ESCAN - kann meine Viren nicht löschen

[Loewe]

Ich habe den ESCAN nach Anleitung von Nikita durchgeführt, aber sobald ich zu Pkt. 14 der Anleitung komme, funktioniert es nicht mehr. Ich kann die zu löschenen Dateien nicht auswählen.

Manchmal bleibt dann der PC hängen. Ich muss aber unbedingt meine Viren los werden!

Für eine Antwort bedanke ich mich im voraus bestens.

Gruss
Loewe
--------------------------------------------------
-------------------- INFECTED --------------------
--------------------------------------------------

1: Mon Oct 03 13:21:06 2005 => System found infected with Aureate Group Mail Spyware/Adware ({ebbfe26d-bdf0-11d2-bbe5-00609419f467})! Action taken: No Action Taken.
2: Mon Oct 03 13:21:06 2005 => System found infected with aureate/radiate Spyware/Adware ({ebbfe288-bdf0-11d2-bbe5-00609419f467})! Action taken: No Action Taken.
3: Mon Oct 03 13:21:06 2005 => System found infected with aureate/radiate Spyware/Adware ({ebbfe289-bdf0-11d2-bbe5-00609419f467})! Action taken: No Action Taken.
4: Mon Oct 03 13:21:06 2005 => System found infected with aureate/radiate Spyware/Adware ({EBBFE27C-BDF0-11D2-BBE5-00609419F467})! Action taken: No Action Taken.
5: Mon Oct 03 13:21:07 2005 => System found infected with HotBar Spyware/Adware ({74CC49F7-EB32-4A08-B204-948962A6E3DB})! Action taken: No Action Taken.
6: Mon Oct 03 13:21:07 2005 => System found infected with Midnight Oil Spyware/Adware ({ebbfe27b-bdf0-11d2-bbe5-00609419f467})! Action taken: No Action Taken.
7: Mon Oct 03 13:21:07 2005 => System found infected with Midnight Oil Spyware/Adware ({ebbfe287-bdf0-11d2-bbe5-00609419f467})! Action taken: No Action Taken.
8: Mon Oct 03 13:21:07 2005 => System found infected with Midnight Oil Spyware/Adware ({ebbfe28a-bdf0-11d2-bbe5-00609419f467})! Action taken: No Action Taken.
9: Mon Oct 03 13:21:18 2005 => Offending file found: C:\WINDOWS\system32\advert.dll
10: Mon Oct 03 13:21:18 2005 => System found infected with aureate/radiate Spyware/Adware (advert.dll)! Action taken: No Action Taken.

--------------------------------------------------
--------------------- TAGGED ---------------------
--------------------------------------------------

1: Mon Oct 03 13:23:06 2005 => File C:\WINDOWS\system32\advert.dll tagged as "not-a-virus:AdWare.Aureate". Action Taken: No Action Taken.
2: Mon Oct 03 14:01:16 2005 => File C:\System Volume Information\_restore{70BDD588-E78D-48FB-A971-051B8FBFE7F4}\RP52\A0005293.exe tagged as "not-a-virus:AdWare.ToolBar.Hotbar.an". Action Taken: No Action Taken.
3: Mon Oct 03 14:01:16 2005 => File C:\System Volume Information\_restore{70BDD588-E78D-48FB-A971-051B8FBFE7F4}\RP52\A0005294.exe tagged as "not-a-virus:AdWare.ToolBar.Hotbar.ar". Action Taken: No Action Taken.
4: Mon Oct 03 14:01:17 2005 => File C:\System Volume Information\_restore{70BDD588-E78D-48FB-A971-051B8FBFE7F4}\RP52\A0005298.exe tagged as "not-a-virus:AdWare.ToolBar.Hotbar.aw". Action Taken: No Action Taken.
5: Mon Oct 03 14:01:18 2005 => File C:\System Volume Information\_restore{70BDD588-E78D-48FB-A971-051B8FBFE7F4}\RP52\A0005303.exe tagged as "not-a-virus:AdWare.ToolBar.Hotbar.ax". Action Taken: No Action Taken.
6: Mon Oct 03 14:01:18 2005 => File C:\System Volume Information\_restore{70BDD588-E78D-48FB-A971-051B8FBFE7F4}\RP52\A0005304.exe tagged as "not-a-virus:AdWare.ToolBar.Hotbar.aw". Action Taken: No Action Taken.
7: Mon Oct 03 14:01:18 2005 => File C:\System Volume Information\_restore{70BDD588-E78D-48FB-A971-051B8FBFE7F4}\RP52\A0005305.dll tagged as "not-a-virus:AdWare.ToolBar.Hotbar.aw". Action Taken: No Action Taken.
8: Mon Oct 03 14:01:20 2005 => File C:\System Volume Information\_restore{70BDD588-E78D-48FB-A971-051B8FBFE7F4}\RP52\A0005327.dll tagged as "not-a-virus:AdWare.ToolBar.Hotbar.ar". Action Taken: No Action Taken.
9: Mon Oct 03 14:02:17 2005 => File C:\System Volume Information\_restore{70BDD588-E78D-48FB-A971-051B8FBFE7F4}\RP66\A0006331.dll tagged as "not-a-virus:AdWare.Aureate.a". Action Taken: No Action Taken.
10: Mon Oct 03 14:12:34 2005 => File C:\WINDOWS\system32\advert.dll tagged as "not-a-virus:AdWare.Aureate". Action Taken: No Action Taken.

--------------------------------------------------
--------------------- ERRORS ---------------------
--------------------------------------------------

1: Mon Oct 03 13:20:45 2005 => ERROR!!! Invalid Entry = C:\WINDOWS\system32\amcis.dll (in key Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{EBBFE27C-BDF0-11D2-BBE5-00609419F467}). No Action Taken.
2: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\CoverDesigner\covered-dan.nls". Action Taken: No Action Taken.
3: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\CoverDesigner\covered-cht.nls". Action Taken: No Action Taken.
4: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\CoverDesigner\covered-nld.nls". Action Taken: No Action Taken.
5: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\CoverDesigner\covered-fra.nls". Action Taken: No Action Taken.
6: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\CoverDesigner\covered-ita.nls". Action Taken: No Action Taken.
7: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\CoverDesigner\covered-jpn.nls". Action Taken: No Action Taken.
8: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\CoverDesigner\covered-kor.nls". Action Taken: No Action Taken.
9: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\CoverDesigner\covered-nor.nls". Action Taken: No Action Taken.
10: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\CoverDesigner\covered-ptg.nls". Action Taken: No Action Taken.
11: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\CoverDesigner\covered-rus.nls". Action Taken: No Action Taken.
12: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\CoverDesigner\covered-esp.nls". Action Taken: No Action Taken.
13: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\CoverDesigner\covered-sve.nls". Action Taken: No Action Taken.
14: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\CoverDesigner\covered-fin.nls". Action Taken: No Action Taken.
15: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\CoverDesigner\covered-ptb.nls". Action Taken: No Action Taken.
16: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\CoverDesigner\covered-chs.nls". Action Taken: No Action Taken.
17: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\CoverDesigner\covered-plk.nls". Action Taken: No Action Taken.
18: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\CoverDesigner\covered-csy.nls". Action Taken: No Action Taken.
19: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\CoverDesigner\covered-sky.nls". Action Taken: No Action Taken.
20: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\CoverDesigner\covered-slv.nls". Action Taken: No Action Taken.
21: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\CoverDesigner\covered-hun.nls". Action Taken: No Action Taken.
22: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\CoverDesigner\covered-tha.nls". Action Taken: No Action Taken.
23: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\CoverDesigner\covered-trk.nls". Action Taken: No Action Taken.
24: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\CoverDesigner\covered-ell.nls". Action Taken: No Action Taken.
25: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\CoverDesigner\covered-esl.nls". Action Taken: No Action Taken.
26: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Chs.nls". Action Taken: No Action Taken.
27: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Cht.nls". Action Taken: No Action Taken.
28: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Esp.nls". Action Taken: No Action Taken.
29: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Fra.nls". Action Taken: No Action Taken.
30: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Ita.nls". Action Taken: No Action Taken.
31: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Kor.nls". Action Taken: No Action Taken.
32: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Nld.nls". Action Taken: No Action Taken.
33: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Ptg.nls". Action Taken: No Action Taken.
34: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Csy.nls". Action Taken: No Action Taken.
35: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Dan.nls". Action Taken: No Action Taken.
36: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Ell.nls". Action Taken: No Action Taken.
37: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Esl.nls". Action Taken: No Action Taken.
38: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Fin.nls". Action Taken: No Action Taken.
39: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Hun.nls". Action Taken: No Action Taken.
40: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Nor.nls". Action Taken: No Action Taken.
41: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Plk.nls". Action Taken: No Action Taken.
42: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Ptb.nls". Action Taken: No Action Taken.
43: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Rus.nls". Action Taken: No Action Taken.
44: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Sky.nls". Action Taken: No Action Taken.
45: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Slv.nls". Action Taken: No Action Taken.
46: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Sve.nls". Action Taken: No Action Taken.
47: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Tha.nls". Action Taken: No Action Taken.
48: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Trk.nls". Action Taken: No Action Taken.
49: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero StartSmart\NeroStartSmart_chs.chm". Action Taken: No Action Taken.
50: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero StartSmart\NeroStartSmart_cht.chm". Action Taken: No Action Taken.
51: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero StartSmart\NeroStartSmart_esl.chm". Action Taken: No Action Taken.
52: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero StartSmart\NeroStartSmart_esp.chm". Action Taken: No Action Taken.
53: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero StartSmart\NeroStartSmart_fra.chm". Action Taken: No Action Taken.
54: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero StartSmart\NeroStartSmart_ita.chm". Action Taken: No Action Taken.
55: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero StartSmart\NeroStartSmart_jpn.chm". Action Taken: No Action Taken.
56: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero StartSmart\NeroStartSmart_kor.chm". Action Taken: No Action Taken.
57: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero StartSmart\NeroStartSmart_nld.chm". Action Taken: No Action Taken.
58: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero StartSmart\NeroStartSmart_ptg.chm". Action Taken: No Action Taken.
59: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero StartSmart\NeroStartSmart_sve.chm". Action Taken: No Action Taken.
60: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Jpn.nls". Action Taken: No Action Taken.
61: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\AVK.exe" refers to invalid object "C:\Programme\PowerAntiVirus 2005\yourapp.Exe". Action Taken: No Action Taken.
62: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\bantam.dll" refers to invalid object "bantam.dll". Action Taken: No Action Taken.
63: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\BatteryManager.exe" refers to invalid object "C:\Programme\Samsung\Samsung Battery Manager\Samsung Battery Manager". Action Taken: No Action Taken.
64: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\bdeadmin.exe" refers to invalid object "bdeadmin.exe". Action Taken: No Action Taken.
65: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\bdeadmin.hlp" refers to invalid object "bdeadmin.hlp". Action Taken: No Action Taken.
66: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\blw32.dll" refers to invalid object "blw32.dll". Action Taken: No Action Taken.
67: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\cmmgr32.exe" refers to invalid object "C:\WINDOWS\system32\cmmgr32.exe". Action Taken: No Action Taken.
68: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\disp.dll" refers to invalid object "disp.dll". Action Taken: No Action Taken.
69: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\HijackThis.exe" refers to invalid object "C:\Dokumente und Einstellungen\P. Gulde\Lokale Einstellungen\Temp\hijackthis.exe". Action Taken: No Action Taken.
70: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\idapi32.dll" refers to invalid object "idapi32.dll". Action Taken: No Action Taken.
71: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\idasci32.dll" refers to invalid object "idasci32.dll". Action Taken: No Action Taken.
72: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\idbat32.dll" refers to invalid object "idbat32.dll". Action Taken: No Action Taken.
73: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\idda3532.dll" refers to invalid object "idda3532.dll". Action Taken: No Action Taken.
74: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\iddao32.dll" refers to invalid object "iddao32.dll". Action Taken: No Action Taken.
75: Mon Oct 03 13:22:26 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\iddbas32.dll" refers to invalid object "iddbas32.dll". Action Taken: No Action Taken.
76: Mon Oct 03 13:22:27 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\iddr32.dll" refers to invalid object "iddr32.dll". Action Taken: No Action Taken.
77: Mon Oct 03 13:22:27 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\idodbc32.dll" refers to invalid object "idodbc32.dll". Action Taken: No Action Taken.
78: Mon Oct 03 13:22:27 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\idpdx32.dll" refers to invalid object "idpdx32.dll". Action Taken: No Action Taken.
79: Mon Oct 03 13:22:27 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\idqbe32.dll" refers to invalid object "idqbe32.dll". Action Taken: No Action Taken.
80: Mon Oct 03 13:22:27 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\idr20009.dll" refers to invalid object "idr20009.dll". Action Taken: No Action Taken.
81: Mon Oct 03 13:22:27 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\idsql32.dll" refers to invalid object "idsql32.dll". Action Taken: No Action Taken.
82: Mon Oct 03 13:22:27 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Programme\Infineon\Security Platform Software\Driver Files\". Action Taken: No Action Taken.
83: Mon Oct 03 13:22:27 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Programme\Infineon\Security Platform Software\". Action Taken: No Action Taken.
84: Mon Oct 03 13:22:27 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Programme\Infineon\". Action Taken: No Action Taken.
85: Mon Oct 03 13:22:27 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Programme\Gemeinsame Dateien\Symantec Shared\Script Blocking\". Action Taken: No Action Taken.
86: Mon Oct 03 13:22:29 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".002". Action Taken: No Action Taken.
87: Mon Oct 03 13:22:29 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".SPT". Action Taken: No Action Taken.
88: Mon Oct 03 13:22:29 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "HbToolsOutlookTools". Action Taken: No Action Taken.
89: Mon Oct 03 13:22:29 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{7B802DE5-84E5-4503-965B-2ABFFC78506A}". Action Taken: No Action Taken.
90: Mon Oct 03 13:22:29 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{B005394D-5A4D-6AE4-CB08-F59CDC9A255C}". Action Taken: No Action Taken.
91: Mon Oct 03 13:22:29 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{EDCD4CE3-DE92-49A9-87F9-FE09B2FBA16C}". Action Taken: No Action Taken.
92: Mon Oct 03 13:22:29 2005 => Entry "HKCR\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}" refers to invalid object "C:\modem\COMCTL32.OCX". Action Taken: No Action Taken.
93: Mon Oct 03 13:22:29 2005 => Entry "HKCR\CLSID\{0713E8A8-850A-101B-AFC0-4210102A8DA7}" refers to invalid object "C:\modem\COMCTL32.OCX". Action Taken: No Action Taken.
94: Mon Oct 03 13:22:29 2005 => Entry "HKCR\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}" refers to invalid object "C:\modem\COMCTL32.OCX". Action Taken: No Action Taken.
95: Mon Oct 03 13:22:29 2005 => Entry "HKCR\CLSID\{0713E8D8-850A-101B-AFC0-4210102A8DA7}" refers to invalid object "C:\modem\COMCTL32.OCX". Action Taken: No Action Taken.
96: Mon Oct 03 13:22:30 2005 => Entry "HKCR\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}" refers to invalid object "C:\modem\COMCTL32.OCX". Action Taken: No Action Taken.
97: Mon Oct 03 13:22:30 2005 => Entry "HKCR\CLSID\{373FF7F4-EB8B-11CD-8820-08002B2F4F5A}" refers to invalid object "C:\modem\COMCTL32.OCX". Action Taken: No Action Taken.
98: Mon Oct 03 13:22:32 2005 => Entry "HKCR\CLSID\{4EA49B78-3AB7-4424-843E-6C4EED916AFE}" refers to invalid object "D:\SOFTWA~E.OCX". Action Taken: No Action Taken.
99: Mon Oct 03 13:22:32 2005 => Entry "HKCR\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}" refers to invalid object "C:\modem\COMCTL32.OCX". Action Taken: No Action Taken.
100: Mon Oct 03 13:22:32 2005 => Entry "HKCR\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}" refers to invalid object "C:\modem\COMCTL32.OCX". Action Taken: No Action Taken.
101: Mon Oct 03 13:22:32 2005 => Entry "HKCR\CLSID\{58DA8D93-9D6A-101B-AFC0-4210102A8DA7}" refers to invalid object "C:\modem\COMCTL32.OCX". Action Taken: No Action Taken.
102: Mon Oct 03 13:22:32 2005 => Entry "HKCR\CLSID\{58DA8D96-9D6A-101B-AFC0-4210102A8DA7}" refers to invalid object "C:\modem\COMCTL32.OCX". Action Taken: No Action Taken.
103: Mon Oct 03 13:22:32 2005 => Entry "HKCR\CLSID\{5ACBB955-5C57-11CF-8993-00AA00688B10}" refers to invalid object "C:\modem\COMCTL32.OCX". Action Taken: No Action Taken.
104: Mon Oct 03 13:22:32 2005 => Entry "HKCR\CLSID\{5ACBB956-5C57-11CF-8993-00AA00688B10}" refers to invalid object "C:\modem\COMCTL32.OCX". Action Taken: No Action Taken.
105: Mon Oct 03 13:22:32 2005 => Entry "HKCR\CLSID\{5ACBB957-5C57-11CF-8993-00AA00688B10}" refers to invalid object "C:\modem\COMCTL32.OCX". Action Taken: No Action Taken.
106: Mon Oct 03 13:22:32 2005 => Entry "HKCR\CLSID\{5ACBB958-5C57-11CF-8993-00AA00688B10}" refers to invalid object "C:\modem\COMCTL32.OCX". Action Taken: No Action Taken.
107: Mon Oct 03 13:22:32 2005 => Entry "HKCR\CLSID\{6027C2D4-FB28-11CD-8820-08002B2F4F5A}" refers to invalid object "C:\modem\COMCTL32.OCX". Action Taken: No Action Taken.
108: Mon Oct 03 13:22:32 2005 => Entry "HKCR\CLSID\{612A8624-0FB3-11CE-8747-524153480004}" refers to invalid object "C:\modem\COMCTL32.OCX". Action Taken: No Action Taken.
109: Mon Oct 03 13:22:32 2005 => Entry "HKCR\CLSID\{612A8628-0FB3-11CE-8747-524153480004}" refers to invalid object "C:\modem\COMCTL32.OCX". Action Taken: No Action Taken.
110: Mon Oct 03 13:22:32 2005 => Entry "HKCR\CLSID\{62823C20-41A3-11CE-9E8B-0020AF039CA3}" refers to invalid object "C:\modem\COMCTL32.OCX". Action Taken: No Action Taken.
111: Mon Oct 03 13:22:32 2005 => Entry "HKCR\CLSID\{648A5600-2C6E-101B-82B6-000000000014}" refers to invalid object "C:\modem\MSCOMM32.OCX". Action Taken: No Action Taken.
112: Mon Oct 03 13:22:32 2005 => Entry "HKCR\CLSID\{648A5604-2C6E-101B-82B6-000000000014}" refers to invalid object "C:\modem\MSCOMM32.OCX". Action Taken: No Action Taken.
113: Mon Oct 03 13:22:33 2005 => Entry "HKCR\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}" refers to invalid object "C:\modem\COMCTL32.OCX". Action Taken: No Action Taken.
114: Mon Oct 03 13:22:33 2005 => Entry "HKCR\CLSID\{6B7E6393-850A-101B-AFC0-4210102A8DA7}" refers to invalid object "C:\modem\COMCTL32.OCX". Action Taken: No Action Taken.
115: Mon Oct 03 13:22:33 2005 => Entry "HKCR\CLSID\{6B7E63A3-850A-101B-AFC0-4210102A8DA7}" refers to invalid object "C:\modem\COMCTL32.OCX". Action Taken: No Action Taken.
116: Mon Oct 03 13:22:34 2005 => Entry "HKCR\CLSID\{9ED94440-E5E8-101B-B9B5-444553540000}" refers to invalid object "C:\modem\COMCTL32.OCX". Action Taken: No Action Taken.
117: Mon Oct 03 13:22:34 2005 => Entry "HKCR\CLSID\{9ED94444-E5E8-101B-B9B5-444553540000}" refers to invalid object "C:\modem\COMCTL32.OCX". Action Taken: No Action Taken.
118: Mon Oct 03 13:22:34 2005 => Entry "HKCR\CLSID\{B66834C6-2E60-11CE-8748-524153480004}" refers to invalid object "C:\modem\COMCTL32.OCX". Action Taken: No Action Taken.
119: Mon Oct 03 13:22:35 2005 => Entry "HKCR\CLSID\{C9AFDEBD-17BA-45D8-AD91-B1FB86774C23}" refers to invalid object "D:\SOFTWA~E.OCX". Action Taken: No Action Taken.
120: Mon Oct 03 13:22:35 2005 => Entry "HKCR\CLSID\{D0FC8A81-2CB2-101B-82B6-000000000014}" refers to invalid object "C:\modem\MSCOMM32.OCX". Action Taken: No Action Taken.
121: Mon Oct 03 13:22:36 2005 => Entry "HKCR\CLSID\{E0DC8C80-3486-101B-82B6-000000000014}" refers to invalid object "C:\modem\MSCOMM32.OCX". Action Taken: No Action Taken.
122: Mon Oct 03 13:22:36 2005 => Entry "HKCR\CLSID\{EBBFE27C-BDF0-11D2-BBE5-00609419F467}" refers to invalid object "C:\WINDOWS\system32\amcis.dll". Action Taken: No Action Taken.
123: Mon Oct 03 13:22:36 2005 => Entry "HKCR\CLSID\{EBBFE288-BDF0-11D2-BBE5-00609419F467}" refers to invalid object "C:\WINDOWS\system32\amcis.dll". Action Taken: No Action Taken.
124: Mon Oct 03 13:22:36 2005 => Entry "HKCR\CLSID\{EBBFE28A-BDF0-11D2-BBE5-00609419F467}" refers to invalid object "C:\WINDOWS\system32\amcis.dll". Action Taken: No Action Taken.
125: Mon Oct 03 13:22:37 2005 => Entry "HKCR\TypeLib\{648A5603-2C6E-101B-82B6-000000000014}" refers to invalid object "C:\modem\MSCOMM32.OCX". Action Taken: No Action Taken.
126: Mon Oct 03 13:22:37 2005 => Entry "HKCR\TypeLib\{6B7E6392-850A-101B-AFC0-4210102A8DA7}" refers to invalid object "C:\modem\COMCTL32.OCX". Action Taken: No Action Taken.
127: Mon Oct 03 13:22:37 2005 => Entry "HKCR\TypeLib\{71EFE583-62FE-4419-9918-CA3B683F7B36}" refers to invalid object "C:\Programme\HbTools\Bin\4.7.0.0\HbtCoreSrv.dll". Action Taken: No Action Taken.
128: Mon Oct 03 13:22:38 2005 => Entry "HKCR\TypeLib\{D4B8E746-B229-4265-AB22-8EC6810B7850}" refers to invalid object "D:\SoftwareOCX.ocx". Action Taken: No Action Taken.
129: Mon Oct 03 13:22:38 2005 => Entry "HKCR\TypeLib\{EBBFE26D-BDF0-11D2-BBE5-00609419F467}" refers to invalid object "C:\WINDOWS\system32\amcis.dll". Action Taken: No Action Taken.
130: Mon Oct 03 13:22:38 2005 => Entry "HKCR\.det" refers to invalid object "DETFile". Action Taken: No Action Taken.
131: Mon Oct 03 13:22:39 2005 => Entry "HKCR\.frg" refers to invalid object "Access.Fragment". Action Taken: No Action Taken.
132: Mon Oct 03 13:22:39 2005 => Entry "HKCR\.gst" refers to invalid object "MSMap.Datainst.8". Action Taken: No Action Taken.
133: Mon Oct 03 13:22:39 2005 => Entry "HKCR\.ldb" refers to invalid object "Access.LockFile.9". Action Taken: No Action Taken.
134: Mon Oct 03 13:22:39 2005 => Entry "HKCR\.pcb" refers to invalid object "PCBFile". Action Taken: No Action Taken.
135: Mon Oct 03 13:22:39 2005 => Entry "HKCR\.sll" refers to invalid object "SSLFile". Action Taken: No Action Taken.
136: Mon Oct 03 13:22:39 2005 => Entry "HKCR\.tuw" refers to invalid object "TUWFile". Action Taken: No Action Taken.
137: Mon Oct 03 13:22:39 2005 => Entry "HKCR\ActMsg.Session" refers to invalid object "{3FA7DEB3-6438-101B-ACC1-00AA00423326}". Action Taken: No Action Taken.
138: Mon Oct 03 13:22:39 2005 => Entry "HKCR\Automap.Map.EU" refers to invalid object "{A49EEA01-9231-4C77-AA9E-2F89D72B4804}". Action Taken: No Action Taken.
139: Mon Oct 03 13:22:39 2005 => Entry "HKCR\Automap.Map.EU.11" refers to invalid object "{A49EEA01-9231-4C77-AA9E-2F89D72B4804}". Action Taken: No Action Taken.
140: Mon Oct 03 13:22:39 2005 => Entry "HKCR\Automap.Template.EU.11" refers to invalid object "{A49EEA01-9231-4C77-AA9E-2F89D72B4804}". Action Taken: No Action Taken.
141: Mon Oct 03 13:22:39 2005 => Entry "HKCR\Connection Manager Profile\shell\open\command" refers to invalid object "C:\WINDOWS\system32\CMMGR32.EXE "%1"". Action Taken: No Action Taken.
142: Mon Oct 03 13:22:40 2005 => Entry "HKCR\MailFileAtt" refers to invalid object "{00020D05-0000-0000-C000-000000000046}". Action Taken: No Action Taken.
143: Mon Oct 03 13:22:40 2005 => Entry "HKCR\mapifvbx.object" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken.
144: Mon Oct 03 13:22:40 2005 => Entry "HKCR\mapifvbx.object.1" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken.
145: Mon Oct 03 13:22:41 2005 => Entry "HKCR\msbackupfile\shell\open\command" refers to invalid object "%SystemRoot%\system32\ntbackup.exe". Action Taken: No Action Taken.
146: Mon Oct 03 13:22:42 2005 => Entry "HKCR\xbmfile\shell\open\command" refers to invalid object """"". Action Taken: No Action Taken.
147: Mon Oct 03 13:22:42 2005 => Entry "HKCR\xmlfile\shell\open\command" refers to invalid object """"". Action Taken: No Action Taken.
148: Mon Oct 03 13:22:42 2005 => Entry "HKCR\xslfile\shell\open\command" refers to invalid object """"". Action Taken: No Action Taken.
149: Mon Oct 03 13:49:00 2005 => Result: ERROR!!! File C:\Programme\CA\eTrust PestPatrol\Quarantine\20050708112643.zip is Not Scanned

--------------------------------------------------
-------------------- Statistik -------------------
--------------------------------------------------

Mon Oct 03 14:18:34 2005 => Total Objects Scanned: 114700
Mon Oct 03 14:18:34 2005 => Total Virus(es) Found: 20
Mon Oct 03 14:18:34 2005 => Total Errors: 149
Mon Oct 03 14:18:34 2005 => Virus Database Date: 2005/09/12
Mon Oct 03 14:18:34 2005 => Virus Database Count: 149026
Mon Oct 03 14:18:46 2005 => Total Objects Scanned: 114700
Mon Oct 03 14:18:46 2005 => Total Virus(es) Found: 20
Mon Oct 03 14:18:46 2005 => Total Errors: 149

[Zyrus]

Kommst wohl an einer Formatierung deiner Festplatte nicht drum herum.

[Fat_Mike]

hey, nicht so schnell. erstmal in ruhe checken, was sache ist. grundsätzlich hast du recht, ein kompromittiertes system stehenzulassen, ist (auch nach reinigung) ne riskante sache. man weiss nie, ob man wirklich alle viren besitigt und alle backdoors geschlossen hat. erfahrungsgemöss lässt sich ein system doch aber meist recht gut wiederherstellen.

ich hätte gerne eine liste aller auf dem system erkannten viren sowie ein hjt log, dann sehen wir mal weiter. alternativ kannst du dich natürlich auch an nikita wenden.


gruss
fat.


ps: hast du mal versucht, die dateien im abgesicherten modus zu löschen?

[Loewe]

hey, nicht so schnell. erstmal in ruhe checken, was sache ist. grundsätzlich hast du recht, ein kompromittiertes system stehenzulassen, ist (auch nach reinigung) ne riskante sache. man weiss nie, ob man wirklich alle viren besitigt und alle backdoors geschlossen hat. erfahrungsgemöss lässt sich ein system doch aber meist recht gut wiederherstellen.

ich hätte gerne eine liste aller auf dem system erkannten viren sowie ein hjt log, dann sehen wir mal weiter. alternativ kannst du dich natürlich auch an nikita wenden.


gruss
fat.





ps: hast du mal versucht, die dateien im abgesicherten modus zu löschen?

Logfile of HijackThis v1.99.1
Scan saved at 11:33:55, on 04.10.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\PowerAntiVirus 2005\AVKService.exe
C:\Programme\PowerAntiVirus 2005\AVKWCtl.exe
C:\PROGRA~1\Firebird\V1_5_1\bin\fbguard.exe
C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\Firebird\V1_5_1\bin\fbserver.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Java\j2re1.4.2_03\bin\jusched.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programme\Synaptics\SynTP\SynTPLpr.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Programme\ltmoh\Ltmoh.exe
C:\Programme\Samsung\AVStation premium\bin\AVStation agent.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
C:\Programme\CA\eTrust PestPatrol\PPActiveDetection.exe
C:\Programme\Gemeinsame Dateien\G DATA\AVKMail\AVKPOP.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\Samsung\Samsung Smart Screen\SSS.EXE
C:\Programme\WinZip\WZQKPICK.EXE
C:\Programme\SAMSUNG\MagicKBD\MagicKBD.exe
C:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis2\kernel.exe
C:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis2\sc_watch.exe
C:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis2\PROFIL~1.EXE
C:\PROGRAMME\T-ONLINE\T-ONLINE_SOFTWARE_5\BROWSER\BROWSER.EXE
C:\Programme\Outlook Express\msimn.exe
C:\Dokumente und Einstellungen\All Users\Software Anweisungen\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onvista.de/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: CIEStub Class - {EBBFE27C-BDF0-11D2-BBE5-00609419F467} - C:\WINDOWS\system32\amcis.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Programme\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LtMoh] C:\Programme\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [MagicKeyboard] C:\Programme\SAMSUNG\MagicKBD\PreMKBD.exe
O4 - HKLM\..\Run: [AVStation premium] "C:\Programme\Samsung\AVStation premium\bin\AVStation agent.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [eTrustPPAP] "C:\Programme\CA\eTrust PestPatrol\PPActiveDetection.exe"
O4 - HKLM\..\Run: [AVK Mail Checker] "C:\Programme\Gemeinsame Dateien\G DATA\AVKMail\AVKPOP.EXE"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Samsung Smart Screen] "C:\Programme\Samsung\Samsung Smart Screen\SSS.EXE"
O4 - Global Startup: db dialog updater.lnk = C:\Programme\db dialog\wiseupdt.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AVK Service (AVKService) - Unknown owner - C:\Programme\PowerAntiVirus 2005\AVKService.exe
O23 - Service: PAV Wächter (AVKWCtl) - Unknown owner - C:\Programme\PowerAntiVirus 2005\AVKWCtl.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\PROGRA~1\Firebird\V1_5_1\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\PROGRA~1\Firebird\V1_5_1\bin\fbserver.exe
O23 - Service: Samsung Update Plus - Unknown owner - C:\Programme\Samsung\Samsung Update Plus\SLUBackgroundService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe

Gruss
Loewe

P.S.: Ich weiß nicht wie man im ungesicherten Modus löscht.

[Fat_Mike]

Code: Alles auswählen

O4 - Global Startup: db dialog updater.lnk = C:\Programme\db dialog\wiseupdt.EXE

was für eine software ist das? hast du sie installiert?

ist auf deinem windows der firebird browser installiert? wenn ja, schmeiss ihn mal raus und installier ihn neu. mich wundern die sehr zahlreichen einträge.

du kannst im abgesicherten modus starten, indem du während des bootens (nach der anzeige der laufwerke) f8 drückst. dort hast du dann verschiedene auswahlmöglichkeiten, am besten wählst du "abgesicherter modus ohne netzwerktreiber" aus, du musst dann natürlich alle programme , die du eventuell starten willst, auf deiner festplatte haben.


gruss
fat.

[Loewe]

Danke für deine schnelle Antwort. Die Software db... ist von der Deutschen Bank. Damit mache ich Internetbanking.

Das mit dem abgesicherten Modus starten, kann ich machen, aber ich weiss ja nicht was ich dann genau löschen muss.

Firebird browser prüfe ich, soll ich dann etwas anderes dafür installieren?

Wundere dich nicht über meine Fragen, ich bin nicht mit PCs großgeworden und nun muss ich geschäftlich damit arbeiten (selbständig) und muss mich ständig mit solchen Dingen auseinandersetzen, von denen ich keine Ahnung habe. Sorry

Nur gut dass es euch gibt!
Gruss
Loewe

Code: Alles auswählen

O4 - Global Startup: db dialog updater.lnk = C:\Programme\db dialog\wiseupdt.EXE

was für eine software ist das? hast du sie installiert?

ist auf deinem windows der firebird browser installiert? wenn ja, schmeiss ihn mal raus und installier ihn neu. mich wundern die sehr zahlreichen einträge.

du kannst im abgesicherten modus starten, indem du während des bootens (nach der anzeige der laufwerke) f8 drückst. dort hast du dann verschiedene auswahlmöglichkeiten, am besten wählst du "abgesicherter modus ohne netzwerktreiber" aus, du musst dann natürlich alle programme , die du eventuell starten willst, auf deiner festplatte haben.


gruss
fat.

[Fat_Mike]

...vielleicht wäre es in deinem fall nicht schlecht, ein kleines it-serviceunternehmen (keinen selbsternannten pc-spezialisten mit gewerbeschein!) mit derartigen dingen zu beauftragen, viele bieten wartungsverträge an. ich arbeite selbst nebenberuflich bei so einem laden, unsere kunden bestehen zum grössten teil aus 1-20 personen starken firmen.

was firebird angeht: grundsätzlich ist das ding ok. ich hab nie damit gearbeitet, mir sind nur die relativ zahlreichen einträge aufgefallen. daher würde ichs einfach mal deinstallieren und wieder neu installieren. sicherer als ein internet explorer dürfte es allemal sein.

mach doch bitte auf deinem aktuellen system nochmal nen check mit escan, mich würde interessieren, wie viel deine bisherigen schritte gebracht haben. dein hjt log weist nämlich eigentlich nichts dramatisches aus.


gruss
fat.