pc zum 4 mal am ende

karoel

so da bin ich wieder ich hoffe du bzw. ihr könnt mir jetzt weiter helfen!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\INSTALIERTE SOFTWARE\WICHTIG\ANTIVIR\AVGUARD.EXE
D:\instalierte software\wichtig\antivir\AVWUPSRV.EXE
C:\WINDOWS\Explorer.EXE
D:\instalierte software\wichtig\antivir\AVGNT.EXE
C:\WINDOWS\Mixer.exe
C:\Programme\Java\jre1.5.0_05\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programme\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
D:\instalierte software\wichtig\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\MSN Messenger\MsnMsgr.Exe
C:\Programme\Internet Explorer\iexplore.exe
D:\instalierte software\wichtig\winrar\WinRAR.exe
C:\DOKUME~1\petra\LOKALE~1\Temp\Rar$EX11.2865\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.de/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\instalierte software\wichtig\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [AVGCtrl] D:\instalierte software\wichtig\antivir\AVGNT.EXE /min
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programme\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,ClientStartup -s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\instalierte software\wichtig\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [RauchFrei] "C:\Programme\RauchFrei\RauchFrei.exe"
O4 - HKCU\..\Run: [WhenUSave] "C:\Programme\Save\Save.exe"
O4 - HKCU\..\Run: [WeatherCast] "C:\Programme\WeatherCast\Weather.exe" /q
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_05\bin\npjpi150_05.dll
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF252FF2-6D65-41A4-93FF-F0969260E582}: NameServer = 213.168.112.60 194.8.194.60
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - D:\INSTALIERTE SOFTWARE\WICHTIG\ANTIVIR\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - D:\instalierte software\wichtig\antivir\AVWUPSRV.EXE



hier der escan!

System found infected with bearshare Spyware/Adware ({558ec983-bedb-9168-b2de-31dbf0ee543e})! Action taken: No Action Taken.
Sun Dec 18 14:22:25 2005 => System found infected with bearshare Spyware/Adware ({9f95f736-0f62-4214-a4b4-caa6738d4c07})! Action taken: No Action Taken.
Sun Dec 18 14:22:25 2005 => System found infected with bearshare Spyware/Adware ({5f95e1af-2620-4f15-bdf9-7fdce4607e17})! Action taken: No Action Taken.
Offending file found: C:\WINDOWS\iun6002.exe
Sun Dec 18 14:32:49 2005 => System found infected with zipitpro Spyware/Adware (iun6002.exe)! Action taken: No Action Taken


Offending file found: C:\WINDOWS\TEMP\_istmp2.dir\mydll.dll
Sun Dec 18 14:32:51 2005 => System found infected with advsearch Spyware/Adware (mydll.dll)! Action taken: No Action Taken.

Sun Dec 18 14:32:51 2005 => Offending Folder found: C:\Programme\Gemeinsame Dateien\whenu
Sun Dec 18 14:32:51 2005 => Object "whenu/savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.

Sun Dec 18 14:32:55 2005 => Offending file found: C:\Dokumente und Einstellungen\petra\Desktop\bearshare.lnk
Sun Dec 18 14:32:55 2005 => System found infected with bearshare Spyware/Adware (bearshare.lnk)! Action taken: No Action Taken.

Sun Dec 18 14:32:55 2005 => Offending file found: C:\Dokumente und Einstellungen\petra\Desktop\internet.lnk
Sun Dec 18 14:32:55 2005 => System found infected with ezula Spyware/Adware (internet.lnk)! Action taken: No Action Taken.

Sun Dec 18 14:32:56 2005 => Offending file found: C:\Dokumente und Einstellungen\petra\Lokale Einstellungen\temporary internet files\content.ie5\4hab6n05\show_ads[2].js
Sun Dec 18 14:32:56 2005 => System found infected with whenu.savenow Spyware/Adware (show_ads[2].js)! Action taken: No Action Taken.

Sun Dec 18 14:32:56 2005 => Offending file found: C:\Dokumente und Einstellungen\petra\Lokale Einstellungen\Temporary Internet Files\content.ie5\4hab6n05\show_ads[2].js
Sun Dec 18 14:32:56 2005 => System found infected with whenu.savenow Spyware/Adware (show_ads[2].js)! Action taken: No Action Taken.

Sun Dec 18 14:32:57 2005 => Offending file found: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\bearshare.lnk
Sun Dec 18 14:32:57 2005 => System found infected with bearshare Spyware/Adware (bearshare.lnk)! Action taken: No Action Taken.

Sun Dec 18 14:32:57 2005 => Offending file found: C:\Dokumente und Einstellungen\All Users\Startmenü\programme\bearshare.lnk
Sun Dec 18 14:32:57 2005 => System found infected with bearshare Spyware/Adware (bearshare.lnk)! Action taken: No Action Taken.

Sun Dec 18 14:32:58 2005 => Offending file found: C:\WINDOWS\iun6002.exe
Sun Dec 18 14:32:58 2005 => System found infected with zipitpro Spyware/Adware (C:\WINDOWS\iun6002.exe)! Action taken: No Action Taken.

File D:\instalierte software\wichtig\email\GcMail\Mails\gelöschte Mails.ms1 infected by "Trojan-Spy.HTML.Paylap.gl" Virus! Action Taken: No Action Taken.

Sun Dec 18 15:39:11 2005 => File D:\instalierte software\wichtig\email\GcMail\Mails\Posteingang.ms1 infected by "Trojan-Spy.HTML.Paylap.gl" Virus! Action Taken: No Action Taken.

File D:\software\BSINSTALLDE.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.z". Action Taken: No Action Taken.

File D:\software\GDiVX1.9.9.5.exe tagged as "not-a-virus:AdWare.Win32.NewDotNet". Action Taken: No Action Taken.

File D:\instalierte software\bearshare\Installer\saveinstwm.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.z". Action Taken: No Action Taken.


File D:\instalierte software\bearshare\Installer\BSINSTALLDE.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.z". Action Taken: No Action Taken.

ile C:\Programme\DAEMON Tools\SetupDTSB.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.bi". Action Taken: No Action Taken.

so ist das jetzt gut oder schlecht der hat ja jede menge gefunden!