytes 23.11.2010 20:14:37
AEHEUR.DLL : 8.1.2.57 3142008 Bytes 16.12.2010 23:28:36
AEHELP.DLL : 8.1.16.0 246136 Bytes 03.12.2010 12:17:27
AEGEN.DLL : 8.1.5.0 397685 Bytes 03.12.2010 12:17:26
AEEMU.DLL : 8.1.3.0 393589 Bytes 23.11.2010 20:14:29
AECORE.DLL : 8.1.19.0 196984 Bytes 03.12.2010 12:17:25
AEBB.DLL : 8.1.1.0 53618 Bytes 06.11.2010 13:33:01
AVWINLL.DLL : 9.0.0.3 18177 Bytes 12.12.2008 07:47:59
AVPREF.DLL : 9.0.3.0 44289 Bytes 26.08.2009 14:14:02
AVREP.DLL : 8.0.0.7 159784 Bytes 06.11.2010 13:33:01
AVREG.DLL : 9.0.0.0 36609 Bytes 05.12.2008 09:32:09
AVARKT.DLL : 9.0.0.3 292609 Bytes 24.03.2009 14:05:41
AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 30.01.2009 09:37:08
SQLITE3.DLL : 3.6.1.0 326401 Bytes 28.01.2009 14:03:49
SMTPLIB.DLL : 9.2.0.25 28417 Bytes 02.02.2009 07:21:33
NETNT.DLL : 9.0.0.0 11521 Bytes 05.12.2008 09:32:10
RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 15.05.2009 14:39:58
RCTEXT.DLL : 9.0.73.0 86785 Bytes 13.10.2009 11:25:47

Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: e:\program files\avira\antivir desktop\sysscan.avp
Logging.............................: low
Primary action......................: interactive
Secondary action....................: ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:, E:,
Process scan........................: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium

Start of the scan: Wednesday, December 22, 2010 14:27

Starting search for hidden objects.
'62717' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'RichVideo.exe' - '1' Module(s) have been scanned
Scan process 'igfxsrvc.exe' - '1' Module(s) have been scanned
Scan process 'msmsgs.exe' - '1' Module(s) have been scanned
Scan process 'Skype.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'RTHDCPL.EXE' - '1' Module(s) have been scanned
Scan process 'igfxpers.exe' - '1' Module(s) have been scanned
Scan process 'hkcmd.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
29 processes with 29 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'E:\'
[INFO] No virus was found!

Starting to scan executable files (registry).
The registry was scanned ( '55' files ).


Starting the file scan:

Begin scan in 'C:\'
Begin scan in 'E:\'
E:\hiberfil.sys
[WARNING] The file could not be opened!
[NOTE] This file is a Windows system file.
[NOTE] This file cannot be opened for scanning.
E:\pagefile.sys
[WARNING] The file could not be opened!
[NOTE] This file is a Windows system file.
[NOTE] This file cannot be opened for scanning.
E:\Documents and Settings\LocalService\Application Data\Sun\Java\Deployment\cache\6.0\57\38a62e39-76fc6a22
[0] Archive type: ZIP
--> P96Xovlb2rs.class
[DETECTION] Contains recognition pattern of the JAVA/Rowindal.A Java virus
--> SWBZXYS.class
[DETECTION] Contains recognition pattern of the JAVA/Agent.abj Java virus
--> Uj_C_nk_.class
[DETECTION] Contains recognition pattern of the JAVA/Remote.B Java virus
E:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\53\7e83e435-3b5d96a5
[0] Archive type: ZIP
--> bpac/a.class
[DETECTION] Contains recognition pattern of the JAVA/OpenConnect.CF Java virus
E:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\IN964V5R\dm6[1].exe
[DETECTION] Is the TR/Kazy.5565.2 Trojan
E:\Documents and Settings\tita\desktop\D\Musik\Flash Professional\Adobe CS4\payloads\AdobeAUM6.0All\AdobeAUM6.0All1.cab
[0] Archive type: CAB (Microsoft)
--> _2_db33955fdd1ba0ba02c707aef8ed9197
[WARNING] No further files can be extracted from this archive. The archive will be closed
[WARNING] No further files can be extracted from this archive. The archive will be closed
E:\WINDOWS\Temp\5.tmp
[DETECTION] Is the TR/Kazy.5565.2 Trojan
E:\WINDOWS\Temp\6.tmp
[DETECTION] Is the TR/Kazy.5565.2 Trojan
E:\WINDOWS\Temp\7.tmp
[DETECTION] Is the TR/Kazy.5565.2 Trojan
E:\WINDOWS\Temp\A.tmp
[DETECTION] Is the TR/Kazy.5565.2 Trojan
E:\WINDOWS\Temp\F.tmp
[DETECTION] Is the TR/Kazy.5565.2 Trojan

Beginning disinfection:
E:\Documents and Settings\LocalService\Application Data\Sun\Java\Deployment\cache\6.0\57\38a62e39-76fc6a22
[NOTE] The file was moved to '4d7305ce.qua'!
E:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\53\7e83e435-3b5d96a5
[NOTE] The file was moved to '4d4a05fc.qua'!
E:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\IN964V5R\dm6[1].exe
[DETECTION] Is the TR/Kazy.5565.2 Trojan
[NOTE] The file was moved to '4d480604.qua'!
E:\WINDOWS\Temp\5.tmp
[DETECTION] Is the TR/Kazy.5565.2 Trojan
[NOTE] The file was moved to '4d8605c5.qua'!
E:\WINDOWS\Temp\6.tmp
[DETECTION] Is the TR/Kazy.5565.2 Trojan
[NOTE] The file was moved to '4c4cbdfe.qua'!
E:\WINDOWS\Temp\7.tmp
[DETECTION] Is the TR/Kazy.5565.2 Trojan
[NOTE] The file was moved to '4c4fb5b6.qua'!
E:\WINDOWS\Temp\A.tmp
[DETECTION] Is the TR/Kazy.5565.2 Trojan
[NOTE] The file was moved to '4c4ead6e.qua'!
E:\WINDOWS\Temp\F.tmp
[DETECTION] Is the TR/Kazy.5565.2 Trojan
[NOTE] The file was moved to '4c47659e.qua'!


End of the scan: Wednesday, December 22, 2010 15:05
Used time: 37:27 Minute(s)

The scan has been done completely.

5292 Scanned directories
327446 Files were scanned
10 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 files were deleted
0 Viruses and unwanted programs were repaired
8 Files were moved to quarantine
0 Files were renamed
2 Files cannot be scanned
327434 Files not concerned
2567 Archives were scanned
4 Warnings
10 Notes
62717 Objects were scanned with rootkit scan
0 Hidden objects were found

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:16:04, on 23.12.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Avira\AntiVir Desktop\sched.exe
E:\Program Files\Avira\AntiVir Desktop\avguard.exe
E:\WINDOWS\explorer.exe
E:\WINDOWS\system32\hkcmd.exe
E:\WINDOWS\system32\igfxpers.exe
E:\WINDOWS\RTHDCPL.EXE
E:\Program Files\Avira\AntiVir Desktop\avgnt.exe
E:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Messenger\msmsgs.exe
E:\WINDOWS\system32\igfxsrvc.exe
E:\Program Files\CyberLink\Shared files\RichVideo.exe
E:\WINDOWS\system32\wuauclt.exe
E:\Program Files\Mozilla Firefox\firefox.exe
E:\WINDOWS\System32\mshta.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Internet Explorer\iexplore.exe
E:\WINDOWS\System32\mshta.exe
E:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
e:\program files\avira\antivir desktop\avcenter.exe
E:\Documents and Settings\tita\My Documents\Downloads\HiJackThis204.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2431245
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\M