bei der Suche nach Hilfe bin ich schon mal auf das HijackThis Programm gestoßen und hab mal ein log erstellt, das ich anschließend reinkopiert habe. Bitte bei der Antwort möglichst einfache und genaue Anweisungen geben. Am Rechner sitzt ein Computer-Laie, der all die schönen Fachausdrücke kein Stück kapiert...

hier also das Log:

Logfile of HijackThis v1.99.1
Scan saved at 16:38:19, on 04-03-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\S3hotkey.exe
C:\WINDOWS\system32\S3tray2.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\system32\GSICON.EXE
C:\WINDOWS\system32\dslagent.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
C:\Programme\Winamp\winampa.exe
C:\Programme\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Programme\Microsoft Office\Office\OSA.EXE
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Programme\Internet Explorer\iexplore.exe
c:\progra~1\intern~1\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\cidaemon.exe
c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\DOKUME~1\Karsten\LOKALE~1\Temp\Temporäres Verzeichnis 1 für hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://oqdnfuwnnakmgnjxqordu.net/IZ9sTb ... 4MVuIk.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ggnlewukdtlpicqccku.net/IZ9s ... _6UVM.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\ptqhg.dll/sp.html#12802
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {92259F5C-0A5B-48C5-3279-E2C9455FB2BD} - C:\PROGRA~1\Birdskip\Rule 4.exe (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\windows\downloaded program files\googletoolbar1.dll
O2 - BHO: (no name) - {C9E66AFA-9785-4C9D-6440-F92F818A2A71} - C:\DOKUME~1\Karsten\ANWEND~1\Birdskip\Rule 4.exe
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Messenger\ycomp.dll (file missing)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\windows\downloaded program files\googletoolbar1.dll
O4 - HKLM\..\Run: [S3hotkey] S3hotkey.exe
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [Apoint] C:\Programme\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Programme\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [Dale Soft Locks Third] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\UploadKeepDaleSoft\load rdr.exe
O4 - HKLM\..\Run: [Barb Chin Type Active] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lies Clock Barb Chin\cash warn.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [CleanUp] C:\PROGRA~1\McAfee.com\Shared\mcappins.exe /v=3 /cleanup
O4 - HKCU\..\Run: [LDM] C:\Programme\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\Run: [Frag Extra] C:\DOKUME~1\Karsten\ANWEND~1\64INTE~1\ShimCake.exe
O4 - Global Startup: Microsoft-Indexerstellung.lnk = C:\Programme\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Office-Start.lnk = C:\Programme\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programme\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\windows\downloaded program files\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.h ... zeb029XXPT
O8 - Extra context menu item: Im Cache gespeicherte Seite - res://c:\windows\downloaded program files\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Verweisseiten - res://c:\windows\downloaded program files\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Ähnliche Seiten - res://c:\windows\downloaded program files\GoogleToolbar1.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://global.acer.com/
O16 - DPF: Arcsoft Web Uploader - http://www.hpphoto.com/downloads/ReadFileApplet.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/mci ... insctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://bin.mcafee.com/molbin/shared/mcg ... cgdmgr.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B6685132-2312-4222-B6AF-C822F0D5EC7F}: NameServer = 194.65.100.117
O18 - Protocol: bw+0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programme\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: Remote Procedure Call (RPC) Helper (O?’ŽrtñåȲ$Ó) - Unknown owner - C:\WINDOWS\system32\netri.exe (file missing)

meine frage lautet! hasse nen Virus programm drauf und ne firewall?????
meine anweisung ist! durchsuch dann ma ersma deinen rechner auf viren und sonstiges!!!!!!!

klar hab ich das. McAfee Virenscan ist installiert und läuft. Firewall ebenfalls.

Hallo@

Um die Diensteverwaltung explizit aufzurufen, geben Sie unter Start > Ausführen den Befehl services.msc ein.

und dann den Eintrag Dienste auswählen. Nun werden alle laufenden Dienste angezeigt. Hier den Punkt " Remote Procedure Call (RPC) Helper (nur genau diesen !!!!!!) " aussuchen. Wenn unter Status "gestartet" steht, mit der rechten Maustaste anklicken und die Option "Eigenschaften" auswählen. Nicht "Den Dienst beenden" auswählen, denn dann wird der
" Remote Procedure Call (RPC) Helper " beim nächsten Systemstart erneut ausgeführt.

Als Starttyp "deaktiviert" auswählen und den Dienststatus mit "Beenden" schliessen. Jetzt noch "Übernehmen" anklicken. Der " " läuft nicht mehr im Hintergrund und wird auch nicht mehr bei einem Neustart ausgeführt.


#öffne das HijackThis-->> Button "scan" -->> Häkchen setzen -->> Button "Fix checked" -->> PC neustarten

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://oqdnfuwnnakmgnjxqordu.net/IZ9sTb ... 4MVuIk.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ggnlewukdtlpicqccku.net/IZ9s ... _6UVM.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\ptqhg.dll/sp.html#12802
O2 - BHO: (no name) - {92259F5C-0A5B-48C5-3279-E2C9455FB2BD} - C:\PROGRA~1\Birdskip\Rule 4.exe (file missing)
O2 - BHO: (no name) - {C9E66AFA-9785-4C9D-6440-F92F818A2A71} - C:\DOKUME~1\Karsten\ANWEND~1\Birdskip\Rule 4.exe
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Messenger\ycomp.dll (file missing)
O4 - HKLM\..\Run: [Dale Soft Locks Third] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\UploadKeepDaleSoft\load rdr.exe
O4 - HKLM\..\Run: [Barb Chin Type Active] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lies Clock Barb Chin\cash warn.exe
O4 - HKCU\..\Run: [LDM] C:\Programme\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [Frag Extra] C:\DOKUME~1\Karsten\ANWEND~1\64INTE~1\ShimCake.exe

O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.h ... zeb029XXPT
O8 - Extra context menu item: Im Cache gespeicherte Seite - res://c:\windows\downloaded program files\GoogleToolbar1.dll/cmcache.html
08 - Extra context menu item: Verweisseiten - res://c:\windows\downloaded program files\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Ähnliche Seiten - res://c:\windows\downloaded program files\GoogleToolbar1.dll/cmsimilar.html
O16 - DPF: Arcsoft Web Uploader - http://www.hpphoto.com/downloads/ReadFileApplet.cab

O18 - Protocol: bw+0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programme\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {2F46312B-744C-49B8-AB61-D7B9E74475C8} - C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O23 - Service: Remote Procedure Call (RPC) Helper (O?’ŽrtñåȲ$Ó) - Unknown owner - C:\WINDOWS\system32\netri.exe (file missing)

PC neustarten


•Download Registry Search Tool :
http://www.billsway.com/vbspage/vbsfiles/RegSrch.zip
Doppelklick:regsrch.vbs

reinkopieren:

O?’ŽrtñåȲ$Ó

poste mir, was angezeigt wird.

•KillBox
http://www.bleepingcomputer.com/files/killbox.php
•Delete File on Reboot <--anhaken

C:\WINDOWS\system32\netri.exe
C:\WINDOWS\ptqhg.dll/sp.html
C:\WINDOWS\ptqhg.dll
C:\DOKUME~1\Karsten\ANWEND~1\Birdskip\Rule 4.exe
C:\Programme\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

C:\Programme\Yahoo!\Messenger\ycomp.dll
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\UploadKeepDaleSoft\load rdr.exe
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lies Clock Barb Chin\cash warn.exe
C:\Programme\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\DOKUME~1\Karsten\ANWEND~1\64INTE~1\ShimCake.exe

und klick auf das rote Kreuz,
wenn gefragt wird, ob "Do you want to reboot? "----> klicke auf "no",und kopiere das naechste rein, erst beim letzten auf "yes"

PC neustarten

_________________________________________________________________________________________________________________


•eScan-Erkennungstool
eSan ist hier unter dem Namen Free eScan Antivirus Toolkit Utility kostenlos erhältlich:
http://www.mwti.net/antivirus/free_utilities.asp
oeffne den Scanner--> noch nicht scannen--> gehe in Start<Ausfuehren< schreib rein: %temp% und suche
kavupd.exe, die klickst du an--> (Update- in DOS) ausführen

-->mwav.exe oeffnen-->alle Haekchen setzen-->scannen-->View Log anklicken--> Bearbeiten anklicken--> "infected" reinschreiben
und nun alles rauskopieren, was angezeigt wird-->

Zwischenzeitlich habe ich alle Anweisungen ausgeführt. Zuletzt habe ich aus dem MVA-Log file alle infizierten Dateien rauskopiert. Was ich damit jetzt anfangen soll, weiss ich leider nicht....

In diesem Zumsammenhang eine Frage. Ich habe das Viren-Programm von McAfee, von dem mir auch regelmäßig up-dates zugeschickt werden. EWas aber nützt mir ein Virenprogramm das 108 Viren auf meinem Rechner nicht erkannt hat? Ist Mc Afee ein schlechtes Produkt oder liegt es einfach am System und daran, dass ich jetzt auch diese anderen Schritte ausgeführt habe.

Und noch eine zweite Frage: am Anfang habe ich anweisungsgemäß den RPC Helper-Dienst ausgeschaltet. Ich gehe mal davon aus, dass er nach wie vor "aus" ist. Soll das so bleiben oder soll ich ihn wieder auf "automatisch" setzen?

Herzl. Grüsse
Karsten

Hallo@SpecialK

der RPC Helper-Dienst wurde vom Virus erstellt, er muss also komplett geloescht werden, auch in der Registry

Du hast leider meine Anweisungen nicht befolgt.

1•Download Registry Search Tool :
http://www.billsway.com/vbspage/vbsfiles/RegSrch.zip
Doppelklick:regsrch.vbs

reinkopieren:

O?’ŽrtñåȲ$Ó

poste mir, was angezeigt wird..

#öffne das HijackThis-->> Button "scan" -->> Häkchen setzen -->> Button "Fix checked" -->> PC neustarten

alles, was ich geschrieben hatte.................

PC neustarten


2•eScan-Erkennungstool
eSan ist hier unter dem Namen Free eScan Antivirus Toolkit Utility kostenlos erhältlich:
http://www.mwti.net/antivirus/free_utilities.asp
oeffne den Scanner--> noch nicht scannen--> gehe in Start<Ausfuehren< schreib rein: %temp% und suche
kavupd.exe, die klickst du an--> (Update- in DOS) ausführen

-->mwav.exe oeffnen-->alle Haekchen setzen-->scannen-->View Log anklicken--> Bearbeiten anklicken--> "infected" reinschreiben
und nun alles rauskopieren, was angezeigt wird-->

Sorry, ich habe genau die Anweisungen ausgeführt, bis zum letzten Punkt. Ich hatte auch schon den RegSearch-LogFile geposted, dabei aber glaube ich einen Fehler gemacht und diese Datei als private Nachricht verschickt. Ist sie nicht angekommen????

Vielleicht war also nur meine Frage blöd und nicht was ich getan habe.

Hinsichtlich des letzten Schritts habe ich alle infizierten Dateien rauskopiert und schicke sie nachstehend mit:

***********************************************

Mon Mar 07 11:34:33 2005 => File C:\WINDOWS\n_vxdtzx.dat infected by "Trojan-Downloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
Mon Mar 07 11:34:50 2005 => File C:\WINDOWS\n_rkrcgc.dat infected by "Trojan-Downloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
Mon Mar 07 11:35:22 2005 => File C:\WINDOWS\crjq.dll infected by "Trojan-Downloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
Mon Mar 07 11:35:36 2005 => File C:\WINDOWS\windc.dll infected by "Trojan-Downloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
Mon Mar 07 11:35:38 2005 => File C:\WINDOWS\winuw.dll infected by "Trojan-Downloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
Mon Mar 07 11:42:18 2005 => File C:\WINDOWS\system32\f3pssavr.scr infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken.
Mon Mar 07 11:48:04 2005 => File C:\WINDOWS\system32\addvv32.dll infected by "Trojan-Downloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
Mon Mar 07 11:53:13 2005 => File C:\DOKUME~1\Karsten\LOKALE~1\Temp\nytyjdhh.exe infected by "not-a-virus:AdWare.Lop.k" Virus. Action Taken: No Action Taken.
Mon Mar 07 14:34:37 2005 => File C:\WINDOWS\system32\f3pssavr.scr infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken.
Mon Mar 07 14:40:36 2005 => File C:\WINDOWS\system32\addvv32.dll infected by "Trojan-Downloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
Mon Mar 07 15:50:01 2005 => File C:\WINDOWS\Temp\Altnet\adm4.dll infected by "not-a-virus:AdWare.Altnet.b" Virus. Action Taken: No Action Taken.
Mon Mar 07 15:50:02 2005 => File C:\WINDOWS\Temp\Altnet\adm25.dll infected by "not-a-virus:AdWare.Altnet.b" Virus. Action Taken: No Action Taken.
Mon Mar 07 15:50:02 2005 => File C:\WINDOWS\Temp\Altnet\adm.exe infected by "not-a-virus:AdWare.Altnet.b" Virus. Action Taken: No Action Taken.
Mon Mar 07 15:50:02 2005 => File C:\WINDOWS\Temp\Altnet\admdata.dll infected by "not-a-virus:AdWare.Altnet.b" Virus. Action Taken: No Action Taken.
Mon Mar 07 15:50:03 2005 => File C:\WINDOWS\Temp\Altnet\admdloader.dll infected by "not-a-virus:AdWare.Altnet.b" Virus. Action Taken: No Action Taken.
Mon Mar 07 15:50:03 2005 => File C:\WINDOWS\Temp\Altnet\admfdi.dll infected by "not-a-virus:AdWare.Altnet.b" Virus. Action Taken: No Action Taken.
Mon Mar 07 15:50:04 2005 => File C:\WINDOWS\Temp\Altnet\admprog.dll infected by "not-a-virus:AdWare.Altnet.b" Virus. Action Taken: No Action Taken.
Mon Mar 07 15:50:08 2005 => File C:\WINDOWS\Temp\Altnet\dmfiles.cab infected by "not-a-virus:AdWare.Altnet.b" Virus. Action Taken: No Action Taken.
Mon Mar 07 15:50:11 2005 => File C:\WINDOWS\Temp\Altnet\mysearch.cab infected by "not-a-virus:AdWare.ToolBar.MyWay.g" Virus. Action Taken: No Action Taken.
Mon Mar 07 15:50:18 2005 => File C:\WINDOWS\Temp\Altnet\pmfiles.cab infected by "not-a-virus:AdWare.BrilliantDigital.1007" Virus. Action Taken: No Action Taken.
Mon Mar 07 15:50:20 2005 => File C:\WINDOWS\Temp\Altnet\Setup.exe infected by "not-a-virus:AdWare.Altnet.b" Virus. Action Taken: No Action Taken.
Mon Mar 07 16:00:03 2005 => File C:\WINDOWS\Downloaded Program Files\f12802.exe infected by "Trojan-Downloader.Win32.WinShow.w" Virus. Action Taken: No Action Taken.
Mon Mar 07 17:47:51 2005 => File C:\WINDOWS\n_vxdtzx.dat infected by "Trojan-Downloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
Mon Mar 07 17:49:08 2005 => File C:\WINDOWS\n_rkrcgc.dat infected by "Trojan-Downloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
Mon Mar 07 18:39:43 2005 => File C:\WINDOWS\crjq.dll infected by "Trojan-Downloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
Mon Mar 07 18:41:16 2005 => File C:\WINDOWS\windc.dll infected by "Trojan-Downloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
Mon Mar 07 18:41:26 2005 => File C:\WINDOWS\winuw.dll infected by "Trojan-Downloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
Mon Mar 07 18:44:22 2005 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lies Clock Barb Chin\once idle.exe infected by "Trojan.Win32.Krepper.ab" Virus. Action Taken: No Action Taken.
Mon Mar 07 18:44:25 2005 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lies Clock Barb Chin\LessMeta.exe infected by "Trojan-Downloader.Win32.Swizzor.bz" Virus. Action Taken: No Action Taken.
Mon Mar 07 18:44:28 2005 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lies Clock Barb Chin\cornpure.exe infected by "Trojan-Downloader.Win32.Swizzor.bz" Virus. Action Taken: No Action Taken.
Mon Mar 07 18:44:31 2005 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lies Clock Barb Chin\MATH FLAW.exe infected by "Trojan-Downloader.Win32.Swizzor.cn" Virus. Action Taken: No Action Taken.
Mon Mar 07 18:44:35 2005 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lies Clock Barb Chin\StyleReadme.exe infected by "Trojan-Downloader.Win32.Swizzor.cn" Virus. Action Taken: No Action Taken.
Mon Mar 07 18:44:39 2005 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lies Clock Barb Chin\jugs book.exe infected by "not-a-virus:AdWare.Lop.j" Virus. Action Taken: No Action Taken.
Mon Mar 07 18:51:23 2005 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\CoolWWWSearchAffWinshow12.zip infected by "Password-protected-EXE" Virus. Action Taken: No Action Taken.
Mon Mar 07 18:55:20 2005 => File C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\64 Internet\ShimCake.exe infected by "not-a-virus:AdWare.Lop.e" Virus. Action Taken: No Action Taken.
Mon Mar 07 18:55:21 2005 => File C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\64 Internet\yhieusdk.exe infected by "Trojan-Downloader.Win32.Swizzor.cm" Virus. Action Taken: No Action Taken.
Mon Mar 07 19:12:53 2005 => File C:\Dokumente und Einstellungen\Karsten\Lokale Einstellungen\Temp\sta267.exe infected by "not-a-virus:AdWare.Lop.k" Virus. Action Taken: No Action Taken.
Mon Mar 07 19:12:54 2005 => File C:\Dokumente und Einstellungen\Karsten\Lokale Einstellungen\Temp\2cc76a.exe infected by "Trojan-Downloader.Win32.Swizzor.ca" Virus. Action Taken: No Action Taken.
Mon Mar 07 19:13:40 2005 => File C:\Dokumente und Einstellungen\Karsten\Lokale Einstellungen\Temporary Internet Files\Content.IE5\CWDLBOWK\upAYB_unk[1].int infected by "Trojan-Downloader.Win32.Swizzor.ca" Virus. Action Taken: No Action Taken.
Mon Mar 07 20:40:18 2005 => File C:\Dokumente und Einstellungen\Karsten\Anwendungsdaten\64 Internet\xeuyykyf.exe infected by "Trojan-Downloader.Win32.Swizzor.bz" Virus. Action Taken: No Action Taken.
Mon Mar 07 20:40:18 2005 => File C:\Dokumente und Einstellungen\Karsten\Anwendungsdaten\64 Internet\two owns wait media.exe infected by "not-a-virus:AdWare.Lop.l" Virus. Action Taken: No Action Taken.
Mon Mar 07 20:40:19 2005 => File C:\Dokumente und Einstellungen\Karsten\Anwendungsdaten\64 Internet\Title Find Log.exe infected by "Trojan-Downloader.Win32.Swizzor.cb" Virus. Action Taken: No Action Taken.
Mon Mar 07 20:40:20 2005 => File C:\Dokumente und Einstellungen\Karsten\Anwendungsdaten\64 Internet\Delete ball bike mess.exe infected by "Trojan-Downloader.Win32.Swizzor.ca" Virus. Action Taken: No Action Taken.
Mon Mar 07 20:40:21 2005 => File C:\Dokumente und Einstellungen\Karsten\Anwendungsdaten\64 Internet\eogzmvbh.exe infected by "Trojan-Downloader.Win32.Swizzor.cc" Virus. Action Taken: No Action Taken.
Mon Mar 07 20:40:23 2005 => File C:\Dokumente und Einstellungen\Karsten\Anwendungsdaten\64 Internet\scxhlqah.exe infected by "Trojan-Downloader.Win32.Swizzor.bz" Virus. Action Taken: No Action Taken.
Mon Mar 07 20:40:23 2005 => File C:\Dokumente und Einstellungen\Karsten\Anwendungsdaten\64 Internet\Thatthat.exe infected by "not-a-virus:AdWare.Lop.l" Virus. Action Taken: No Action Taken.
Mon Mar 07 20:40:25 2005 => File C:\Dokumente und Einstellungen\Karsten\Anwendungsdaten\64 Internet\pqjjwsib.exe infected by "Trojan-Downloader.Win32.Swizzor.cn" Virus. Action Taken: No Action Taken.
Mon Mar 07 20:40:26 2005 => File C:\Dokumente und Einstellungen\Karsten\Anwendungsdaten\64 Internet\lrzcixth.exe infected by "Trojan-Downloader.Win32.Swizzor.cc" Virus. Action Taken: No Action Taken.
Mon Mar 07 20:40:28 2005 => File C:\Dokumente und Einstellungen\Karsten\Anwendungsdaten\64 Internet\axpakjfs.exe infected by "Trojan-Downloader.Win32.Swizzor.cn" Virus. Action Taken: No Action Taken.
Mon Mar 07 20:40:28 2005 => File C:\Dokumente und Einstellungen\Karsten\Anwendungsdaten\64 Internet\ogpdfnrk.exe infected by "Trojan-Downloader.Win32.Swizzor.cc" Virus. Action Taken: No Action Taken.
Mon Mar 07 20:40:29 2005 => File C:\Dokumente und Einstellungen\Karsten\Anwendungsdaten\64 Internet\itiglpms.exe infected by "Trojan-Downloader.Win32.Swizzor.cc" Virus. Action Taken: No Action Taken.
Mon Mar 07 20:40:31 2005 => File C:\Dokumente und Einstellungen\Karsten\Anwendungsdaten\64 Internet\qtzrxlrg.exe infected by "not-a-virus:AdWare.Lop.j" Virus. Action Taken: No Action Taken.
Mon Mar 07 20:40:33 2005 => File C:\Dokumente und Einstellungen\Karsten\Anwendungsdaten\64 Internet\ShimCake.exe infected by "not-a-virus:AdWare.Lop.k" Virus. Action Taken: No Action Taken.
Mon Mar 07 20:40:35 2005 => File C:\Dokumente und Einstellungen\Karsten\Anwendungsdaten\64 Internet\mgnegndz.exe infected by "not-a-virus:AdWare.Lop.j" Virus. Action Taken: No Action Taken.
Mon Mar 07 21:18:20 2005 => File C:\Dokumente und Einstellungen\Karsten\Anwendungsdaten\Birdskip\Rule 4.exe infected by "Trojan-Downloader.Win32.Swizzor.bo" Virus. Action Taken: No Action Taken.
Mon Mar 07 23:48:15 2005 => File C:\System Volume Information\_restore{E4CC41E2-8539-44EA-ACBB-E21C485D2268}\RP272\A0042700.exe infected by "Trojan-Downloader.Win32.Swizzor.bo" Virus. Action Taken: No Action Taken.
Mon Mar 07 23:48:21 2005 => File C:\System Volume Information\_restore{E4CC41E2-8539-44EA-ACBB-E21C485D2268}\RP272\A0042709.exe infected by "not-a-virus:AdWare.Lop.k" Virus. Action Taken: No Action Taken.
Mon Mar 07 23:48:23 2005 => File C:\System Volume Information\_restore{E4CC41E2-8539-44EA-ACBB-E21C485D2268}\RP272\A0042711.exe infected by "not-a-virus:AdWare.Lop.j" Virus. Action Taken: No Action Taken.
Mon Mar 07 23:48:28 2005 => File C:\System Volume Information\_restore{E4CC41E2-8539-44EA-ACBB-E21C485D2268}\RP272\A0042719.exe infected by "Trojan.Win32.Krepper.ab" Virus. Action Taken: No Action Taken.
Mon Mar 07 23:48:30 2005 => File C:\System Volume Information\_restore{E4CC41E2-8539-44EA-ACBB-E21C485D2268}\RP272\A0042720.exe infected by "Trojan-Downloader.Win32.Swizzor.bz" Virus. Action Taken: No Action Taken.
Mon Mar 07 23:48:32 2005 => File C:\System Volume Information\_restore{E4CC41E2-8539-44EA-ACBB-E21C485D2268}\RP272\A0042721.exe infected by "Trojan-Downloader.Win32.Swizzor.bz" Virus. Action Taken: No Action Taken.
Mon Mar 07 23:48:35 2005 => File C:\System Volume Information\_restore{E4CC41E2-8539-44EA-ACBB-E21C485D2268}\RP272\A0042722.exe infected by "Trojan-Downloader.Win32.Swizzor.cn" Virus. Action Taken: No Action Taken.
Mon Mar 07 23:48:37 2005 => File C:\System Volume Information\_restore{E4CC41E2-8539-44EA-ACBB-E21C485D2268}\RP272\A0042723.exe infected by "Trojan-Downloader.Win32.Swizzor.cn" Virus. Action Taken: No Action Taken.
Mon Mar 07 23:48:38 2005 => File C:\System Volume Information\_restore{E4CC41E2-8539-44EA-ACBB-E21C485D2268}\RP272\A0042724.exe infected by "Trojan-Downloader.Win32.Swizzor.ca" Virus. Action Taken: No Action Taken.
Mon Mar 07 23:48:40 2005 => File C:\System Volume Information\_restore{E4CC41E2-8539-44EA-ACBB-E21C485D2268}\RP272\A0042725.exe infected by "Trojan-Downloader.Win32.Swizzor.cb" Virus. Action Taken: No Action Taken.
Mon Mar 07 23:49:17 2005 => File C:\System Volume Information\_restore{E4CC41E2-8539-44EA-ACBB-E21C485D2268}\RP225\A0034288.exe infected by "not-a-virus:AdWare.Lop.e" Virus. Action Taken: No Action Taken.
Mon Mar 07 23:49:19 2005 => File C:\System Volume Information\_restore{E4CC41E2-8539-44EA-ACBB-E21C485D2268}\RP225\A0034289.exe infected by "Trojan.Win32.Krepper.ab" Virus. Action Taken: No Action Taken.
Mon Mar 07 23:49:21 2005 => File C:\System Volume Information\_restore{E4CC41E2-8539-44EA-ACBB-E21C485D2268}\RP225\A0034290.exe infected by "Trojan-Downloader.Win32.Swizzor.bz" Virus. Action Taken: No Action Taken.
Mon Mar 07 23:49:22 2005 => File C:\System Volume Information\_restore{E4CC41E2-8539-44EA-ACBB-E21C485D2268}\RP225\A0034291.exe infected by "Trojan-Downloader.Win32.Swizzor.bo" Virus. Action Taken: No Action Taken.
Mon Mar 07 23:49:23 2005 => File C:\System Volume Information\_restore{E4CC41E2-8539-44EA-ACBB-E21C485D2268}\RP225\A0034292.exe infected by "Trojan-Downloader.Win32.Swizzor.ca" Virus. Action Taken: No Action Taken.
Mon Mar 07 23:49:24 2005 => File C:\System Volume Information\_restore{E4CC41E2-8539-44EA-ACBB-E21C485D2268}\RP225\A0034293.exe infected by "Trojan-Downloader.Win32.Swizzor.cb" Virus. Action Taken: No Action Taken.
Mon Mar 07 23:50:37 2005 => File C:\System Volume Information\_restore{E4CC41E2-8539-44EA-ACBB-E21C485D2268}\RP229\A0035380.exe infected by "not-a-virus:AdWare.Lop.e" Virus. Action Taken: No Action Taken.
Mon Mar 07 23:50:39 2005 => File C:\System Volume Information\_restore{E4CC41E2-8539-44EA-ACBB-E21C485D2268}\RP229\A0035381.exe infected by "Trojan.Win32.Krepper.ab" Virus. Action Taken: No Action Taken.
Mon Mar 07 23:50:41 2005 => File C:\System Volume Information\_restore{E4CC41E2-8539-44EA-ACBB-E21C485D2268}\RP229\A0035382.exe infected by "Trojan-Downloader.Win32.Swizzor.bz" Virus. Action Taken: No Action Taken.
Mon Mar 07 23:50:44 2005 => File C:\System Volume Information\_restore{E4CC41E2-8539-44EA-ACBB-E21C485D2268}\RP229\A0035383.exe infected by "Trojan-Downloader.Win32.Swizzor.bz" Virus. Action Taken: No Action Taken.
Mon Mar 07 23:50:45 2005 => File C:\System Volume Information\_restore{E4CC41E2-8539-44EA-ACBB-E21C485D2268}\RP229\A0035384.exe infected by "Trojan-Downloader.Win32.Swizzor.bo" Virus. Action Taken: No Action Taken.
Mon Mar 07 23:50:46 2005 => File C:\System Volume Information\_restore{E4CC41E2-8539-44EA-ACBB-E21C485D2268}\RP229\A0035385.exe infected by "Trojan-Downloader.Win32.Swizzor.cm" Virus. Action Taken: No Action Taken.
Mon Mar 07 23:50:47 2005 => File C:\System Volume Information\_restore{E4CC41E2-8539-44EA-ACBB-E21C485D2268}\RP229\A0035386.exe infected by "Trojan-Downloader.Win32.Swizzor.cb" Virus. Action Taken: No Action Taken.
Mon Mar 07 23:55:04 2005 => File C:\System Volume Information\_restore{E4CC41E2-8539-44EA-ACBB-E21C485D2268}\RP237\A0035740.exe infected by "Trojan-Downloader.Win32.Swizzor.cp" Virus. Action Taken: No Action Taken.
Mon Mar 07 23:55:07 2005 => File C:\System Volume Information\_restore{E4CC41E2-8539-44EA-ACBB-E21C485D2268}\RP237\A0035741.exe infected by "Trojan.Win32.Krepper.ab" Virus. Action Taken: No Action Taken.
Mon Mar 07 23:55:09 2005 => File C:\System Volume Information\_restore{E4CC41E2-8539-44EA-ACBB-E21C485D2268}\RP237\A0035742.exe infected by "Trojan-Downloader.Win32.Swizzor.bz" Virus. Action Taken: No Action Taken.
Mon Mar 07 23:55:11 2005 => File C:\System Volume Information\_restore{E4CC41E2-8539-44EA-ACBB-E21C485D2268}\RP237\A0035743.exe infected by "Trojan-Downloader.Win32.Swizzor.bz" Virus. Action Taken: No Action Taken.
Mon Mar 07 23:55:13 2005 => File C:\System Volume Information\_restore{E4CC41E2-8539-44EA-ACBB-E21C485D2268}\RP237\A0035744.exe infected by "Trojan-Downloader.Win32.Swizzor.cn" Virus. Action Taken: No Action Taken.
Mon Mar 07 23:55:14 2005 => File C:\System Volume Information\_restore{E4CC41E2-8539-44EA-ACBB-E21C485D2268}\RP237\A0035745.exe infected by "Trojan-Downloader.Win32.Swizzor.bo" Virus. Action Taken: No Action Taken.
Mon Mar 07 23:55:16 2005 => File C:\System Volume Information\_restore{E4CC41E2-8539-44EA-ACBB-E21C485D2268}\RP237\A0035746.exe infected by "Trojan-Downloader.Win32.Swizzor.cc" Virus. Action Taken: No Action Taken.
Mon Mar 07 23:55:17 2005 => File C:\System Volume Information\_restore{E4CC41E2-8539-44EA-ACBB-E21C485D2268}\RP237\A0035747.exe infected by "Trojan-Downloader.Win32.Swizzor.cb" Virus. Action Taken: No Action Taken.
Tue Mar 08 00:40:52 2005 => File C:\WINDOWS\system32\f3pssavr.scr infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken.
Tue Mar 08 00:47:18 2005 => File C:\WINDOWS\system32\addvv32.dll infected by "Trojan-Downloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
Tue Mar 08 02:04:10 2005 => File C:\WINDOWS\Temp\Altnet\adm4.dll infected by "not-a-virus:AdWare.Altnet.b" Virus. Action Taken: No Action Taken.
Tue Mar 08 02:04:11 2005 => File C:\WINDOWS\Temp\Altnet\adm25.dll infected by "not-a-virus:AdWare.Altnet.b" Virus. Action Taken: No Action Taken.
Tue Mar 08 02:04:11 2005 => File C:\WINDOWS\Temp\Altnet\adm.exe infected by "not-a-virus:AdWare.Altnet.b" Virus. Action Taken: No Action Taken.
Tue Mar 08 02:04:11 2005 => File C:\WINDOWS\Temp\Altnet\admdata.dll infected by "not-a-virus:AdWare.Altnet.b" Virus. Action Taken: No Action Taken.
Tue Mar 08 02:04:12 2005 => File C:\WINDOWS\Temp\Altnet\admdloader.dll infected by "not-a-virus:AdWare.Altnet.b" Virus. Action Taken: No Action Taken.
Tue Mar 08 02:04:12 2005 => File C:\WINDOWS\Temp\Altnet\admfdi.dll infected by "not-a-virus:AdWare.Altnet.b" Virus. Action Taken: No Action Taken.
Tue Mar 08 02:04:13 2005 => FileTue Mar 08 02:14:50 2005 => File C:\WINDOWS\Downloaded Program Files\f12802.exe infected by "Trojan-Downloader.Win32.WinShow.w" Virus. Action Taken: No Action Taken. C:\WINDOWS\Temp\Altnet\admprog.dll infected by "not-a-virus:AdWare.Altnet.b" Virus. Action Taken: No Action Taken.
Tue Mar 08 02:04:17 2005 => File C:\WINDOWS\Temp\Altnet\dmfiles.cab infected by "not-a-virus:AdWare.Altnet.b" Virus. Action Taken: No Action Taken.
Tue Mar 08 02:04:21 2005 => File C:\WINDOWS\Temp\Altnet\mysearch.cab infected by "not-a-virus:AdWare.ToolBar.MyWay.g" Virus. Action Taken: No Action Taken.
Tue Mar 08 02:04:28 2005 => File C:\WINDOWS\Temp\Altnet\pmfiles.cab infected by "not-a-virus:AdWare.BrilliantDigital.1007" Virus. Action Taken: No Action Taken.
Tue Mar 08 02:04:30 2005 => File C:\WINDOWS\Temp\Altnet\Setup.exe
Tue Mar 08 03:44:14 2005 => File C:\WINDOWS\n_vxdtzx.dat infected by "Trojan-Downloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
Tue Mar 08 03:45:16 2005 => File C:\WINDOWS\n_rkrcgc.dat infected by "Trojan-Downloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
Tue Mar 08 04:21:49 2005 => File C:\WINDOWS\crjq.dll infected by "Trojan-Downloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
Tue Mar 08 04:22:42 2005 => File C:\WINDOWS\windc.dll infected by "Trojan-Downloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
Tue Mar 08 04:22:50 2005 => File C:\WINDOWS\winuw.dll infected by "Trojan-Downloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
infected by "not-a-virus:AdWare.Altnet.b" Virus. Action Taken: No Action Taken.


****************************************************
Was soll ich jetzt damit machen???


Vielen Dank für die Geduld....

1•Download Registry Search Tool :
http://www.billsway.com/vbspage/vbsfiles/RegSrch.zip
Doppelklick:regsrch.vbs

reinkopieren:

O?’ŽrtñåȲ$Ó

poste mir, was angezeigt wird

Da ich die datei von gestern so schnell icht gefunden habe, habe ich noch mal das Programm laufen lassen. Hier also das Ergebnis:


REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "O?’ŽrtñåȲ$Ó" 08-03-2005 10:20:33

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_O?*001E*2019*017DRT*00F1*00E5*00C8*00B2$*000E*00D3\0000]
"Service"="O?’ŽrtñåȲ$Ó"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_O?*001E*2019*017DRT*00F1*00E5*00C8*00B2$*000E*00D3\0000]
"Service"="O?’ŽrtñåȲ$Ó"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\O?’ŽrtñåȲ$Ó]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\O?’ŽrtñåȲ$Ó\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_O?*001E*2019*017DRT*00F1*00E5*00C8*00B2$*000E*00D3\0000]
"Service"="O?’ŽrtñåȲ$Ó"

SpecialK hat geschrieben:Da ich die datei von gestern so schnell icht gefunden habe, habe ich noch mal das Programm laufen lassen. Hier also das Ergebnis:


REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "O?’ŽrtñåȲ$Ó" 08-03-2005 10:20:33

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_O?*001E*2019*017DRT*00F1*00E5*00C8*00B2$*000E*00D3\0000]
"Service"="O?’ŽrtñåȲ$Ó"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_O?*001E*2019*017DRT*00F1*00E5*00C8*00B2$*000E*00D3\0000]
"Service"="O?’ŽrtñåȲ$Ó"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\O?’ŽrtñåȲ$Ó]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\O?’ŽrtñåȲ$Ó\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_O?*001E*2019*017DRT*00F1*00E5*00C8*00B2$*000E*00D3\0000]
"Service"="O?’ŽrtñåȲ$Ó"

nun so schnell wie moeglich alle Viren und Malware loeschen, denn der Dienst ist schon aus der Registry geloescht !!!!!!!!!!!!!

nach den Anweisungen soll ich ja alle angezeigten Dateien in KillBox kopieren damit sie nach dem reboot gelöscht werden.
Tue ich das und klicke dann auf das rote "x" und sage zu "jetzt rebooten" "nein", dann ist das Eingabefeld wieder leer aber auch in dem aufklappbaren Menü ist die bereits kopierte Datei nicht mehr vorhanden. Ich gehe davon aus, das doch am Ende alle reinkopierten Dateien angezeigt werden müssten, oder?! Muss ich noch weitere Einstellungen in KillBox vornehmen, damit es mehr als nur eine Datei beim rebooten löscht?

es geht etwas turbulent zu heute morgen.
Also: Viren und Malware so schnell wie möglich löschen, aber wie? Mein McAfee Virenscanner hat diese Viren ja offenbar nicht erkannt. Muss ich den MVA kaufen?

Sorry für soviele unbeholfene Fragen.......

na ja, die letzte Frage hinsichtlich der Entfernung hat sich natürlich erledigt....
sage ja, alles etwas turbulent heute morgen, sorry!

KillBox kann nicht beendet werden. Wenn der PC neu gebootet werden soll erscheint die Fehlermeldung

"PendingFileRenameOperations Registry Data has been Removed my External Process"

was tun?