Trojaner-Board - Hilfe!! Trojaner wird wiedergeboren!

Hallo!

Hab da ein paar lästige Trojaner, die bei jedem Windows-Start (und nach jedem Löschen) wieder auf's Neue da sind...

Hier das HijackThis-Logfile:

Code:

Logfile of HijackThis v1.99.0

Scan saved at 01:32:14, on 16.02.2005

Platform: Windows 2000 SP4 (WinNT 5.00.2195)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
 

Running processes:

C:\WINNT\System32\smss.exe

C:\WINNT\system32\winlogon.exe

C:\WINNT\system32\services.exe

C:\WINNT\system32\lsass.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\system32\spoolsv.exe

C:\Programme\AntiVirus\AVGUARD.EXE

C:\Programme\AntiVirus\AVWUPSRV.EXE

C:\WINNT\System32\svchost.exe

C:\WINNT\system32\nvsvc32.exe

C:\WINNT\system32\regsvc.exe

C:\WINNT\system32\MSTask.exe

C:\WINNT\System32\WBEM\WinMgmt.exe

C:\WINNT\System32\mspmspsv.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\Explorer.EXE

C:\PROGRA~1\MAGICW~1\MulMouse.exe

C:\WINNT\system32\dla\tfswctrl.exe

C:\Programme\PowerDVD\Umbrella\hpcdtray.exe

C:\PROGRA~1\HPCD-D~1\Umbrella\DVDTray.exe

C:\Programme\Java\jre1.5.0_01\bin\jusched.exe

C:\Programme\AntiVirus\AVGNT.EXE

C:\Programme\WinPortrait\wpctrl.exe

C:\Programme\Skype\Skype.exe

C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe

C:\WINNT\system32\RUNDLL32.EXE

C:\Programme\Adobe Acrobat 6.0\Distillr\acrotray.exe

C:\WINNT\system32\rundll32.exe

C:\Programme\AutoHotkey\Meine Skripts\OE News lesen - Win+n.exe

C:\Programme\AutoHotkey\Meine Skripts\Opera starten - Win+o.exe

C:\Programme\AutoHotkey\Meine Skripts\Outlook starten - Win+l.exe

C:\Programme\Google\Google Desktop Search\GoogleDesktopIndex.exe

C:\Programme\Google\Google Desktop Search\GoogleDesktopCrawl.exe

C:\Programme\WinPortrait\floater.exe

C:\Programme\SpySub.exe

D:\Downloads + Source Files\Anti Spy\CW Shredder\CWShredder.exe

C:\Programme\Opera75\opera.exe

D:\Downloads + Source Files\Anti Spy\HijackThis\HijackThis.exe
 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOKUME~1\PHILIP~1\LOKALE~1\Temp\se.dll/sp.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOKUME~1\PHILIP~1\LOKALE~1\Temp\se.dll/sp.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

O2 - BHO: (no name) - {6320997E-87E4-426B-90AC-B4700FBB3BE4} - C:\WINNT\system32\ich.dll

O4 - Global Startup: SpySubtract.lnk = C:\Programme\SpySub.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present

O17 - HKLM\System\CCS\Services\Tcpip\..\{B8C01418-5296-417E-9CB3-805820B38CED}: NameServer = 143.50.56.25 143.50.19.25

O18 - Filter: text/html - {569A3A2E-47CD-40D7-B3F9-845416FBF44B} - C:\WINNT\system32\ich.dll

O18 - Filter: text/plain - {569A3A2E-47CD-40D7-B3F9-845416FBF44B} - C:\WINNT\system32\ich.dll

...und hier das, was mwav.exe (escan) dazu meint:

Code:

Tue Feb 15 20:25:14 2005 => File C:\WINNT\system32\jfaoelq.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.

Tue Feb 15 20:25:42 2005 => File C:\WINNT\NDNuninstall4_85.exe infected by "not-a-virus:AdWare.NewDotNet" Virus. Action Taken: No Action Taken.

Tue Feb 15 20:25:42 2005 => File C:\WINNT\NDNuninstall5_64.exe infected by "not-a-virus:AdWare.NewDotNet" Virus. Action Taken: No Action Taken.

Tue Feb 15 20:25:42 2005 => File C:\WINNT\NDNuninstall6_10.exe infected by "not-a-virus:AdWare.NewDotNet" Virus. Action Taken: No Action Taken.

Tue Feb 15 20:26:45 2005 => File C:\WINNT\system32\ggffdb.dll infected by "Trojan.Win32.StartPage.qr" Virus. Action Taken: No Action Taken.

Tue Feb 15 20:27:03 2005 => File C:\WINNT\system32\jlmjho.dll infected by "Trojan.Win32.StartPage.qr" Virus. Action Taken: No Action Taken.

Tue Feb 15 20:28:34 2005 => File C:\WINNT\system32\up2date.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.