Trojaner-Board - Häufige Abstürze von Firefox und PC extrem langsam -

Hallo,
nachdem mein PC mit heftigen Abstürzen von Firefox ohne Grund reagierte habe ich mal nen Scan mit HJT gemacht und stelle den hier mal rein.
Hatte vor wenigen Tagen noch das komplette Windows Updtae durchgeführt. So wie sonst auch alle 2 Wochen.
Ich hoffe, ihr könnt mir helfen bitte ?

Außerdem habe ich noch mit malwarebytes nachgescannt und der meldet mir 12 Files als infected.

Also: wäre klasse, wenn ihr helfen könntet.
TX in advance und Gruß

Code:

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 11:33:16, on 18.06.2010

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Programme\Ahead\InCD\InCDsrv.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe

C:\WINDOWS\System32\svchost.exe

C:\Programme\Java\jre6\bin\jqs.exe

C:\Programme\McAfee\VirusScan Enterprise\EngineServer.exe

C:\Programme\Network Associates\Common Framework\FrameworkService.exe

C:\Programme\McAfee\VirusScan Enterprise\VsTskMgr.exe

C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\mfevtps.exe

D:\Programme\Sony Ericsson\Mobile2\Sony Ericsson PC Suite\SupServ.exe

C:\Programme\Analog Devices\SoundMAX\SMAgent.exe

C:\Programme\RealVNC\VNC4\WinVNC4.exe

C:\Programme\McAfee\VirusScan Enterprise\Mcshield.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\Programme\Analog Devices\SoundMAX\SMTray.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Programme\Network Associates\Common Framework\udaterui.exe

C:\Programme\Ahead\InCD\InCD.exe

C:\Programme\Network Associates\Common Framework\McTray.exe

C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe

C:\Programme\QuickTime\qttask.exe

C:\Programme\iTunes\iTunesHelper.exe

D:\Programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

C:\Programme\Spybot - Search & Destroy\SpybotSD.exe

C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe

C:\Programme\iPod\bin\iPodService.exe

C:\Programme\Gemeinsame Dateien\Teleca Shared\CapabilityManager.exe

C:\Programme\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programme\Eraser\eraser.exe

C:\Programme\KONICA MINOLTA\FTP Utility\KMFtp.exe

C:\Programme\Logitech\SetPoint\SetPoint.exe

C:\WINDOWS\system32\taskmgr.exe

C:\Programme\Gemeinsame Dateien\Logishrd\KHAL2\KHALMNPR.EXE

C:\Dokumente und Einstellungen\Administrator.EN01\Desktop\TOTALCMD.EXE

C:\Programme\Gemeinsame Dateien\Teleca Shared\Generic.exe

D:\Programme\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe

C:\Programme\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\rundll32.exe

C:\Programme\Java\jre6\bin\jucheck.exe

C:\Programme\Internet Explorer\iexplore.exe

C:\Programme\Internet Explorer\iexplore.exe

C:\Programme\Internet Explorer\iexplore.exe

C:\Programme\Internet Explorer\iexplore.exe

C:\Dokumente und Einstellungen\Administrator.EN01\Eigene Dateien\Downloads\HiJackThis204.exe
 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = 
 

hxxx://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxx://www.hp.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
 

hxxx://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
 

hxxx://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 
 

hxxx://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = 
 

hxxx://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 
 

172.16.0.10:3128

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings

O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame 
 

Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame 
 

Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot 
 

- Search & Destroy\SDHelper.dll

O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Programme\McAfee\VirusScan 
 

Enterprise\scriptsn.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - 
 

C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - 
 

C:\Programme\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - 
 

C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 
 

7.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Smapp] C:\Programme\Analog Devices\SoundMAX\SMTray.exe

O4 - HKLM\..\Run: [SetRefresh] C:\Programme\Compaq\SetRefresh\SetRefresh.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Programme\Network Associates\Common 
 

Framework\udaterui.exe" /StartedFromRunKey

O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [InCD] C:\Programme\Ahead\InCD\InCD.exe

O4 - HKLM\..\Run: [Tweak UI 1.33 deutsch] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp

O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "D:\Programme\Sony Ericsson\Mobile2\Application 
 

Launcher\Application Launcher.exe" /startoptions

O4 - HKLM\..\Run: [SpybotSnD] "C:\Programme\Spybot - Search & Destroy\SpybotSD.exe"

O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Programme\Gemeinsame 
 

Dateien\Acronis\Schedule2\schedhlp.exe"

O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Programme\hpq\HP Wireless Assistant\HP Wireless 
 

Assistant.exe

O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 
 

9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [ShStatEXE] "C:\Programme\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Run: [Eraser] C:\Programme\Eraser\eraser.exe -hide

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')

O4 - Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 
 

7.0\Reader\reader_sl.exe

O4 - Global Startup: Adobe Acrobat - Schnellstart.lnk = ?

O4 - Global Startup: Adobe Gamma Loader.lnk = ?

O4 - Global Startup: Communication Assistant.lnk = C:\Programme\Panasonic\Communication 
 

Assistant\Communication Assistant.exe

O4 - Global Startup: FTP Utility.lnk = C:\Programme\KONICA MINOLTA\FTP Utility\KMFtp.exe

O4 - Global Startup: Logitech SetPoint.lnk = C:\Programme\Logitech\SetPoint\SetPoint.exe

O4 - Global Startup: taskmgr.exe.lnk = C:\WINDOWS\system32\taskmgr.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - 
 

res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - 
 

res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - 
 

res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - 
 

res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 
 

7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - 
 

res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - 
 

res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - 
 

res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - 
 

res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - 
 

C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - 
 

Search & Destroy\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - 
 

{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - 
 

C:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - 
 

C:\Programme\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=hxxp://www.xxxh.org

O15 - ESC Trusted Zone: hxxx://*.0.0.0.0 (HKLM)

O15 - ESC Trusted Zone: hxxx://www.admins-tipps.net (HKLM)

O15 - ESC Trusted Zone: hxxx://ardownload.adobe.com (HKLM)

O15 - ESC Trusted Zone: hxxx://www.apc.com (HKLM)

O15 - ESC Trusted Zone: hxxx://www.apcc.com (HKLM)

O15 - ESC Trusted Zone: hxxx://www.google.de (HKLM)

O15 - ESC Trusted Zone: hxxx://www.heise.de (HKLM)

O15 - ESC Trusted Zone: hxxx://www.hellasystems.de (HKLM)

O15 - ESC Trusted Zone: hxxx://www.java.com (HKLM)

O15 - ESC Trusted Zone: hxxx://www.kyoceramita.de (HKLM)

O15 - ESC Trusted Zone: hxxx://*.mcafeesecurity.com (HKLM)

O15 - ESC Trusted Zone: hxxx://www.nai.com (HKLM)

O15 - ESC Trusted Zone: hxxx://*.nai.com (HKLM)

O15 - ESC Trusted Zone: hxxx://www.networkassociates.com (HKLM)

O15 - ESC Trusted Zone: hxxx://sunsdlc1-17-vhost2.sun.com (HKLM)

O15 - ESC Trusted Zone: hxxx://sunsdlc1-25.sun.com (HKLM)

O15 - ESC Trusted Zone: www.sun.com (HKLM)

O15 - ESC Trusted Zone: hxxx://labmice.techtarget.com (HKLM)

O15 - ESC Trusted Zone: hxxx://de.trendmicro-europe.com (HKLM)

O15 - ESC Trusted Zone: hxxx://softwareupdate.veritas.com (HKLM)

O15 - ESC Trusted IP range: hxxx://1xx.16.0.186 (HKLM)

O15 - ESC Trusted IP range: hxxx://192.168.xx.254 (HKLM)

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - 
 

hxxx://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?126398496153
 

6

O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - 
 

hxxx://support.f-secure.com/ols/fscax.cab

O16 - DPF: {CCA0B877-CB5E-4ADC-AD30-457C379512DD} - 

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = 

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - 
 

C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - 
 

{8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programme\Gemeinsame 
 

Dateien\Acronis\Schedule2\schedul2.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - 
 

C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Programme\Ahead\InCD\InCDsrv.exe

O23 - Service: iPod Service - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - 
 

C:\Programme\Java\jre6\bin\jqs.exe

O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Programme\Gemeinsame 
 

Dateien\Logishrd\Bluetooth\LBTServ.exe

O23 - Service: McAfee Engine Service (McAfeeEngineService) - McAfee, Inc. - 
 

C:\Programme\McAfee\VirusScan Enterprise\EngineServer.exe

O23 - Service: McAfee Framework-Dienst (McAfeeFramework) - McAfee, Inc. - C:\Programme\Network 
 

Associates\Common Framework\FrameworkService.exe

O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Programme\McAfee\VirusScan 
 

Enterprise\Mcshield.exe

O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Programme\McAfee\VirusScan 
 

Enterprise\VsTskMgr.exe

O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - 
 

C:\WINDOWS\system32\mfevtps.exe

O23 - Service: Sony Ericsson OMSI download service (OMSI download service) - Unknown owner - 
 

D:\Programme\Sony Ericsson\Mobile2\Sony Ericsson PC Suite\SupServ.exe

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - 
 

C:\Programme\WinPcap\rpcapd.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - 
 

C:\Programme\Analog Devices\SoundMAX\SMAgent.exe

Malwarebytes' Anti-Malware 1.46
Malwarebytes

Database version: 4052

Windows 5.1.2600 Service Pack 2 (Safe Mode)
Internet Explorer 8.0.6001.18702

Code:



18.06.2010 12:57:44

mbam-log-2010-06-18 (12-57-44).txt
 

Scan type: Full scan (C:\|)

Objects scanned: 240612

Time elapsed: 30 minute(s), 9 second(s)
 

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 1

Folders Infected: 1

Files Infected: 11
 

Memory Processes Infected:

(No malicious items detected)
 

Memory Modules Infected:

(No malicious items detected)
 

Registry Keys Infected:

(No malicious items detected)
 

Registry Values Infected:

(No malicious items detected)
 

Registry Data Items Infected:

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel\Homepage (Hijack.Homepage) -> Bad: (1) Good: (0) -> No action taken.
 

Folders Infected:

C:\WINDOWS\system32\xmldm (Stolen.Data) -> No action taken.
 

Files Infected:

C:\quarantine\entspannung.exe.Vir.0 (Trojan.Bier) -> No action taken.

C:\quarantine\entspannung.exe.Vir.1 (Trojan.Bier) -> No action taken.

C:\WINDOWS\system32\xmldm\FromJava01CB0C809DC29990_00000224_se_softw.wid (Stolen.Data) -> No action taken.

C:\WINDOWS\system32\xmldm\FromJava01CB0C809DEB2B1A_00000224_se_softw.s (Stolen.Data) -> No action taken.

C:\WINDOWS\system32\xmldm\FromJava01CB0C80B0DC4C7A_00000224_se_tips.wid (Stolen.Data) -> No action taken.

C:\WINDOWS\system32\xmldm\FromJava01CB0C80B104DE04_00000224_se_tips.s (Stolen.Data) -> No action taken.

C:\WINDOWS\system32\xmldm\FromJava01CB0D5D1D51F9B1_00003736_classes.jsa (Stolen.Data) -> No action taken.

C:\WINDOWS\system32\xmldm\FromJava01CB0D5D1D5B831D_00003736_classes.jsa (Stolen.Data) -> No action taken.

C:\WINDOWS\system32\xmldm\FromJava01CB0DF17F6C4AEB_00002476_classes.jsa (Stolen.Data) -> No action taken.

C:\WINDOWS\system32\xmldm\iexplore.exe_UAs002.dat (Stolen.Data) -> No action taken.

C:\WINDOWS\system32\xmldm\iexplore.exe_UAs003.dat (Stolen.Data) -> No action taken.