Das Problem was ich habe is folgendes,
ich surfe mit Mozilla, aber ab und zu geht ganz kurz die console auf, und dann startet der IE eine Seite, z.B firstload.de

Dann will der auch immer ein Weihnachtsprogramm.zip runterladen, hab die Sicherheitseinstellungen schon hoch gestellt, was könnte das sein??

Logfile of HijackThis v1.99.1
...
[edit]
bitte editiere zukünftig deine links, wie es dir u.a. hier angezeigt wird:
http://www.trojaner-board.de/showpost.php?p=171957&postcount=1

danke
GUA
[/edit]


Habe mal dieses EScan durchlaufen lassen:

Sun Dec 25 13:17:31 2005 => Total Disinfected Files: 0
Sun Dec 25 13:17:31 2005 => Total Files Renamed: 0
Sun Dec 25 13:17:31 2005 => Total Deleted Objects: 0
Sun Dec 25 13:17:31 2005 => Total Errors: 49
Sun Dec 25 13:17:31 2005 => Time Elapsed: 00:03:29
Sun Dec 25 13:17:31 2005 => Virus Database Date: 2005/12/12
Sun Dec 25 13:17:31 2005 => Virus Database Count: 164615

Sun Dec 25 13:17:31 2005 => Scan Completed.

VIRUS LOG INFORMATION::

File C:\Programme\little_helper2\little_helper2.exe tagged as "not-a-virus:AdWare.Win32.Helper.b". Action Taken: No Action Taken.
Object "zipitpro Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "limewire Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "lop.com Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "casinoclient Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "casinoclient Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "zipitpro Spyware/Adware" found in File System! Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "D:\Programme\Mobile Phone Manager\bin\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Mobile Phone Manager\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Dokumente und Einstellungen\Joline\Anwendungsdaten\InstallShield\Driver\8\Intel 32\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Dokumente und Einstellungen\Joline\Anwendungsdaten\InstallShield\Driver\8\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Dokumente und Einstellungen\Joline\Anwendungsdaten\InstallShield\Driver\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Dokumente und Einstellungen\Joline\Anwendungsdaten\InstallShield\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "D:\Spiele\Terzio\Loewenzahn 1\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "D:\Spiele\Terzio\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "D:\Spiele\Terzio\Loewenzahn 1\xtras\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "D:\Spiele\Terzio\Loewenzahn 2\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "D:\Spiele\Terzio\Loewenzahn 2\xtras\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "D:\Spiele\Terzio\Loewenzahn 3\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "D:\Spiele\Terzio\Loewenzahn 3\xtras\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "D:\Spiele\Terzio\Loewenzahn 4\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "D:\Spiele\Terzio\Loewenzahn 4\xtras\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "D:\Spiele\Terzio\Löwenzahn 5\xtras\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "D:\Spiele\Terzio\Löwenzahn 5\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "D:\Spiele\Terzio\Loewenzahn 6\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "D:\Spiele\Terzio\Loewenzahn 6\xtras\". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".2". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".xfb". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Active GIF Creator 2.22". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "GitarreroDemo_is1". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "InstallShield_{7AE38076-D8FD-4EF9-A203-98A3EF0C66C1}". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "MobiMB Mobile Media Browser". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Mozilla Firefox (1.0.6)". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Netscape Browser". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Toddler". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{6BAA26DB-2D4E-42B6-BC3F-3B58144A64B6}". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{7AE38076-D8FD-4EF9-A203-98A3EF0C66C1}". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{8F2D21F9-F428-4EF2-8111-953EF3299EFB}". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{B6F867E8-F092-4C5E-7D72-AC7057DBEF45}". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{D417C96A-FCC7-4590-A1BB-FAF73F5BC98E}". Action Taken: No Action Taken.
Entry "HKCR\.b5i" refers to invalid object "vc7.image". Action Taken: No Action Taken.
Entry "HKCR\.bin" refers to invalid object "vc7.image". Action Taken: No Action Taken.
Entry "HKCR\.bwi" refers to invalid object "vc7.image". Action Taken: No Action Taken.
Entry "HKCR\.c2d" refers to invalid object "vc7.image". Action Taken: No Action Taken.
Entry "HKCR\.xmf" refers to invalid object "vc7.image". Action Taken: No Action Taken.
Entry "HKCR\Magnet\shell\open\command" refers to invalid object ""C:\Programme\Azureus\Azureus.exe" "%1"". Action Taken: No Action Taken.
Entry "HKCR\NeroAACType\shell\open\command" refers to invalid object "D:\PROGRA~1\ahead\Nero\nero.exe "%1"". Action Taken: No Action Taken.
Entry "HKCR\NeroCopyType\shell\open\command" refers to invalid object "D:\PROGRA~1\ahead\Nero\nero.exe "%1"". Action Taken: No Action Taken.
Entry "HKCR\NeroCueSheetType\shell\open\command" refers to invalid object "D:\PROGRA~1\ahead\Nero\nero.exe "%1"". Action Taken: No Action Taken.
Entry "HKCR\NeroErrorType\shell\open\command" refers to invalid object "D:\PROGRA~1\ahead\Nero\nero.exe "%1"". Action Taken: No Action Taken.
Entry "HKCR\NeroHDBackupType\shell\open\command" refers to invalid object "D:\PROGRA~1\ahead\Nero\nero.exe "%1"". Action Taken: No Action Taken.
Entry "HKCR\NMUIEngine.NMUIResourceLoaderHarddisk" refers to invalid object "{03DC5606-EA66-4f02-AB52-2065524B03821}". Action Taken: No Action Taken.

Schön und gut das editiert wurde aber wo ist jetzt HijackThis logfile?

sorry-

Logfile of HijackThis v1.99.1
Scan saved at 15:29:57, on 25.12.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\HHVcdV7Sys\VC7SecS.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LXSUPMON.EXE
C:\Programme\Java\jre1.5.0_04\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Programme\HHVcdV7Sys\VC7Play.exe
C:\Programme\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe
C:\Programme\little_helper2\little_helper2.exe
D:\Programme\SAMSUNG\Samsung Internet Keyboard\MMKbd.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Dokumente und Einstellungen\Tismar\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: BitComet Toolbar Helper - {6A373B7E-496E-424f-A9BE-486A5E9AB018} - C:\Programme\BitComet Toolbar\v2.0.0.1\BitComet_Toolbar.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O3 - Toolbar: BitComet Toolbar - {2E608F70-C430-4bc5-96F6-608E02EBA5B2} - C:\Programme\BitComet Toolbar\v2.0.0.1\BitComet_Toolbar.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Realtime Audio Engine] mmrtkrnl.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [VC7Player] C:\Programme\HHVcdV7Sys\VC7Play.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe"
O4 - Global Startup: little_helper2.lnk = C:\Programme\little_helper2\little_helper2.exe
O4 - Global Startup: Samsung Internet Keyboard.lnk = ?
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Klicke hier um das Projekt xp-AntiSpy zu unterstützen - {584AB006-0510-4053-9573-09C003544B46} - C:\Programme\xp-AntiSpy\sponsoring\sponsor.html (HKCU)
O9 - Extra 'Tools' menuitem: Unterstützung für xp-AntiSpy - {584AB006-0510-4053-9573-09C003544B46} - C:\Programme\xp-AntiSpy\sponsoring\sponsor.html (HKCU)
O17 - HKLM\System\CCS\Services\Tcpip\..\{8B81865C-8A66-4D78-884B-DE5861AB4DE2}: NameServer = 85.237.87.167,217.20.114.124
O17 - HKLM\System\CCS\Services\Tcpip\..\{E4347D83-F8DE-4AF9-AC8F-4D05885D7F46}: NameServer = 85.237.87.167,217.20.114.124
O18 - Protocol: Festoon - (no CLSID) - (no file)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Programme\TuneUp Utilities 2004\WinStylerThemeSvc.exe
O23 - Service: Virtual CD v7 Management Service (VC7SecS) - H+H Software GmbH - C:\Programme\HHVcdV7Sys\VC7SecS.exe

Du solltest alle unseriösen programme wie Casino Client deinstallieren die Sache die wir gefixt haben dürfte dir das alle gebracht haben
Desweiteren solltest du mit File Sharing aushören
da dies dir ganz schnell mal schlimmer Sachen bringt wie Backdoor Trojaner ...
Limewire dürfte File Sharing Programm sein oder?

mfG Mk

Edit : sollte in den anderen Tread aber egal

ich kenn limeware gar nicht, wie bekomme ich das denn alles weg?? Auch die Sachen, die MWAV und ad-aware gefunden hat`??

Hallo Toto,
in der >Systemsteuerung unter >Software alles rausschmeißen das du nicht kennst.Ad Aware frägt dich doch was du tun willst ,oder ?Dann sag doch löschen !
Irrlicht

also in der software finde ich nichts ungewöhnliches

Hallo Toto,
na wenn das so ist....
das hier schafft dir eine Menge altes Zeug vom Hals :http://www.hoverdesk.net/freeware.htm
Regseeker runterladen,deutsch einstellen und darauf achten das die Sicherung unten links angehakt ist,dann auf "Registrierung säubern" und sooft laufen lassen bis nix mehr zu löschen ist.
rrlicht

also alles das was ad-aware gefunden hat habe ich gelöscht.
Bloß dieses MWAV hat noch einiges gefunden..

Object "zipitpro Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "redv Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "limewire Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "lop.com Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "casinoclient Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "redv Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "casinoclient Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "zipitpro Spyware/Adware" found in File System! Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "D:\Programme\Mobile Phone Manager\bin\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Mobile Phone Manager\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Dokumente und Einstellungen\Joline\Anwendungsdaten\InstallShield\Driver\8\Intel 32\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Dokumente und Einstellungen\Joline\Anwendungsdaten\InstallShield\Driver\8\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Dokumente und Einstellungen\Joline\Anwendungsdaten\InstallShield\Driver\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Dokumente und Einstellungen\Joline\Anwendungsdaten\InstallShield\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "D:\Spiele\Terzio\Loewenzahn 1\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "D:\Spiele\Terzio\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "D:\Spiele\Terzio\Loewenzahn 1\xtras\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "D:\Spiele\Terzio\Loewenzahn 2\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "D:\Spiele\Terzio\Loewenzahn 2\xtras\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "D:\Spiele\Terzio\Loewenzahn 3\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "D:\Spiele\Terzio\Loewenzahn 3\xtras\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "D:\Spiele\Terzio\Loewenzahn 4\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "D:\Spiele\Terzio\Loewenzahn 4\xtras\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "D:\Spiele\Terzio\Löwenzahn 5\xtras\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "D:\Spiele\Terzio\Löwenzahn 5\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "D:\Spiele\Terzio\Loewenzahn 6\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "D:\Spiele\Terzio\Loewenzahn 6\xtras\". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".2". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".xfb". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Active GIF Creator 2.22". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "GitarreroDemo_is1". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "InstallShield_{7AE38076-D8FD-4EF9-A203-98A3EF0C66C1}". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "MobiMB Mobile Media Browser". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Mozilla Firefox (1.0.6)". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Netscape Browser". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Toddler". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{6BAA26DB-2D4E-42B6-BC3F-3B58144A64B6}". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{7AE38076-D8FD-4EF9-A203-98A3EF0C66C1}". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{8F2D21F9-F428-4EF2-8111-953EF3299EFB}". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{B6F867E8-F092-4C5E-7D72-AC7057DBEF45}". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{D417C96A-FCC7-4590-A1BB-FAF73F5BC98E}". Action Taken: No Action Taken.
Entry "HKCR\.b5i" refers to invalid object "vc7.image". Action Taken: No Action Taken.
Entry "HKCR\.bin" refers to invalid object "vc7.image". Action Taken: No Action Taken.
Entry "HKCR\.bwi" refers to invalid object "vc7.image". Action Taken: No Action Taken.
Entry "HKCR\.c2d" refers to invalid object "vc7.image". Action Taken: No Action Taken.
Entry "HKCR\.xmf" refers to invalid object "vc7.image". Action Taken: No Action Taken.
Entry "HKCR\Magnet\shell\open\command" refers to invalid object ""C:\Programme\Azureus\Azureus.exe" "%1"". Action Taken: No Action Taken.
Entry "HKCR\MultimediaConverterPlayer.Converter" refers to invalid object "{132CE671-8582-11D5-AD52-00B0D0797201}". Action Taken: No Action Taken.
Entry "HKCR\MultimediaConverterPlayer.Player" refers to invalid object "{132CE673-8582-11D5-AD52-00B0D0797201}". Action Taken: No Action Taken.
Entry "HKCR\MultimediaConverterPlayer.Player.1" refers to invalid object "{132CE673-8582-11D5-AD52-00B0D0797201}". Action Taken: No Action Taken.
Entry "HKCR\NeroAACType\shell\open\command" refers to invalid object "D:\PROGRA~1\ahead\Nero\nero.exe "%1"". Action Taken: No Action Taken.
Entry "HKCR\NeroCopyType\shell\open\command" refers to invalid object "D:\PROGRA~1\ahead\Nero\nero.exe "%1"". Action Taken: No Action Taken.
Entry "HKCR\NeroCueSheetType\shell\open\command" refers to invalid object "D:\PROGRA~1\ahead\Nero\nero.exe "%1"". Action Taken: No Action Taken.
Entry "HKCR\NeroErrorType\shell\open\command" refers to invalid object "D:\PROGRA~1\ahead\Nero\nero.exe "%1"". Action Taken: No Action Taken.
Entry "HKCR\NeroHDBackupType\shell\open\command" refers to invalid object "D:\PROGRA~1\ahead\Nero\nero.exe "%1"". Action Taken: No Action Taken.
Entry "HKCR\NMUIEngine.NMUIResourceLoaderHarddisk" refers to invalid object "{03DC5606-EA66-4f02-AB52-2065524B03821}". Action Taken: No Action Taken.


wie bekomm ich das weg??

Guggst du eins über dir !
Spybot Search and Destroy laden und updaten.Ewido Security Suite laden und updaten.In den Abgesicherten Modus gehen und beide Programme laufen lassen.Laß löschen was vorgeschlagen wird.
Nach den drei Programmen,neuer Escan zeigen
Irrlicht

mh, hab jetzt alle genannten progs benutzt, haben auch alle was gefunden und beseitigt, aber das is immer noch da:


escan
Virus Log information

Object "zipitpro Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "redv Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "limewire Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "lop.com Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "casinoclient Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "redv Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "casinoclient Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "zipitpro Spyware/Adware" found in File System! Action Taken: No Action Taken.

Wie geht es denn jetzt weiter??

Hab beim starten von Windows jetzt auch immer ne Fehlermeldung

Failed to connect to driver 2

Hallo??!! Irrlicht??!!!

Kann denn niemand mehr hier helfen??

Hallo Toto,
mach mal ein neues HjT-Log.
Für was benötigst du die "little Helper exe." und das : O2 - BHO: BitComet Toolbar Helper - {6A373B7E-496E-424f-A9BE-486A5E9AB018} - C:\Programme\BitComet Toolbar\v2.0.0.1\BitComet_Toolbar.dll
Irrlicht