hijackthis-log, bitte um auswertung

schneebesen

Hallo,
ich habe anscheinend coolwebsearch und ein paar trojaner auf meinem rechner. das problem ist, dass ich sie schon mit diversen programmen gefunden und -angeblich- geloescht habe. Jedoch tauchen sie bei jedem neustart des Computers wieder auf. Die Programme, die ich ausprobiert habe: Anti-Vir, SpyBot Search&Destroy, SpySubtract und das darin enthaltene CWShredder und als letztes dann HijackThis. Von letzterem habe ich auch das Log-File hier reingestellt. Es wundert mich weiterhin, dass SpySubtract CoolWebsearch findet, CWShredder allerdings nicht. Von allen Versionen habe ich die neuesten updates heruntergeladen. Ich weiss nicht mehr, was ich noch machen soll und bin für jede Hilfe zutiefst dankbar, ehrlich.

gruss, sebastian


Hier also das Log-File:

StartupList report, 14.11.04, 19:03:28
StartupList version: 1.52.2
Started from : C:\PROGRAMME\HIJACKTHIS.EXE
Detected: Windows 98 SE (Win9x 4.10.2222A)
Detected: Internet Explorer v5.00 (5.00.2614.3500)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAMME\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\APITR32.EXE
C:\PROGRAMME\HIJACKTHIS.EXE
C:\PROGRAMME\WEBDE\SMARTSURFER2.3\SMARTSURFER.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\WINDOWS\Startmenü\Programme\Autostart]
Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

SystemTray = SysTray.Exe
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
EM_EXEC = C:\PROGRA~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXE
AVGCtrl = C:\PROGRAMME\AVPERSONAL\AVGCTRL.EXE /min
Zone Labs Client = "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SchedulingAgent = mstask.exe
ADDUC.EXE = C:\WINDOWS\ADDUC.EXE
TrueVector = C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
WINWH.EXE = C:\WINDOWS\SYSTEM\WINWH.EXE
APITR32.EXE = C:\WINDOWS\APITR32.EXE

--------------------------------------------------

File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command

(Default) = C:\WINDOWS\NOTEPAD.EXE %1

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=Explorer.exe
SCRNSAVE.EXE=
drivers=mmsystem.dll power.drv

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 14/11/2004, 17:0:22)

[rename]
NUL=C:\WINDOWS\TEMPOR~1\CONTENT.IE5\INDEX.DAT
NUL=C:\WINDOWS\VERLAUF\HISTORY.IE5\INDEX.DAT
NUL=C:\WINDOWS\COOKIES\INDEX.DAT

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

mode con codepage prepare=((850) C:\WINDOWS\COMMAND\ega.cpi)
mode con codepage select=850
keyb gr,,C:\WINDOWS\COMMAND\keyboard.sys
Set tvdumpflags=10

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\WINDOWS\SYSTEM\SYSUK32.DLL - {6B27B32D-461E-24CD-626F-90B916F9A990}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Programmstart beschleunigen.job
Wartung - Programme defragmentieren.job
Wartung - ScanDisk.job
Wartung - Datenträgerbereinigung.job

--------------------------------------------------

Enumerating Download Program Files:

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = http://download.macromedia.com/pub/s...sh/swflash.cab

[{33564D57-0000-0010-8000-00AA00389B71}]
CODEBASE = http://download.microsoft.com/downlo...22/wmv9VCM.CAB

[{11111111-1111-1111-1111-111111113458}]
CODEBASE = file://C:\WINDOWS\Tempor~1\Content.IE5\5HEOZA7J\explorer9[1].cab

[Attachment Upload Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\MAIL_U~1.OCX
CODEBASE = https://img.web.de/v/mail/activex/mail_upload_1123.cab

[{15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6}]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\WINADCTLX.DLL
CODEBASE = http://public.windupdates.com/get_fi...a29296baabe1d6

[{386A771C-E96A-421F-8BA7-32F1B706892F}]
CODEBASE = http://www.xxxtoolbar.com/ist/softwa...06_regular.cab

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL

--------------------------------------------------
End of report, 5.208 bytes
Report generated in 0,199 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only