Logfile of HijackThis v1.98.2
Scan saved at 13:47:54, on 16.10.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\sstray.exe
C:\Program Files\N-case\msbb.exe
C:\Programme\Java\j2re1.4.2_01\bin\jusched.exe
C:\programme\u-storage tools1.0\ustorage.exe
C:\WINDOWS\System32\RUNDLL32.exe
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
C:\Programme\HighCriteria\TotalRecorder\TotRecSched.exe
C:\WINDOWS\Help\cmdun.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Programme\AVPersonal\AVWIN.EXE
C:\Programme\ICQLite\ICQLite.exe
C:\Programme\Warcraft III\replay\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.t-online.de/
O1 - Hosts: nd.com
O1 - Hosts: nd.com
O1 - Hosts: ind.com
O1 - Hosts: ind.com
O1 - Hosts: find.com
O1 - Hosts: find.com
O1 - Hosts: yfind.com
O1 - Hosts: yfind.com
O1 - Hosts: tyfind.com
O1 - Hosts: tyfind.com
O1 - Hosts: styfind.com
O1 - Hosts: styfind.com
O1 - Hosts: estyfind.com
O1 - Hosts: estyfind.com
O1 - Hosts: c.whenu.com
O1 - Hosts: c.whenu.com
O1 - Hosts: c.whenu.com
O1 - Hosts: inc.whenu.com
O1 - Hosts: inc.whenu.com
O2 - BHO: CATLEvents Object - {3EC8E271-FAB9-418a-8A8E-65AEB4029E64} - C:\DOKUME~1\Stefan\LOKALE~1\Temp\wdrah.dat
O2 - BHO: CATLEvents Object - {60112085-E1CE-4e0e-823A-EBB1AD98804C} - C:\DOKUME~1\Stefan\LOKALE~1\Temp\wdrah.dat
O2 - BHO: CATLEvents Object - {6A06CDAD-9D2D-42A0-9C91-C0CF7CB9971B} - C:\DOKUME~1\Stefan\LOKALE~1\Temp\nudmc.dat
O2 - BHO: CATLEvents Object - {72AC6865-B1D3-4C32-A27B-4B3BF04DE655} - C:\DOKUME~1\Stefan\LOKALE~1\Temp\nurcfm.dat
O2 - BHO: CATLEvents Object - {8109AF33-6949-4833-8881-43DCC232B7B2} - C:\DOKUME~1\Stefan\LOKALE~1\Temp\wdrah.dat
O2 - BHO: CATLEvents Object - {F32F8ECD-6CF3-459D-82F2-9738392C85A8} - C:\DOKUME~1\Stefan\LOKALE~1\Temp\nurcfm.dat
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [msbb] C:\Program Files\N-case\msbb.exe
O4 - HKLM\..\Run: [RunProg] C:\WINDOWS\System32\server.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [SysUpd] C:\WINDOWS\SysUpd.exe
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Programme\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [hardw] C:\WINDOWS\msagent\chars\hardw.exe
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [Winsock2 driver] winlog32.exe
O4 - HKLM\..\Run: [Microsoft Restore] scrgrd.exe
O4 - HKLM\..\Run: [msvctapi] C:\WINDOWS\msvctapi.exe
O4 - HKLM\..\Run: [admsvc] C:\WINDOWS\Config\admsvc.exe
O4 - HKLM\..\Run: [*mfcrun] C:\WINDOWS\mfcrun.exe
O4 - HKLM\..\Run: [*drvvb] C:\WINDOWS\Cursors\drvvb.exe
O4 - HKLM\..\Run: [*docnet] C:\WINDOWS\system\docnet.exe
O4 - HKLM\..\Run: [TotalRecorderScheduler] "C:\Programme\HighCriteria\TotalRecorder\TotRecSched.exe"
O4 - HKLM\..\Run: [*as] C:\WINDOWS\repair\as.exe
O4 - HKLM\..\Run: [*unras] C:\WINDOWS\repair\unras.exe
O4 - HKLM\..\Run: [*iisdll] C:\WINDOWS\msagent\iisdll.exe
O4 - HKLM\..\Run: [*cmdun] C:\WINDOWS\Help\cmdun.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\RunServices: [Microsoft Restore] scrgrd.exe
O4 - HKLM\..\RunOnce: [*cmdun] C:\WINDOWS\Help\cmdun.exe rerun
O4 - HKCU\..\Run: [Steam] C:\Programme\Steam\Steam.exe -silent
O4 - HKCU\..\Run: [Microsoft Restore] scrgrd.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {33288993-5664-11D4-8B5B-00D0B73B3518} (ell Class) - http://www.easports.com/downloads/games ... /ieell.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://www.wow-europe.com/signup/de/wowbeta/Si.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://god.t-online.de/godcheck/CLASSES/ExentCtl.ocx
O16 - DPF: {92CA8ACC-4E99-4A2A-93F1-B2C5CADC8613} (OPInstall Control) - http://a14.g.akamai.net/f/14/7141/14400 ... 1.0.18.cab
O16 - DPF: {DCF0768D-BA7A-101A-B57A-0000C0C3ED5F} - http://203.199.200.61/ads/shareit/da/cab/SysUpd.CAB

Hallo@Zensi

oeffne das HijackThis, hake an, was ich schreibe, <fix< und PC neustarten

O1 - Hosts: nd.com
O1 - Hosts: nd.com
O1 - Hosts: ind.com
O1 - Hosts: ind.com
O1 - Hosts: find.com
O1 - Hosts: find.com
O1 - Hosts: yfind.com
O1 - Hosts: yfind.com
O1 - Hosts: tyfind.com
O1 - Hosts: tyfind.com
O1 - Hosts: styfind.com
O1 - Hosts: styfind.com
O1 - Hosts: estyfind.com
O1 - Hosts: estyfind.com
O1 - Hosts: c.whenu.com
O1 - Hosts: c.whenu.com
O1 - Hosts: c.whenu.com
O1 - Hosts: inc.whenu.com
O1 - Hosts: inc.whenu.com
O2 - BHO: CATLEvents Object - {3EC8E271-FAB9-418a-8A8E-65AEB4029E64} - C:\DOKUME~1\Stefan\LOKALE~1\Temp\wdrah.dat
O2 - BHO: CATLEvents Object - {60112085-E1CE-4e0e-823A-EBB1AD98804C} - C:\DOKUME~1\Stefan\LOKALE~1\Temp\wdrah.dat
O2 - BHO: CATLEvents Object - {6A06CDAD-9D2D-42A0-9C91-C0CF7CB9971B} - C:\DOKUME~1\Stefan\LOKALE~1\Temp\nudmc.dat
O2 - BHO: CATLEvents Object - {72AC6865-B1D3-4C32-A27B-4B3BF04DE655} - C:\DOKUME~1\Stefan\LOKALE~1\Temp\nurcfm.dat
O2 - BHO: CATLEvents Object - {8109AF33-6949-4833-8881-43DCC232B7B2} - C:\DOKUME~1\Stefan\LOKALE~1\Temp\wdrah.dat
O2 - BHO: CATLEvents Object - {F32F8ECD-6CF3-459D-82F2-9738392C85A8} - C:\DOKUME~1\Stefan\LOKALE~1\Temp\nurcfm.dat

O4 - HKLM\..\Run: [msbb] C:\Program Files\N-case\msbb.exe
O4 - HKLM\..\Run: [RunProg] C:\WINDOWS\System32\server.exe
O4 - HKLM\..\Run: [SysUpd] C:\WINDOWS\SysUpd.exe
O4 - HKLM\..\Run: [hardw] C:\WINDOWS\msagent\chars\hardw.exe
O4 - HKLM\..\Run: [Winsock2 driver] winlog32.exe
O4 - HKLM\..\Run: [Microsoft Restore] scrgrd.exe
O4 - HKLM\..\Run: [hardw] C:\WINDOWS\msagent\chars\hardw.exe
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [Winsock2 driver] winlog32.exe
O4 - HKLM\..\Run: [Microsoft Restore] scrgrd.exe
O4 - HKLM\..\Run: [msvctapi] C:\WINDOWS\msvctapi.exe
O4 - HKLM\..\Run: [admsvc] C:\WINDOWS\Config\admsvc.exe
O4 - HKLM\..\Run: [*mfcrun] C:\WINDOWS\mfcrun.exe
O4 - HKLM\..\Run: [*drvvb] C:\WINDOWS\Cursors\drvvb.exe
O4 - HKLM\..\Run: [*docnet] C:\WINDOWS\system\docnet.exe
O4 - HKLM\..\Run: [TotalRecorderScheduler] "C:\Programme\HighCriteria\TotalRecorder\TotRecSched.exe"
O4 - HKLM\..\Run: [*as] C:\WINDOWS\repair\as.exe
O4 - HKLM\..\Run: [*unras] C:\WINDOWS\repair\unras.exe
O4 - HKLM\..\Run: [*iisdll] C:\WINDOWS\msagent\iisdll.exe
O4 - HKLM\..\Run: [*cmdun] C:\WINDOWS\Help\cmdun.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\RunServices: [Microsoft Restore] scrgrd.exe
O4 - HKLM\..\RunOnce: [*cmdun] C:\WINDOWS\Help\cmdun.exe rerun
O4 - HKCU\..\Run: [Microsoft Restore] scrgrd.exe
O16 - DPF: {92CA8ACC-4E99-4A2A-93F1-B2C5CADC8613} (OPInstall Control) - http://a14.g.akamai.net/f/14/7141/14400 ... 1.0.18.cab
O16 - DPF: {DCF0768D-BA7A-101A-B57A-0000C0C3ED5F} - http://203.199.200.61/ads/shareit/da/cab/SysUpd.CAB
O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://www.wow-europe.com/signup/de/wowbeta/Si.cab

neustarten


Deaktivieren Wiederherstellung
XP
http://service1.symantec.com/SUPPORT/IN ... 7105707924

#Datentraegerbereinigung: und Loeschen der Temporary-Dateien
Disk Cleanup Wizard
1. Start<Ausfuehren<cleanmgr
2. Click Temporary Internet Files, O.K

#die Host-Datei (mit Editor oeffnen)
: in c:\Windows\System32\drivers\etc\hosts
127.0.0.1 localhost (alles andere loeschen)
oder:
#Hoster-Tool : http://members.aol.com/toadbee/hoster.zip
Press 'Restore Original Hosts' and press 'OK'
Exit Program.


Das eScan AV Toolkit (mwav.exe) herunterladen,
http://www.mwti.net/antivirus/escan/esc ... ivirus.asp
danach die "kavupd.exe" (automatisches Update ueber DOS) ausführen.

<gehe in den abgesicherten Modus
http://www.tu-berlin.de/www/software/vi ... mode.shtml

und den Scanner mit der "mwav.exe" starten. Alle Häkchen setzen :
Auswählen: Memory, Startup-Folders, Registry, System Folders, Services, Drive/All Local drives

folgende Haken :
[x] Memory
[x] Registry
[x] Startup Folders
[x] System Folders
[x] Services
[x] Drive
(x) All Local Drives
[x] Folder [C:\WINDOWS]
[x] Include SubDirectory

<und "Scan clean" klicken.

<Öffne die mwav.log -> Bearbeiten -> Suchen ->
Wenn man infizierte Dateien in dem eScan Log finden will, sollte man nach infected suchen und die Eintraege hier posten

und das neue Log vom HijackThis noch mal posten.

mfg
Nikita