Trojaner-Board - Nervige Popups und dauernd neue Dateien im System32 Ordner

Der hieß glaub ich "Trojan.Downloader" oder so.
hier das HJ-File:
Code:
Logfile of HijackThis v1.99.1

Scan saved at 08:15:07, on 19.2.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0011)
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\netdde.exe

F:\Programme\Apache Group\Apache\Apache.exe

C:\WINDOWS\Explorer.EXE

C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe

C:\WINDOWS\system32\svchost.exe

C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe

C:\Programme\Canon\DIAS\CnxDIAS.exe

C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe

F:\Programme\Apache Group\Apache\Apache.exe

C:\Programme\LogMeIn\RaMaint.exe

C:\Programme\LogMeIn\LogMeIn.exe

C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe

C:\Programme\Norton AntiVirus\navapsvc.exe

C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe

C:\WINDOWS\AGRSMMSG.exe

C:\Programme\Spamihilator\SRVANY.EXE

C:\Programme\LogMeIn\LogMeInSystray.exe

C:\PROGRA~1\LAUNCH~1\QtZpAcer.EXE

C:\Programme\Spamihilator\Spamihilator.exe

C:\WINDOWS\System32\svchost.exe

C:\Programme\Gemeinsame Dateien\svchost.exe

C:\Programme\Symantec_Client_Security\Symantec AntiVirus\vptray.exe

C:\WINDOWS\wt\updater\wcmdmgr.exe

C:\WINDOWS\system32\rundll32.exe

C:\Programme\Java\jre1.5.0_10\bin\jusched.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Programme\Logitech\MouseWare\system\em_exec.exe

C:\Programme\FreePDF_XP\fpassist.exe

C:\Programme\Synaptics\SynTP\SynTPEnh.exe

C:\Programme\Synaptics\SynTP\SynTPLpr.exe

C:\WINDOWS\system32\ctfmon.exe

F:\Programme\Stardock\ObjectDock\ObjectDock.exe

C:\Programme\RALINK\Common\RaUI.exe

C:\WINDOWS\system32\taskmgr.exe

C:\Programme\Google\Web Accelerator\GoogleWebAccWarden.exe

C:\Programme\Google\Web Accelerator\googlewebaccclient.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Dokumente und Einstellungen\Jonas.NBJENS\Desktop\virus entfernen\HijackThis.exe
 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.de

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Mein Browser

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://localhost:9100/proxy.pac

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: NavExcel Toolbar - {5AA06644-BC46-4220-A460-47A6EB47C96D} - C:\Programme\NavExcel Search Toolbar\NavExcelBar.dll (file missing)

O3 - Toolbar: PimpFish - {D593DE91-7B41-45C2-830E-E9A99AB142AA} - D:\Programme\PimpFish\PimpFish.dll

O3 - Toolbar: Google Web Accelerator - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - C:\Programme\Google\Web Accelerator\GoogleWebAccToolbar.dll

O4 - HKLM\..\Run: [LaunchApp] Alaunch

O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZpAcer.EXE

O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe

O4 - HKLM\..\Run: [vptray] C:\Programme\Symantec_Client_Security\Symantec AntiVirus\vptray.exe

O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\GEMEIN~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup

O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch

O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.5.0_10\bin\jusched.exe"

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Programme\LogMeIn\LogMeInSystray.exe"

O4 - HKLM\..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe

O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [ObjectDock] F:\Programme\Stardock\ObjectDock\ObjectDock.exe

O4 - Startup: taskmgr.exe.lnk = C:\WINDOWS\system32\taskmgr.exe

O4 - Startup: Run Google Web Accelerator.lnk = Google\Web Accelerator\GoogleWebAccWarden.exe

O4 - Global Startup: Ralink Wireless Utility.lnk = RALINK\Common\RaUI.exe

O4 - Global Startup: Adobe Reader - Schnellstart.lnk = D:\Programme\Adobe\Reader 8.0\Reader\reader_sl.exe

O4 - Global Startup: Adobe Reader Synchronizer.lnk = D:\Programme\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe

O8 - Extra context menu item: &eBay Search - res://D:\Programme\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html

O8 - Extra context menu item: Bild in &Microsoft PhotoDraw öffnen - res://C:\PROGRA~1\MICROS~2\Office\1031\phdintl.dll/phdContext.htm

O8 - Extra context menu item: Download &Flash Movies - C:\Programme\Flash2X\Flash Hunter\save.htm

O8 - Extra context menu item: PimpFish Grab movies on this page - D:\Programme\PimpFish\GRABPAGEMOVIES.HTM

O8 - Extra context menu item: PimpFish Grab pictures on this page - D:\Programme\PimpFish\GRABPAGEPICS.HTM

O8 - Extra context menu item: PimpFish Grab pictures this page links to - D:\Programme\PimpFish\GRABPAGELINKS.HTM

O8 - Extra context menu item: PimpFish Grab Target File - D:\Programme\PimpFish\GRABLINK.HTM

O8 - Extra context menu item: PimpFish Grab This Picture - D:\Programme\PimpFish\GRABPIC.HTM

O8 - Extra context menu item: Senden an &Bluetooth - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

O8 - Extra context menu item: Sothink SWF Decompiler - C:\Programme\SourceTec\Sothink Glanda\InternetExplorer.htm

O9 - Extra button: IE7pro - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Programme\IE7pro\IE7pro.dll

O9 - Extra 'Tools' menuitem: IE7pro        Ctrl+Alt+7 - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Programme\IE7pro\IE7pro.dll

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_10\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_10\bin\ssv.dll

O9 - Extra button: Internet Radio by Endicosoft.com - {1F958B09-3312-7f0e-9723-4C1324C57B20} - C:\Programme\Internet Radio\Radio.exe (file missing)

O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programme\WinHTTrack\WinHTTrackIEBar.dll

O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programme\WinHTTrack\WinHTTrackIEBar.dll

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: Sothink SWF Decompiler - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Programme\SourceTec\Sothink Glanda\InternetExplorer.htm

O9 - Extra 'Tools' menuitem: Sothink SWF Decompiler - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Programme\SourceTec\Sothink Glanda\InternetExplorer.htm

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra button: Flash2X Flash Hunter - {77B563A5-2A35-4E6B-BFC8-F4B6BB65D5DF} - C:\Programme\Flash2X\Flash Hunter\save.htm (HKCU)

O9 - Extra 'Tools' menuitem: &Launch Flash Hunter - {77B563A5-2A35-4E6B-BFC8-F4B6BB65D5DF} - C:\Programme\Flash2X\Flash Hunter\save.htm (HKCU)

O11 - Options group: [INTERNATIONAL] International*

O16 - DPF: Microsoft Office Workgroup Web Control - http://192.168.2.100/common/wkgrpweb.cab

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/german/partner/de/kavwebscan_unicode.cab

O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://a516.g.akamai.net/f/516/25175/7d/runaware.download.akamai.com/25175/citrix/wficat-no-eula.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/DE-DE/a-UNO1/GAME_UNO1.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = concepcion.concepcion

O17 - HKLM\Software\..\Telephony: DomainName = concepcion.concepcion

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = concepcion.concepcion

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\btxppanel.dll

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Apache - Unknown owner - F:\Programme\Apache Group\Apache\Apache.exe" --ntservice (file missing)

O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe

O23 - Service: Canon Driver Information Assist Service - CANON INC. - C:\Programme\Canon\DIAS\CnxDIAS.exe

O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe

O23 - Service: License Management Service ESD - element5 - C:\Programme\Gemeinsame Dateien\element5 Shared\Service\Licence Manager ESD.exe

O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Programme\LogMeIn\RaMaint.exe

O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Programme\LogMeIn\LogMeIn.exe

O23 - Service: Norton AntiVirus Auto-Protect-Dienst (navapsvc) - Symantec Corporation - C:\Programme\Norton AntiVirus\navapsvc.exe

O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe

O23 - Service: SpamiService - Unknown owner - C:\Programme\Spamihilator\SRVANY.EXE