Problem mit Popups und Spyware

#1 Hallo ich habe ein starkes Problem mit Spyware und anderen diversen Viren ...ich hab mal hier den HijackThis Log und hoffe ihr kennt euch besser damit aus und könnt mir evtl helfen =(

z.b hab ich auch das Problem dass sobald ich ins I-net gehe sich im sekundentackt irgentwelche werbeseiten oder so was öffnen ...


Logfile of HijackThis v1.99.1
Scan saved at 13:11:09, on 10.02.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\PSupport\psupport.exe
C:\WINDOWS\wt\updater\wcmdmgr.exe
C:\WINDOWS\ymembbsA.exe
C:\Programme\Gemeinsame Dateien\AOL\1157121461\ee\AOLSoftware.exe
C:\Programme\Gemeinsame Dateien\G DATA\AVKMail\AVKPOP.EXE
C:\WINDOWS\$NtUninstallKB925454$\sikoqe.exe
C:\Programme\Gadwin Systems\PrintScreen\PrintScreen.exe
C:\Programme\AOL 9.0a\waol.exe
C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLacsd.exe
C:\Programme\AOL 9.0a\shellmon.exe
C:\Programme\Gemeinsame Dateien\Aol\aoltpspd.exe
C:\Programme\Exolon\Exolon.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Winamp\winamp.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Dokumente und Einstellungen\OSTI.GABRIELE\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.the-exit.com/search
R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - C:\Programme\DeluxeCommunications\DxcBho.dll
O2 - BHO: Web Assistant - {04DCB17C-AB45-83AD-A86A-6DFB90277939} - C:\Programme\PSupport\plibrary.dll
O2 - BHO: (no name) - {219F3FD3-7108-486D-9CF6-2694CF2666D7} - C:\Programme\Movie Maker\hocep.dll (file missing)
O2 - BHO: (no name) - {4A57AA7C-9CA1-46EF-A5C5-53C49FA0528D} - C:\DOKUME~1\OSTI~1.GAB\ANWEND~1\SENDFO~1\mix stupid.exe (file missing)
O2 - BHO: CFG32S - {7564B020-44E8-4c9b-A887-C6EC41AC67DA} - C:\WINDOWS\cfg32r.dll (file missing)
O2 - BHO: Mirar - {9A9C9B69-F908-4AAB-8D0C-10EA8997F37E} - C:\WINDOWS\system32\WinNB69.dll
O2 - BHO: Jffdjljo Class - {A16AC1F4-BCA7-4401-B5F5-22240F78E776} - C:\WINDOWS\system32\p2jlseh8.dll (file missing)
O2 - BHO: Scaggy Insert - {C68AE9C0-0909-4DDC-B661-C1AFB9F59898} - C:\WINDOWS\cfg32o.dll (file missing)
O3 - Toolbar: My EmailEmoticons Toolbar - {D5A5A2C7-7C4C-4a60-B507-B62932CE6ADD} - C:\Dokumente und Einstellungen\OSTI.GABRIELE\Desktop\My Email Emoticons Toolbar\toolbar.dll (file missing)
O3 - Toolbar: Search - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\WINDOWS\cfg32s.dll (file missing)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: Mirar - {9A9C9B68-F908-4AAB-8D0C-10EA8997F37E} - C:\WINDOWS\system32\WinNB69.dll
O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [aaa00000] RUNDLL32.EXE aaa000002c.dll,n 000000000000001d
O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\system32\pwinkoea.exe SKY001
O4 - HKLM\..\Run: [ymembbsA] C:\WINDOWS\ymembbsA.exe
O4 - HKLM\..\Run: [DeluxeCommunications] C:\Programme\DeluxeCommunications\Dxc.exe
O4 - HKLM\..\Run: [HostManager] C:\Programme\Gemeinsame Dateien\AOL\1157121461\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IPHSend] C:\Programme\Gemeinsame Dateien\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [{4E-EB-B9-90-ZN}] c:\windows\system32\njdsregk.exe SKY001
O4 - HKLM\..\Run: [AVK Mail Checker] "C:\Programme\Gemeinsame Dateien\G DATA\AVKMail\AVKPOP.EXE"
O4 - HKLM\..\Run: [sikoqe] C:\WINDOWS\$NtUninstallKB925454$\sikoqe.exe
O4 - HKLM\..\RunServices: [p2pnetworking] p2pnetworking.exe
O4 - HKCU\..\Run: [Gadwin PrintScreen 3.1] C:\Programme\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash
O4 - HKCU\..\Run: [DeluxeCommunications] C:\Programme\DeluxeCommunications\Dxc.exe
O4 - Startup: Think-Adz.lnk = C:\WINDOWS\system32\pwinkoea.exe
O8 - Extra context menu item: >>> FREE PORN GALLERIES <<< - javascript:{document.location='http://sexmaxx.com/freegalleries.htm';}
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'c:\programme\newdotnet\newdotnet6_38.dll' missing
O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://click.getmirar.com (HKLM)
O15 - Trusted Zone: http://click.mirarsearch.com (HKLM)
O15 - Trusted Zone: http://redirect.mirarsearch.com (HKLM)
O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {0EB73E39-8AD4-43E8-8FBA-0165C2CCDB8B} (GameControl Class) - http://www.midasplayer.com/midasa.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.15.cab
O16 - DPF: {266B9238-31A5-4B53-9039-272FE846DF9D} (DiameterTransfer Control) - http://www.sis.com/download/SISTransfer.cab
O16 - DPF: {26FCCDF9-A7E1-452A-A73D-7BF7B4D0BA6C} (AOL Pictures Uploader Class) - http://o.aolcdn.com/pictures/ap/Resources/2.2.0.51g/cab/aolpPlugins.10.4.0.2.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {29D73455-3ADA-49BB-9067-44822F6728F5} - http://www.joga.com/activex/uploadactx.cab
O16 - DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} (king.com) - http://www.king.com/ctl/kingcomie.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} - http://aolcc.aol.de/computercheckup/qdiagcc.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1128628224524
O16 - DPF: {8B1BC605-C593-4865-8F5B-05517F0CD0BB} (MSSecurityAdvisorCD Class) - file://D:\Content\include\msSecUcd.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {92E7E45A-D8C8-480E-AF99-176E43997CAA} (Aurigma Image Uploader 3.5 Combo Control) - http://www.pixdiscount.de/clients/ImageUploader3.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://ak.imgag.com/imgag/cp/install/Crusher.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2BDB8398-72F5-499D-87CA-B2B0A2EBC251}: NameServer = 85.237.87.173,84.16.240.135
O17 - HKLM\System\CCS\Services\Tcpip\..\{3DBE1CB7-E3D1-4E7C-9C69-AF3FD655F763}: NameServer = 85.237.87.173,84.16.240.135
O17 - HKLM\System\CCS\Services\Tcpip\..\{41F9DD51-1100-4373-8455-D1191EAC8CA8}: NameServer = 85.237.87.173,84.16.240.135
O17 - HKLM\System\CCS\Services\Tcpip\..\{731AC1FC-B05B-4E20-9BF0-ADFE1A9079B0}: NameServer = 85.237.87.173,84.16.240.135
O17 - HKLM\System\CCS\Services\Tcpip\..\{87E99475-D0A1-41CE-9A0C-8E2D056AAE6E}: NameServer = 205.188.146.145
O17 - HKLM\System\CCS\Services\Tcpip\..\{E605E7D1-9C9A-4789-88F2-E22D0D0BAFBA}: NameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2028F2E-B1CD-46F5-9747-5242E6FC04CB}: NameServer = 85.237.87.173,84.16.240.135
O17 - HKLM\System\CS1\Services\Tcpip\..\{2BDB8398-72F5-499D-87CA-B2B0A2EBC251}: NameServer = 85.237.87.173,84.16.240.135
O17 - HKLM\System\CS2\Services\Tcpip\..\{2BDB8398-72F5-499D-87CA-B2B0A2EBC251}: NameServer = 85.237.87.173,84.16.240.135
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter: text/html - {994D478A-45D0-4DB4-AE28-738B1E346F99} - C:\Programme\Exolon\Exolon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Net Agent - Unknown owner - C:\WINDOWS\dls0523pmw.exe

#2 raftosti

««
LSPfix
http://www.spychecker.com/program/lspfix.html
Anschließend auf den 'Finished' Button klicken. - Danach bitte den Rechner neu starten.

««
öffne das HijackThis -- Button "scan" -- vor diese Einträge Häkchen setzen -- Button "Fix checked"

Zitat

R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - C:\Programme\DeluxeCommunications\DxcBho.dll

O2 - BHO: Web Assistant - {04DCB17C-AB45-83AD-A86A-6DFB90277939} - C:\Programme\PSupport\plibrary.dll

O2 - BHO: (no name) - {219F3FD3-7108-486D-9CF6-2694CF2666D7} - C:\Programme\Movie Maker\hocep.dll (file missing)

O2 - BHO: (no name) - {4A57AA7C-9CA1-46EF-A5C5-53C49FA0528D} - C:\DOKUME~1\OSTI~1.GAB\ANWEND~1\SENDFO~1\mix stupid.exe (file missing)

O2 - BHO: CFG32S - {7564B020-44E8-4c9b-A887-C6EC41AC67DA} - C:\WINDOWS\cfg32r.dll (file missing)

O2 - BHO: Mirar - {9A9C9B69-F908-4AAB-8D0C-10EA8997F37E} - C:\WINDOWS\system32\WinNB69.dll

O2 - BHO: Jffdjljo Class - {A16AC1F4-BCA7-4401-B5F5-22240F78E776} - C:\WINDOWS\system32\p2jlseh8.dll (file missing)

O2 - BHO: Scaggy Insert - {C68AE9C0-0909-4DDC-B661-C1AFB9F59898} - C:\WINDOWS\cfg32o.dll (file missing)

O3 - Toolbar: My EmailEmoticons Toolbar - {D5A5A2C7-7C4C-4a60-B507-B62932CE6ADD} - C:\Dokumente und Einstellungen\OSTI.GABRIELE\Desktop\My Email Emoticons Toolbar\toolbar.dll
(file missing)

O3 - Toolbar: Search - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\WINDOWS\cfg32s.dll (file missing)

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

O3 - Toolbar: Mirar - {9A9C9B68-F908-4AAB-8D0C-10EA8997F37E} - C:\WINDOWS\system32\WinNB69.dll

O4 - HKLM\..\Run: [aaa00000] RUNDLL32.EXE aaa000002c.dll,n 000000000000001d

O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\system32\pwinkoea.exe SKY001

O4 - HKLM\..\Run: [ymembbsA] C:\WINDOWS\ymembbsA.exe

O4 - HKLM\..\Run: [DeluxeCommunications] C:\Programme\DeluxeCommunications\Dxc.exe

O4 - HKLM\..\Run: [{4E-EB-B9-90-ZN}] c:\windows\system32\njdsregk.exe SKY001

O4 - HKLM\..\Run: [sikoqe] C:\WINDOWS\$NtUninstallKB925454$\sikoqe.exe

O4 - HKLM\..\RunServices: [p2pnetworking] p2pnetworking.exe

O4 - HKCU\..\Run: [DeluxeCommunications] C:\Programme\DeluxeCommunications\Dxc.exe

O4 - Startup: Think-Adz.lnk = C:\WINDOWS\system32\pwinkoea.exe

O8 - Extra context menu item: >>> FREE PORN GALLERIES <<< - javascript:{document.location='http://sexmaxx.com/freegalleries.htm';}

O15 - Trusted Zone: http://click.getmirar.com (HKLM)
O15 - Trusted Zone: http://click.mirarsearch.com (HKLM)
O15 - Trusted Zone: http://redirect.mirarsearch.com (HKLM)
O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.15.cab

O16 - DPF: {29D73455-3ADA-49BB-9067-44822F6728F5} - http://www.joga.com/activex/uploadactx.cab

O16 - DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} (king.com) - http://www.king.com/ctl/kingcomie.cab

O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab

-----------

O17 - HKLM\System\CCS\Services\Tcpip\..\{2BDB8398-72F5-499D-87CA-B2B0A2EBC251}: NameServer = 85.237.87.173,84.16.240.135

O17 - HKLM\System\CCS\Services\Tcpip\..\{3DBE1CB7-E3D1-4E7C-9C69-AF3FD655F763}: NameServer = 85.237.87.173,84.16.240.135

O17 - HKLM\System\CCS\Services\Tcpip\..\{41F9DD51-1100-4373-8455-D1191EAC8CA8}: NameServer = 85.237.87.173,84.16.240.135

O17 - HKLM\System\CCS\Services\Tcpip\..\{731AC1FC-B05B-4E20-9BF0-ADFE1A9079B0}: NameServer = 85.237.87.173,84.16.240.135

O17 - HKLM\System\CCS\Services\Tcpip\..\{F2028F2E-B1CD-46F5-9747-5242E6FC04CB}: NameServer = 85.237.87.173,84.16.240.135

O17 - HKLM\System\CS1\Services\Tcpip\..\{2BDB8398-72F5-499D-87CA-B2B0A2EBC251}: NameServer = 85.237.87.173,84.16.240.135

O17 - HKLM\System\CS2\Services\Tcpip\..\{2BDB8398-72F5-499D-87CA-B2B0A2EBC251}: NameServer = 85.237.87.173,84.16.240.135

««
scanne und poste den scanreport
http://virus-protect.org/artikel/tools/fixwareout.html

««
Folgen den Anweisungen unter
http://virus-protect.org/cleanup.html
und stelle den CleanUp genauso ein, wie dort angegeben, dann den Rechner neustarten (so werden die temporaeren Dateien geloescht)

««
combofix anwenden, auch die Datentraegerbereinigung durchfuehren lassen + den Scanreport abkopieren und im Beitrag posten
http://virus-protect.org/artikel/tools/combofix.html

»»
wende die bfu an
http://virus-protect.org/artikel/bfu/p2pbfuhtml.html

««
Logfiles mittels datfind.bat erstellen und posten (abkopieren)
Exakte Anleitung unter: http://virus-protect.org/datfindbat.html
Kopiere diese 6 erstellten Textdateien ab . (rechtsklick mit der Maus -> den Text markieren -> kopieren -> einfügen) Sie sind nach Datum geordnet.
(kopiere je Logfile nur die letzten 3 Monate ab !)

««
Download Registry Search by Bobbi Flekman
http://virus-protect.org/artikel/tools/regsearch.html
und doppelklicken, um zu starten.
in: "Enter search strings" (reinschreiben oder reinkopieren)

Net Agent

in edit und klicke "Ok".
Notepad wird sich öffnen -- kopiere den Text ab und poste ihn.
__________
MfG Sabina

rund um die PC-Sicherheit