Hallo ich brauche dringend Hilfeeeeeeeeeeeeeeeeeeeee!
Ich habe einen Virus durch Media Tube Codec bekommen!
Als ich die Datei öffnete war meine Festplatte C und D weg!
Ich kann sie nicht finden aber sie ist irrgendwie noch da denn
Wenn ich z.B. auf ein Pogramm klicke wo ich auf Festplatte C
installiert habe und dann auf Zielort suchen gehe öffnet er mir
den Ordner auf Festplatte C.
HijackThis hat einen check gemacht und das kam raus ich kenne mich nicht aus damit… ich hoffe ihr könnt mir weiterhelfen…
Logfile of HijackThis v1.99.1
Scan saved at 19:32: VIRUS ALERT!, on 28.08.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\McAfee.com\VSO\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Programme\Microsoft IntelliPoint\point32.exe
C:\PROGRA~1\mcafee.com\vso\mcvsescn.exe
C:\Programme\McAfee.com\VSO\oasclnt.exe
C:\Programme\SyncroSoft\Pos\H2O\cledx.exe
C:\Programme\FRITZ!DSL\IGDCTRL.EXE
C:\Programme\Java\jre1.6.0_05\bin\jusched.exe
C:\Programme\Belkin\Belkin Wireless Network Utility\WLService.exe
C:\Programme\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe
c:\programme\mcafee.com\agent\mcdetect.exe
C:\Programme\MSA\MSA.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Skype\Phone\Skype.exe
C:\Programme\FRITZ!DSL\StCenter.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programme\Skype\Plugin Manager\skypePM.exe
C:\Programme\Java\jre1.6.0_05\bin\jucheck.exe
C:\WINDOWS\system32\rundll32.exe
C:\Dokumente und Einstellungen\Teddy\Desktop\aswclnr211.exe
C:\Dokumente und Einstellungen\Teddy\Desktop\aswclnr211.tmp
C:\Programme\Mozilla Firefox\firefox.exe
C:\Dokumente und Einstellungen\Teddy\Desktop\pruefung.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=M…
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\5403\toolbaru.dll
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Programme\Macrogaming\SweetIMBarForIE\toolbar.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Proxy Connection support DLL - {1DC9D850-044D-11E1-B3C9-00805E499D93} - C:\WINDOWS\system32\proxyspd.dll
O2 - BHO: (no name) - {3BC547AB-69D8-44A9-83CA-318E8EC59EA5} - C:\WINDOWS\system32\awtqq.dll (file missing)
O2 - BHO: (no name) - {40FDFAEC-2D09-4884-AFE5-43EAD4511716} - (no file)
O2 - BHO: {d1ef9c13-9a5f-1d7b-0a34-ccef29b58f24} - {42f85b92-fecc-43a0-b7d1-f5a931c9fe1d} - C:\WINDOWS\system32\wbgjha.dll
O2 - BHO: (no name) - {501C3C41-4185-4594-99D8-C15680803532} - C:\Dokumente und Einstellungen\Teddy\Lokale Einstellungen\Temporary Internet Files\Content.IE5\6ZXEH9JS\3077ahntdksr[2].dll (file missing)
O2 - BHO: (no name) - {522c1ac8-403e-46eb-9140-d65b143458cd} - (no file)
O2 - BHO: (no name) - {681A821C-0B2B-4466-879E-967170E98C01} - C:\WINDOWS\system32\bhmkinpy.dll
O2 - BHO: (no name) - {6C23AB0C-0244-4B01-8253-BEE724D0D2EC} - C:\WINDOWS\system32\opnmMeCu.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {8E3FBDE2-7DBD-4040-85D9-29BBC559C129} - C:\WINDOWS\system32\urqqrqp.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Programme\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll (file missing)
O2 - BHO: (no name) - {A777A1B4-5DBE-419D-87FF-575D1F662DF9} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar3.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\MSN Apps\MSN Toolbar\01.02.5000.1021\de\msntb.dll (file missing)
O2 - BHO: (no name) - {C6B9DB09-425A-46EE-BA0C-0A83BDF4FB1D} - C:\WINDOWS\system32\ddcYrRiJ.dll
O2 - BHO: QXK Olive - {E350B1C6-A8DC-4EEF-90DB-61DCAE9D1B67} - C:\WINDOWS\rodqgpvlkoa.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\MSN Apps\MSN Toolbar\01.02.5000.1021\de\msntb.dll (file missing)
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\5403\toolbaru.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar3.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Programme\Macrogaming\SweetIMBarForIE\toolbar.dll (file missing)
O3 - Toolbar: (no name) - {07AA283A-43D7-4CBE-A064-32A21112D94D} - (no file)
O3 - Toolbar: qalkfxor - {18C388BB-5014-4906-AE38-E62BA5AA7387} - C:\WINDOWS\qalkfxor.dll
O4 - HKLM…\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM…\Run: [VSOCheckTask] „C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe“ /checktask
O4 - HKLM…\Run: [VirusScan Online] C:\Programme\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM…\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM…\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM…\Run: [IntelliPoint] „C:\Programme\Microsoft IntelliPoint\point32.exe“
O4 - HKLM…\Run: [HP Software Update] C:\Programme\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM…\Run: [HomeFtpServer] C:\Programme\Home Ftp Server\HomeFtpServer.exe
O4 - HKLM…\Run: [BO1HelperStartUp] C:\PROGRA~1\BUTTER~1\BO1HEL~1.EXE /partner BO1
O4 - HKLM…\Run: [OASClnt] C:\Programme\McAfee.com\VSO\oasclnt.exe
O4 - HKLM…\Run: [H2O] C:\Programme\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM…\Run: [SunJavaUpdateSched] „C:\Programme\Java\jre1.6.0_05\bin\jusched.exe“
O4 - HKLM…\Run: [SeekmoOE] C:\Programme\Seekmo\bin\10.0.406.0\OEAddOn.exe
O4 - HKLM…\Run: [SeekmoSA] „C:\Programme\Seekmo\bin\10.0.406.0\SeekmoSA.exe“
O4 - HKLM…\Run: [\VIE1BF.exe] C:\Windows\System32\VIE1BF.exe
O4 - HKLM…\Run: [\VIE1C0.exe] C:\Windows\System32\VIE1C0.exe
O4 - HKLM…\Run: [\VIE1C3.exe] C:\Windows\System32\VIE1C3.exe
O4 - HKLM…\Run: [\VIE1C5.exe] C:\Windows\System32\VIE1C5.exe
O4 - HKLM…\Run: [\SUE1C6.exe] C:\Windows\SUE1C6.exe
O4 - HKLM…\Run: [Antivirus] C:\Programme\MSA\MSA.exe
O4 - HKLM…\Run: [\VIE7.exe] C:\Windows\System32\VIE7.exe
O4 - HKLM…\Run: [\VIE8.exe] C:\Windows\System32\VIE8.exe
O4 - HKLM…\Run: [\VIE9.exe] C:\Windows\System32\VIE9.exe
O4 - HKLM…\Run: [\VIEA.exe] C:\Windows\System32\VIEA.exe
O4 - HKLM…\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM…\Run: [BM7ab3bb97] Rundll32.exe „C:\WINDOWS\system32\uckdiqby.dll“,s
O4 - HKLM…\Run: [7980880b] rundll32.exe „C:\WINDOWS\system32\vkpwfjio.dll“,b
O4 - HKLM…\RunOnce: [0011 - C:\Programme\hewlett-packard\hp deskjet assistant\bin\chrome\packages\widget-toolkit\global\content] C:\WINDOWS\command.com /c rmdir „C:\Programme\hewlett-packard\hp deskjet assistant\bin\chrome\packages\widget-toolkit\global\content“
O4 - HKLM…\RunOnce: [0012 - C:\Programme\hewlett-packard\hp deskjet assistant\bin\chrome\packages\widget-toolkit\global] C:\WINDOWS\command.com /c rmdir „C:\Programme\hewlett-packard\hp deskjet assistant\bin\chrome\packages\widget-toolkit\global“
O4 - HKLM…\RunOnce: [0013 - C:\Programme\hewlett-packard\hp deskjet assistant\bin\chrome\packages\widget-toolkit] C:\WINDOWS\command.com /c rmdir „C:\Programme\hewlett-packard\hp deskjet assistant\bin\chrome\packages\widget-toolkit“
O4 - HKLM…\RunOnce: [0015 - C:\Programme\hewlett-packard\hp deskjet assistant\bin\chrome\skins\modern\global\skin] C:\WINDOWS\command.com /c rmdir „C:\Programme\hewlett-packard\hp deskjet assistant\bin\chrome\skins\modern\global\skin“
O4 - HKLM…\RunOnce: [0016 - C:\Programme\hewlett-packard\hp deskjet assistant\bin\chrome\skins\modern\global] C:\WINDOWS\command.com /c rmdir „C:\Programme\hewlett-packard\hp deskjet assistant\bin\chrome\skins\modern\global“
O4 - HKLM…\RunOnce: [0017 - C:\Programme\hewlett-packard\hp deskjet assistant\bin\chrome\skins\modern] C:\WINDOWS\command.com /c rmdir „C:\Programme\hewlett-packard\hp deskjet assistant\bin\chrome\skins\modern“
O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU…\Run: [Steam] „c:\programme\steam\steam.exe“ -silent
O4 - HKCU…\Run: [AntiSpywareShield] C:\Program Files\AntiSpywareShield\AntiSpywareShield.exe
O4 - HKCU…\Run: [ICQ] „C:\Programme\ICQ6\ICQ.exe“ silent
O4 - HKCU…\Run: [Skype] „C:\Programme\Skype\Phone\Skype.exe“ /nosplash /minimized
O4 - HKCU…\Run: [\VIE1BF.exe] C:\Windows\System32\VIE1BF.exe
O4 - HKCU…\Run: [\VIE1C0.exe] C:\Windows\System32\VIE1C0.exe
O4 - HKCU…\Run: [\VIE1C3.exe] C:\Windows\System32\VIE1C3.exe
O4 - HKCU…\Run: [\VIE1C5.exe] C:\Windows\System32\VIE1C5.exe
O4 - HKCU…\Run: [\SUE1C6.exe] C:\Windows\SUE1C6.exe
O4 - HKCU…\Run: [Antivirus] C:\Programme\MSA\MSA.exe
O4 - HKCU…\Run: [\VIE7.exe] C:\Windows\System32\VIE7.exe
O4 - HKCU…\Run: [\VIE8.exe] C:\Windows\System32\VIE8.exe
O4 - HKCU…\Run: [\VIE9.exe] C:\Windows\System32\VIE9.exe
O4 - HKCU…\Run: [\VIEA.exe] C:\Windows\System32\VIEA.exe
O4 - HKCU…\Run: [86850532373682305986693465611453] C:\Programme\Antivirus 2009\av2009.exe
O4 - Startup: FRITZ!DSL Startcenter.lnk = C:\Programme\FRITZ!DSL\StCenter.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra ‚Tools‘ menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.securesoftwarefeed.com/redirect.php (file missing)
O9 - Extra ‚Tools‘ menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.securesoftwarefeed.com/redirect.php (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - D:\ICQ6\ICQ.exe (file missing)
O9 - Extra ‚Tools‘ menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - D:\ICQ6\ICQ.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe (file missing)
O9 - Extra ‚Tools‘ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) - http://update.videoegg.com/Install/Windows/Initial/V…
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649…
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsP…
O17 - HKLM\System\CCS\Services\Tcpip…{B1281989-EE95-423B-9CFE-428AB742107E}: NameServer = 192.168.122.252,192.168.122.253
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.142 85.255.112.80
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.142 85.255.112.80
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: wbgjha.dll
O20 - Winlogon Notify: opnmMeCu - C:\WINDOWS\SYSTEM32\opnmMeCu.dll
O20 - Winlogon Notify: urqqrqp - urqqrqp.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVM IGD CTRL Service - AVM Berlin - C:\Programme\FRITZ!DSL\IGDCTRL.EXE
O23 - Service: Belkin 54g Wireless USB Network Adapter (Belkin 54g Wireless USB Network Adapter Service) - Unknown owner - C:\Programme\Belkin\Belkin Wireless Network Utility\WLService.exe
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\programme\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe