Trojaner scan - hier ein log

#1 Ich habe vermutlich einen TRojaner geladen, habe mit hickjack this gescannt, wie bekomme ich den trojaner vom Rechner, hier der log

Logfile of HijackThis v1.99.1
Scan saved at 06:56:22, on 06.07.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Ahead\InCD\InCD.exe
C:\Programme\F-Secure Anti-Virus 2004 - WEB.DE Edition\Common\FSM32.EXE
C:\Programme\Java\jre1.5.0_02\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Dokumente und Einstellungen\Anja\Anwendungsdaten\h?yrf?.exe
C:\Programme\VIA Technologies, Inc\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe
C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\PROGRA~1\F-SECU~1.DEE\backweb\154149\Program\SERVIC~1.EXE
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Programme\F-Secure Anti-Virus 2004 - WEB.DE Edition\Anti-Virus\fsgk32st.exe
C:\Programme\F-Secure Anti-Virus 2004 - WEB.DE Edition\backweb\154149\program\fsbwsys.exe
C:\Programme\F-Secure Anti-Virus 2004 - WEB.DE Edition\Anti-Virus\FSGK32.EXE
C:\Programme\F-Secure Anti-Virus 2004 - WEB.DE Edition\backweb\154149\Program\BackWeb-154149.exe
C:\Programme\F-Secure Anti-Virus 2004 - WEB.DE Edition\Common\FSMA32.EXE
C:\Programme\F-Secure Anti-Virus 2004 - WEB.DE Edition\Anti-Virus\fssm32.exe
C:\Programme\F-Secure Anti-Virus 2004 - WEB.DE Edition\fswsclds.exe
C:\Programme\F-Secure Anti-Virus 2004 - WEB.DE Edition\Common\FSMB32.EXE
C:\WINDOWS\system32\slserv.exe
C:\Programme\F-Secure Anti-Virus 2004 - WEB.DE Edition\Common\FCH32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Programme\F-Secure Anti-Virus 2004 - WEB.DE Edition\Common\FAMEH32.EXE
C:\Programme\F-Secure Anti-Virus 2004 - WEB.DE Edition\Anti-Virus\fsav32.exe
C:\Programme\F-Secure Anti-Virus 2004 - WEB.DE Edition\FWES\Program\fsdfwd.exe
C:\PROGRA~1\Versatel\Versatel.exe
C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\DOKUME~1\Anja\LOKALE~1\Temp\Temporäres Verzeichnis 1 für hijackthis_199[1].zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\System32\SearchBar.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://de.my.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.versatel.de/internet-cd/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.versatel.de/internet-cd/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer von Versatel
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn0\ycomp5_6_2_0.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn0\ycomp5_6_2_0.dll
O4 - HKLM\..\Run: [InCD] C:\Programme\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [ati control panel] atiphexx.exe
O4 - HKLM\..\Run: [slvchost] slvchost32.exe
O4 - HKLM\..\Run: [WindowsRegKeys update] winsysi.exe
O4 - HKLM\..\Run: [Sysino] lsess.exe
O4 - HKLM\..\Run: [Microsoft Services] lssrv.exe
O4 - HKLM\..\Run: [Win32 System Spool] spoolsvc.exe
O4 - HKLM\..\Run: [uFr] C:\windows\temp\uFr.exe
O4 - HKLM\..\Run: [XML Service] msxml.exe
O4 - HKLM\..\Run: [Win32 Configuration] videosd32.exe
O4 - HKLM\..\Run: [iWD9RqXr] C:\windows\temp\iWD9RqXr.exe
O4 - HKLM\..\Run: [Dsi] C:\WINDOWS\System32\dp-him.exe
O4 - HKLM\..\Run: [RunWindowsUpdate] C:\WINDOWS\uptodate.exe
O4 - HKLM\..\Run: [52D8AG842K5G#A] C:\WINDOWS\System32\Kmt3.exe
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [Media Player] wmplayer.exe
O4 - HKLM\..\Run: [starter] scvhosting.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Programme\F-Secure Anti-Virus 2004 - WEB.DE Edition\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Programme\F-Secure Anti-Virus 2004 - WEB.DE Edition\TNB\TNBUtil.exe" /CHECKALL
O4 - HKLM\..\Run: [rQ2UhO1xb] C:\windows\rQ2UhO1xb.exe
O4 - HKLM\..\Run: [Vix] C:\windows\Vix.exe
O4 - HKLM\..\Run: [SFnGV.exe] c:\windows\system32\SFnGV.exe
O4 - HKLM\..\Run: [iAyZU] C:\windows\system32\iAyZU.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe
O4 - HKLM\..\RunServices: [ati control panel] atiphexx.exe
O4 - HKLM\..\RunServices: [slvchost] slvchost32.exe
O4 - HKLM\..\RunServices: [WindowsRegKeys update] winsysi.exe
O4 - HKLM\..\RunServices: [Sysino] lsess.exe
O4 - HKLM\..\RunServices: [Microsoft Services] lssrv.exe
O4 - HKLM\..\RunServices: [Win32 System Spool] spoolsvc.exe
O4 - HKLM\..\RunServices: [XML Service] msxml.exe
O4 - HKLM\..\RunServices: [Win32 Configuration] videosd32.exe
O4 - HKLM\..\RunServices: [Media Player] wmplayer.exe
O4 - HKLM\..\RunServices: [starter] scvhosting.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Sysino] lsess.exe
O4 - HKCU\..\Run: [ati control panel] atiphexx.exe
O4 - HKCU\..\Run: [WindowsRegKeys update] winsysi.exe
O4 - HKCU\..\Run: [Win32 System Spool] spoolsvc.exe
O4 - HKCU\..\Run: [Win32 Configuration] videosd32.exe
O4 - HKCU\..\Run: [starter] scvhosting.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Programme\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [Rsae] C:\Dokumente und Einstellungen\Anja\Anwendungsdaten\h?yrf?.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AudioDeck.lnk = C:\Programme\VIA Technologies, Inc\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\ms.exe (file missing)
O9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\ms.exe (file missing)
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Programme\Yahoo!\Messenger\yhexbmesde.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Programme\Yahoo!\Messenger\yhexbmesde.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.versatel.de/internet-cd/
O16 - DPF: {0EB73E39-8AD4-43E8-8FBA-0165C2CCDB8B} (GameControl Class) - http://turnier.freenet.de/midasa.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Programme\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {59136DB4-6CA3-4B40-8F2F-BBF84B6F1E91} (Attachment Upload Control) - https://img.web.de/v/mail/activex/mail_upload_1123.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{15F7CFF8-D303-4C11-982E-71EAE607EF7B}: NameServer = 62.72.64.237 62.72.64.241
O17 - HKLM\System\CS1\Services\Tcpip\..\{15F7CFF8-D303-4C11-982E-71EAE607EF7B}: NameServer = 62.72.64.237 62.72.64.241
O23 - Service: F-Secure Anti-Virus 2004 - WEB.DE Edition (BackWeb Client - 154149) - Unknown owner - C:\PROGRA~1\F-SECU~1.DEE\backweb\154149\Program\SERVIC~1.EXE
O23 - Service: Boonty Games - BOONTY - C:\Programme\Gemeinsame Dateien\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Programme\F-Secure Anti-Virus 2004 - WEB.DE Edition\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Programme\F-Secure Anti-Virus 2004 - WEB.DE Edition\backweb\154149\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Programme\F-Secure Anti-Virus 2004 - WEB.DE Edition\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Programme\F-Secure Anti-Virus 2004 - WEB.DE Edition\Common\FSMA32.EXE
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Programme\F-Secure Anti-Virus 2004 - WEB.DE Edition\fswsclds.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

Vielen dank

#2 Hallo Joern,

Zitat

Ich habe vermutlich einen TRojaner geladen ...

Das ist leider leicht untertrieben!
Dein Rechner ist der wahre Viren-Zoo, mit mehreren Backdoors als Prachtstücke (und das in schöner Eintracht neben F-Secure Antivir!).
Ich würde Dir empfehlen, den Rechner sofort vom Netz zu nehmen und das System neu aufzusetzen. Tipps dazu findest Du hier im Board.

Gruß
Heron
__________
"Die Welt ist groß, weil der Kopf so klein"
Wilhelm Busch