Log bitte checken, Instandfinder
 

Logfile of HijackThis v1.99.1
Scan saved at 16:08:57, on 17.06.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
E:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\Explorer.EXE
C:\ATI-CPanel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programme\QuickTime\qttask.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\MSN Messenger\msnmsgr.exe
E:\Programme\GetRight\getright.exe
E:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
E:\Programme\GetRight\getright.exe
C:\WINDOWS\System32\wuauclt.exe
E:\Programme\ICQLite\ICQLite.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Dokumente und Einstellungen\Frogga\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orf.at/
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - E:\Programme\ICQToolbar\toolbaru.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - E:\Programme\GetRight\xx2gr.dll
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - E:\Programme\Xi\NetTransport 2\NTIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - E:\Programme\ICQToolbar\toolbaru.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\RunOnce: [ICQ Lite] E:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: GetRight - Tray Icon.lnk = E:\Programme\GetRight\getright.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = E:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Programme\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &ICQ Toolbar Search - res://E:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: Alles mit Net Transport herunterladen - E:\Programme\Xi\NetTransport 2\NTAddList.html
O8 - Extra context menu item: Download with GetRight - E:\Programme\GetRight\GRdownload.htm
O8 - Extra context menu item: Download with Go!Zilla - file://E:\Programme\Go!Zilla\download-with-gozilla.html
O8 - Extra context menu item: Mit Net Transport herunterladen - E:\Programme\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://E:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - E:\Programme\GetRight\GRbrowse.htm
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - E:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - E:\Programme\ICQLite\ICQLite.exe
O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} (Macromedia Authorware Web Player Control) - h++p://www.bildung.at/content/webplayer/awswax.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - hh**pp://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_42.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - p://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - h**p://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1117577993765
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - h**p://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - hh**pp://chat.msn.com/bin/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F7F7CFE3-83BA-4FA9-8E28-6458B742AB86}: NameServer = 195.3.96.67 193.3.96.68
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - E:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe


immer wenn ich auf ne falsche url eingegeben habe, dann komme ich auf so eine kack suchseite....bitte um hilfe

1. System und IE dringenst updaten
2. Das genau nach Anleitung und Log hier posten
http://www.trojaner-board.de/showthread.php?t=17492
3. Aktive Links entschärfen

ok und welche sachen müssen weg?

Den Post editieren und die aktiven links so bearbeiten, dass man sie zwar noch erkennen kann, aber nicht mehr aufrufen.

erledigt :))

Und jetzt mache den eScan. Und poste das mit der find.bat erstellte Log.

ich posts dann rein, muss jetzt weg

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Funde für "infected"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Fri Jun 17 16:30:00 2005 => System found infected with Alexa Spyware/Adware ({c95fe080-8f5d-11d2-a20b-00aa003c157a})! Action taken: No Action Taken.
Fri Jun 17 16:30:00 2005 => System found infected with MyBar Spyware/Adware ({0494d0d9-f8e0-41ad-92a3-14154ece70ac})! Action taken: No Action Taken.
Fri Jun 17 16:30:04 2005 => System found infected with AltnetBDE Spyware/Adware (altnet signing module.exe)! Action taken: No Action Taken.
Fri Jun 17 16:30:04 2005 => System found infected with AltnetBDE Spyware/Adware (adm.exe)! Action taken: No Action Taken.
Fri Jun 17 17:30:29 2005 => Scanning Folder: E:\Programme\AVPersonal\INFECTED\*.*
Fri Jun 17 17:30:29 2005 => Scanning File E:\Programme\AVPersonal\INFECTED\MSMSGSVC.VIR
Fri Jun 17 17:30:30 2005 => File E:\Programme\AVPersonal\INFECTED\MSMSGSVC.VIR infected by "Trojan-Dropper.Win32.Small.lx" Virus! Action Taken: No Action Taken.
Fri Jun 17 17:30:30 2005 => Scanning File E:\Programme\AVPersonal\INFECTED\MSMSGSVC.VIR00
Fri Jun 17 17:30:30 2005 => File E:\Programme\AVPersonal\INFECTED\MSMSGSVC.VIR00 infected by "Trojan-Dropper.Win32.Small.lx" Virus! Action Taken: No Action Taken.
Fri Jun 17 17:30:30 2005 => Scanning File E:\Programme\AVPersonal\INFECTED\updmgr.VIR
Fri Jun 17 17:30:30 2005 => File E:\Programme\AVPersonal\INFECTED\updmgr.VIR infected by "Trojan-Downloader.Win32.Keenval" Virus! Action Taken: No Action Taken.
Fri Jun 17 17:40:24 2005 => Total Disinfected Files: 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Funde für "tagged"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Fri Jun 17 16:29:49 2005 => File C:\Programme\INSTAFINK\instafink.dll tagged as "not-a-virus:AdWare.ToolBar.404Search.h". Action Taken: No Action Taken.
Fri Jun 17 16:32:02 2005 => File C:\Dokumente und Einstellungen\Frogga\Desktop\backups\backup-20050617-160825-817.dll tagged as "not-a-virus:AdWare.ToolBar.404Search.h". Action Taken: No Action Taken.
Fri Jun 17 16:32:39 2005 => File C:\Dokumente und Einstellungen\Frogga\Lokale Einstellungen\Temp\InstaFinderK_inst.exe tagged as "not-a-virus:AdWare.ToolBar.404Search.h". Action Taken: No Action Taken.
Fri Jun 17 16:42:03 2005 => File C:\Programme\INSTAFINK\InstaFinderK_inst.exe tagged as "not-a-virus:AdWare.ToolBar.404Search.h". Action Taken: No Action Taken.
Fri Jun 17 16:42:03 2005 => File C:\Programme\INSTAFINK\instafink.dll tagged as "not-a-virus:AdWare.ToolBar.404Search.h". Action Taken: No Action Taken.
Fri Jun 17 16:45:19 2005 => File C:\System Volume Information\_restore{31ADDCA9-F9A1-4BD6-91FD-7D007E068A1D}\RP263\A0066196.DLL tagged as "not-a-virus:AdWare.MySearch.e". Action Taken: No Action Taken.
Fri Jun 17 16:45:20 2005 => File C:\System Volume Information\_restore{31ADDCA9-F9A1-4BD6-91FD-7D007E068A1D}\RP264\A0066207.dll tagged as "not-a-virus:AdWare.Cydoor". Action Taken: No Action Taken.
Fri Jun 17 16:45:21 2005 => File C:\System Volume Information\_restore{31ADDCA9-F9A1-4BD6-91FD-7D007E068A1D}\RP264\A0066222.dll tagged as "not-a-virus:AdWare.Gator.6051". Action Taken: No Action Taken.
Fri Jun 17 16:45:21 2005 => File C:\System Volume Information\_restore{31ADDCA9-F9A1-4BD6-91FD-7D007E068A1D}\RP264\A0066223.exe tagged as "not-a-virus:AdWare.Gator.6034". Action Taken: No Action Taken.
Fri Jun 17 16:45:21 2005 => File C:\System Volume Information\_restore{31ADDCA9-F9A1-4BD6-91FD-7D007E068A1D}\RP264\A0066224.dll tagged as "not-a-virus:AdWare.Gator.6051". Action Taken: No Action Taken.
Fri Jun 17 16:45:21 2005 => File C:\System Volume Information\_restore{31ADDCA9-F9A1-4BD6-91FD-7D007E068A1D}\RP264\A0066225.dll tagged as "not-a-virus:AdWare.Gator.6051". Action Taken: No Action Taken.
Fri Jun 17 16:45:21 2005 => File C:\System Volume Information\_restore{31ADDCA9-F9A1-4BD6-91FD-7D007E068A1D}\RP264\A0066226.dll tagged as "not-a-virus:AdWare.Gator.3124". Action Taken: No Action Taken.
Fri Jun 17 16:45:21 2005 => File C:\System Volume Information\_restore{31ADDCA9-F9A1-4BD6-91FD-7D007E068A1D}\RP264\A0066227.dll tagged as "not-a-virus:AdWare.Gator.6051". Action Taken: No Action Taken.
Fri Jun 17 16:45:21 2005 => File C:\System Volume Information\_restore{31ADDCA9-F9A1-4BD6-91FD-7D007E068A1D}\RP264\A0066228.dll tagged as "not-a-virus:AdWare.Gator.6051". Action Taken: No Action Taken.
Fri Jun 17 16:45:21 2005 => File C:\System Volume Information\_restore{31ADDCA9-F9A1-4BD6-91FD-7D007E068A1D}\RP264\A0066229.dll tagged as "not-a-virus:AdWare.Gator.6051". Action Taken: No Action Taken.
Fri Jun 17 16:45:21 2005 => File C:\System Volume Information\_restore{31ADDCA9-F9A1-4BD6-91FD-7D007E068A1D}\RP264\A0066230.dll tagged as "not-a-virus:AdWare.Gator.6051". Action Taken: No Action Taken.
Fri Jun 17 16:45:21 2005 => File C:\System Volume Information\_restore{31ADDCA9-F9A1-4BD6-91FD-7D007E068A1D}\RP264\A0066231.dll tagged as "not-a-virus:AdWare.Gator.6051". Action Taken: No Action Taken.
Fri Jun 17 16:45:21 2005 => File C:\System Volume Information\_restore{31ADDCA9-F9A1-4BD6-91FD-7D007E068A1D}\RP264\A0066232.dll tagged as "not-a-virus:AdWare.Gator.6051". Action Taken: No Action Taken.
Fri Jun 17 16:45:22 2005 => File C:\System Volume Information\_restore{31ADDCA9-F9A1-4BD6-91FD-7D007E068A1D}\RP264\A0066233.dll tagged as "not-a-virus:AdWare.Gator.6051". Action Taken: No Action Taken.
Fri Jun 17 16:45:22 2005 => File C:\System Volume Information\_restore{31ADDCA9-F9A1-4BD6-91FD-7D007E068A1D}\RP264\A0066236.dll tagged as "not-a-virus:AdWare.Gator.6051". Action Taken: No Action Taken.
Fri Jun 17 16:45:22 2005 => File C:\System Volume Information\_restore{31ADDCA9-F9A1-4BD6-91FD-7D007E068A1D}\RP264\A0066238.dll tagged as "not-a-virus:AdWare.Gator.6041". Action Taken: No Action Taken.
Fri Jun 17 16:45:22 2005 => File C:\System Volume Information\_restore{31ADDCA9-F9A1-4BD6-91FD-7D007E068A1D}\RP264\A0066239.dll tagged as "not-a-virus:AdWare.Gator.5017". Action Taken: No Action Taken.
Fri Jun 17 16:45:22 2005 => File C:\System Volume Information\_restore{31ADDCA9-F9A1-4BD6-91FD-7D007E068A1D}\RP264\A0066240.dll tagged as "not-a-virus:AdWare.Gator.6041". Action Taken: No Action Taken.
Fri Jun 17 16:45:22 2005 => File C:\System Volume Information\_restore{31ADDCA9-F9A1-4BD6-91FD-7D007E068A1D}\RP264\A0066241.exe tagged as "not-a-virus:AdWare.Gator.6034". Action Taken: No Action Taken.
Fri Jun 17 16:45:23 2005 => File C:\System Volume Information\_restore{31ADDCA9-F9A1-4BD6-91FD-7D007E068A1D}\RP264\A0066242.exe tagged as "not-a-virus:AdWare.Gator.6051". Action Taken: No Action Taken.
Fri Jun 17 16:45:24 2005 => File C:\System Volume Information\_restore{31ADDCA9-F9A1-4BD6-91FD-7D007E068A1D}\RP264\A0066267.dll tagged as "not-a-virus:AdWare.MySearch.e". Action Taken: No Action Taken.
Fri Jun 17 16:45:24 2005 => File C:\System Volume Information\_restore{31ADDCA9-F9A1-4BD6-91FD-7D007E068A1D}\RP264\A0066278.dll tagged as "not-a-virus:AdWare.ToolBar.404Search.h". Action Taken: No Action Taken.
Fri Jun 17 16:45:31 2005 => File C:\System Volume Information\_restore{31ADDCA9-F9A1-4BD6-91FD-7D007E068A1D}\RP265\A0066501.dll tagged as "not-a-virus:AdWare.Altnet.b". Action Taken: No Action Taken.
Fri Jun 17 16:46:22 2005 => File C:\WINDOWS\Downloaded Program Files\pdfmgr.dll tagged as "not-a-virus:AdWare.BHO.MegaSearch.b". Action Taken: No Action Taken.
Fri Jun 17 16:46:22 2005 => File C:\WINDOWS\Downloaded Program Files\pdfrpt00.dll tagged as "not-a-virus:AdWare.BHO.MegaSearch.b". Action Taken: No Action Taken.
Fri Jun 17 16:57:30 2005 => File C:\WINDOWS\system32\rundll32\moo.dll tagged as not-a-virus:Tool.Win32.Moo. No Action Taken.
Fri Jun 17 16:57:30 2005 => File C:\WINDOWS\system32\rundll32\svchost.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.60. No Action Taken.
Fri Jun 17 17:25:31 2005 => File E:\Downloads\mirc616.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.16. No Action Taken.
Fri Jun 17 17:29:45 2005 => File E:\mIRC\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.16. No Action Taken.
Fri Jun 17 17:30:09 2005 => File E:\Program Files\Altnet\Download Manager\asmps.dll tagged as "not-a-virus:AdWare.Altnet.b". Action Taken: No Action Taken.
Fri Jun 17 17:38:43 2005 => File E:\System Volume Information\_restore{31ADDCA9-F9A1-4BD6-91FD-7D007E068A1D}\RP262\A0066141.exe tagged as "not-a-virus:AdWare.Altnet.l". Action Taken: No Action Taken.
Fri Jun 17 17:38:46 2005 => File E:\System Volume Information\_restore{31ADDCA9-F9A1-4BD6-91FD-7D007E068A1D}\RP264\A0066212.dll tagged as "not-a-virus:AdWare.Altnet.d". Action Taken: No Action Taken.
Fri Jun 17 17:38:47 2005 => File E:\System Volume Information\_restore{31ADDCA9-F9A1-4BD6-91FD-7D007E068A1D}\RP264\A0066292.exe tagged as "not-a-virus:AdWare.Altnet.l". Action Taken: No Action Taken.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Statistiken:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Fri Jun 17 17:40:24 2005 => Total Virus(es) Found: 49
Fri Jun 17 17:40:24 2005 => Total Errors: 1559
Fri Jun 17 17:40:24 2005 => Time Elapsed: 01:10:31
Fri Jun 17 17:40:24 2005 => Total Objects Scanned: 104680
Fri Jun 17 16:29:25 2005 => Virus Database Date: 2005/06/17
Fri Jun 17 17:40:24 2005 => Virus Database Date: 2005/06/17
Fri Jun 17 17:55:00 2005 => Virus Database Date: 2005/06/17
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
~~~~~~~ © Haui ;-) ~~~~~~~
~~~~~~~ Dank an Cidre ~~~~~~~

Lade dir zunächst Spybot und Adaware runter und versorge beide anschliessend mit einem Update.
Wechsle ansschliessend in den abgesicherten Modus bei deaktivierter Systemwiederherstellung:

http://www.systemwiederherstellung-d...indows-xp.html

Lösche nun den Inhalt folgender Ordner:

E:\Programme\AVPersonal\INFECTED

C:\Dokumente und Einstellungen\Default User\Cookies\
C:\Dokumente und Einstellungen\Default User\Lokale Einstellungen\Temp\
C:\Dokumente und Einstellungen\Default User\Lokale Einstellungen\Temporary Internet Files
C:\Dokumente und Einstellungen\Default User\Lokale Einstellungen\Verlauf


Lösche dann den Inhalt folgender Ordner, dann die Ordner selbst:

C:\Programme\INSTAFINK
E:\Program Files\Altnet

Jetzt folgende Dateien löschen:

C:\WINDOWS\Downloaded Program Files\pdfmgr.dll
C:\WINDOWS\Downloaded Program Files\pdfrpt00.dll
C:\WINDOWS\system32\rundll32\moo.dll


Die auf IRC verweisenden Einträge kannst du lösschen, mußt du aber nicht.

Lasse jetzt noch Spybot und Adaware durchlaufen und behebe gefundene Probleme.Mit Spybot zusätzlich noch immunisieren.
Melde dich dann wieder mit einem neu erstelltem Hijackthis-Log-aber das bitte im normalen Modus erstellen.

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
E:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\Explorer.EXE
C:\ATI-CPanel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programme\QuickTime\qttask.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe
C:\WINDOWS\System32\ctfmon.exe
E:\Programme\GetRight\getright.exe
E:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
E:\Programme\GetRight\getright.exe
C:\WINDOWS\System32\wuauclt.exe
D:\Programme\Microids\Tennis Masters Series 2003\Tennis Masters Series 2003.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Dokumente und Einstellungen\Frogga\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.orf.at
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - E:\Programme\ICQToolbar\toolbaru.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - E:\Programme\GetRight\xx2gr.dll
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - E:\Programme\Xi\NetTransport 2\NTIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - E:\Programme\ICQToolbar\toolbaru.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\RunOnce: [ICQ Lite] E:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: GetRight - Tray Icon.lnk = E:\Programme\GetRight\getright.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = E:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Programme\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &ICQ Toolbar Search - res://E:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: Alles mit Net Transport herunterladen - E:\Programme\Xi\NetTransport 2\NTAddList.html
O8 - Extra context menu item: Download with GetRight - E:\Programme\GetRight\GRdownload.htm
O8 - Extra context menu item: Download with Go!Zilla - file://E:\Programme\Go!Zilla\download-with-gozilla.html
O8 - Extra context menu item: Mit Net Transport herunterladen - E:\Programme\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://E:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - E:\Programme\GetRight\GRbrowse.htm
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - E:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - E:\Programme\ICQLite\ICQLite.exe
O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} (Macromedia Authorware Web Player Control) - //www.bildung.at/content/webplayer/awswax.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) -wwgw.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_42.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1117577993765
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - wgww.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - chat.msn.com/bin/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F7F7CFE3-83BA-4FA9-8E28-6458B742AB86}: NameServer = 195.3.96.67 193.3.96.68
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - E:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Du solltest dir dringenst das Service Pack 2 installieren.
Danach www.windowsupdate.com besuchen.
Desweiteren solltest du dein Java aktualisieren .
Zum surfen solltest du alternative Browser verwenden und den Internetexplorer nur noch für Windowsupdates nutzen.