kann das ein Virus sein?
 

Hallo ich hab ein Problem und zwar friert mein PC bei programmen einfach ein, besonders, wenn ich etwas mit nero brennen will.
Auch einen kompletten scan mit Kaspersky konnte ich nicht tun.

Programme sind folgende drauf Kaspersky Personal Pro und ewido.

Mein os ist Xp Pro

könnt ihr mir vielleicht helfen?

Mache dies:
http://www.trojaner-board.de/showthread.php?t=17493
und poste das Log. Halte Dich genau an die Anleitung.

Logfile of HijackThis v1.99.1
Scan saved at 20:28:35, on 16.09.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LckFldService.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Programme\Java\jre1.5.0_04\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Dit.exe
C:\Programme\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\DitExp.exe
C:\Programme\Logitech\SetPoint\SetPoint.exe
C:\Programme\Gemeinsame Dateien\Logitech\KHAL\KHALMNPR.EXE
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programme\RealVNC\VNC4\WinVNC4.exe
C:\Programme\Miranda IM\miranda32.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\mIRC\mirc.exe
C:\Dokumente und Einstellungen\911gt2\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://google.icq.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://xx.am/
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O2 - BHO: (no name) - {031B1891-1EF2-89EF-B6B7-94F717B633B3} - C:\DOKUME~1\911gt2\ANWEND~1\MIXAIM~1\Coolflaw.exe (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: PreispiratenSearchURL - {0B660087-931C-4056-A04F-0423890E40B6} - C:\Programme\Preispiraten\Preispiraten2\PPSearchURL.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: metaspinner media GmbH - {D3AA56A9-8137-4950-A6F9-D0190A82AF2A} - C:\Programme\Preispiraten\Preispiraten2\IEButtonPPInterface.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Virus Detector] dark.exe
O4 - HKLM\..\Run: [Anti-Virus Update Scheduler] C:\WINDOWS\system32\astteavxdh\winsp3.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [BOWSKNOBWMAPILE] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\platformbikebowsknob\TransLong.exe
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize
O4 - HKLM\..\RunServices: [Virus Detector] dark.exe
O4 - HKCU\..\Run: [Hopefind] C:\DOKUME~1\911gt2\ANWEND~1\HTMCOPY\Optionsoftinfo.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Programme\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: &Preispiratensuche nach markiertem Text - C:\\Programme\\Preispiraten\\Preispiraten2\\preispiraten.html
O8 - Extra context menu item: Download with NetPumper - C:\Programme\NetPumper\AddUrl.htm
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Preispiraten 2.5 - {2638A03E-1669-43BE-8119-B47087629A7F} - C:\Programme\Preispiraten\Preispiraten2\preispiraten2ie.exe
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Programme\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Programme\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - hxxp://security.symantec.com/sscv6/S.../bin/cabsa.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Programme\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programme\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe
O23 - Service: LckFldService - Unknown owner - C:\WINDOWS\system32\LckFldService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Programme\RealVNC\VNC4\WinVNC4.exe" -service (file missing)

Ich kann eigentlich nichts schlechtes in dem Log erkennen. Versuche:
http://www.trojaner-board.de/showthread.php?t=17492
Halte Dich genau an die Anleitung und poste das mit der find.bat erzeugte Log.

Hi, hat ein bisschen länger gedauert

hier kommt das log


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Funde für "infected"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Sun Sep 25 18:54:59 2005 => System found infected with alexa Spyware/Adware ({c95fe080-8f5d-11d2-a20b-00aa003c157a})! Action taken: No Action Taken.
Sun Sep 25 18:56:15 2005 => File C:\WINDOWS\System32\i infected by "Trojan-Downloader.BAT.Ftp.ab" Virus! Action Taken: No Action Taken.
Sun Sep 25 19:01:51 2005 => Scanning File C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Infected.wav
Sun Sep 25 19:19:32 2005 => File C:\WINDOWS\system32\i infected by "Trojan-Downloader.BAT.Ftp.ab" Virus! Action Taken: No Action Taken.
Sun Sep 25 19:42:00 2005 => Scanning Folder: D:\Programme\AVPersonal\INFECTED\*.*
Sun Sep 25 20:09:15 2005 => Scanning File D:\Programme\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Infected.wav
Sun Sep 25 21:23:26 2005 => Scanning Folder: E:\Mp3\Rock, Pop\SUM 41\Does This Look Infected_\*.*
Sun Sep 25 21:23:26 2005 => Scanning File E:\Mp3\Rock, Pop\SUM 41\Does This Look Infected_\A.N.I.C.mp3
Sun Sep 25 21:23:26 2005 => Scanning File E:\Mp3\Rock, Pop\SUM 41\Does This Look Infected_\All Messed Up.mp3
Sun Sep 25 21:23:26 2005 => Scanning File E:\Mp3\Rock, Pop\SUM 41\Does This Look Infected_\Billy Spleen.mp3
Sun Sep 25 21:23:26 2005 => Scanning File E:\Mp3\Rock, Pop\SUM 41\Does This Look Infected_\Hooch.mp3
Sun Sep 25 21:23:26 2005 => Scanning File E:\Mp3\Rock, Pop\SUM 41\Does This Look Infected_\Hyper-Insomnia-Para-Condrioid.mp3
Sun Sep 25 21:23:26 2005 => Scanning File E:\Mp3\Rock, Pop\SUM 41\Does This Look Infected_\Mr. Amsterdam.mp3
Sun Sep 25 21:23:26 2005 => Scanning File E:\Mp3\Rock, Pop\SUM 41\Does This Look Infected_\My Direction.mp3
Sun Sep 25 21:23:26 2005 => Scanning File E:\Mp3\Rock, Pop\SUM 41\Does This Look Infected_\No Brains.mp3
Sun Sep 25 21:23:26 2005 => Scanning File E:\Mp3\Rock, Pop\SUM 41\Does This Look Infected_\Over My Head Better Off Dead.mp3
Sun Sep 25 21:23:26 2005 => Scanning File E:\Mp3\Rock, Pop\SUM 41\Does This Look Infected_\Still Waiting.mp3
Sun Sep 25 21:23:26 2005 => Scanning File E:\Mp3\Rock, Pop\SUM 41\Does This Look Infected_\Thanks for Nothing.mp3
Sun Sep 25 21:23:26 2005 => Scanning File E:\Mp3\Rock, Pop\SUM 41\Does This Look Infected_\The Hell Song.mp3
Sun Sep 25 21:23:45 2005 => Total Disinfected Files: 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Funde für "tagged"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Sun Sep 25 18:56:47 2005 => File C:\WINDOWS\System32\mt-uninstaller.exe tagged as "not-a-virus:AdWare.PurityScan.u". Action Taken: No Action Taken.
Sun Sep 25 19:20:06 2005 => File C:\WINDOWS\system32\mt-uninstaller.exe tagged as "not-a-virus:AdWare.PurityScan.u". Action Taken: No Action Taken.
Sun Sep 25 19:25:10 2005 => File D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\platformbikebowsknob\mess readme.exe tagged as "not-a-virus:AdWare.Lop.z". Action Taken: No Action Taken.
Sun Sep 25 19:25:10 2005 => File D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\platformbikebowsknob\owns cast.exe tagged as "not-a-virus:AdWare.Lop.z". Action Taken: No Action Taken.
Sun Sep 25 19:30:10 2005 => File D:\mIRC\backup\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
Sun Sep 25 19:30:13 2005 => File D:\mIRC\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
Sun Sep 25 20:37:13 2005 => File D:\Programme\RealVNC\VNC4\wm_hooks.dll tagged as not-a-virus:RemoteAdmin.Win32.WinVNC.4. No Action Taken.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Statistiken:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Sun Sep 25 21:23:45 2005 => Total Virus(es) Found: 10
Sun Sep 25 21:23:45 2005 => Total Errors: 20
Sun Sep 25 21:23:45 2005 => Time Elapsed: 02:30:00
Sun Sep 25 21:23:45 2005 => Total Objects Scanned: 125708
Sun Sep 25 18:53:34 2005 => Virus Database Date: 2005/09/09
Sun Sep 25 21:23:45 2005 => Virus Database Date: 2005/09/09
Sun Sep 25 22:22:40 2005 => Virus Database Date: 2005/09/09
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
~~~~~~~ © Haui ;-) ~~~~~~~
~~~~~~~ Dank an Cidre ~~~~~~~