über 51 Viren auf dem Rechner könnt ihr euch das Logfile mal anschauen.

#1 Hab bei nem Bekannten über 51 Viren hauptsächlich backdoor progs gefunden.

könnt ihr das Logfile anschauen

Logfile of HijackThis v1.97.7
Scan saved at 17:52:47, on 07.08.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\PROGRA~1\GEMEIN~1\XCPCSync\TRANSL~1\ErPhn2\ErTray.exe
C:\Programme\Ahead\InCD\InCD.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\wuamgrd65.exe
C:\Programme\ISTsvc\istsvc.exe
C:\WINDOWS\System32\wiigma.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Programme\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\System32\Config33.exe
D:\Programme\Norton AntiVirus\navapsvc.exe
C:\Programme\BullsEye Network\bin\bargains.exe
C:\Programme\NaviSearch\bin\nls.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
D:\Programme\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\Dokumente und Einstellungen\Ars..*patsch*\Anwendungsdaten\uume.exe
C:\WINDOWS\System32\agq.exe
D:\Programme\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\DOKUME~1\Ars..*patsch*\LOKALE~1\Temp\msbb.exe
D:\Programme\Winamp3\studio.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\CashBack\bin\cashback.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\NMain.exe
C:\WINDOWS\System32\krpxcu.exe
C:\Programme\WinRAR\WinRAR.exe
C:\DOKUME~1\Ars..*patsch*\LOKALE~1\Temp\Rar$EX00.766\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://ok-search.com/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ok-search.com/search.html
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O1 - Hosts: 66.159.20.52 www1.ndhosting.com
O1 - Hosts: 66.159.20.52 www3.ndhosting.com
O1 - Hosts: 66.159.20.52 www2.ndhosting.com
O1 - Hosts: 66.159.20.52 www.ndhosting.com
O1 - Hosts: 66.159.20.52 www.kinghost.com
O1 - Hosts: 66.159.20.52 kinghost.com
O1 - Hosts: 66.159.20.52 www1.kinghost.com
O1 - Hosts: 66.159.20.52 www2.kinghost.com
O1 - Hosts: 66.159.20.52 www3.kinghost.com
O1 - Hosts: 66.159.20.52 www4.kinghost.com
O1 - Hosts: 66.159.20.52 www5.kinghost.com
O1 - Hosts: 66.159.20.52 www6.kinghost.com
O1 - Hosts: 66.159.20.52 www7.kinghost.com
O1 - Hosts: 66.159.20.52 www8.kinghost.com
O1 - Hosts: 66.159.20.52 www9.kinghost.com
O1 - Hosts: 66.159.20.52 www10.kinghost.com
O1 - Hosts: 66.159.20.52 www.smutserver.com
O1 - Hosts: 66.159.20.52 smutserver.com
O1 - Hosts: 66.159.20.52 www1.smutserver.com
O1 - Hosts: 66.159.20.52 www2.smutserver.com
O1 - Hosts: 66.159.20.52 www16.smutserver.com
O1 - Hosts: 66.159.20.52 www3.smutserver.com
O1 - Hosts: 66.159.20.52 www4.smutserver.com
O1 - Hosts: 66.159.20.52 www5.smutserver.com
O1 - Hosts: 66.159.20.52 www6.smutserver.com
O1 - Hosts: 66.159.20.52 www7.smutserver.com
O1 - Hosts: 66.159.20.52 www8.smutserver.com
O1 - Hosts: 66.159.20.52 www9.smutserver.com
O1 - Hosts: 66.159.20.52 www10.smutserver.com
O1 - Hosts: 66.159.20.52 www11.smutserver.com
O1 - Hosts: 66.159.20.52 www12.smutserver.com
O1 - Hosts: 66.159.20.52 www13.smutserver.com
O1 - Hosts: 66.159.20.52 www14.smutserver.com
O1 - Hosts: 66.159.20.52 www15.smutserver.com
O1 - Hosts: 66.159.20.52 www17.smutserver.com
O1 - Hosts: 66.159.20.52 www18.smutserver.com
O1 - Hosts: 66.159.20.52 www19.smutserver.com
O1 - Hosts: 66.159.20.52 www20.smutserver.com
O1 - Hosts: 66.159.20.52 www21.smutserver.com
O1 - Hosts: 66.159.20.52 www22.smutserver.com
O1 - Hosts: 66.159.20.52 www23.smutserver.com
O1 - Hosts: 66.159.20.52 www24.smutserver.com
O1 - Hosts: 66.159.20.52 www25.smutserver.com
O1 - Hosts: 66.159.20.52 www26.smutserver.com
O1 - Hosts: 66.159.20.52 www27.smutserver.com
O1 - Hosts: 66.159.20.52 www28.smutserver.com
O1 - Hosts: 66.159.20.52 www29.smutserver.com
O1 - Hosts: 66.159.20.52 www30.smutserver.com
O1 - Hosts: 66.159.20.52 www31.smutserver.com
O1 - Hosts: 66.159.20.52 www32.smutserver.com
O1 - Hosts: 66.159.20.52 agreathost.net
O1 - Hosts: 66.159.20.52 www.agreathost.net
O1 - Hosts: 66.159.20.52 hotfreehost.com
O1 - Hosts: 66.159.20.52 www.hotfreehost.com
O1 - Hosts: 66.159.20.52 greatfreehost.com
O1 - Hosts: 66.159.20.52 www.greatfreehost.com
O1 - Hosts: 66.159.20.52 freesmutpages.com
O1 - Hosts: 66.159.20.52 www.freesmutpages.com
O1 - Hosts: 66.159.20.52 apornhost.com
O1 - Hosts: 66.159.20.52 www.apornhost.com
O1 - Hosts: 66.159.20.52 nasty-pages.com
O1 - Hosts: 66.159.20.52 www.nasty-pages.com
O1 - Hosts: 66.159.20.52 sexyfreehost.com
O1 - Hosts: 66.159.20.52 www.sexyfreehost.com
O1 - Hosts: 66.159.20.52 x4web.com
O1 - Hosts: 66.159.20.52 www.x4web.com
O1 - Hosts: 66.159.20.52 sexplanets.com
O1 - Hosts: 66.159.20.52 www.sexplanets.com
O1 - Hosts: 66.159.20.52 maxismut.com
O1 - Hosts: 66.159.20.52 www.maxismut.com
O1 - Hosts: 66.159.20.52 tgpfriendly.com
O1 - Hosts: 66.159.20.52 www.tgpfriendly.com
O1 - Hosts: 66.159.20.52 tgp-server.com
O1 - Hosts: 66.159.20.52 www.tgp-server.com
O1 - Hosts: 66.159.20.52 magnaplza.com
O1 - Hosts: 66.159.20.52 www.magnaplza.com
O1 - Hosts: 66.159.20.52 free-xxx-server.com
O1 - Hosts: 66.159.20.52 www.free-xxx-server.com
O1 - Hosts: 66.159.20.52 libereco.net
O1 - Hosts: 66.159.20.52 www.libereco.net
O1 - Hosts: 66.159.20.52 0190-dialer.com
O1 - Hosts: 66.159.20.52 www.0190-dialer.com
O1 - Hosts: 66.159.20.52 xxxod.net
O1 - Hosts: 66.159.20.52 www.xxxod.net
O1 - Hosts: 66.159.20.52 altsights.com
O1 - Hosts: 66.159.20.52 www.altsights.com
O1 - Hosts: 66.159.20.52 adulthosting.com
O1 - Hosts: 66.159.20.52 www.adulthosting.com
O1 - Hosts: 66.159.20.52 superhova.com
O1 - Hosts: 66.159.20.52 www.superhova.com
O1 - Hosts: 66.159.20.52 bestpornhost.com
O1 - Hosts: 66.159.20.52 www.bestpornhost.com
O1 - Hosts: 66.159.20.52 hostingfree.com
O1 - Hosts: 66.159.20.52 www.hostingfree.com
O1 - Hosts: 66.159.20.52 xfreehosting.com
O1 - Hosts: 66.159.20.52 www.xfreehosting.com
O1 - Hosts: 66.159.20.52 blinghosting.com
O1 - Hosts: 66.159.20.52 www.blinghosting.com
O1 - Hosts: 66.159.20.52 x-x-x-hosting.com
O1 - Hosts: 66.159.20.52 www.x-x-x-hosting.com
O1 - Hosts: 66.159.20.52 pornparks.com
O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS\twaintec.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\WINDOWS\Downloaded Program Files\ycomp5_1_6_0.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3EAA3D22-E415-5FB2-8757-6D550FA22D17} - C:\WINDOWS\System32\pjce.dll (file missing)
O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:\WINDOWS\2_0_1browserhelper2.dll
O2 - BHO: (no name) - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - C:\WINDOWS\Downloaded Program Files\bridge.dll (file missing)
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - D:\Programme\Norton AntiVirus\NavShExt.dll
O2 - BHO: Url Catcher - {CE31A1F7-3D90-4874-8FBE-A5D97F8BC8F1} - C:\WINDOWS\System32\apuc.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Assistent - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\WINDOWS\Downloaded Program Files\ycomp5_1_6_0.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [XTNDConnect PC - ErPhn2] C:\PROGRA~1\GEMEIN~1\XCPCSync\TRANSL~1\ErPhn2\ErTray.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Programme\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] D:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [Microsoft Update Machine] winupdt.exe
O4 - HKLM\..\Run: [Microsoft Java Windows Update] krpxcu.exe
O4 - HKLM\..\Run: [Microsoft Update 1Machine1] wuamgrd65.exe
O4 - HKLM\..\Run: [WindowsRegKey%update] ethernet32m.exe
O4 - HKLM\..\Run: [Microsoft Update] muamgrd.exe
O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\Downloaded Program Files\bridge.dll",Load
O4 - HKLM\..\Run: [IST Service] C:\Programme\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [Microsoft Update Agent ] wupdclt32.exe
O4 - HKLM\..\Run: [kpdsovybknnnq] C:\WINDOWS\System32\wiigma.exe
O4 - HKLM\..\Run: [alchem] C:\WINDOWS\alchem.exe
O4 - HKLM\..\Run: [Microsoft Service Host] svchost2.exe
O4 - HKLM\..\Run: [Config33.exe] Config33.exe
O4 - HKLM\..\Run: [msbb] c:\dokume~1\Ars..*patsch*\lokale~1\temp\msbb.exe
O4 - HKLM\..\Run: [knox] C:\WINDOWS\knox.exe
O4 - HKLM\..\Run: [CashBack] C:\Programme\CashBack\bin\cashback.exe
O4 - HKLM\..\Run: [NaviSearch] C:\Programme\NaviSearch\bin\nls.exe
O4 - HKLM\..\Run: [BullsEye Network] C:\Programme\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [Windows SA] C:\Program Files\WindowsSA\omniscient.exe
O4 - HKLM\..\Run: [Windows Update] wamgrd.exe
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Microsoft Update Machine] winupdt.exe
O4 - HKLM\..\RunServices: [Microsoft Java Windows Update] krpxcu.exe
O4 - HKLM\..\RunServices: [Microsoft Update 1Machine1] wuamgrd65.exe
O4 - HKLM\..\RunServices: [WindowsRegKey%update] ethernet32m.exe
O4 - HKLM\..\RunServices: [Microsoft Update] muamgrd.exe
O4 - HKLM\..\RunServices: [Microsoft Update Agent ] wupdclt32.exe
O4 - HKLM\..\RunServices: [Microsoft Service Host] svchost2.exe
O4 - HKLM\..\RunServices: [Config33.exe] Config33.exe
O4 - HKLM\..\RunServices: [Windows Update] wamgrd.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Programme\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [Microsoft Update Machine] winupdt.exe
O4 - HKCU\..\Run: [Microsoft Java Windows Update] krpxcu.exe
O4 - HKCU\..\Run: [Microsoft Update 1Machine1] wuamgrd65.exe
O4 - HKCU\..\Run: [WindowsRegKey%update] ethernet32m.exe
O4 - HKCU\..\Run: [Microsoft Update] muamgrd.exe
O4 - HKCU\..\Run: [Shed] C:\Dokumente und Einstellungen\Ars..*patsch*\Anwendungsdaten\uume.exe
O4 - HKCU\..\Run: [Dgkcfcki] C:\WINDOWS\System32\agq.exe
O4 - HKCU\..\Run: [Microsoft Service Host] svchost2.exe
O4 - HKCU\..\Run: [Windows Update] wamgrd.exe
O8 - Extra context menu item: &Google Search - res://C:\Programme\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Im Cache gespeicherte Seite - res://C:\Programme\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Verweisseiten - res://C:\Programme\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Ähnliche Seiten - res://C:\Programme\Google\GoogleToolbar1.dll/cmsimilar.html
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: {00000000-CDDC-0704-0B53-2C8830E9FAEC} (IELoaderCtl Class) - http://install.global-netcom.de/ieloader.cab
O16 - DPF: {386A771C-E96A-421F-8BA7-32F1B706892F} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares/v4.0/0006_regular.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/196572fe3724a5359217/netzip/RdxIE601_de.cab
O16 - DPF: {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} (brdg Class) - http://static.flingstone.com/cab/2000XP/CDTInc/bridge.cab
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E0B795B4-FD95-4ABD-A375-27962EFCE8CF} (StarInstall Control) - http://www.stardialer.de/install/StarInstall.ocx
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Assistent) - http://us.dl1.yimg.com/download.companion.yahoo.com/dl/toolbar/yiebio5_1_6_0.cab

DANKE

#2 Dann würde ich schnellstens formatieren, danach alle Updates aufspielen.
Zum Schluss Foren zum sichern Surfen durchlesen.
__________
°<- Vorsicht Trollköder und Trollfalle -> {_}

#3 von @Cidre
Nach dem Neuaufsetzen deines Systems und vor, ich betone vor, der ersten Interntet Verbindung folgende Punkte abarbeiten:

1. Eingeschränktes Benutzerkonto erstellen
2. Interne Verbindungsfirewall aktivieren http://www.computerhilfe-euski...ipp16.html
3. NT- Dienste sicher konfigurieren http://www.ntsvcfg.de/
4. dein System updaten http://v4.windowsupdate.micros...efault.asp
5. Deine Passwörter ändern
6. IE sicherer konfigurieren http://www.datenschutzzentrum....config.htm
oder Browserwechsel wie z.B. Mozilla oder Firefox
7. Image deiner Systempartition erstellen
8. Surfverhalten überdenken

mfg
Sabina
__________
MfG Sabina

rund um die PC-Sicherheit

#4 Völlig richtig, nur würde ich die Reihenfolge etwas abändern:

Interne Verbindungsfirewall aktivieren http://www.computerhilfe-euski...ipp16.html

dein System updaten http://v4.windowsupdate.micros...efault.asp

NT- Dienste sicher konfigurieren http://www.ntsvcfg.de/

Eingeschränktes Benutzerkonto erstellen

IE sicherer konfigurieren http://www.datenschutzzentrum....config.htm
oder Browserwechsel wie z.B. Mozilla oder Firefox

Deine Passwörter ändern