Trojaner-Board - Viren und sonstiges Hilfe

Gute Tag
also hier mal der Log
HiJackthis Logfile:

Code:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:49:14, on 21.06.2010

Platform: Unknown Windows (WinNT 6.01.3504)

MSIE: Internet Explorer v8.00 (8.00.7600.16385)

Boot mode: Normal
 

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskhost.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe

C:\Program Files\D-Link\DWA-125 revA\AirGCFG.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Windows Live\Contacts\wlcomm.exe

E:\xxxx\HijackThis.exe
 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.msn.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/home

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.msn.com/1me10IE8ENUS/701

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 

R3 - URLSearchHook: (no name) -  - (no file)

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe

O4 - HKLM\..\Run: [D-Link D-Link Wireless 150 USB Adapter DWA-125] C:\Program Files\D-Link\DWA-125 revA\AirGCFG.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [explorer] C:\Windows\system32\svchosb.exe

O4 - HKLM\..\Run: [Windows Task Manager] C:\Windows\system32\svchosb.exe

O4 - HKLM\..\Run: [Yahoo! Messenger] C:\Windows\system32\svchosb.exe

O4 - Global Startup: Reboot.exe

O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Daniel\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm

O9 - Extra button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - E:\ICQ7.0\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - E:\ICQ7.0\ICQ.exe

O13 - Gopher Prefix: 

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: ANIWConn Service (ANIWConnService) - Unknown owner - C:\Windows\system32\ANIWConnService.exe

O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Wireless Service - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe

O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - E:\hamachi-2.exe

O23 - Service: LELMK - Sysinternals - www.sysinternals.com - C:\Users\xxxx\AppData\Local\Temp\LELMK.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

O23 - Service: SearchAnonymizer - Unknown owner - C:\Users\xxxxx\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe

O23 - Service: XTO - Sysinternals - www.sysinternals.com - C:\Users\xxx\AppData\Local\Temp\XTO.exe

O23 - Service: YFFI - Sysinternals - www.sysinternals.com - C:\Users\xxxx\AppData\Local\Temp\YFFI.exe

O23 - Service: YRTZEVWXV - Sysinternals - www.sysinternals.com - C:\Users\xxxxx\AppData\Local\Temp\YRTZEVWXV.exe

O23 - Service: ZVSKWE - Sysinternals - www.sysinternals.com - C:\Usersxxxx\AppData\Local\Temp\ZVSKWE.exe
 

--

End of file - 5005 bytes

--- --- ---

Und hier was Antivir so gefunden hat

eginne mit der Suche in 'C:\Users\xxxx\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AN6I3A4S\url[1].htm'
C:\Users\xxxx\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AN6I3A4S\url[1].htm
[FUND] Enthält Erkennungsmuster des HTML-Scriptvirus HTML/Infected.WebPage.Gen
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4f7291b7.qua' verschoben!

C:\Windows\System32\drivers\FSsdt.sys
[FUND] Ist das Trojanische Pferd TR/Rootkit.Gen

Beginne mit der Suche in 'C:\Windows\System32\FSsdt.dat'
C:\Windows\System32\FSsdt.dat
[FUND] Ist das Trojanische Pferd TR/Crypt.ZPACK.Gen

Mein Anti Spym hat eben ein Backdoor HPT entdeckt Pfad

hkey_local_machine/software/microsoft/windows/currentversion/run

Das kommt wie die obigen sachen immer wieder was kann ich tun?????