Bitte um Hilfe:

seit einigen Tagen ist mein PC quälend langsam und stürzt regelmäßig ab.
Kann es sein, dass ich Viren, Trojaner, etc. auf dem PC habe? Für Hilfe wäre ich sehr dankbar.

Hier mein Hijack-Log:

Logfile of HijackThis v1.99.1
Scan saved at 12:55:20, on 30.06.05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\PROGRAMME\GEMEINSAME DATEIEN\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAMME\GEMEINSAME DATEIEN\SYMANTEC SHARED\CCSETMGR.EXE
C:\PROGRAMME\NORTON ANTIVIRUS\IWP\NPFMNTOR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAMME\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAMME\KFH\CL\LAUNCHER.EXE
C:\WINDOWS\SYSTEM\LVHIDSVC.EXE
C:\WINDOWS\SYSTEM\DESBYHDW.EXE
C:\WINDOWS\ASRD.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAMME\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\PROGRAMME\GUILLEMOT\MAXI STUDIO ISIS\ISISMAN.EXE
C:\PROGRAMME\GEMEINSAME DATEIEN\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAMME\GEMEINSAME DATEIEN\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAMME\GEMEINSAME DATEIEN\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAMME\SAVE\SAVE.EXE
C:\PROGRAMME\GHOSTSURF EXPRESS\GHOSTSURF.EXE
C:\PROGRAMME\DIAMOND\INCONTROL TOOLS 99\DMHKEY.EXE
C:\PROGRAMME\REAL\REALPLAYER\REALPLAY.EXE
C:\PROGRAMME\ZYDAS TECHNOLOGY CORPORATION\ZYDAS_802.11G_UTILITY\ZDWLAN.EXE
C:\WINDOWS\WINIPCFG.EXE
C:\PROGRAMME\GEMEINSAME DATEIEN\SYMANTEC SHARED\SNDSRVC.EXE
C:\PROGRAMME\MOZILLA FIREFOX\FIREFOX.EXE
C:\PROGRAMME\ACDSEE32\ACDSEE32.EXE
C:\PROGRAMME\SYMANTEC\LIVEUPDATE\AUPDATE.EXE
C:\PROGRAMME\SYMANTEC\LIVEUPDATE\LUCOMSERVER_2_5.EXE
C:\PROGRAMME\WINZIP\WINZIP32.EXE
C:\WINDOWS\TEMP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = h**p://www.yyep.com/search/search05.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.web.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://www.lycos.de/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = h**p://www.yyep.com/search/search05.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer bereitgestellt von Lycos Europe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:7212
O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:\WINDOWS\2_0_1browserhelper2.dll (file missing)
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\SYSTEM\MSBE.DLL
O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\SYSTEM\NVMS.DLL
O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\SYSTEM\MSCB.DLL
O2 - BHO: IEWatchObj Class - {9527D42F-D666-11D3-B8DD-00600838CD5F} - C:\WINDOWS\SYSTEM\IETie.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: ngsh33.clsIS - {941CA48C-3984-4E7D-AAF8-8755ED76EB50} - C:\WINDOWS\SYSTEM32\NGSH33.DLL
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [Launcher] "C:\Programme\KFH\cl\launcher.exe" /P
O4 - HKLM\..\Run: [SienaManager] siena95.exe
O4 - HKLM\..\Run: [LvRemote] "C:\WINDOWS\SYSTEM\lvhidsvc.exe"
O4 - HKLM\..\Run: [RecSche] "c:\programme\tvcapture\RecSche.exe"
O4 - HKLM\..\Run: [njbctnnpmnw] C:\WINDOWS\SYSTEM\desbyhdw.exe
O4 - HKLM\..\Run: [BullsEye Network] C:\Programme\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [ALCHEM] C:\WINDOWS\ALCHEM.exe
O4 - HKLM\..\Run: [satmat] C:\WINDOWS\SATMAT.exe
O4 - HKLM\..\Run: [GminiSystrayUtility] asrd.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\Run: [ISIS Manager] C:\Programme\Guillemot\Maxi Studio ISIS\ISISMan.exe /BOOTUP
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Symantec Core LC] C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [WhenUSave] "C:\Programme\Save\Save.exe"
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [NPFMonitor] C:\Programme\Norton AntiVirus\IWP\NPFMntor.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Programme\Gemeinsame Dateien\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKCU\..\Run: [AIM] C:\PROGRAMME\NETSCAPE\COMMUNICATOR\PROGRAM\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [ngpw36] C:\windows\system32\ngpw36.exe
O4 - HKCU\..\Run: [adprot] C:\windows\system32\adprot.exe
O4 - Startup: GhostSurf Express.lnk = C:\Programme\GhostSurf Express\GhostSurf.exe
O4 - Startup: InControl Desktop Manager.lnk = C:\Programme\Diamond\InControl Tools 99\DMHKEY.EXE
O4 - Startup: CAPI Control.lnk = C:\Programme\Eumex 604PC HomeNet\Capictrl.exe
O4 - Startup: HomeNet Control.lnk = C:\Programme\Eumex 604PC HomeNet\HNetCtrl.exe
O4 - Startup: ZDWLan Utility.lnk = C:\Programme\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
O4 - Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: NetShow PowerPoint Helper.lnk = C:\Programme\NetShow Services\Tools\nsppthlp.exe
O8 - Extra context menu item: Block this advertisement - file://C:\PROGRAMME\GHOSTSURF EXPRESS\menu.blockimg.html
O8 - Extra context menu item: Allow this advertisement - file://C:\PROGRAMME\GHOSTSURF EXPRESS\menu.allowimg.html
O8 - Extra context menu item: Block popups on this site - file://C:\PROGRAMME\GHOSTSURF EXPRESS\popup.block.html
O8 - Extra context menu item: Allow popups on this site - file://C:\PROGRAMME\GHOSTSURF EXPRESS\popup.allow.html
O8 - Extra context menu item: Block personal info from this site - file://C:\PROGRAMME\GHOSTSURF EXPRESS\info.block.html
O8 - Extra context menu item: Allow personal info to reach this site - file://C:\PROGRAMME\GHOSTSURF EXPRESS\info.allow.html
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: (no name) - {578FC4E3-151E-456c-AF8E-B63061EFE228}} - (no file)
O9 - Extra button: GhostSurf Privacy Center - {578FC4E3-151E-456c-AF8E-B63061EFE228} - C:\PROGRAMME\GHOSTSURF EXPRESS\LaunchPCC.exe
O9 - Extra 'Tools' menuitem: GhostSurf Privacy Center - {578FC4E3-151E-456c-AF8E-B63061EFE228} - C:\PROGRAMME\GHOSTSURF EXPRESS\LaunchPCC.exe
O12 - Plugin for .pca: C:\PROGRA~1\INTERN~1\PLUGINS\nppcaplg.dll
O14 - IERESET.INF: START_PAGE_URL=h**p://www.lycos.de/


Schöne Grüße.

Hallo mgrules,

Downloade Dir clearprog, nimm eine Datenträgerbereinigung vor (Häckchen bei “alles Löschen” und auf “löschen” klicken) und leere den Quarantäne-Ordner Deines Antivir-Programms.
Desweiteren führe Escan aus und befolge genau an die Anleitung.


dartus

Hallo,
ich habe nach dartus' Tip (vielen Dank auch!) eScan und danach Find.bat durchlaufen lassen. Und es wurde doch so allerhand gefunden. Mit den Ergebnissen kann ich aber leider nicht viel anfangen...

Kann mir jemand beim beseitigen helfen?!

Vielen Dank im voraus!!!

Hier das eScan_neu - log:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Funde für "infected"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~

---------- c:\bases_x\mwav.log
Fri Jul 01 11:16:34 2005 => File C:\WINDOWS\SYSTEM\desbyhdw.exe infected by "Trojan-Downloader.Win32.Agent.ae" Virus! Action Taken: No Action Taken.
Fri Jul 01 11:16:34 2005 => File C:\WINDOWS\ALCHEM.exe infected by "Trojan-Downloader.Win32.Alchemic" Virus! Action Taken: No Action Taken.
Fri Jul 01 11:16:41 2005 => File C:\windows\system32\adprot.exe infected by "Trojan-Clicker.Win32.VB.gn" Virus! Action Taken: No Action Taken.
Fri Jul 01 11:18:01 2005 => System found infected with BearShare Spyware/Adware ({905d0df2-3a0a-4d94-853c-54a12a745905})! Action taken: No Action Taken.
Fri Jul 01 11:18:01 2005 => System found infected with BearShare Spyware/Adware ({9f95f736-0f62-4214-a4b4-caa6738d4c07})! Action taken: No Action Taken.
Fri Jul 01 11:18:01 2005 => System found infected with BearShare Spyware/Adware ({558ec983-bedb-9168-b2de-31dbf0ee543e})! Action taken: No Action Taken.
Fri Jul 01 11:18:01 2005 => System found infected with BearShare Spyware/Adware ({5f95e1af-2620-4f15-bdf9-7fdce4607e17})! Action taken: No Action Taken.
Fri Jul 01 11:18:01 2005 => System found infected with Bargain Buddy Spyware/Adware ({8eee58d5-130e-4cbd-9c83-35a0564e2468})! Action taken: No Action Taken.
Fri Jul 01 11:18:01 2005 => System found infected with Bargain Buddy Spyware/Adware ({ce188402-6ee7-4022-8868-ab25173a3e14})! Action taken: No Action Taken.
Fri Jul 01 11:18:01 2005 => System found infected with Bargain Buddy Spyware/Adware ({4eb7bbe8-2e15-424b-9ddb-2cdb9516b2c3})! Action taken: No Action Taken.
Fri Jul 01 11:18:01 2005 => System found infected with Bargain Buddy Spyware/Adware ({c6906a23-4717-4e1f-b6fd-f06ebed15678})! Action taken: No Action Taken.
Fri Jul 01 11:18:01 2005 => System found infected with Bargain Buddy Spyware/Adware ({8eee58d5-130e-4cbd-9c83-35a0564e5678})! Action taken: No Action Taken.
Fri Jul 01 11:18:01 2005 => System found infected with Bargain Buddy Spyware/Adware ({f4e04583-354e-4076-be7d-ed6a80fd66da})! Action taken: No Action Taken.
Fri Jul 01 11:18:01 2005 => System found infected with Alexa Spyware/Adware ({c95fe080-8f5d-11d2-a20b-00aa003c157a})! Action taken: No Action Taken.
Fri Jul 01 11:18:01 2005 => System found infected with WhenU Spyware/Adware (wusn)! Action taken: No Action Taken.
Fri Jul 01 11:18:07 2005 => System found infected with eZula Spyware/Adware (exul.exe)! Action taken: No Action Taken.
Fri Jul 01 11:18:07 2005 => System found infected with eZula Spyware/Adware (exdl.exe)! Action taken: No Action Taken.
Fri Jul 01 11:18:07 2005 => System found infected with eZula Spyware/Adware (bbchk.exe)! Action taken: No Action Taken.
Fri Jul 01 11:19:18 2005 => File C:\WINDOWS\Sngpw36.exe infected by "Trojan-Clicker.Win32.VB.gn" Virus! Action Taken: No Action Taken.
Fri Jul 01 11:21:36 2005 => File C:\WINDOWS\SYSTEM\POLALL1M.EXE infected by "Trojan-Downloader.Win32.Agent.ae" Virus! Action Taken: No Action Taken.
Fri Jul 01 11:32:15 2005 => File C:\WINDOWS\SYSTEM\POLALL1M.EXE infected by "Trojan-Downloader.Win32.Agent.ae" Virus! Action Taken: No Action Taken.
Fri Jul 01 11:34:03 2005 => File C:\WINDOWS\SYSTEM32\ngpw36.exe.exe infected by "Trojan-Clicker.Win32.VB.gn" Virus! Action Taken: No Action Taken.
Fri Jul 01 11:41:45 2005 => File C:\WINDOWS\Sngpw36.exe infected by "Trojan-Clicker.Win32.VB.gn" Virus! Action Taken: No Action Taken.
Fri Jul 01 12:23:28 2005 => File C:\Programme\Norton AntiVirus\Quarantine\2066722E.exe infected by "P2P-Worm.Win32.SdDrop.c" Virus! Action Taken: No Action Taken.
Fri Jul 01 12:23:28 2005 => File C:\Programme\Norton AntiVirus\Quarantine\4F652677.exe infected by "P2P-Worm.Win32.SdDrop.c" Virus! Action Taken: No Action Taken.
Fri Jul 01 12:23:30 2005 => File C:\Programme\Norton AntiVirus\Quarantine\6F8A7317.dll infected by "Trojan-Clicker.Win32.Delf.r" Virus! Action Taken: No Action Taken.
Fri Jul 01 12:23:30 2005 => File C:\Programme\Norton AntiVirus\Quarantine\6F94710C.exe infected by "Trojan-Spy.Win32.Briss.e" Virus! Action Taken: No Action Taken.
Fri Jul 01 12:23:31 2005 => File C:\Programme\Norton AntiVirus\Quarantine\6F94710C.dll infected by "Trojan-Spy.Win32.Briss.i" Virus! Action Taken: No Action Taken.
Fri Jul 01 12:23:31 2005 => File C:\Programme\Norton AntiVirus\Quarantine\5DCB6947.exe infected by "Trojan-Spy.Win32.Briss.j" Virus! Action Taken: No Action Taken.
Fri Jul 01 12:23:31 2005 => File C:\Programme\Norton AntiVirus\Quarantine\6F9A4505.TMP infected by "Trojan-Spy.Win32.Briss.j" Virus! Action Taken: No Action Taken.
Fri Jul 01 12:23:33 2005 => File C:\Programme\Norton AntiVirus\Quarantine\6F9E6F01.exe infected by "Trojan-Dropper.Win32.Delf.z" Virus! Action Taken: No Action Taken.
Fri Jul 01 12:44:28 2005 => Total Disinfected Files: 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Funde für "tagged"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~

---------- c:\bases_x\mwav.log
Fri Jul 01 11:16:29 2005 => File C:\WINDOWS\SYSTEM\MSBE.DLL tagged as "not-a-virus:AdWare.BargainBuddy.j". Action Taken: No Action Taken.
Fri Jul 01 11:16:29 2005 => File C:\WINDOWS\SYSTEM\NVMS.DLL tagged as "not-a-virus:AdWare.BargainBuddy.j". Action Taken: No Action Taken.
Fri Jul 01 11:16:29 2005 => File C:\WINDOWS\SYSTEM\MSCB.DLL tagged as "not-a-virus:AdWare.BargainBuddy.j". Action Taken: No Action Taken.
Fri Jul 01 11:16:29 2005 => File C:\WINDOWS\SYSTEM32\NGSH33.DLL tagged as "not-a-virus:AdWare.AdBlaster.b". Action Taken: No Action Taken.
Fri Jul 01 11:16:38 2005 => File C:\Programme\Save\Save.exe tagged as "not-a-virus:AdWare.SaveNow.bc". Action Taken: No Action Taken.
Fri Jul 01 11:18:33 2005 => File C:\WINDOWS\TWAINTEC.DLL tagged as "not-a-virus:AdWare.BiSpy.t". Action Taken: No Action Taken.
Fri Jul 01 11:19:05 2005 => File C:\WINDOWS\cep1unin.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Fri Jul 01 11:19:06 2005 => File C:\WINDOWS\x-launch.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Fri Jul 01 11:19:07 2005 => File C:\WINDOWS\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Fri Jul 01 11:19:16 2005 => File C:\WINDOWS\NDNuninstall4_50.exe tagged as "not-a-virus:AdWare.NewDotNet". Action Taken: No Action Taken.
Fri Jul 01 11:19:18 2005 => File C:\WINDOWS\Sngsh33.dll tagged as "not-a-virus:AdWare.AdBlaster.b". Action Taken: No Action Taken.
Fri Jul 01 11:19:25 2005 => File C:\WINDOWS\PREINSTT.EXE tagged as "not-a-virus:AdWare.BiSpy.f". Action Taken: No Action Taken.
Fri Jul 01 11:21:45 2005 => File C:\WINDOWS\SYSTEM\exdl.exe tagged as "not-a-virus:AdWare.BargainBuddy.j". Action Taken: No Action Taken.
Fri Jul 01 11:21:45 2005 => File C:\WINDOWS\SYSTEM\exul.exe tagged as "not-a-virus:AdWare.BargainBuddy.j". Action Taken: No Action Taken.
Fri Jul 01 11:21:46 2005 => File C:\WINDOWS\SYSTEM\apuc.dll tagged as "not-a-virus:AdWare.BargainBuddy.j". Action Taken: No Action Taken.
Fri Jul 01 11:22:29 2005 => File C:\WINDOWS\SYSTEM\FSG.exe_data.dat tagged as "not-a-virus:AdWare.Gator.1050". Action Taken: No Action Taken.
Fri Jul 01 11:27:15 2005 => File C:\WINDOWS\OPTIONS\CABS\EBD.CAB tagged as not-a-virus:Tool.DOS.Restart. No Action Taken.
Fri Jul 01 11:27:17 2005 => File C:\WINDOWS\OPTIONS\CABS\OLS\AOL\AOL40DE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Fri Jul 01 11:30:33 2005 => File C:\WINDOWS\SYSTEM\MACROMED\Shockwave 10\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Fri Jul 01 11:32:26 2005 => File C:\WINDOWS\SYSTEM\exdl.exe tagged as "not-a-virus:AdWare.BargainBuddy.j". Action Taken: No Action Taken.
Fri Jul 01 11:32:26 2005 => File C:\WINDOWS\SYSTEM\exul.exe tagged as "not-a-virus:AdWare.BargainBuddy.j". Action Taken: No Action Taken.
Fri Jul 01 11:32:26 2005 => File C:\WINDOWS\SYSTEM\apuc.dll tagged as "not-a-virus:AdWare.BargainBuddy.j". Action Taken: No Action Taken.
Fri Jul 01 11:33:10 2005 => File C:\WINDOWS\SYSTEM\FSG.exe_data.dat tagged as "not-a-virus:AdWare.Gator.1050". Action Taken: No Action Taken.
Fri Jul 01 11:33:16 2005 => File C:\WINDOWS\TWAINTEC.DLL tagged as "not-a-virus:AdWare.BiSpy.t". Action Taken: No Action Taken.
Fri Jul 01 11:34:03 2005 => File C:\WINDOWS\SYSTEM32\stmtreco.exe tagged as "not-a-virus:AdWare.BetterInternet". Action Taken: No Action Taken.
Fri Jul 01 11:41:32 2005 => File C:\WINDOWS\cep1unin.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Fri Jul 01 11:41:33 2005 => File C:\WINDOWS\x-launch.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Fri Jul 01 11:41:34 2005 => File C:\WINDOWS\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Fri Jul 01 11:41:44 2005 => File C:\WINDOWS\NDNuninstall4_50.exe tagged as "not-a-virus:AdWare.NewDotNet". Action Taken: No Action Taken.
Fri Jul 01 11:41:56 2005 => File C:\WINDOWS\Sngsh33.dll tagged as "not-a-virus:AdWare.AdBlaster.b". Action Taken: No Action Taken.
Fri Jul 01 11:42:03 2005 => File C:\WINDOWS\PREINSTT.EXE tagged as "not-a-virus:AdWare.BiSpy.f". Action Taken: No Action Taken.
Fri Jul 01 12:06:46 2005 => File C:\Programme\ACDSee32\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Fri Jul 01 12:14:52 2005 => File C:\Programme\Opera\UnInst\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Fri Jul 01 12:15:34 2005 => File C:\Programme\DVDlab\DVD-lab 1.1.crack.exe tagged as not-a-virus:Tool.Win32.TPE.a. No Action Taken.
Fri Jul 01 12:19:09 2005 => File C:\Programme\Steinberg\Cubase VST32 Demo\Uninstall.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Fri Jul 01 12:19:10 2005 => File C:\Programme\BearShare\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Fri Jul 01 12:19:15 2005 => File C:\Programme\BearShare\Installer\saveinstwm.exe tagged as "not-a-virus:AdWare.SaveNow.z". Action Taken: No Action Taken.
Fri Jul 01 12:19:18 2005 => File C:\Programme\BearShare\Installer\BSINSTALL.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Fri Jul 01 12:23:49 2005 => File C:\Programme\Save\SaveUninst.exe tagged as "not-a-virus:AdWare.SaveNow.bc". Action Taken: No Action Taken.
Fri Jul 01 12:31:16 2005 => File C:\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Fri Jul 01 12:32:15 2005 => File C:\Audio\Logic Audio Platinum\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Fri Jul 01 12:36:31 2005 => File D:\My Downloads\RADTools.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Fri Jul 01 12:36:51 2005 => File D:\My Downloads\ow32dede754.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Fri Jul 01 12:38:57 2005 => File D:\My Downloads\LiveDemo404_DE.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Fri Jul 01 12:39:07 2005 => File D:\My Downloads\dvdlab_final.zip tagged as not-a-virus:Tool.Win32.TPE.a. No Action Taken.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Statistiken:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~

---------- c:\bases_X\mwav.log
Fri Jul 01 12:44:28 2005 => Total Objects Scanned: 57102

---------- c:\bases_X\mwav.log
Fri Jul 01 12:44:28 2005 => Total Virus(es) Found: 91

---------- c:\bases_x\mwav.log
Fri Jul 01 12:44:28 2005 => Total Errors: 201

---------- c:\bases_x\mwav.log
Fri Jul 01 12:44:28 2005 => Time Elapsed: 01:19:05
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
~~~~~~~ © Haui ;-) ~~~~~~~
~~~~~~~ Dank an Cidre ~~~~~~~
_____________
Anm.
Threads zusammengeführt!

LG Cidre
S-Mod TB

Hallo,

ich habe nach dartus' Tip (vielen Dank auch!) eScan und danach Find.bat durchlaufen lassen.

Warum eröffnest du dann einen neuen Thread?
Der Übersichtlichkeit wegen wäre es sinnvoller, wenn du in einem Thread bleiben würdest.

Darum werden jetztbeide Threads wieder zusammengeführt!

Lösche, wie in der eScan Anleitung beschrieben, die einzelnen Funde und wende zusätzlich Ad-Aware und Spybot S&D im abgesicherten Modus an.

Poste anschließend ein neues HJT Log-File.