PC verlässt mich ab und zu

[mbn]

hallo zusammen.
hab neee frage!
Und zwar ich habe ein DFÜ Verbindung eingestellt, d.h. wenn ich ins IE gehe öffnet sich die Verbindung und nach dem öffnen hängte er sich manchmal auf!

warum ???

wenn ich manch mal winXP starte, verbindet er sich auch manchmal alleine ins Internet ohne dass ich was drück!!!

Un das find ich auch Komisch!

hier die date von hijackthis!

Logfile of HijackThis v1.99.1
Scan saved at 18:13:38, on 25.08.2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programme\Netropa\One-touch Multimedia Keyboard\MMKeybd.exe
C:\Programme\IC\Card Reader Driver v1.9e\Disk_Monitor.exe
C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe
C:\Programme\Common Files\Presentia\LTDMgr.exe
C:\WINDOWS\System32\rundll32.exe
C:\Programme\Netropa\One-touch Multimedia Keyboard\KEYBDMGR.EXE
C:\Programme\LocalProxy\proxy4free.exe
C:\PROGRA~1\Netropa\Onscre~1\OSD.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\SpyCatcher\DeleteSatellite.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Meaya\Popup Ad Filter\PopFilter.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\devldr32.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\WINDOWS\System32\Ati2evxx.exe
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe
C:\Programme\Netropa\One-touch Multimedia Keyboard\MMUSBKB2.EXE
C:\Programme\Mozilla Firefox\firefox.exe
D:\Daten\Downloads\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.goggle.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: LinkTracker Class - {6A6E50DC-BFA8-4B40-AB1B-159E03E829FD} - C:\WINDOWS\System32\lmf32.dll
O2 - BHO: (no name) - {AFAF94C4-A416-71D9-CCE7-FE2732288828} - C:\DOKUME~1\BELLAR~1\ANWEND~1\SAVEOB~1\bib skip.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [Keyboard Manager] C:\Programme\Netropa\One-touch Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [AttuneClientEngine] C:\PROGRA~1\Aveo\Attune\bin\attune_ce.exe
O4 - HKLM\..\Run: [Disk Monitor] C:\Programme\IC\Card Reader Driver v1.9e\Disk_Monitor.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LTDMgr] C:\Programme\Common Files\Presentia\LTDMgr.exe
O4 - HKLM\..\Run: [fash] C:\WINDOWS\fash.exe
O4 - HKLM\..\Run: [pmr] C:\Programme\Common Files\Presentia\pmr.exe
O4 - HKLM\..\Run: [Indexindicator] C:\WINDOWS\System32\Indexindicator.exe /check
O4 - HKLM\..\Run: [MEMreaload] C:\Programme\ServicePackFiles\MEMreaload.exe /checkmouse /updateratio
O4 - HKLM\..\Run: [Suite] C:\WINDOWS\System32\SuiteOffices.exe /cleandb
O4 - HKLM\..\Run: [Reload] C:\Programme\ServicePackFiles\reload.exe /reloadenterpice
O4 - HKLM\..\Run: [Diesel] C:\WINDOWS\System32\Recalculate.exe /reloadenterpice
O4 - HKLM\..\Run: [Realtime Audio Engine] mmrtkrnl.exe
O4 - HKLM\..\Run: [LSAS] C:\WINDOWS\System32\LSAS.exe /check
O4 - HKLM\..\Run: [lservers] C:\Programme\ServicePackFiles\lservers.exe /checkmouse /updateratio
O4 - HKLM\..\Run: [mctask] C:\WINDOWS\System32\mctask.exe /allservice
O4 - HKLM\..\Run: [systems] C:\Programme\ServicePackFiles\systems.exe /reloadenterpice
O4 - HKLM\..\Run: [terminal] C:\WINDOWS\System32\terminal.exe /reloadenterpice
O4 - HKLM\..\Run: [Advanced Message Server] rundll32.exe usb496.dat,Execute
O4 - HKLM\..\Run: [nameoptionregsdate] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\active live name option\16Face.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [LocalProxy] C:\Programme\LocalProxy\proxy4free.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [Windows Update AutoUpdate Client] C:\WINDOWS\System32\winupd\wuauclt.exe
O4 - HKLM\..\Run: [TermAgent] C:\WINDOWS\System32\deskconn.exe
O4 - HKLM\..\Run: [GhostSurfDelSatellite] "C:\Programme\SpyCatcher\DeleteSatellite.exe"
O4 - HKLM\..\Run: [SpyCatcher Reminder] "C:\Programme\SpyCatcher\SpyCatcher.exe" reminder
O4 - HKLM\..\RunOnce: [GhostSurfDelSatellite] "C:\Programme\SpyCatcher\DeleteSatellite.exe" nowait
O4 - HKCU\..\Run: [Popup Ad Filter] C:\Programme\Meaya\Popup Ad Filter\PopFilter.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Jawa32] C:\WINDOWS\jawa32.exe
O4 - HKCU\..\Run: [win third] C:\DOKUME~1\BELLAR~1\ANWEND~1\REALTI~1\Wave fast.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Allow Popups - C:\Programme\Meaya\Popup Ad Filter\WhiteGetUrl.js
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Richfind - {F9A05A79-7F03-41CE-867D-7C1B5C1CAF38} - C:\WINDOWS\System32\Q3095843.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O15 - Trusted Zone: *.energyfactor.com
O15 - Trusted Zone: *.hardcorefantasyland.com
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O16 - DPF: {00000000-0000-0000-0000-000020030000} - http://www.celebritaspoglie.net/sex.exe
O16 - DPF: {00000000-0000-0000-0000-000020040000} - http://207.234.185.217/ABoxInst_int4.exe
O16 - DPF: {02C20140-76F8-4763-83D5-B660107B7A90} (Moniker32 Class) - http://63.217.29.115/cax.cab
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file. ... 00d46a3ac6
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540006} (CInstall Class) - http://www.errorguard.com/installation/Install.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v ... 0181866281
O16 - DPF: {6E2D6932-3885-4FA2-8DD4-DB63FFE33797} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/A ... tPkCnv.cab
O16 - DPF: {706F3805-27D7-478D-80E5-E25D2BB030B3} (VacPro.internazionale_ver3) - http://ocx1.advnt01.com/dialer/internazionale_ver3.CAB
O16 - DPF: {7704D8D8-9EFE-4D82-9C89-0ECBA8434EEE} (PSSetup Class) - http://www.adsvr.net/PowerStrip/PSOCX2.cab
O16 - DPF: {7C559105-9ECF-42B8-B3F7-832E75EDD959} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares ... cracks.cab
O16 - DPF: {8522F9B3-38C5-4AA4-AE40-7401F1BBC851} - http://www.pianetafree.com/giochi_online.exe
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b30149.cab
O16 - DPF: {9E98E84C-79E1-49C3-82EB-798FCD552EFB} (VacPro.internazionale_ver4) - http://advnt01.com/dialer/internazionale_ver4.CAB
O16 - DPF: {AD0B8220-7DA4-4C0A-8532-B25A9F631D3D} (VacPro.internazionale_ver10) - http://advnt01.com/dialer/internazionale_ver10.CAB
O16 - DPF: {D19781C5-2051-44F8-8445-DDC82933C191} (VacPro.internazionale_ver11) - http://advnt01.com/dialer/internazionale_ver11.CAB
O16 - DPF: {DB893839-10F0-4AF9-92FA-B23528F530AF} - http://deposito.hostance.net/dialer/604485.exe
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/So ... b30149.cab
O16 - DPF: {FFA6CE4C-2199-4A4F-9542-12E0163D6841} - http://sessa.isprime.com:8080/tel2net/CABDialer.cab
O16 - DPF: {FFFF0001-0001-101A-A3C9-08002B2F49FC} - http://download.energyfactor.com/dialer ... _10_it.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{66A384B4-F76D-45EE-B03E-9053D4EA5744}: NameServer = 217.237.151.161 217.237.151.33
O18 - Filter: text/html - {4E9A1D3F-92C2-4748-A7E5-5B4B019B33FE} - C:\WINDOWS\System32\Q3095843.dll
O18 - Filter: text/plain - {4E9A1D3F-92C2-4748-A7E5-5B4B019B33FE} - C:\WINDOWS\System32\Q3095843.dll
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe
O23 - Service: Tenebril antispyware satellite (TNBRLDS) - Tenebril Inc. - C:\Programme\SpyCatcher\DeleteSvc.exe

[Nikita]

ich habe selten so einen verseuchten PC gesehen.
Formatiere und lade in Zukunft nicht so viel Muell, der immer mit Viren und Spyware und Dialern behaftet ist.
Und surfe nur noch mit dem Firefox.


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
O2 - BHO: LinkTracker Class - {6A6E50DC-BFA8-4B40-AB1B-159E03E829FD} - C:\WINDOWS\System32\lmf32.dll

O4 - HKLM\..\Run: [AttuneClientEngine] C:\PROGRA~1\Aveo\Attune\bin\attune_ce.exe
O4 - HKLM\..\Run: [LTDMgr] C:\Programme\Common Files\Presentia\LTDMgr.exe
O4 - HKLM\..\Run: [fash] C:\WINDOWS\fash.exe
O4 - HKLM\..\Run: [pmr] C:\Programme\Common Files\Presentia\pmr.exe
O4 - HKLM\..\Run: [Indexindicator] C:\WINDOWS\System32\Indexindicator.exe /check
O4 - HKLM\..\Run: [MEMreaload] C:\Programme\ServicePackFiles\MEMreaload.exe /checkmouse /updateratio
O4 - HKLM\..\Run: [Suite] C:\WINDOWS\System32\SuiteOffices.exe /cleandb
O4 - HKLM\..\Run: [Reload] C:\Programme\ServicePackFiles\reload.exe /reloadenterpice
O4 - HKLM\..\Run: [Diesel] C:\WINDOWS\System32\Recalculate.exe /reloadenterpice
O4 - HKLM\..\Run: [LSAS] C:\WINDOWS\System32\LSAS.exe /check
O4 - HKLM\..\Run: [lservers] C:\Programme\ServicePackFiles\lservers.exe /checkmouse /updateratio
O4 - HKLM\..\Run: [mctask] C:\WINDOWS\System32\mctask.exe /allservice
O4 - HKLM\..\Run: [terminal] C:\WINDOWS\System32\terminal.exe /reloadenterpice
O4 - HKLM\..\Run: [Advanced Message Server] rundll32.exe usb496.dat,Execute
O4 - HKLM\..\Run: [nameoptionregsdate] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\active live name option\16Face.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [LocalProxy] C:\Programme\LocalProxy\proxy4free.exe
O4 - HKLM\..\Run: [Windows Update AutoUpdate Client] C:\WINDOWS\System32\winupd\wuauclt.exe
O4 - HKLM\..\Run: [TermAgent] C:\WINDOWS\System32\deskconn.exe
O4 - HKLM\..\Run: [GhostSurfDelSatellite] "C:\Programme\SpyCatcher\DeleteSatellite.exe"
O4 - HKLM\..\Run: [SpyCatcher Reminder] "C:\Programme\SpyCatcher\SpyCatcher.exe" reminder
O4 - HKLM\..\RunOnce: [GhostSurfDelSatellite] "C:\Programme\SpyCatcher\DeleteSatellite.exe" nowait
O4 - HKCU\..\Run: [Popup Ad Filter] C:\Programme\Meaya\Popup Ad Filter\PopFilter.exe
O4 - HKCU\..\Run: [Jawa32] C:\WINDOWS\jawa32.exe
O4 - HKCU\..\Run: [win third] C:\DOKUME~1\BELLAR~1\ANWEND~1\REALTI~1\Wave fast.exe
O8 - Extra context menu item: Allow Popups - C:\Programme\Meaya\Popup Ad Filter\WhiteGetUrl.js
O9 - Extra button: Richfind - {F9A05A79-7F03-41CE-867D-7C1B5C1CAF38} - C:\WINDOWS\System32\Q3095843.dll (file missing)
15 - Trusted Zone: *.energyfactor.com
O15 - Trusted Zone: *.hardcorefantasyland.com
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O16 - DPF: {00000000-0000-0000-0000-000020030000} - http://www.celebritaspoglie.net/sex.exe
O16 - DPF: {00000000-0000-0000-0000-000020040000} - http://207.234.185.217/ABoxInst_int4.exe
O16 - DPF: {02C20140-76F8-4763-83D5-B660107B7A90} (Moniker32 Class) - http://63.217.29.115/cax.cab
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file. ... 00d46a3ac6
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540006} (CInstall Class) - http://www.errorguard.com/installation/Install.cab

O16 - DPF: {706F3805-27D7-478D-80E5-E25D2BB030B3} (VacPro.internazionale_ver3) - http://ocx1.advnt01.com/dialer/internazionale_ver3.CAB
O16 - DPF: {7704D8D8-9EFE-4D82-9C89-0ECBA8434EEE} (PSSetup Class) - http://www.adsvr.net/PowerStrip/PSOCX2.cab
O16 - DPF: {7C559105-9ECF-42B8-B3F7-832E75EDD959} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares ... cracks.cab
O16 - DPF: {8522F9B3-38C5-4AA4-AE40-7401F1BBC851} - http://www.pianetafree.com/giochi_online.exe
O16 - DPF: {9E98E84C-79E1-49C3-82EB-798FCD552EFB} (VacPro.internazionale_ver4) - http://advnt01.com/dialer/internazionale_ver4.CAB
O16 - DPF: {AD0B8220-7DA4-4C0A-8532-B25A9F631D3D} (VacPro.internazionale_ver10) - http://advnt01.com/dialer/internazionale_ver10.CAB
O16 - DPF: {D19781C5-2051-44F8-8445-DDC82933C191} (VacPro.internazionale_ver11) - http://advnt01.com/dialer/internazionale_ver11.CAB
O16 - DPF: {DB893839-10F0-4AF9-92FA-B23528F530AF} - http://deposito.hostance.net/dialer/604485.exe

O16 - DPF: {FFA6CE4C-2199-4A4F-9542-12E0163D6841} - http://sessa.isprime.com:8080/tel2net/CABDialer.cab
O16 - DPF: {FFFF0001-0001-101A-A3C9-08002B2F49FC} - http://download.energyfactor.com/dialer ... _10_it.exe

O18 - Filter: text/html - {4E9A1D3F-92C2-4748-A7E5-5B4B019B33FE} - C:\WINDOWS\System32\Q3095843.dll
O18 - Filter: text/plain - {4E9A1D3F-92C2-4748-A7E5-5B4B019B33FE} - C:\WINDOWS\System32\Q3095843.dll
O23 - Service: Tenebril antispyware satellite (TNBRLDS) - Tenebril Inc. - C:\Programme\SpyCatcher\DeleteSvc.exe