Surf SideKick und evtl. noch andere Biester
 

Hallo !
Ich brauche mal eure Hilfe !
Ich habe keine Ahnung wie ich diesen Surf SideKick und alle evtl anderen Biester auf meinem Rechner entferne.

Gleich kommt noch mein Log File.
Danke schon mal

Der Bremer Jung

Logfile of HijackThis v1.99.1
Scan saved at 20:55:55, on 10.05.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\explorer.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\s?stem\m?config.exe
C:\DOKUME~1\Alex\LOKALE~1\Temp\!update.exe
C:\WINDOWS\FNTS~1\alg.exe
D:\Programme\totalcmd\TOTALCMD.EXE
D:\Programme\Hijack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://localhost:3476/cgi-bin/ncgir.exe?menu/fwl_index.html
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - C:\Programme\SurfSideKick 3\SskBho.dll
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {31B032AD-A06F-D4B8-3151-8A6A67D5DBE8} - C:\WINDOWS\system32\oykkcnk.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar2.dll
O2 - BHO: (no name) - {D489E398-B169-9D6A-2B14-9693CDE4FD7E} - C:\WINDOWS\bppyloxp.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll
O4 - HKLM\..\Run: [nTrayFw] C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [CmPCIaudio] RunDll32 CMICNFG3.CPL,CMICtrlWnd
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [WinDVR SchSvr] "C:\Programme\Gemeinsame Dateien\InterVideo\SchSvr\SchSvr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SurfSideKick 3] C:\Programme\SurfSideKick 3\Ssk.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Rlst] "C:\WINDOWS\FNTS~1\alg.exe" -vt tzt
O4 - HKCU\..\Run: [SurfSideKick 3] C:\Programme\SurfSideKick 3\Ssk.exe
O8 - Extra context menu item: &Google Search - res://c:\programme\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\programme\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\programme\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programme\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\programme\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\programme\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O18 - Filter: text/html - {994D478A-45D0-4DB4-AE77-738B1E346E99} - C:\Programme\SDVita\SDVita.dll
O20 - AppInit_DLLs: repairs303169584.dll
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Programme\Tune Up 2006\WinStylerThemeSvc.exe

mOIn ILOVEWERDER,
lasse mal bitte diese 3
C:\Programme\s?stem\m?config.exe
C:\DOKUME~1\Alex\LOKALE~1\Temp\!update.exe
C:\WINDOWS\FNTS~1\alg.exe
hier
http://virusscan.jotti.org/de/
oder da
http://www.virustotal.com/en/indexf.html
auswerten und berichte dann nochmal
MFG aus HH

Moin Moin!
Ich habe die 3 Dateien analysieren lassen.
Die ersten beiden haben keine Infektion aufgewiesen.
Bei dritten erschien folgende Summary

STATUS: FINISHED
Complete scanning result of "alg.exe", received in VirusTotal at 05.11.2006, 09:09:09 (CET).
Antivirus Version Update Result
AntiVir 6.34.1.27 05.11.2006 no virus found
Avast 4.6.695.0 05.10.2006 Win32:PurityScan-N
AVG 386 05.10.2006 no virus found
BitDefender 7.2 05.11.2006 no virus found
CAT-QuickHeal 8.00 05.11.2006 no virus found
ClamAV devel-20060426 05.11.2006 no virus found
DrWeb 4.33 05.10.2006 Trojan.PurityAd
eTrust-InoculateIT 23.72.5 05.11.2006 Win32/Clspring.Variant!Trojan
eTrust-Vet 12.4.2205 05.11.2006 no virus found
Ewido 3.5 05.10.2006 Downloader.PurityScan.cl
Fortinet 2.76.0.0 05.11.2006 W32/EV!tr.dldr
F-Prot 3.16c 05.11.2006 no virus found
Ikarus 0.2.65.0 05.10.2006 Trojan-Downloader.Win32.PurityScan.cl
Kaspersky 4.0.2.24 05.11.2006 Trojan-Downloader.Win32.PurityScan.cl
McAfee 4759 05.10.2006 Downloader-EV
Microsoft 1.1372 05.11.2006 no virus found
NOD32v2 1.1531 05.11.2006 probably a variant of Win32/Adware.MediaTickets
Norman 5.90.17 05.10.2006 W32/PurityScan.VP
Panda 9.0.0.4 05.10.2006 Adware/PurityScan
Sophos 4.05.0 05.11.2006 no virus found
Symantec 8.0 05.11.2006 no virus found
TheHacker 5.9.7.141 05.10.2006 no virus found
UNA 1.83 05.10.2006 no virus found
VBA32 3.11.0 05.10.2006 suspected of Backdoor.Rbot.2
Aditional Information
File size: 71168 bytes
MD5: 998638b9e8af170f95dc2b124c294266
SHA1: 82e328e70e888a6d31564da9493956abdf18f499


Vielen Dank schonmal für die Hilfe!
MFG Der Bremer Jung

@ILOVEWERDER
Sorry, aber daran glauben kann ich einfach nicht:
http://www.bleepingcomputer.com/star....exe-9029.html
http://www.liutilities.com/products/...ibrary/update/
sind nicht unbedingt Dein Fall, aber die Dateien gehören zu Malware-Produkten.