Spyaxe bitte checkt mal meine hijackthis log

#1 hi,

bin anscheinend auch von spyaxe infiziert. meine browser seite wechselt immer auf wewewe.updateyoursystem.com (der roteball mit dem kreuz erscheint allerdings nicht mehr, nachdem ich spyaxefix ausgeführt habe)

Logfile of HijackThis v1.99.0
Scan saved at 12:10:37, on 04.12.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\EDS\License Servers\UGNXFLEXlm\lmgrd.exe
C:\Programme\EDS\License Servers\UGNXFLEXlm\uglmd.exe
C:\WINDOWS\System32\alg.exe
C:\Programme\Spyware Doctor\sdhelp.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\QuickTime\qttask.exe
C:\Programme\Logitech\iTouch\iTouch.exe
C:\WINDOWS\system32\asycfilt.exe
C:\Programme\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\MSN Messenger\MsnMsgr.Exe
C:\Programme\Spyware Doctor\swdoctor.exe
C:\Programme\hp\Digital Imaging\bin\hpqtra08.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\system32\nvctrl.exe
C:\WINDOWS\system32\mssearchnet.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Programme\WinRAR\WinRAR.exe
C:\DOKUME~1\Martin\LOKALE~1\Temp\Rar$EX00.516\HijackThis.exe

R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Programme\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL (file missing)
O2 - BHO: HomepageBHO - {3e9b951e-6f72-431b-82cf-4a9fbf2f53bc} - C:\WINDOWS\system32\hp58E7.tmp
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programme\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [204fd562af9b] C:\WINDOWS\system32\asycfilt.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Programme\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Jet Detection] C:\Programme\Creative\SBAudigy\PROGRAM\ADGJDet.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DVDXGhost] C:\Programme\DVD X Studios\DVD X Utilities 1.5\DVDGhost\DVDGhost.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Programme\Spyware Doctor\swdoctor.exe" /Q
O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Programme\MyWebSearch\bar\2.bin\MWSOEMON.EXE
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programme\hp\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Schnellstart.lnk = C:\Programme\hp\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programme\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Frontpage\Office\OSA9.EXE
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Programme\MyWebSearch\bar\2.bin\MWSOEMON.EXE
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZSzeb029YYCH_ZNxdm745YYCH
O9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\system32\maxspeed.exe (file missing)
O9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\system32\maxspeed.exe (file missing)
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: http://*.billingnow.com
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: http://*.reliablestats.com
O15 - Trusted Zone: http://*.winantispyware.com
O15 - Trusted Zone: http://*.winantivirus.com
O15 - Trusted Zone: http://*.winantiviruspro.com
O15 - Trusted Zone: http://*.winfixer.com
O15 - Trusted Zone: http://*.winnanny.com
O15 - Trusted Zone: http://*.winsoftware.com
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O15 - Trusted IP range: (HKLM)
O16 - DPF: {11111111-1111-1111-1111-111111113457} - file://c:\ied_s7.cab
O16 - DPF: {11111111-1111-1111-1111-511111113457} - file://c:\x.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.15.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1102954829920
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C47D4B63-F208-4579-9C06-1BCEA5F97DF2}: NameServer = 172.22.1.2
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: avast! iAVS4 Control Service - Unknown - C:\Programme\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown - C:\Programme\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programme\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programme\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sandra Data Service - SiSoftware - C:\Programme\SiSoftware\SiSoftware Sandra Lite 2005.SR1\RpcDataSrv.exe
O23 - Service: Sandra Service - SiSoftware - C:\Programme\SiSoftware\SiSoftware Sandra Lite 2005.SR1\RpcSandraSrv.exe
O23 - Service: PC Tools Spyware Doctor - Unknown - C:\Programme\Spyware Doctor\sdhelp.exe
O23 - Service: Windows User Mode Driver Framework - Unknown - C:\WINDOWS\System32\wdfmgr.exe (file missing)
O23 - Service: Unigraphics License Server (uglmd) - Macrovision Corporation - C:\Programme\EDS\License Servers\UGNXFLEXlm\lmgrd.exe
O23 - Service: Remote Procedure Call (RPC) Helper - Unknown - C:\WINDOWS\system32\ipzq.exe (file missing)


Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: FCD8-88DF

Verzeichnis von C:\WINDOWS\system32

04.12.2005 11:31 5'384 ncompat.tlb
04.12.2005 11:24 5'632 msvol.tlb
04.12.2005 11:24 20'480 hp58E7.tmp
04.12.2005 11:23 28'886 nvapps.xml
04.12.2005 11:23 24'064 ld1391.tmp
04.12.2005 11:23 20'480 hp1362.tmp
04.12.2005 11:15 20'480 hp21EF.tmp
04.12.2005 10:51 24'064 ld6F30.tmp
04.12.2005 10:51 20'480 hp6DE7.tmp
04.12.2005 10:50 97 LMGRD.LOG
04.12.2005 00:49 384 DVCStateBkp-{00000000-00000000-00000009-00001102-00000004-00531102}.dat
04.12.2005 00:49 1'080 settings.sfm
04.12.2005 00:49 384 DVCState-{00000000-00000000-00000009-00001102-00000004-00531102}.dat
04.12.2005 00:49 1'080 settingsbkup.sfm
04.12.2005 00:49 28'968 BMXBkpCtrlState-{00000000-00000000-00000009-00001102-00000004-00531102}.rfx
04.12.2005 00:49 28'968 BMXCtrlState-{00000000-00000000-00000009-00001102-00000004-00531102}.rfx
04.12.2005 00:49 31'656 BMXState-{00000000-00000000-00000009-00001102-00000004-00531102}.rfx
04.12.2005 00:49 31'656 BMXStateBkp-{00000000-00000000-00000009-00001102-00000004-00531102}.rfx
03.12.2005 23:36 2 stera.job
03.12.2005 23:36 2 stera.log
03.12.2005 18:57 70'144 st3.dll
03.12.2005 18:53 4'286 ts.ico
03.12.2005 18:53 4'286 ot.ico
03.12.2005 18:53 9'728 mssearchnet.exe
03.12.2005 18:53 13'964 nvctrl.exe
03.12.2005 18:51 14'568 mscornet.exe
02.12.2005 23:34 13'002 wpa.dbl
13.11.2005 18:52 199'344 FNTCACHE.DAT
02.11.2005 06:34 2'377'568 MRT.exe
30.10.2005 10:22 391'000 perfh007.dat
30.10.2005 10:22 63'580 perfc007.dat
30.10.2005 10:22 52'764 perfc009.dat
30.10.2005 10:22 380'350 perfh009.dat
30.10.2005 10:22 897'954 PerfStringBackup.INI
16.10.2005 00:13 1'126 qtplugin.log
13.10.2005 00:11 118'784 sirenacm.dll
06.10.2005 04:18 280'064 gdi32.dll
06.10.2005 04:08 1'839'616 win32k.sys
04.10.2005 20:41 28'672 f3PSSavr.scr
04.10.2005 16:26 3'013'120 mshtml.dll
23.09.2005 04:06 8'491'520 shell32.dll
10.09.2005 02:54 2'067'968 cdosys.dll
03.09.2005 00:53 664'064 wininet.dll
03.09.2005 00:53 474'112 shlwapi.dll
03.09.2005 00:53 605'696 urlmon.dll
03.09.2005 00:53 1'484'288 shdocvw.dll
03.09.2005 00:53 251'392 iepeers.dll
03.09.2005 00:53 530'432 mstime.dll
03.09.2005 00:53 146'432 msrating.dll
03.09.2005 00:53 55'808 extmgr.dll
03.09.2005 00:53 96'768 inseng.dll
03.09.2005 00:53 39'424 pngfilt.dll
03.09.2005 00:53 205'312 dxtrans.dll
03.09.2005 00:53 448'512 mshtmled.dll
03.09.2005 00:53 152'064 cdfview.dll
03.09.2005 00:53 1'019'904 browseui.dll
03.09.2005 00:53 1'055'744 danim.dll
01.09.2005 02:44 292'352 winsrv.dll
01.09.2005 02:44 19'968 linkinfo.dll


Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: FCD8-88DF

Verzeichnis von C:\DOKUME~1\Martin\LOKALE~1\Temp

04.12.2005 11:24 16'384 ~DF9C16.tmp
04.12.2005 11:24 1'430 MARE.tmp
04.12.2005 11:23 13'344 hpodvd09.log
27.11.2005 20:43 98 DFC5A2B2.TMP
4 Datei(en) 31'256 Bytes
0 Verzeichnis(se), 1'989'324'800 Bytes frei


Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: FCD8-88DF

Verzeichnis von C:\WINDOWS

04.12.2005 11:01 186'514 setupapi.log
04.12.2005 11:00 192 winamp.ini
04.12.2005 10:51 0 0.log
04.12.2005 10:50 1'382'738 WindowsUpdate.log
04.12.2005 10:50 159 wiadebug.log
04.12.2005 10:50 50 wiaservc.log
04.12.2005 10:50 2'048 bootstat.dat
04.12.2005 00:49 32'568 SchedLgU.Txt
03.12.2005 18:57 71'168 adsldpbe.dll
03.12.2005 18:53 13'824 q15232953.dll
01.12.2005 22:29 1'409 QTFont.for
01.12.2005 22:29 54'156 QTFont.qfn
16.11.2005 22:14 2'068 vminst.log
13.11.2005 22:08 158 matlab.ini
10.11.2005 22:56 567'846 iis6.log
10.11.2005 22:56 95'298 ntdtcsetup.log
10.11.2005 22:56 157'086 comsetup.log
10.11.2005 22:56 1'393 imsins.log
10.11.2005 22:56 15'367 tabletoc.log
10.11.2005 22:56 209'926 tsoc.log
10.11.2005 22:56 22'476 ocmsn.log
10.11.2005 22:56 11'807 KB896424.log
10.11.2005 22:56 53'375 netfxocm.log
10.11.2005 22:56 216'379 ocgen.log
10.11.2005 22:56 22'668 msgsocm.log
10.11.2005 22:56 22'688 medctroc.Log
10.11.2005 22:56 442'984 FaxSetup.log
10.11.2005 22:56 147'940 msmqinst.log
10.11.2005 22:56 0 setuperr.log
10.11.2005 22:56 21'280 updspapi.log
05.11.2005 18:44 77'523 wmsetup.log
30.10.2005 12:48 180'187 setupact.log
18.10.2005 22:16 21'169 KB901017.log
18.10.2005 22:16 23'417 KB902400.log
18.10.2005 22:15 14'029 KB896688.log
18.10.2005 22:15 13'390 KB899589.log
18.10.2005 22:15 13'706 KB905414.log
18.10.2005 22:15 13'497 KB900725.log
18.10.2005 22:15 11'334 KB904706.log
18.10.2005 22:15 11'966 KB905749.log

Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: FCD8-88DF

Verzeichnis von C:\

04.12.2005 11:35 0 sys.txt
04.12.2005 11:34 10'546 system.txt
04.12.2005 11:34 439 systemtemp.txt
04.12.2005 11:33 108'355 system32.txt
05.11.2005 19:28 97 RTSPNetSrc.log
20.06.2005 23:19 0 cdio.log
28.05.2005 11:44 211 boot.ini
15.04.2005 19:10 405 mmcInst.log
08.04.2005 08:46 85'028 MALog.txt
21.12.2004 13:15 47'564 NTDETECT.COM
21.12.2004 13:15 251'184 ntldr
21.12.2004 11:43 75 LuResult.txt
13.12.2004 16:19 0 IO.SYS
13.12.2004 16:19 0 AUTOEXEC.BAT
13.12.2004 16:19 0 MSDOS.SYS
13.12.2004 16:19 0 CONFIG.SYS
18.08.2001 13:00 4'952 bootfont.bin
17 Datei(en) 508'856 Bytes
0 Verzeichnis(se), 1'989'308'416 Bytes frei