Hallo,
habe das selbe Problem wie hier schon des öfteren beschrieben : Beim downloaden von pdfcreator - jetzt hab ich auch diesen incredibar-Schrott.
Bin leider nicht sehr versiert, hoffe aber, das mir da ein freundlicher Mensch weiterhelfen kann. Danke schon mal im Voraus:
Malwarebytes hat ein Objekt gefunden. Das wurde gelöscht.
Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.07.02.01

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
xxxxxxxxxxxxx :: xxxxxxxxxxxx-PC [Administrator]

02.07.2012 12:49:30
mbam-log-2012-07-02 (12-49-30).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 290504
Laufzeit: 1 Stunde(n), 2 Minute(n), 14 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|{E9073B6D-D2AA-4B27-9A82-3F3042106810} (Trojan.ZbotR.Gen) -> Daten: "C:\Users\xxxxxxxxxxxxxxx\AppData\Roaming\Obfyh\viqaodl.exe" -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Vorher hat ein scan mit avira 2 Funde gezeigt:

ADWARE/Multplug.A.1 ist jetzt noch in avira quarantäne, der andere,
mit dem selben Namen( in etwa ) wurde leider gelöscht.

Malwarebytes hatte das Teil nicht gefunden.

Wäre schön, wenn Ihr mir helfen könnt. Bis auf weiteres
RS

INCREDIBAR IST JETZT WIDER WEG!!!!!!!!Vielen Dank an das Board!!!!!!!!!!!!!!!!!


Hallo,
bei mir ist die toolbar jetzt verschwunden, nach dem Einsatz von ADW-Cleaner:
Das ging ganz schnell - noch nicht mal eine Minute!
Und das nach eset mit einem Suchlauf, der fast 5 Stunden dauerte.
Ich habe gedacht, dass schaffe ich nie.
Ob es das jetzt war? Das wäre schön.

# AdwCleaner v1.701 - Logfile created 07/03/2012 at 08:34:08
# Updated 02/07/2012 by Xplode
# Operating system : Windows 7 Professional Service Pack 1 (32 bits)
# User : -PC
# Running from : C:\Users\\Downloads\adwcleaner.exe
# Option [Delete]


***** [Services] *****

Stopped & Deleted : Web Assistant Updater

***** [Files / Folders] *****

Folder Deleted : C:\Users\\AppData\LocalLow\Incredibar.com
Folder Deleted : C:\Users\\AppData\Roaming\Mozilla\Firefox\Profiles\135r9kpp.default\extensions\ffxtlbr@incredibar.com
Folder Deleted : C:\Program Files\Incredibar.com
Folder Deleted : C:\Program Files\Web Assistant
File Deleted : C:\Users\\AppData\Roaming\Mozilla\Firefox\Profiles\135r9kpp.default\searchplugins\MyStart Search.xml

***** [Registry] *****

Key Deleted : HKCU\Software\IM
Key Deleted : HKCU\Software\ImInstaller
Key Deleted : HKCU\Software\Incredibar.com
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\Extension.DLL
Key Deleted : HKLM\SOFTWARE\Classes\escort.escortIEPane
Key Deleted : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Key Deleted : HKLM\SOFTWARE\Classes\esrv.IncredibarESrvc
Key Deleted : HKLM\SOFTWARE\Classes\esrv.IncredibarESrvc.1
Key Deleted : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject
Key Deleted : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject.1
Key Deleted : HKLM\SOFTWARE\Classes\I
Key Deleted : HKLM\SOFTWARE\Classes\Incredibar.dskBnd
Key Deleted : HKLM\SOFTWARE\Classes\Incredibar.dskBnd.1
Key Deleted : HKLM\SOFTWARE\Classes\Incredibar.IncredibarHlpr
Key Deleted : HKLM\SOFTWARE\Classes\Incredibar.IncredibarHlpr.1
Key Deleted : HKLM\SOFTWARE\Classes\IncredibarApp.appCore
Key Deleted : HKLM\SOFTWARE\Classes\IncredibarApp.appCore.1
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Key Deleted : HKLM\SOFTWARE\Incredibar.com
Key Deleted : HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{336D0C35-8A85-403a-B9D2-65C292C39087}_is1
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\incredibar
Key Deleted : HKLM\SOFTWARE\Web Assistant
Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}]

***** [Registre - GUID] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{CFE8AAFD-A0F3-4329-84E9-6B679EC93EC2}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{336D0C35-8A85-403a-B9D2-65C292C39087}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C01315C7-B4E2-4864-B43D-5FAFC414D179}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C1545464-C77C-4130-A572-1C619E2895FE}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{ED0E67AD-926C-4008-87E5-03CF72AA2A7E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EF7FEC6D-451B-4452-9D26-7E10C6B5DB6E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F9639E4A-801B-4843-AEE3-03D9DA199E77}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{22B0769F-794B-4422-AC84-47B123C8986D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{255E0B2A-D747-4EEF-B7CE-159D73A3656D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{28ED590D-F5ED-4E05-A87F-1D759F1C6169}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{45D5B93F-E2ED-4AF2-915E-DCDDBDA8C33C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{771B99AB-636F-4A11-9039-8DFEB927B061}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A8321AA2-2227-40C7-8525-6C2F4E1B0EBE}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AA41A731-6814-4A70-A6F1-C0A20FBBFBD5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{ABBB8A9E-D8AF-40D1-94BE-5175077465FC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BF737694-56F6-46FA-9FDC-FA99A5B25FAD}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{CFCD164E-8AC9-478E-9ECC-B616A932016C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D5961CC0-B442-4567-8030-67E241EF4CC2}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E450067F-1C93-41A7-928E-07E5C2EEC680}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F977D9F2-4BDC-44A6-B508-7C0284C61EED}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{1D5A4199-956E-49BC-B89F-6A35C57C0D13}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{48C9C8B0-A546-46C1-A81F-47A31E623E9D}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{CFE8AAFD-A0F3-4329-84E9-6B679EC93EC2}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{74C36554-31F0-49DD-8857-ED6A64DF45BE}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{336D0C35-8A85-403a-B9D2-65C292C39087}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F9639E4A-801B-4843-AEE3-03D9DA199E77}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{336D0C35-8A85-403a-B9D2-65C292C39087}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9639E4A-801B-4843-AEE3-03D9DA199E77}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{F9639E4A-801B-4843-AEE3-03D9DA199E77}]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://mystart.incredibar.com/mb139?a=6R8xKADKKA&i=26 --> hxxp://www.google.com

-\\ Mozilla Firefox v13.0.1 (de)

Profile name : default
File : C:\Users\\AppData\Roaming\Mozilla\Firefox\Profiles\135r9kpp.default\prefs.js

C:\Users\\AppData\Roaming\Mozilla\Firefox\Profiles\135r9kpp.default\user.js ... Deleted !

Deleted : user_pref("browser.newtab.url", "hxxp://mystart.incredibar.com/mb139?a=6R8xKADKKA&loc=FF_NT");
Deleted : user_pref("browser.startup.homepage", "hxxp://Mystart.incredibar.com/mb124");
Deleted : user_pref("extensions.enabledAddons", "jl@leimbach-it.de:2.5,shopclever@extension:1.1.0.0,{9AA46F4F-[...]
Deleted : user_pref("extensions.incredibar.admin", false);
Deleted : user_pref("extensions.incredibar.aflt", "orgnl");
Deleted : user_pref("extensions.incredibar.cntry", "DE");
Deleted : user_pref("extensions.incredibar.dfltLng", "");
Deleted : user_pref("extensions.incredibar.dfltSrch", false);
Deleted : user_pref("extensions.incredibar.did", "10669");
Deleted : user_pref("extensions.incredibar.envrmnt", "production");
Deleted : user_pref("extensions.incredibar.excTlbr", false);
Deleted : user_pref("extensions.incredibar.hdrMd5", "0BE9D29A08051BDEE6C785E75DD9B082");
Deleted : user_pref("extensions.incredibar.hmpg", false);
Deleted : user_pref("extensions.incredibar.id", "98cd8f01000000000000001e90e9e576");
Deleted : user_pref("extensions.incredibar.installerproductid", "26");
Deleted : user_pref("extensions.incredibar.instlDay", "15523");
Deleted : user_pref("extensions.incredibar.instlRef", "");
Deleted : user_pref("extensions.incredibar.lastVrsnTs", "1.5.11.1410:27:28");
Deleted : user_pref("extensions.incredibar.mntrvrsn", "1.2.0");
Deleted : user_pref("extensions.incredibar.newTab", false);
Deleted : user_pref("extensions.incredibar.noFFXTlbr", false);
Deleted : user_pref("extensions.incredibar.ppd", "123%5F1");
Deleted : user_pref("extensions.incredibar.prdct", "incredibar");
Deleted : user_pref("extensions.incredibar.productid", "26");
Deleted : user_pref("extensions.incredibar.prtnrId", "Incredibar");
Deleted : user_pref("extensions.incredibar.sg", "none");
Deleted : user_pref("extensions.incredibar.smplGrp", "none");
Deleted : user_pref("extensions.incredibar.tlbrId", "base");
Deleted : user_pref("extensions.incredibar.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6R8xKADKKA&loc=IB_T[...]
Deleted : user_pref("extensions.incredibar.upn2", "6R8xKADKKA");
Deleted : user_pref("extensions.incredibar.upn2n", "92824634881737608");
Deleted : user_pref("extensions.incredibar.vrsn", "1.5.11.14");
Deleted : user_pref("extensions.incredibar.vrsnTs", "1.5.11.1410:27:28");
Deleted : user_pref("extensions.incredibar.vrsni", "1.5.11.14");
Deleted : user_pref("extensions.incredibar_i.aflt", "orgnl");
Deleted : user_pref("extensions.incredibar_i.dfltLng", "");
Deleted : user_pref("extensions.incredibar_i.did", "10669");
Deleted : user_pref("extensions.incredibar_i.excTlbr", false);
Deleted : user_pref("extensions.incredibar_i.id", "98cd8f01000000000000001e90e9e576");
Deleted : user_pref("extensions.incredibar_i.installerproductid", "26");
Deleted : user_pref("extensions.incredibar_i.instlDay", "15523");
Deleted : user_pref("extensions.incredibar_i.instlRef", "");
Deleted : user_pref("extensions.incredibar_i.ms_url_id", "");
Deleted : user_pref("extensions.incredibar_i.newTab", false);
Deleted : user_pref("extensions.incredibar_i.ppd", "123%5F1");
Deleted : user_pref("extensions.incredibar_i.prdct", "incredibar");
Deleted : user_pref("extensions.incredibar_i.productid", "26");
Deleted : user_pref("extensions.incredibar_i.prtnrId", "Incredibar");
Deleted : user_pref("extensions.incredibar_i.smplGrp", "none");
Deleted : user_pref("extensions.incredibar_i.tlbrId", "base");
Deleted : user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6R8xKADKKA&loc=IB[...]
Deleted : user_pref("extensions.incredibar_i.upn2", "6R8xKADKKA");
Deleted : user_pref("extensions.incredibar_i.upn2n", "92824634881737608");
Deleted : user_pref("extensions.incredibar_i.vrsn", "1.5.11.14");
Deleted : user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1410:27:28");
Deleted : user_pref("extensions.incredibar_i.vrsni", "1.5.11.14");
Deleted : user_pref("keyword.URL", "hxxp://mystart.incredibar.com/mb139/?loc=IB_DS&a=6R8xKADKKA&&i=26&search="[...]
Deleted : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_whiteList", "{\"search.babylon.com\[...]

*************************

AdwCleaner[R1].txt - [11189 octets] - [03/07/2012 08:30:07]
AdwCleaner[S1].txt - [11546 octets] - [03/07/2012 08:34:08]

########## EOF - C:\AdwCleaner[S1].txt - [11675 octets] ##########

Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.

Hallo,
hier die gewünschten Dateien.
Gruß
RS

********************************************************************


Malwarebytes Anti-Malware 1.61.0.1400
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: v2012.07.02.01

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
xxxxxxxxxxxx :: xxxxxxxxxxxxxxxx-PC [Administrator]

02.07.2012 12:49:30
mbam-log-2012-07-02 (12-49-30).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 290504
Laufzeit: 1 Stunde(n), 2 Minute(n), 14 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|{E9073B6D-D2AA-4B27-9A82-3F3042106810} (Trojan.ZbotR.Gen) -> Daten: "C:\Users\xx\AppData\Roaming\Obfyh\viqaodl.exe" -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)


*****************************************************************


Malwarebytes Anti-Malware 1.61.0.1400
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: v2012.07.03.01

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-PC [Administrator]

03.07.2012 07:58:07
mbam-log-2012-07-03 (07-58-07).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 92435
Laufzeit: 30 Minute(n), 30 Sekunde(n) [Abgebrochen]

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Hallo,
ich hab noch mal eine Frage:
das Problem haben scheinbar jene, die den pdf-creator pdfforge herunterladen.
Ich würde gerne einen pdf creator benutzen - vielleicht kann ich eine sichere Empfehlung erhalten. ( Produkt und Quelle )
Danke schon mal im Voraus und mit freundlichen Grüßen
RS

Ich würde gerne einen pdf creator benutzen - vielleicht kann ich eine sichere Empfehlung erhalten. ( Produkt und Quelle )

Ich nutze eigentlich unter Windows wenn überhaupt nur FreePDF
Ansonsten kann man eigentlich ohne Probleme unter MS-Office ab 2007 oder Open- und LibreOffice direkt als PDF speichern
Wozu genau braucht man diesen PDFCreator?

Du hast recht, scheinbar geht das direkt unter open office. Das war mir unbekannt! Damit sollte ein separater pdf -Erzeuger eigentlich überflüssig sein.
Ich denke, es ist etwas umständlicher in der Handhabung......
Mal sehen, ob sich Deine Variante bewährt.
Danke erst einmal.
Gruß
RS

Du hast nicht erklärt wozu du den PDFCreator brauchst
Wenn man direkt aus Office Dateien PDFs machen willst druckt man die über den virtuellen PDF-Drucker von FreePDF in eine Datei oder man speichert sie direkt als PDF ab
Ansonsten kannst du jede beliebige andere Datei mit dem dazugehörigen Programm öffnen und über den FreePDF Drucker in eine PDF-Datei "drucken"

Wozu also genau der PDFCreator?

Hi, ich möchte die Frage stellen, ob ich adwcleaner ganz normal, also präventiv von Zeit zu Zeit durchlaufen lassen kann, so wie meinetwegen Avira. Oder ist das nur dazu gedacht, im Falle der Infektion irgendetwas zu detektieren bzw zu löschen oder zu reparieren.

Danke schon mal im Voraus
Gruß
RS

Der adwCleaner löscht Toolbars und ähnlichen Werbemüll!
Ich finde du solltest mal deine allgemiene Strategie umdenken, meinst du nicht auch es wäre besser in Zukunft einfach mal besser aufzupassen was man sich installiert, anstatt alle Nase lang den Rechner von Müll zu befreien?!

Hi Cosinus, ich gebe Dir uneingeschränkt recht - seit der My Start Attacke bin ich vorsichtiger denn je. Ich denke, diese Lektion habe ich verstanden. Also software nur direkt vom Herausgeber und abschätzen, ob man das wirklich braucht oder nicht.Trotz allem hat mein Avira heute HTLM/FakeAV.AU gemeldet und in die Quarantäne gesteckt.
Ich glaube, das Internet ist wohl etwas tückischer geworden in der letzten Zeit. Mit solchen Problemen hatte ich in der Vergangenheit eher so gut wie nichts zu tun.
Dieses FakeAV.AU wurde danach weder von malwarebytes, eset, dawcleaner detektiert.
Ich denke, den werde ich erst mal vergessen. Siehst Du das ähnlich?
Viele Grüße
RS

Trotz allem hat mein Avira heute HTLM/FakeAV.AU gemeldet und in die Quarantäne gesteckt.

Damit kann ich nichts anfangen, wo ist das Log dazu?

so sieht das aus:



Avira Free Antivirus
Report file date: Montag, 30. Juli 2012 12:00

Scanning for 4004920 virus strains and unwanted programs.

The program is running as an unrestricted full version.
Online services are available.

Licensee : Avira AntiVir Personal - Free Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows 7 Professional
Windows version : (Service Pack 1) [6.1.7601]
Boot mode : Normally booted
Username : SYSTEM
Computer name : xxxxxxxxxxxxxxxx-PC

Version information:
BUILD.DAT : 12.0.0.1125 41829 Bytes 02.05.2012 17:40:00
AVSCAN.EXE : 12.3.0.15 466896 Bytes 09.05.2012 06:03:20
AVSCAN.DLL : 12.3.0.15 54736 Bytes 09.05.2012 06:03:20
LUKE.DLL : 12.3.0.15 68304 Bytes 09.05.2012 06:03:20
AVSCPLR.DLL : 12.3.0.14 97032 Bytes 09.05.2012 06:03:20
AVREG.DLL : 12.3.0.17 232200 Bytes 10.05.2012 17:32:33
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 18:18:34
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 09:07:39
VBASE002.VDF : 7.11.19.170 14374912 Bytes 20.12.2011 06:03:45
VBASE003.VDF : 7.11.21.238 4472832 Bytes 01.02.2012 13:08:04
VBASE004.VDF : 7.11.26.44 4329472 Bytes 28.03.2012 12:49:48
VBASE005.VDF : 7.11.34.116 4034048 Bytes 29.06.2012 16:43:12
VBASE006.VDF : 7.11.34.117 2048 Bytes 29.06.2012 16:43:12
VBASE007.VDF : 7.11.34.118 2048 Bytes 29.06.2012 16:43:12
VBASE008.VDF : 7.11.34.119 2048 Bytes 29.06.2012 16:43:12
VBASE009.VDF : 7.11.34.120 2048 Bytes 29.06.2012 16:43:12
VBASE010.VDF : 7.11.34.121 2048 Bytes 29.06.2012 16:43:12
VBASE011.VDF : 7.11.34.122 2048 Bytes 29.06.2012 16:43:12
VBASE012.VDF : 7.11.34.123 2048 Bytes 29.06.2012 16:43:12
VBASE013.VDF : 7.11.34.124 2048 Bytes 29.06.2012 16:43:12
VBASE014.VDF : 7.11.34.201 169472 Bytes 02.07.2012 16:43:17
VBASE015.VDF : 7.11.35.19 122368 Bytes 04.07.2012 05:56:22
VBASE016.VDF : 7.11.35.87 146944 Bytes 06.07.2012 12:28:22
VBASE017.VDF : 7.11.35.143 126464 Bytes 09.07.2012 06:57:22
VBASE018.VDF : 7.11.35.235 151552 Bytes 12.07.2012 18:00:23
VBASE019.VDF : 7.11.36.45 118784 Bytes 13.07.2012 10:16:20
VBASE020.VDF : 7.11.36.107 123904 Bytes 16.07.2012 14:28:49
VBASE021.VDF : 7.11.36.147 238592 Bytes 17.07.2012 15:27:09
VBASE022.VDF : 7.11.36.209 135168 Bytes 19.07.2012 16:14:14
VBASE023.VDF : 7.11.37.19 116224 Bytes 21.07.2012 11:27:15
VBASE024.VDF : 7.11.37.79 149504 Bytes 23.07.2012 08:16:58
VBASE025.VDF : 7.11.37.137 992256 Bytes 25.07.2012 08:16:59
VBASE026.VDF : 7.11.37.195 120832 Bytes 26.07.2012 08:16:59
VBASE027.VDF : 7.11.37.196 2048 Bytes 26.07.2012 08:17:00
VBASE028.VDF : 7.11.37.197 2048 Bytes 26.07.2012 08:17:00
VBASE029.VDF : 7.11.37.198 2048 Bytes 26.07.2012 08:17:00
VBASE030.VDF : 7.11.37.199 2048 Bytes 26.07.2012 08:17:00
VBASE031.VDF : 7.11.37.248 142336 Bytes 29.07.2012 15:10:25
Engine version : 8.2.10.120
AEVDF.DLL : 8.1.2.10 102772 Bytes 10.07.2012 14:45:01
AESCRIPT.DLL : 8.1.4.36 459131 Bytes 28.07.2012 08:17:03
AESCN.DLL : 8.1.8.2 131444 Bytes 29.01.2012 09:30:15
AESBX.DLL : 8.2.5.12 606578 Bytes 15.06.2012 07:09:24
AERDL.DLL : 8.1.9.15 639348 Bytes 08.09.2011 21:16:06
AEPACK.DLL : 8.3.0.18 807287 Bytes 28.07.2012 08:17:03
AEOFFICE.DLL : 8.1.2.42 201083 Bytes 21.07.2012 11:27:19
AEHEUR.DLL : 8.1.4.80 5075318 Bytes 28.07.2012 08:17:02
AEHELP.DLL : 8.1.23.2 258422 Bytes 29.06.2012 05:47:20
AEGEN.DLL : 8.1.5.34 434548 Bytes 21.07.2012 11:27:16
AEEXP.DLL : 8.1.0.72 86389 Bytes 28.07.2012 08:17:03
AEEMU.DLL : 8.1.3.2 393587 Bytes 10.07.2012 14:45:01
AECORE.DLL : 8.1.27.2 201078 Bytes 10.07.2012 14:45:00
AEBB.DLL : 8.1.1.0 53618 Bytes 01.09.2011 21:46:01
AVWINLL.DLL : 12.3.0.15 27344 Bytes 09.05.2012 06:03:20
AVPREF.DLL : 12.3.0.15 51920 Bytes 09.05.2012 06:03:20
AVREP.DLL : 12.3.0.15 179208 Bytes 09.05.2012 06:03:20
AVARKT.DLL : 12.3.0.15 211408 Bytes 09.05.2012 06:03:20
AVEVTLOG.DLL : 12.3.0.15 169168 Bytes 09.05.2012 06:03:20
SQLITE3.DLL : 3.7.0.1 398288 Bytes 09.05.2012 06:03:20
AVSMTP.DLL : 12.3.0.15 63440 Bytes 09.05.2012 06:03:20
NETNT.DLL : 12.3.0.15 17104 Bytes 09.05.2012 06:03:20
RCIMAGE.DLL : 12.3.0.15 4450000 Bytes 09.05.2012 06:03:20
RCTEXT.DLL : 12.3.0.15 96720 Bytes 09.05.2012 06:03:20

Configuration settings for the scan:
Jobname.............................: Local Hard Disks
Configuration file..................: C:\Program Files\Avira\AntiVir Desktop\alldiscs.avp
Logging.............................: default
Primary action......................: Interactive
Secondary action....................: Ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:, F:,
Process scan........................: on
Scan registry.......................: on
Search for rootkits.................: off
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: extended
Deviating risk categories...........: +APPL,+GAME,+JOKE,+PCK,+PFS,+SPR,

Start of the scan: Montag, 30. Juli 2012 12:00

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'F:\'
[INFO] No virus was found!

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'FlashPlayerPlugin_11_3_300_268.exe' - '1' Module(s) have been scanned
Scan process 'FlashPlayerPlugin_11_3_300_268.exe' - '1' Module(s) have been scanned
Scan process 'plugin-container.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'PresentationFontCache.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'wmpnetwk.exe' - '1' Module(s) have been scanned
Scan process 'thunderbird.exe' - '1' Module(s) have been scanned
Scan process 'SearchIndexer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'conhost.exe' - '1' Module(s) have been scanned
Scan process 'avshadow.exe' - '1' Module(s) have been scanned
Scan process 'CCC.exe' - '1' Module(s) have been scanned
Scan process 'googledrivesync.exe' - '1' Module(s) have been scanned
Scan process 'soffice.bin' - '1' Module(s) have been scanned
Scan process 'MOM.exe' - '1' Module(s) have been scanned
Scan process 'soffice.exe' - '1' Module(s) have been scanned
Scan process 'YahooWidgets.exe' - '1' Module(s) have been scanned
Scan process 'phonostarTimer.exe' - '1' Module(s) have been scanned
Scan process 'SpotifyWebHelper.exe' - '1' Module(s) have been scanned
Scan process 'googledrivesync.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'wmdc.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'taskhost.exe' - '1' Module(s) have been scanned
Scan process 'Explorer.EXE' - '1' Module(s) have been scanned
Scan process 'Dwm.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'Fuel.Service.exe' - '1' Module(s) have been scanned
Scan process 'armsvc.exe' - '1' Module(s) have been scanned
Scan process 'aavus.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'atieclxx.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'atiesrxx.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'lsm.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'wininit.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned

Starting to scan executable files (registry).
The registry was scanned ( '3016' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\Program Files\SpeedFan\uninstall.exe
[WARNING] Invalid end of file
C:\Users\\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\V1XR1O6K\swflash[1].cab
[WARNING] No further files can be extracted from this archive. The archive will be closed
C:\Users\\AppData\Local\Mozilla\Firefox\Profiles\135r9kpp.default\Cache\9\71\867CAd01
[DETECTION] Contains recognition pattern of the HTML/FakeAV.AU HTML script virus
C:\Users\\AppData\Local\Temp\install_flashplayer11x32_mssd_aih(1).exe
[WARNING] The file is password protected
C:\Users\\AppData\Local\Temp\jar_cache185021671257598841.tmp
[WARNING] Invalid end of file
C:\Users\\AppData\Local\Temp\jar_cache3832533257805597156.tmp
[WARNING] Invalid end of file
C:\Users\\AppData\Local\Temp\jar_cache389848016673712260.tmp
[WARNING] Invalid end of file
C:\Users\\AppData\Local\Temp\IM_6F77.tmp\terms.7z
[WARNING] The archive header is damaged
C:\Users\\AppData\LocalLow\Google\GoogleEarth\webdata\f_000004
[WARNING] Invalid end of file
C:\Users\\Downloads\avira_free_antivirus_en.exe
[WARNING] The file is password protected
C:\Users\Roland Scholz\Downloads\install_flashplayer11x32_mssd_aih(1).exe
[WARNING] The file is password protected
C:\Users\\Downloads\install_flashplayer11x32_mssd_aih.exe
[WARNING] The file is password protected
C:\Windows\SoftwareDistribution\Download\73359e52f84f08cc68c71cf422b798bb\BIT4A4.tmp
[WARNING] The archive header is damaged
Begin scan in 'F:\' <Volume>
F:\-PC\Backup Set 2012-02-15 115516\Backup Files 2012-02-15 115516\Backup files 13.zip
[WARNING] The file is password protected
F:\-PC\Backup Set 2012-03-04 092405\Backup Files 2012-03-04 092405\Backup files 15.zip
[WARNING] The file is password protected
F:\-PC\Backup Set 2012-03-25 143403\Backup Files 2012-03-25 143403\Backup files 15.zip
[WARNING] The file is password protected
F:\-PC\Backup Set 2012-04-08 150637\Backup Files 2012-04-08 150637\Backup files 12.zip
[WARNING] The file is password protected
F:\-PC\Backup Set 2012-04-30 081909\Backup Files 2012-04-30 081909\Backup files 17.zip
[WARNING] The file is password protected
F:\-PC\Backup Set 2012-05-20 101202\Backup Files 2012-05-20 101202\Backup files 17.zip
[WARNING] The file is password protected

Beginning disinfection:
C:\Users\\AppData\Local\Mozilla\Firefox\Profiles\135r9kpp.default\Cache\9\71\867CAd01
[DETECTION] Contains recognition pattern of the HTML/FakeAV.AU HTML script virus
[NOTE] The file was moved to the quarantine directory under the name '55b8ddf1.qua'.


End of the scan: Montag, 30. Juli 2012 13:40
Used time: 1:40:01 Hour(s)

The scan has been canceled!

25849 Scanned directories
1098110 Files were scanned
1 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 Files were deleted
0 Viruses and unwanted programs were repaired
1 Files were moved to quarantine
0 Files were renamed
0 Files cannot be scanned
1098109 Files not concerned
21696 Archives were scanned
18 Warnings
1 Notes

Wo hast du eigentlich das Log von ESET? Bitte nochmal ausführen wenn du es nicht richtig gemacht hast


ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Hi Arne, ich halte Dich ja auf Trab - hab schon ein schlechtes Gewissen.
Hier kommts -------- siehe letzte Zeile
Könnte man denn nicht einfach das Backup vom 22.07.2012 löschen?
F: ist eine Backup Festplatte nur für die regelmäßige Wartung

*****************************************************************

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=2c79c4f9bf24324ca94f5f91562443c8
# end=stopped
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-07-02 06:57:27
# local_time=2012-07-02 08:57:27 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 22331864 22331864 0 0
# compatibility_mode=5893 16776573 100 94 24696 92886459 0 0
# compatibility_mode=8192 67108863 100 0 172 172 0 0
# scanned=386
# found=0
# cleaned=0
# scan_time=178
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=53251
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=2c79c4f9bf24324ca94f5f91562443c8
# end=stopped
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-07-02 07:03:39
# local_time=2012-07-02 09:03:39 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6000 NT
# compatibility_mode=1792 16777215 100 0 22332328 22332328 0 0
# compatibility_mode=5893 16776573 100 94 25160 92886923 0 0
# compatibility_mode=8192 67108863 100 0 636 636 0 0
# scanned=386
# found=0
# cleaned=0
# scan_time=87
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=53251
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=2c79c4f9bf24324ca94f5f91562443c8
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-07-03 05:39:56
# local_time=2012-07-03 07:39:56 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 22332494 22332494 0 0
# compatibility_mode=5893 16776573 100 94 25326 92887089 0 0
# compatibility_mode=8192 67108863 100 0 802 802 0 0
# scanned=109112
# found=9
# cleaned=9
# scan_time=38098
C:\Users\\Downloads\PDFCreator-1_2_3_setup.exe Win32/Toolbar.Widgi

application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
F:\-PC\Backup Set 2012-02-15 115516\Backup Files 2012-02-15 115516\Backup files

8.zip Win32/Toolbar.Widgi application (deleted - quarantined)

00000000000000000000000000000000 C
F:\-PC\Backup Set 2012-03-04 092405\Backup Files 2012-03-04 092405\Backup files

8.zip Win32/Toolbar.Widgi application (deleted - quarantined)

00000000000000000000000000000000 C
F:\-PC\Backup Set 2012-03-25 143403\Backup Files 2012-03-25 143403\Backup files

8.zip Win32/Toolbar.Widgi application (deleted - quarantined)

00000000000000000000000000000000 C
F:\-PC\Backup Set 2012-04-08 150637\Backup Files 2012-04-08 150637\Backup files

5.zip Win32/Toolbar.Widgi application (deleted - quarantined)

00000000000000000000000000000000 C
F:\-PC\Backup Set 2012-04-30 081909\Backup Files 2012-04-30 081909\Backup files

9.zip Win32/Toolbar.Widgi application (deleted - quarantined)

00000000000000000000000000000000 C
F:\-PC\Backup Set 2012-05-20 101202\Backup Files 2012-05-20 101202\Backup files

9.zip Win32/Toolbar.Widgi application (deleted - quarantined)

00000000000000000000000000000000 C
F:\-PC\Backup Set 2012-06-11 075647\Backup Files 2012-06-11 075647\Backup files

9.zip Win32/Toolbar.Widgi application (deleted - quarantined)

00000000000000000000000000000000 C
F:\-PC\Backup Set 2012-07-01 184350\Backup Files 2012-07-01 184350\Backup files

11.zip Win32/Toolbar.Widgi application (deleted - quarantined)

00000000000000000000000000000000 C
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=2c79c4f9bf24324ca94f5f91562443c8
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-07-30 02:57:10
# local_time=2012-07-30 04:57:10 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 24732038 24732038 0 0
# compatibility_mode=5893 16776573 100 94 192027 95286633 0 0
# compatibility_mode=8192 67108863 100 0 2400346 2400346 0 0
# scanned=128840
# found=0
# cleaned=0
# scan_time=4789
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=2c79c4f9bf24324ca94f5f91562443c8
# end=stopped
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-07-31 11:13:40
# local_time=2012-07-31 01:13:40 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 24809771 24809771 0 0
# compatibility_mode=5893 16776573 100 94 13150 95364366 0 0
# compatibility_mode=8192 67108863 100 0 2478079 2478079 0 0
# scanned=250
# found=0
# cleaned=0
# scan_time=45
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=53251
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=2c79c4f9bf24324ca94f5f91562443c8
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-07-31 04:33:09
# local_time=2012-07-31 06:33:09 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 24810213 24810213 0 0
# compatibility_mode=5893 16776573 100 94 13592 95364808 0 0
# compatibility_mode=8192 67108863 100 0 2478521 2478521 0 0
# scanned=130767
# found=1
# cleaned=0
# scan_time=18772
F:\-PC\Backup Set 2012-07-22 144216\Backup Files 2012-07-22 144216\Backup files

6.zip JS/TrojanDownloader.FraudLoad.NAY trojan (unable to clean)

00000000000000000000000000000000 I

Du willst das gnaze Backup löschen, nur weil darin ein paar schädliche Dateien drin sein könnten?!
Sry irgendwie macht das nicht so richtig Sinn oder kannst du auf Backup verzichten?

War nur so ne Idee. Wenn es bessere Alternativen gibt wäre ich erfreut, wenn Du mir mitteilen würdest, wie es weitergeht, aus Deiner Sicht. Wir sprechen ja von aktuell 2 Stück detektierten Plagegeistern :
Ausgegangen war ich von
1) HTML/FakeAV.AU HTML script virus und neu gefunden wurde
2)JS/TrojanDownloader.FraudLoad.NAY trojan

Freue mich von Dir zu hören
Gruß
RS