Hallo zusammen,

bereits abeim einschalten des PC überschüttete mich das Virenprogramm mit Warnungen über Trojaner und Würmer.

Anbei das Log File.

Bitte werft mal einen Blick drauf. Kann man das noch reparieren oder hilft nur eine neue Formatierung??

Danke im voraus

Logfile of HijackThis v1.99.1
Scan saved at 13:20:41, on 31.12.2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\dmrproc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Dokumente und Einstellungen\Günther\Lokale Einstellungen\Temp\Temporäres Verzeichnis 2 für hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.msn.de/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.de/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O2 - BHO: (no name) - {30B7F5B8-7F41-4E65-8D06-FAF69077B61A} - C:\WINDOWS\System32\ddcyx.dll
O2 - BHO: (no name) - {3FD6B99C-A275-46ea-8FD1-3D63986E51E4} - C:\WINDOWS\System32\ywnwsoru.dll (file missing)
O2 - BHO: (no name) - {F22656E2-02AA-43A9-BED5-0331CDFD72D0} - C:\WINDOWS\System32\byxutrq.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [defender] C:\\dfndrad_5.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrdad_5.exe
O4 - HKLM\..\Run: [DllRunning] rundll32.exe "C:\WINDOWS\System32\aduyipjy.dll",setvm
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: VR-NetWorld Auftragsprüfung.lnk = C:\Programme\VR-NetWorld\VRToolCheckOrder.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{97D92AD0-C544-4615-BFB9-383834602AC0}: NameServer = 217.237.151.115 217.237.150.51
O20 - Winlogon Notify: byxutrq - C:\WINDOWS\SYSTEM32\byxutrq.dll
O20 - Winlogon Notify: ddcyx - C:\WINDOWS\System32\ddcyx.dll
O20 - Winlogon Notify: Hints - C:\WINDOWS\system32\mv4ml9h11.dll (file missing)
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Debug Window Services - Unknown owner - C:\WINDOWS\system32\bug32.exe (file missing)
O23 - Service: Microsoft Windows DMR Service (Windows DMR Service) - Unknown owner - C:\WINDOWS\dmrproc.exe

O2 - BHO: (no name) - {3FD6B99C-A275-46ea-8FD1-3D63986E51E4} - C:\WINDOWS\System32\ywnwsoru.dll (file missing)
C:\WINDOWS\dmrproc.exe
O2 - BHO: (no name) - {F22656E2-02AA-43A9-BED5-0331CDFD72D0} - C:\WINDOWS\System32\byxutrq.dll
O4 - HKLM..Run: [defender] C:\dfndrad_5.exe
O4 - HKLM..Run: [keyboard] C:\kybrdad_5.exe
O4 - HKLM\..\Run: [DllRunning] rundll32.exe "C:\WINDOWS\System32\aduyipjy.dll",setvm
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O20 - Winlogon Notify: byxutrq - C:\WINDOWS\SYSTEM32\byxutrq.dll
O20 - Winlogon Notify: ddcyx - C:\WINDOWS\System32\ddcyx.dll
O20 - Winlogon Notify: Hints - C:\WINDOWS\system32\mv4ml9h11.dll (file missing)
O23 - Service: Microsoft Windows DMR Service (Windows DMR Service) - Unknown owner - C:\WINDOWS\dmrproc.exe
O23 - Service: Debug Window Services - Unknown owner - C:\WINDOWS\system32\bug32.exe

ohohoh, das sieht verdammt schlecht aus..
1. lade dir dieses toll runter und las es durchlaufen:
-link entfernt-das ist wohl ein faketool-
2. mache den online-scan auf www.bitdefender.de und stelle den report hier rein
3. lade dir spybot und ad-aware(siehe signatur) runter und lasse sieh einen vollständigen systemscan machen
4. fixe folgenden eintrag mit hijackthis(haken davor, fix checked)
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
5. erstelle erneut ein hijackthis-logfile
dann sehen wir weiter
bitte lass nichts davon aus^^

Danke erstmal für die schnelle Hilfe.

Da das Problem auf dem PC meines Kumpels vorliegt, und der noch weniger Ahnung hat als ich, werde ich die Sache erst am Dienstag od. Mittwoch (02.; 03.01.07) abarbeiten können. Würde mich freuen, wenn du dann die Tage noch mal nachschauen könntest was weiter zu erledigen ist.
vorerst Danke für die Hilfe und die Tipps.
Und guten Rutsch....

Hir schon mal das Log von bitdefender.

Rest folgt im Laufe des Tages.

BitDefender Online Scanner



Scan report generated at: Wed, Jan 03, 2007 - 09:44:20





Scan path: A:\;C:\;D:\;E:\;







Statistics

Time
00:31:51

Files
47550

Folders
859

Boot Sectors
3

Archives
763

Packed Files
3530




Results

Identified Viruses
2

Infected Files
20

Suspect Files
35

Warnings
0

Disinfected
0

Deleted Files
55




Engines Info

Virus Definitions
366306

Engine build
AVCORE v1.0 (build 2371) (i386) (Dec 13 2006 11:16:42)

Scan plugins
14

Archive plugins
38

Unpack plugins
6

E-mail plugins
6

System plugins
1




Scan Settings

First Action
Disinfect

Second Action
Delete

Heuristics
Yes

Enable Warnings
Yes

Scanned Extensions
*;

Exclude Extensions


Scan Emails
Yes

Scan Archives
Yes

Scan Packed
Yes

Scan Files
Yes

Scan Boot
Yes




Scanned File
Status

C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\WHAROXMB\pro[1].exe=>(RAR Sfx o)=>neo.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\WHAROXMB\pro[1].exe=>(RAR Sfx o)=>neo.exe
Disinfection failed

C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\WHAROXMB\pro[1].exe=>(RAR Sfx o)=>neo.exe
Deleted

C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\WHAROXMB\pro[1].exe=>(RAR Sfx o)
Update failed

C:\lip3_install.exe=>(RAR Sfx o)=>neo.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\lip3_install.exe=>(RAR Sfx o)=>neo.exe
Disinfection failed

C:\lip3_install.exe=>(RAR Sfx o)=>neo.exe
Deleted

C:\lip3_install.exe=>(RAR Sfx o)
Update failed

C:\spb_install.exe=>(RAR Sfx o)=>neo.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\spb_install.exe=>(RAR Sfx o)=>neo.exe
Disinfection failed

C:\spb_install.exe=>(RAR Sfx o)=>neo.exe
Deleted

C:\spb_install.exe=>(RAR Sfx o)
Update failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP40\A0014807.exe=>(RAR Sfx o)=>rasmed.exe
Infected with: MemScan:Trojan.Virtumod.T

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP40\A0014807.exe=>(RAR Sfx o)=>rasmed.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP40\A0014807.exe=>(RAR Sfx o)=>rasmed.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP40\A0014807.exe=>(RAR Sfx o)
Update failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP40\A0014807.exe=>(RAR Sfx o)=>neo.exe
Infected with: Trojan.Downloader.Tibs.BO

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP40\A0014807.exe=>(RAR Sfx o)=>neo.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP40\A0014807.exe=>(RAR Sfx o)=>neo.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP40\A0014807.exe=>(RAR Sfx o)
Update failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP40\A0014815.exe=>(RAR Sfx o)=>rasmed.exe
Infected with: MemScan:Trojan.Virtumod.T

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP40\A0014815.exe=>(RAR Sfx o)=>rasmed.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP40\A0014815.exe=>(RAR Sfx o)=>rasmed.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP40\A0014815.exe=>(RAR Sfx o)
Update failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP40\A0014815.exe=>(RAR Sfx o)=>neo.exe
Infected with: Trojan.Downloader.Tibs.BO

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP40\A0014815.exe=>(RAR Sfx o)=>neo.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP40\A0014815.exe=>(RAR Sfx o)=>neo.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP40\A0014815.exe=>(RAR Sfx o)
Update failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP40\A0015815.exe=>(RAR Sfx o)=>rasmed.exe
Infected with: MemScan:Trojan.Virtumod.T

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP40\A0015815.exe=>(RAR Sfx o)=>rasmed.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP40\A0015815.exe=>(RAR Sfx o)=>rasmed.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP40\A0015815.exe=>(RAR Sfx o)
Update failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP40\A0015815.exe=>(RAR Sfx o)=>neo.exe
Infected with: Trojan.Downloader.Tibs.BO

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP40\A0015815.exe=>(RAR Sfx o)=>neo.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP40\A0015815.exe=>(RAR Sfx o)=>neo.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP40\A0015815.exe=>(RAR Sfx o)
Update failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP40\A0015823.exe=>(RAR Sfx o)=>rasmed.exe
Infected with: MemScan:Trojan.Virtumod.T

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP40\A0015823.exe=>(RAR Sfx o)=>rasmed.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP40\A0015823.exe=>(RAR Sfx o)=>rasmed.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP40\A0015823.exe=>(RAR Sfx o)
Update failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP40\A0015823.exe=>(RAR Sfx o)=>neo.exe
Infected with: Trojan.Downloader.Tibs.BO

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP40\A0015823.exe=>(RAR Sfx o)=>neo.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP40\A0015823.exe=>(RAR Sfx o)=>neo.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP40\A0015823.exe=>(RAR Sfx o)
Update failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP41\A0015855.exe=>(RAR Sfx o)=>neo.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP41\A0015855.exe=>(RAR Sfx o)=>neo.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP41\A0015855.exe=>(RAR Sfx o)=>neo.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP41\A0015855.exe=>(RAR Sfx o)
Update failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP41\A0015863.exe=>(RAR Sfx o)=>neo.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP41\A0015863.exe=>(RAR Sfx o)=>neo.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP41\A0015863.exe=>(RAR Sfx o)=>neo.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP41\A0015863.exe=>(RAR Sfx o)
Update failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP41\A0015926.exe=>(RAR Sfx o)=>neo.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP41\A0015926.exe=>(RAR Sfx o)=>neo.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP41\A0015926.exe=>(RAR Sfx o)=>neo.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP41\A0015926.exe=>(RAR Sfx o)
Update failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015937.exe=>(RAR Sfx o)=>neo.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015937.exe=>(RAR Sfx o)=>neo.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015937.exe=>(RAR Sfx o)=>neo.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015937.exe=>(RAR Sfx o)
Update failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015938.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015938.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015938.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015947.exe=>(RAR Sfx o)=>neo.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015947.exe=>(RAR Sfx o)=>neo.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015947.exe=>(RAR Sfx o)=>neo.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015947.exe=>(RAR Sfx o)
Update failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015948.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015948.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015948.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015960.exe=>(RAR Sfx o)=>neo.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015960.exe=>(RAR Sfx o)=>neo.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015960.exe=>(RAR Sfx o)=>neo.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015960.exe=>(RAR Sfx o)
Update failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015970.exe=>(RAR Sfx o)=>neo.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015970.exe=>(RAR Sfx o)=>neo.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015970.exe=>(RAR Sfx o)=>neo.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015970.exe=>(RAR Sfx o)
Update failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015979.exe=>(RAR Sfx o)=>neo.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015979.exe=>(RAR Sfx o)=>neo.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015979.exe=>(RAR Sfx o)=>neo.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015979.exe=>(RAR Sfx o)
Update failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015989.exe=>(RAR Sfx o)=>neo.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015989.exe=>(RAR Sfx o)=>neo.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015989.exe=>(RAR Sfx o)=>neo.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015989.exe=>(RAR Sfx o)
Update failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015998.exe=>(RAR Sfx o)=>neo.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015998.exe=>(RAR Sfx o)=>neo.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015998.exe=>(RAR Sfx o)=>neo.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015998.exe=>(RAR Sfx o)
Update failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015999.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015999.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0015999.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0016009.exe=>(RAR Sfx o)=>neo.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0016009.exe=>(RAR Sfx o)=>neo.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0016009.exe=>(RAR Sfx o)=>neo.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0016009.exe=>(RAR Sfx o)
Update failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0016010.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0016010.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0016010.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0016020.exe=>(RAR Sfx o)=>neo.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0016020.exe=>(RAR Sfx o)=>neo.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0016020.exe=>(RAR Sfx o)=>neo.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0016020.exe=>(RAR Sfx o)
Update failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0016021.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0016021.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0016021.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0016030.exe=>(RAR Sfx o)=>neo.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0016030.exe=>(RAR Sfx o)=>neo.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0016030.exe=>(RAR Sfx o)=>neo.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0016030.exe=>(RAR Sfx o)
Update failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0016040.exe=>(RAR Sfx o)=>neo.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0016040.exe=>(RAR Sfx o)=>neo.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0016040.exe=>(RAR Sfx o)=>neo.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0016040.exe=>(RAR Sfx o)
Update failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0016041.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0016041.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0016041.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0017039.exe=>(RAR Sfx o)=>neo.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0017039.exe=>(RAR Sfx o)=>neo.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0017039.exe=>(RAR Sfx o)=>neo.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0017039.exe=>(RAR Sfx o)
Update failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0017040.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0017040.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0017040.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0017049.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0017049.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0017049.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0017057.exe=>(RAR Sfx o)=>neo.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0017057.exe=>(RAR Sfx o)=>neo.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0017057.exe=>(RAR Sfx o)=>neo.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0017057.exe=>(RAR Sfx o)
Update failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0017058.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0017058.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0017058.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0018058.exe=>(RAR Sfx o)=>neo.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0018058.exe=>(RAR Sfx o)=>neo.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0018058.exe=>(RAR Sfx o)=>neo.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0018058.exe=>(RAR Sfx o)
Update failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0018068.exe=>(RAR Sfx o)=>neo.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0018068.exe=>(RAR Sfx o)=>neo.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0018068.exe=>(RAR Sfx o)=>neo.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0018068.exe=>(RAR Sfx o)
Update failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0018069.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0018069.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP42\A0018069.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP44\A0018209.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP44\A0018209.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP44\A0018209.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP44\A0018210.exe=>(RAR Sfx o)=>neo.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP44\A0018210.exe=>(RAR Sfx o)=>neo.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP44\A0018210.exe=>(RAR Sfx o)=>neo.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP44\A0018210.exe=>(RAR Sfx o)
Update failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP44\A0018211.exe=>(RAR Sfx o)=>neo.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP44\A0018211.exe=>(RAR Sfx o)=>neo.exe
Disinfection failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP44\A0018211.exe=>(RAR Sfx o)=>neo.exe
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP44\A0018211.exe=>(RAR Sfx o)
Update failed

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP44\A0018269.dll
Infected with: MemScan:Trojan.Virtumod.T

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP44\A0018269.dll
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP44\A0018270.dll
Infected with: MemScan:Trojan.Virtumod.T

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP44\A0018270.dll
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP44\A0018271.dll
Infected with: MemScan:Trojan.Virtumod.T

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP44\A0018271.dll
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP44\A0018272.dll
Infected with: MemScan:Trojan.Virtumod.T

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP44\A0018272.dll
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP44\A0018273.dll
Infected with: MemScan:Trojan.Virtumod.T

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP44\A0018273.dll
Deleted

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP44\A0018274.dll
Infected with: MemScan:Trojan.Virtumod.T

C:\System Volume Information\_restore{3D9EFF91-9F87-4DF6-B753-919D41837340}\RP44\A0018274.dll
Deleted

C:\WINDOWS\system32\Com\neo.exe
Suspected of: BehavesLike:Trojan.Downloader

C:\WINDOWS\system32\Com\neo.exe
Disinfection failed

C:\WINDOWS\system32\Com\neo.exe
Deleted

C:\WINDOWS\system32\efccdaw.dll
Infected with: MemScan:Trojan.Virtumod.T

C:\WINDOWS\system32\efccdaw.dll
Deleted

C:\WINDOWS\system32\efcdaby.dll
Infected with: MemScan:Trojan.Virtumod.T

C:\WINDOWS\system32\efcdaby.dll
Deleted

C:\WINDOWS\system32\gebyvvt.dll
Infected with: MemScan:Trojan.Virtumod.T

C:\WINDOWS\system32\gebyvvt.dll
Deleted

C:\WINDOWS\system32\iifghij.dll
Infected with: MemScan:Trojan.Virtumod.T

C:\WINDOWS\system32\iifghij.dll
Deleted

C:\WINDOWS\system32\ljjgdcy.dll
Infected with: MemScan:Trojan.Virtumod.T

C:\WINDOWS\system32\ljjgdcy.dll
Deleted

C:\WINDOWS\system32\urqqpqq.dll
Infected with: MemScan:Trojan.Virtumod.T

C:\WINDOWS\system32\urqqpqq.dll
Deleted

...und hier noch das neue HijackThis Log:

Logfile of HijackThis v1.99.1
Scan saved at 11:25:28, on 03.01.2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Dokumente und Einstellungen\Günther\Lokale Einstellungen\Temp\Temporäres Verzeichnis 2 für hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.msn.de/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.de/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O2 - BHO: (no name) - {30B7F5B8-7F41-4E65-8D06-FAF69077B61A} - (no file)
O2 - BHO: (no name) - {3FD6B99C-A275-46ea-8FD1-3D63986E51E4} - C:\WINDOWS\System32\ywnwsoru.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {53BA8736-2C70-4501-8F42-9710311AC459} - C:\WINDOWS\System32\gebcy.dll (file missing)
O2 - BHO: (no name) - {81845A9E-2030-43E6-8341-6F8BB4FF6823} - C:\WINDOWS\System32\ddcyx.dll (file missing)
O2 - BHO: (no name) - {F22656E2-02AA-43A9-BED5-0331CDFD72D0} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [DllRunning] rundll32.exe "C:\WINDOWS\System32\aduyipjy.dll",setvm
O4 - HKLM\..\Run: [defender] C:\\dfndrad_5.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrdad_5.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: VR-NetWorld Auftragsprüfung.lnk = C:\Programme\VR-NetWorld\VRToolCheckOrder.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resourc ... oscan8.cab
O20 - Winlogon Notify: byxutrq - C:\WINDOWS\
O20 - Winlogon Notify: ddcyx - C:\WINDOWS\System32\ddcyx.dll (file missing)
O20 - Winlogon Notify: Hints - C:\WINDOWS\system32\mv4ml9h11.dll (file missing)
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Debug Window Services - Unknown owner - C:\WINDOWS\system32\bug32.exe (file missing)
O23 - Service: Microsoft Windows DMR Service (Windows DMR Service) - Unknown owner - C:\WINDOWS\dmrproc.exe (file missing)

na also, 55 gelöschte dateien sind doch schonmal was!
hm, mir ist letztens gar nicht aufgefallen, dass der rechner noch mit service pack 1 arbeitet
lade also bitte das service pack 2 und aktuelle updates runter!
diese einträge solltest du jetzt mit hijackthis fixen können:

O2 - BHO: (no name) - {3FD6B99C-A275-46ea-8FD1-3D63986E51E4} - C:\WINDOWS\System32\ywnwsoru.dll (file missing)
O2 - BHO: (no name) - {30B7F5B8-7F41-4E65-8D06-FAF69077B61A} - (no file)
O2 - BHO: (no name) - {53BA8736-2C70-4501-8F42-9710311AC459} - C:\WINDOWS\System32\gebcy.dll (file missing)
O2 - BHO: (no name) - {81845A9E-2030-43E6-8341-6F8BB4FF6823} - C:\WINDOWS\System32\ddcyx.dll (file missing)
O2 - BHO: (no name) - {F22656E2-02AA-43A9-BED5-0331CDFD72D0} - (no file)
O20 - Winlogon Notify: ddcyx - C:\WINDOWS\System32\ddcyx.dll (file missing)
O20 - Winlogon Notify: Hints - C:\WINDOWS\system32\mv4ml9h11.dll (file missing)
O23 - Service: Debug Window Services - Unknown owner - C:\WINDOWS\system32\bug32.exe (file missing)
O23 - Service: Microsoft Windows DMR Service (Windows DMR Service) - Unknown owner - C:\WINDOWS\dmrproc.exe (file missing)
O20 - Winlogon Notify: byxutrq - C:\WINDOWS\

die müssen noch weg:

O4 - HKLM\..\Run: [DllRunning] rundll32.exe "C:\WINDOWS\System32\aduyipjy.dll",setvm
O4 - HKLM..Run: [defender] C:\dfndrad_5.exe
O4 - HKLM..Run: [keyboard] C:\kybrdad_5.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

stelle den CleanUp genauso ein, wie hier angegeben: (+ PC neustarten)
http://virus-protect.org/cleanup.html

dann erstelle ein weiteres hijackthis-file

hier das neue Log:

Logfile of HijackThis v1.99.1
Scan saved at 13:48:25, on 03.01.2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Dokumente und Einstellungen\Günther\Lokale Einstellungen\Temp\Temporäres Verzeichnis 1 für hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.msn.de/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.de/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O2 - BHO: (no name) - {30B7F5B8-7F41-4E65-8D06-FAF69077B61A} - (no file)
O2 - BHO: (no name) - {3FD6B99C-A275-46ea-8FD1-3D63986E51E4} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {F22656E2-02AA-43A9-BED5-0331CDFD72D0} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [DllRunning] rundll32.exe "C:\WINDOWS\System32\aduyipjy.dll",setvm
O4 - HKLM\..\Run: [defender] C:\\dfndrad_5.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrdad_5.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: VR-NetWorld Auftragsprüfung.lnk = C:\Programme\VR-NetWorld\VRToolCheckOrder.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resourc ... oscan8.cab
O20 - Winlogon Notify: byxutrq - C:\WINDOWS\
O20 - Winlogon Notify: ddcyx - C:\WINDOWS\
O20 - Winlogon Notify: Hints - C:\WINDOWS\
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Microsoft Windows DMR Service (Windows DMR Service) - Unknown owner - C:\WINDOWS\dmrproc.exe (file missing)

@ reißer

Hallo reißer,

ich würde formatieren. Dein PC kann man schon wieder reinigen, aber es würde sich nicht mehr lohnen. Du wirst immer befallen bleiben. Deshalb formatiere, installiere Windows neu,

Mache 3. Partitionen

1. Partition --> Windows, Programme
2. Partition --> Eigene Dateien, Spiele
3. Partition --> Temp vom Internet (heruntergeladene Programme, gespeicherte Webseiten usw.)

Danach installiere Win SP2 (Service Pack 2, danach installiere AntiVir und Ashampoo FireWall Free 1.10 Deutsch. Danach bist du wieder sicher im Internet.

PS:

Die Dateien

C:\\dfndrad_5.exe
C:\\kybrdad_5.exe

bekommt man auf dem PC, wenn man auf sogenannte Cracks Seiten geht und da dann die *.exe ausführt. Gehen bei dir auch Popups auf?

Nein,

Popups sind keine da.

Das Problem ist auch schon ziemlich eingedämmt.
Die ganzen Meldungen die vorher schon beim starten erschienen sind, sind weg.
auch wenn der Rechner online ist, kommen fast keine Meldungen mehr.

Es geht jetzt nur noch darum, daß die Reste getilgt werden.

Wie im ersten Beitrag beschrieben, ist es der Rechner von meinem Kumpel.
Er sagt, er habe bei ebay was ersteigert und eine Rechnung verlangt.
Die hat im der Verkäufer als Anhang im e-mail geschickt. Als er den Anhang geöffnet hat, waren die Probleme da.

Der Hauptbefall waren zwei Trojaner: TR/Vundo und TR/Dll.Ant.1.A

1.
Arbeitsplatz-->Rechtsklick, dann auf Eigenschaften--->Reiter Systemwiederherstellung--->Häkchen setzen bei Systemwiederherstellung auf allen Laufwerken deaktivieren.(dann wieder aktivieren)

2.
KILLBOX - Pocket KillBox
http://virus-protect.org/killbox.html

Options: Delete on Reboot --> anhaken
und klicke auf das rote Kreuz, wenn gefragt wird, ob "Do you want to reboot? "---- klicke auf "no",und kopiere das nächste rein, erst beim letzten auf "yes"
reinkopieren: ............

C:\dfndrad_5.exe
C:\kybrdad_5.exe

3. fixe mit Hijackthis

O4 - HKLM..Run: [defender] C:\dfndrad_5.exe
O4 - HKLM..Run: [keyboard] C:\kybrdad_5.exe

4.
Look2Me-Destroyer V1.0.5 - abarbeiten (poste dann das log)
http://virus-protect.org/l2mfix.html

5.
L2mfix - Option 2 ->PC neustarten, scan abwarten - poste das log
http://virus-protect.org/l2mfix.html

Das wird einige Zeit in Anspruch nehmen.
Ich melde mich bei Dir mit einer PN wenn ich soweit bin.
Schon mal im voraus, Danke für die Hilfe

Problem scheint gelöst zu sein.
Auf alle Fälle kommen keine Warnungen mehr.
Mein Kumpel ist zufrieden.
Danke für die Hilfe.