Brauche Hilfe beim Auswerten der Logs
 

Jaa, hallo erstmal.
Könnte mal jemand "kurz" über diese Logs rübergucken?

Hier ist das erste von HJT:

Logfile of HijackThis v1.99.0
Scan saved at 07:59:09, on 04.01.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cmd.exe
C:\bases\mwavscan.com
C:\bases\kavss.exe
C:\WINDOWS\system32\notepad.exe
C:\Dokumente und Einstellungen\Ruben\Desktop\hijackthis199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.planet3dnow.de/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://infinity01.netfirms.com/deesc/plugin
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.safersurf.com:7779
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497 - (no file)
R3 - URLSearchHook: (no name) - _{965A592F-8EFA-4250-8630-7960230792F1} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Idea2 SidebarBrowserMonitor Class - {45AD732C-2CE2-4666-B366-B2214AD57A49} - D:\Programme\Desktop Sidebar\sbhelp.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programme\Spybot\SDHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SBDrvDet] C:\Programme\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [PRONoMgr.exe] D:\Programme\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack
O4 - HKLM\..\Run: [StatusClient] C:\Programme\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto
O4 - HKLM\..\Run: [TomcatStartup] C:\Programme\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] D:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [ASUS Probe] D:\Programme\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Programme\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Programme\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [zBrowser Launcher] D:\Programme\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [CTSysVol] D:\Programme\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTDVDDET] D:\Programme\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [myCIO.com ASaP] C:\WINDOWS\myCIO\Agent\myagttry.exe
O4 - HKLM\..\Run: [LogonStudio] "D:\Programme\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Gainward] C:\WINDOWS\TBPanel.exe /A
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Programme\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [QuickTime Task] "D:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RemoteControl] D:\Programme\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [iTunesHelper] D:\Programme\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [ezlink] "C:\Programme\KiSS EzLink\ezlink.exe" -service_start -background
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [aBoIjr] C:\WINDOWS\uhoaoq.exe
O4 - HKLM\..\Run: [È Ý8¿Ì*û]Mú*ÀaîžaaûC:\Programme\ISTsvc\istsvc.exe] C:\WINDOWS\uhoaoq.exe
O4 - HKLM\..\Run: [È Ý8¿Ì*ÀaîžaaûY§ÄC:\Programme\ISTsvc\istsvc.exe] C:\WINDOWS\uhoaoq.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "D:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [aBoÈ Ý8¿Ì*û]Mú*ÀaîžC:\Programme\ISTsvc\istsvc.exe] C:\WINDOWS\uhoaoq.exe
O4 - HKLM\..\Run: [aBoÈ Ý8¿Ì*ÀaîžaaûYC:\Programme\ISTsvc\istsvc.exe] C:\WINDOWS\uhoaoq.exe
O4 - HKLM\..\Run: [IST Service] C:\Programme\ISTsvc\istsvc.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RemoteCenter] D:\Programme\Creative\MediaSource\RemoteControl\RcMan.exe
O4 - HKCU\..\Run: [SIDEBAR] "D:\Programme\Desktop Sidebar\dsidebar.exe"
O4 - HKCU\..\Run: [GoogleFilter] D:\Programme\GoogleFilter\FiltecAPP.exe /run
O4 - HKCU\..\Run: [Steam] "d:\progra~1\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [Skype] "D:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Startup: Quicken 2005 Zahlungserinnerung.lnk = D:\Programme\Quicken2005\billmind.exe
O4 - Startup: YzToolBar.lnk = D:\Programme\Y'z ToolBar\YzToolBar.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AutoCAD-Startbeschleuniger.lnk = C:\Programme\Gemeinsame Dateien\Autodesk Shared\acstart16.exe
O4 - Global Startup: BOINC.lnk = D:\Programme\BOINC\boinc_gui.exe
O4 - Global Startup: ISDNWatch.lnk = D:\Programme\FRITZ!\IWatch.exe
O4 - Global Startup: Miranda IM.lnk = D:\Programme\Miranda IM\miranda32.exe
O4 - Global Startup: PowerISDNMonitor 4.2.lnk = D:\Programme\PowerISDNMonitor\pimjava.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Download with GetRight - D:\Programme\GetRight\GRdownload.htm

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - D:\Programme\GetRight\GRbrowse.htm
O8 - Extra context menu item: Subscribe in Desktop Sidebar - res://D:\Programme\Desktop Sidebar\sbhelp.dll/menuhandler.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programme\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programme\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - D:\Programme\Desktop Sidebar\sbhelp.dll
O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - D:\Programme\Desktop Sidebar\sbhelp.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - D:\Programme\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - D:\Programme\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - D:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - D:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {00000000-0000-0000-0000-000020030000} - http://207.234.185.217/ABoxInst_int2.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15007/CTSUEng.cab
O16 - DPF: {40C83AF8-FEA7-4A6A-A470-431EE84A0886} (SecureObjectFactory Class) - http://viruscanasap.services-asap.co...n/myCioAgt.cab
O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} (Microsoft.WinRep) - https://webresponse.one.microsoft.co...veX/winrep.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-intl/de/games4.cab
O16 - DPF: {C432C4BD-3566-411C-8F3C-E5E0D3AE5D33} (CBrowser Class) - http://www.streamingfaith.com/common...INIBrowser.CAB
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15008/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{690017DC-1EA5-4D0B-A92A-E1431A377D30}: NameServer = 192.168.120.252,192.168.120.253
O18 - Protocol: myrm - {4D034FC3-013F-4B95-B544-44D49ABE3E76} - C:\WINDOWS\myCIO\Agent\myRmProt2.8.1.133.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk - Macrovision Corporation - D:\Programme\Autodesk Network License Manager\lmgrd.exe
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Programme\Gemeinsame Dateien\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: AVM FRITZ!web Routing Service - AVM Berlin - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown - C:\Programme\Gemeinsame Dateien\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McShield - Network Associates, Inc. - C:\WINDOWS\myCIO\VScan\McShield.exe
O23 - Service: McAfee Agent - Network Associates, Inc. - C:\WINDOWS\myCIO\Agent\myAgtSvc.exe
O23 - Service: Intel NCS NetService - Intel(R) Corporation - D:\Programme\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: TuneUp WinStyler Theme Service - TuneUp Software GmbH - D:\Programme\TuneUp Utilities 2004\WinStylerThemeSvc.exe

Habe beide logs schon im abgesicherten Modus erstellen lassen. Das von escan werde ich gleich posten, bin gerade noch dabei, die "infected"-Einträge auszusortieren ...

Schon mal vielen Dank für Eure Hilfe!

Hier ist nun mein Escan Log:

Tue Jan 04 00:07:36 2005 => File C:\WINDOWS\uhoaoq.exe infected by "Trojan-Downloader.Win32.IstBar.go" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:07:36 2005 => File C:\WINDOWS\uhoaoq.exe infected by "Trojan-Downloader.Win32.IstBar.go" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:07:36 2005 => File C:\WINDOWS\uhoaoq.exe infected by "Trojan-Downloader.Win32.IstBar.go" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:07:36 2005 => File C:\WINDOWS\uhoaoq.exe infected by "Trojan-Downloader.Win32.IstBar.go" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:07:36 2005 => File C:\WINDOWS\uhoaoq.exe infected by "Trojan-Downloader.Win32.IstBar.go" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:07:36 2005 => File C:\Programme\ISTsvc\istsvc.exe infected by "Trojan-Downloader.Win32.IstBar.gm" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:07:57 2005 => File C:\WINDOWS\cxtpls_loader.exe infected by "not-a-virus:AdWare.Apropos.b" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:08:00 2005 => File C:\WINDOWS\IEMenuExtension.exe infected by "not-a-virus:AdWare.ToolBar.Ucmore" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:08:06 2005 => File C:\WINDOWS\SSK_B5.EXE infected by "Trojan-Dropper.Win32.SurfSide.a" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:08:07 2005 => File C:\WINDOWS\uhoaoq.exe infected by "Trojan-Downloader.Win32.IstBar.go" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:09:07 2005 => File C:\WINDOWS\system32\mac80ex.idf infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:09:27 2005 => File C:\WINDOWS\system32\netut80ex.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:09:44 2005 => File C:\WINDOWS\system32\psis80ex.ax infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:10:12 2005 => File C:\WINDOWS\system32\WebRebates_Auto_InstallSilent.exe infected by "not-a-virus:AdWare.WebRebates.b" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:10:23 2005 => File C:\DOKUME~1\Ruben\LOKALE~1\Temp\5Xq1jG.exe infected by "Trojan-Downloader.Win32.IstBar.gn" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:10:25 2005 => File C:\DOKUME~1\Ruben\LOKALE~1\Temp\CaB5Cx.exe infected by "Trojan-Downloader.Win32.IstBar.gn" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:10:26 2005 => File C:\DOKUME~1\Ruben\LOKALE~1\Temp\E4D3mG.exe infected by "Trojan-Downloader.Win32.IstBar.gn" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:10:26 2005 => File C:\DOKUME~1\Ruben\LOKALE~1\Temp\fkaC5a.exe infected by "Trojan-Downloader.Win32.IstBar.gn" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:10:27 2005 => File C:\DOKUME~1\Ruben\LOKALE~1\Temp\i1130.tmp infected by "not-a-virus:AdWare.SurfSide.a" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:10:27 2005 => File C:\DOKUME~1\Ruben\LOKALE~1\Temp\IKieZh.exe infected by "Trojan-Downloader.Win32.IstBar.gn" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:10:29 2005 => File C:\DOKUME~1\Ruben\LOKALE~1\Temp\LRWv8y.exe infected by "Trojan-Downloader.Win32.IstBar.gn" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:10:31 2005 => File C:\DOKUME~1\Ruben\LOKALE~1\Temp\qybS2G.exe infected by "Trojan-Downloader.Win32.IstBar.gn" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:10:32 2005 => File C:\DOKUME~1\Ruben\LOKALE~1\Temp\sidefind.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:10:32 2005 => File C:\DOKUME~1\Ruben\LOKALE~1\Temp\temp.fr1C4F\istsvc.exe infected by "Trojan-Downloader.Win32.IstBar.gm" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:10:33 2005 => File C:\DOKUME~1\Ruben\LOKALE~1\Temp\temp.fr66E3\istsvc.exe infected by "Trojan-Downloader.Win32.IstBar.gm" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:10:33 2005 => File C:\DOKUME~1\Ruben\LOKALE~1\Temp\temp.frB569\istsvc.exe infected by "Trojan-Downloader.Win32.IstBar.gm" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:10:33 2005 => File C:\DOKUME~1\Ruben\LOKALE~1\Temp\temp.frE699 infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:10:33 2005 => File C:\DOKUME~1\Ruben\LOKALE~1\Temp\temp.frF524 infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:10:35 2005 => File C:\DOKUME~1\Ruben\LOKALE~1\Temp\Temporary Internet Files\Content.IE5\GLQJCHI3\sidefind13[1].dll infected by "not-a-virus:AdWare.ToolBar.SideFind" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:10:35 2005 => File C:\DOKUME~1\Ruben\LOKALE~1\Temp\Temporary Internet Files\Content.IE5\GLQJCHI3\sidefind[1].exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:10:37 2005 => File C:\DOKUME~1\Ruben\LOKALE~1\Temp\Temporary Internet Files\Content.IE5\NZR8RGWI\sfbho13[1].dll infected by "not-a-virus:AdWare.ToolBar.SideFind" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:10:38 2005 => File C:\DOKUME~1\Ruben\LOKALE~1\Temp\Temporary Internet Files\Content.IE5\SD27WL6N\istbar_mainstream[1].dll infected by "Trojan-Downloader.Win32.IstBar.gj" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:11:37 2005 => File C:\DOKUME~1\Ruben\LOKALE~1\TEMPOR~1\Content.IE5\3JPRZDSS\bridge-c11[1].cab infected by "not-a-virus:AdWare.WinAD.j" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:14:15 2005 => File C:\DOKUME~1\Ruben\LOKALE~1\TEMPOR~1\Content.IE5\A1HUNQXG\AdmilliKeep[1].exe infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:16:16 2005 => File C:\DOKUME~1\Ruben\LOKALE~1\TEMPOR~1\Content.IE5\CRPBAMRH\bridge-c2[1].cab infected by "not-a-virus:AdWare.WinAD.j" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:16:44 2005 => File C:\DOKUME~1\Ruben\LOKALE~1\TEMPOR~1\Content.IE5\CXIN4DQN\AdmilliKeep[1].exe infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:17:38 2005 => File C:\DOKUME~1\Ruben\LOKALE~1\TEMPOR~1\Content.IE5\DZFNH1S2\AdmilliServ[1].exe infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:17:47 2005 => File C:\DOKUME~1\Ruben\LOKALE~1\TEMPOR~1\Content.IE5\DZFNH1S2\games4[1].cab infected by "Trojan.Win32.Dialer.fy" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:19:29 2005 => File C:\DOKUME~1\Ruben\LOKALE~1\TEMPOR~1\Content.IE5\J7SEFVJF\istsvc[2].exe infected by "Trojan-Downloader.Win32.IstBar.gm" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:20:56 2005 => File C:\DOKUME~1\Ruben\LOKALE~1\TEMPOR~1\Content.IE5\KPY745IJ\AdmilliComm[1].dll infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:21:52 2005 => File C:\DOKUME~1\Ruben\LOKALE~1\TEMPOR~1\Content.IE5\MNQB29QR\games4[1].cab infected by "Trojan.Win32.Dialer.fy" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:22:08 2005 => File C:\DOKUME~1\Ruben\LOKALE~1\TEMPOR~1\Content.IE5\O39J2U35\AdmilliServ[1].exe infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:23:59 2005 => File C:\DOKUME~1\Ruben\LOKALE~1\TEMPOR~1\Content.IE5\PVRJDH4E\AdmilliComm[1].dll infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:24:15 2005 => File C:\DOKUME~1\Ruben\LOKALE~1\TEMPOR~1\Content.IE5\PVRJDH4E\prompt[1].htm infected by "Trojan-Downloader.JS.IstBar.b" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:24:36 2005 => File C:\DOKUME~1\Ruben\LOKALE~1\TEMPOR~1\Content.IE5\QTLEB698\Installer[1].exe infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken.
Tue Jan 04 00:25:26 2005 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\DyFuCAInternetOptimizer.zip infected by "Password-protected-EXE" Virus. Action Taken: No Action Taken.

Tue Jan 04 01:05:09 2005 => File C:\Dokumente und Einstellungen\Ruben\Internet Optimizer\optimize.exe infected by "TrojanDownloader.Win32.Dyfuca.da" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:05:32 2005 => File C:\Dokumente und Einstellungen\Ruben\Lokale Einstellungen\Anwendungsdaten\Microsoft\Internet Explorer\V0.26.dat infected by "Trojan.Win32.Dialer.fy" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:05:45 2005 => File C:\Dokumente und Einstellungen\Ruben\Lokale Einstellungen\Temp\5Xq1jG.exe infected by "Trojan-Downloader.Win32.IstBar.gn" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:05:46 2005 => File C:\Dokumente und Einstellungen\Ruben\Lokale Einstellungen\Temp\CaB5Cx.exe infected by "Trojan-Downloader.Win32.IstBar.gn" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:05:47 2005 => File C:\Dokumente und Einstellungen\Ruben\Lokale Einstellungen\Temp\E4D3mG.exe infected by "Trojan-Downloader.Win32.IstBar.gn" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:05:48 2005 => File C:\Dokumente und Einstellungen\Ruben\Lokale Einstellungen\Temp\fkaC5a.exe infected by "Trojan-Downloader.Win32.IstBar.gn" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:05:49 2005 => File C:\Dokumente und Einstellungen\Ruben\Lokale Einstellungen\Temp\i1130.tmp infected by "not-a-virus:AdWare.SurfSide.a" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:05:49 2005 => File C:\Dokumente und Einstellungen\Ruben\Lokale Einstellungen\Temp\IKieZh.exe infected by "Trojan-Downloader.Win32.IstBar.gn" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:05:51 2005 => File C:\Dokumente und Einstellungen\Ruben\Lokale Einstellungen\Temp\LRWv8y.exe infected by "Trojan-Downloader.Win32.IstBar.gn" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:05:53 2005 => File C:\Dokumente und Einstellungen\Ruben\Lokale Einstellungen\Temp\qybS2G.exe infected by "Trojan-Downloader.Win32.IstBar.gn" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:05:53 2005 => File C:\Dokumente und Einstellungen\Ruben\Lokale Einstellungen\Temp\sidefind.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:05:54 2005 => File C:\Dokumente und Einstellungen\Ruben\Lokale Einstellungen\Temp\temp.fr1C4F\istsvc.exe infected by "Trojan-Downloader.Win32.IstBar.gm" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:05:54 2005 => File C:\Dokumente und Einstellungen\Ruben\Lokale Einstellungen\Temp\temp.fr66E3\istsvc.exe infected by "Trojan-Downloader.Win32.IstBar.gm" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:05:55 2005 => File C:\Dokumente und Einstellungen\Ruben\Lokale Einstellungen\Temp\temp.frB569\istsvc.exe infected by "Trojan-Downloader.Win32.IstBar.gm" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:05:55 2005 => File C:\Dokumente und Einstellungen\Ruben\Lokale Einstellungen\Temp\temp.frE699 infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:05:55 2005 => File C:\Dokumente und Einstellungen\Ruben\Lokale Einstellungen\Temp\temp.frF524 infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:05:57 2005 => File C:\Dokumente und Einstellungen\Ruben\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\GLQJCHI3\sidefind13[1].dll infected by "not-a-virus:AdWare.ToolBar.SideFind" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:05:57 2005 => File C:\Dokumente und Einstellungen\Ruben\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\GLQJCHI3\sidefind[1].exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:05:58 2005 => File C:\Dokumente und Einstellungen\Ruben\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\NZR8RGWI\sfbho13[1].dll infected by "not-a-virus:AdWare.ToolBar.SideFind" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:05:59 2005 => File C:\Dokumente und Einstellungen\Ruben\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\SD27WL6N\istbar_mainstream[1].dll infected by "Trojan-Downloader.Win32.IstBar.gj" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:06:55 2005 => File C:\Dokumente und Einstellungen\Ruben\Lokale Einstellungen\Temporary Internet Files\Content.IE5\3JPRZDSS\bridge-c11[1].cab infected by "not-a-virus:AdWare.WinAD.j" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:09:28 2005 => File C:\Dokumente und Einstellungen\Ruben\Lokale Einstellungen\Temporary Internet Files\Content.IE5\A1HUNQXG\AdmilliKeep[1].exe infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:11:24 2005 => File C:\Dokumente und Einstellungen\Ruben\Lokale Einstellungen\Temporary Internet Files\Content.IE5\CRPBAMRH\bridge-c2[1].cab infected by "not-a-virus:AdWare.WinAD.j" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:11:51 2005 => File C:\Dokumente und Einstellungen\Ruben\Lokale Einstellungen\Temporary Internet Files\Content.IE5\CXIN4DQN\AdmilliKeep[1].exe infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:12:44 2005 => File C:\Dokumente und Einstellungen\Ruben\Lokale Einstellungen\Temporary Internet Files\Content.IE5\DZFNH1S2\AdmilliServ[1].exe infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:12:52 2005 => File C:\Dokumente und Einstellungen\Ruben\Lokale Einstellungen\Temporary Internet Files\Content.IE5\DZFNH1S2\games4[1].cab infected by "Trojan.Win32.Dialer.fy" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:14:33 2005 => File C:\Dokumente und Einstellungen\Ruben\Lokale Einstellungen\Temporary Internet Files\Content.IE5\J7SEFVJF\istsvc[2].exe infected by "Trojan-Downloader.Win32.IstBar.gm" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:15:56 2005 => File C:\Dokumente und Einstellungen\Ruben\Lokale Einstellungen\Temporary Internet Files\Content.IE5\KPY745IJ\AdmilliComm[1].dll infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:16:50 2005 => File C:\Dokumente und Einstellungen\Ruben\Lokale Einstellungen\Temporary Internet Files\Content.IE5\MNQB29QR\games4[1].cab infected by "Trojan.Win32.Dialer.fy" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:17:06 2005 => File C:\Dokumente und Einstellungen\Ruben\Lokale Einstellungen\Temporary Internet Files\Content.IE5\O39J2U35\AdmilliServ[1].exe infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:18:54 2005 => File C:\Dokumente und Einstellungen\Ruben\Lokale Einstellungen\Temporary Internet Files\Content.IE5\PVRJDH4E\AdmilliComm[1].dll infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:19:09 2005 => File C:\Dokumente und Einstellungen\Ruben\Lokale Einstellungen\Temporary Internet Files\Content.IE5\PVRJDH4E\prompt[1].htm infected by "Trojan-Downloader.JS.IstBar.b" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:19:29 2005 => File C:\Dokumente und Einstellungen\Ruben\Lokale Einstellungen\Temporary Internet Files\Content.IE5\QTLEB698\Installer[1].exe infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:20:34 2005 => File C:\Program Files\Admilli Service\AdmilliComm.dll infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:20:34 2005 => File C:\Program Files\Admilli Service\AdmilliKeep.exe infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:27:00 2005 => File C:\Programme\ISTsvc\istsvc.exe infected by "Trojan-Downloader.Win32.IstBar.gm" Virus. Action Taken: No Action Taken.

Tue Jan 04 01:28:16 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP204\A0032644.EXE infected by "not-a-virus:AdWare.ClearSearch.o" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:28:16 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP204\A0032645.DLL infected by "not-a-virus:AdWare.ClearSearch.j" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:28:19 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP204\A0032727.ocx infected by "not-a-virus:AdWare.Suggestor.a" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:28:19 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP204\A0032729.exe infected by "not-a-virus:AdWare.Adstart.b" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:28:21 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP204\A0032772.EXE infected by "not-a-virus:AdWare.ClearSearch.o" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:28:22 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP204\A0032774.DLL infected by "not-a-virus:AdWare.ClearSearch.j" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:28:25 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP204\A0032837.EXE infected by "not-a-virus:AdWare.ClearSearch.o" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:28:25 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP204\A0032838.DLL infected by "not-a-virus:AdWare.ClearSearch.j" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:28:45 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP206\A0032920.EXE infected by "not-a-virus:AdWare.ClearSearch.o" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:28:45 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP206\A0032921.DLL infected by "not-a-virus:AdWare.ClearSearch.j" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:28:46 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP206\A0032965.EXE infected by "not-a-virus:AdWare.ClearSearch.o" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:28:46 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP206\A0032966.DLL infected by "not-a-virus:AdWare.ClearSearch.j" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:28:47 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP206\A0033029.EXE infected by "not-a-virus:AdWare.ClearSearch.o" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:28:47 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP206\A0033030.DLL infected by "not-a-virus:AdWare.ClearSearch.j" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:28:50 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP207\A0033100.EXE infected by "not-a-virus:AdWare.ClearSearch.o" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:28:50 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP207\A0033101.DLL infected by "not-a-virus:AdWare.ClearSearch.j" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:28:53 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP207\A0033217.EXE infected by "not-a-virus:AdWare.ClearSearch.o" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:28:53 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP207\A0033218.DLL infected by "not-a-virus:AdWare.ClearSearch.j" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:28:56 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP207\A0033292.EXE infected by "not-a-virus:AdWare.ClearSearch.o" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:28:56 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP207\A0033293.DLL infected by "not-a-virus:AdWare.ClearSearch.j" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:28:59 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP208\A0033346.EXE infected by "not-a-virus:AdWare.ClearSearch.o" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:28:59 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP208\A0033347.DLL infected by "not-a-virus:AdWare.ClearSearch.j" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:29:03 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP208\A0033448.EXE infected by "not-a-virus:AdWare.ClearSearch.o" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:29:03 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP208\A0033449.DLL infected by "not-a-virus:AdWare.ClearSearch.j" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:29:06 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP208\A0033528.EXE infected by "not-a-virus:AdWare.ClearSearch.o" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:29:06 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP208\A0033529.DLL infected by "not-a-virus:AdWare.ClearSearch.j" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:29:09 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP208\A0033568.EXE infected by "not-a-virus:AdWare.ClearSearch.o" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:29:09 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP208\A0033569.DLL infected by "not-a-virus:AdWare.ClearSearch.j" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:29:09 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP208\A0033593.EXE infected by "not-a-virus:AdWare.ClearSearch.o" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:29:09 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP208\A0033594.DLL infected by "not-a-virus:AdWare.ClearSearch.j" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:29:13 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP208\A0033664.EXE infected by "not-a-virus:AdWare.ClearSearch.o" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:29:13 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP208\A0033665.DLL infected by "not-a-virus:AdWare.ClearSearch.j" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:29:20 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP209\A0033797.EXE infected by "not-a-virus:AdWare.ClearSearch.o" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:29:20 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP209\A0033798.DLL infected by "not-a-virus:AdWare.ClearSearch.j" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:29:23 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP209\A0033907.EXE infected by "not-a-virus:AdWare.ClearSearch.o" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:29:23 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP209\A0033908.DLL infected by "not-a-virus:AdWare.ClearSearch.j" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:29:25 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP209\A0033942.EXE infected by "not-a-virus:AdWare.ClearSearch.o" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:29:25 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP209\A0033943.DLL infected by "not-a-virus:AdWare.ClearSearch.j" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:29:27 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP209\A0034046.EXE infected by "not-a-virus:AdWare.ClearSearch.o" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:29:27 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP209\A0034047.DLL infected by "not-a-virus:AdWare.ClearSearch.j" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:29:30 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP209\A0034110.EXE infected by "not-a-virus:AdWare.ClearSearch.o" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:29:30 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP209\A0034111.DLL infected by "not-a-virus:AdWare.ClearSearch.j" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:29:31 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP209\A0034153.EXE infected by "not-a-virus:AdWare.ClearSearch.o" Virus. Action Taken: No Action Taken.

Tue Jan 04 01:29:31 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP209\A0034154.DLL infected by "not-a-virus:AdWare.ClearSearch.j" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:29:39 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP212\A0034207.EXE infected by "not-a-virus:AdWare.ClearSearch.o" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:29:39 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP212\A0034208.DLL infected by "not-a-virus:AdWare.ClearSearch.j" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:29:42 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP212\A0034262.EXE infected by "not-a-virus:AdWare.ClearSearch.o" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:29:42 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP212\A0034263.DLL infected by "not-a-virus:AdWare.ClearSearch.j" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:29:45 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP212\A0034390.EXE infected by "not-a-virus:AdWare.ClearSearch.o" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:29:45 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP212\A0034391.DLL infected by "not-a-virus:AdWare.ClearSearch.j" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:29:47 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP212\A0034439.exe infected by "TrojanDownloader.Win32.Dyfuca.da" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:29:52 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP212\A0034529.dll infected by "not-a-virus:AdWare.Adstart.c" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:29:52 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP212\A0034546.dll infected by "TrojanDownloader.Win32.Dyfuca.gen" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:30:11 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP214\A0034968.exe infected by "not-a-virus:AdWare.SurfSide.c" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:30:11 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP214\A0034969.dll infected by "not-a-virus:AdWare.TotalVelocity.y" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:30:11 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP214\A0034970.dll infected by "not-a-virus:AdWare.TotalVelocity.y" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:30:11 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP214\A0034990.dll infected by "TrojanDownloader.Win32.Dyfuca.gen" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:30:46 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP218\A0036348.exe infected by "Trojan-Downloader.Win32.Dyfuca.dp" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:30:46 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP218\A0036349.exe infected by "Trojan-Downloader.Win32.Dyfuca.dp" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:30:46 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP218\A0036364.exe infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:30:49 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP218\A0036405.exe infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:30:49 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP218\A0036406.dll infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:31:54 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP220\A0036883.exe infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:31:54 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP220\A0036884.exe infected by "Trojan-Downloader.Win32.IstBar.gm" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:31:55 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP220\A0037912.exe infected by "Trojan-Downloader.Win32.IstBar.gm" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:31:59 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP221\A0037976.exe infected by "Trojan-Downloader.Win32.IstBar.gm" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:32:03 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP222\A0038035.exe infected by "not-a-virus:AdWare.AdBox.a" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:32:03 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP222\A0038036.exe infected by "Trojan-Downloader.Win32.Dyfuca.dp" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:32:03 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP222\A0038037.exe infected by "Trojan-Downloader.Win32.Dyfuca.dp" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:32:03 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP222\A0038038.exe tagged as not-a-virus:RiskWare.Tool.ServiceRunner.f. No Action Taken.
Tue Jan 04 01:32:16 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP223\A0038155.exe infected by "Trojan-Downloader.Win32.IstBar.gm" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:32:20 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP225\A0038212.exe infected by "Trojan-Downloader.Win32.IstBar.gm" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:32:21 2005 => File C:\System Volume Information\_restore{12C24D64-8A87-4BC1-B2EF-DC3AE3A440A6}\RP225\A0038235.exe infected by "Trojan-Downloader.Win32.IstBar.gm" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:36:09 2005 => File C:\WINDOWS\bundles\2504040901.exe infected by "not-a-virus:AdWare.VirtualBouncer.c" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:36:09 2005 => File C:\WINDOWS\bundles\bs5-vwqouc.exe infected by "not-a-virus:AdWare.BookedSpace.c" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:36:10 2005 => File C:\WINDOWS\bundles\HelperInstaller.exe infected by "Trojan-Dropper.Win32.Delf.z" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:36:10 2005 => File C:\WINDOWS\bundles\saie1101.exe infected by "TrojanDropper.Win32.Small.mr" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:36:10 2005 => File C:\WINDOWS\bundles\shopinst.exe infected by "TrojanDownloader.Win32.Small.wj" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:36:11 2005 => File C:\WINDOWS\bundles\thin-8-1-x-x.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:36:11 2005 => File C:\WINDOWS\bundles\TVM_B5_Bundle_8.EXE infected by "TrojanDropper.Win32.Small.ht" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:36:11 2005 => File C:\WINDOWS\bundles\WebRebates_Auto_InstallSilent.exe infected by "not-a-virus:AdWare.WebRebates.b" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:36:28 2005 => File C:\WINDOWS\cxtpls_loader.exe infected by "not-a-virus:AdWare.Apropos.b" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:37:53 2005 => File C:\WINDOWS\Downloaded Program Files\AdmilliServX.dll infected by "not-a-virus:AdWare.WinAD.j" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:37:53 2005 => File C:\WINDOWS\Downloaded Program Files\CONFLICT.1\AdmilliServX.dll infected by "not-a-virus:AdWare.WinAD.j" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:40:51 2005 => File C:\WINDOWS\IEMenuExtension.exe infected by "not-a-virus:AdWare.ToolBar.Ucmore" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:44:21 2005 => File C:\WINDOWS\myCIO\VScan\Quarantine\CIO0.MCQ infected by "Trojan-Downloader.Win32.VB.fi" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:44:21 2005 => File C:\WINDOWS\myCIO\VScan\Quarantine\CIO1.MCQ infected by "Trojan-Downloader.Win32.VB.fi" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:44:22 2005 => File C:\WINDOWS\myCIO\VScan\Quarantine\CIO2.MCQ infected by "Trojan-Dropper.Win32.Delf.fl" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:44:22 2005 => File C:\WINDOWS\myCIO\VScan\Quarantine\CIO3.MCQ infected by "Trojan-Downloader.Win32.VB.fi" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:44:22 2005 => File C:\WINDOWS\myCIO\VScan\Quarantine\CIO4.MCQ infected by "Trojan-Dropper.Win32.Delf.fl" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:44:22 2005 => File C:\WINDOWS\myCIO\VScan\Quarantine\CIO5.MCQ infected by "Backdoor.Win32.Agent.bg" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:44:22 2005 => File C:\WINDOWS\myCIO\VScan\Quarantine\CIO6.MCQ infected by "Backdoor.Win32.Agent.bg" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:48:50 2005 => File C:\WINDOWS\SSK_B5.EXE infected by "Trojan-Dropper.Win32.SurfSide.a" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:51:24 2005 => File C:\WINDOWS\system32\mac80ex.idf infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken.

Tue Jan 04 01:51:46 2005 => File C:\WINDOWS\system32\netut80ex.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:52:11 2005 => File C:\WINDOWS\system32\psis80ex.ax infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:53:18 2005 => File C:\WINDOWS\system32\WebRebates_Auto_InstallSilent.exe infected by "not-a-virus:AdWare.WebRebates.b" Virus. Action Taken: No Action Taken.
Tue Jan 04 01:53:42 2005 => File C:\WINDOWS\uhoaoq.exe infected by "Trojan-Downloader.Win32.IstBar.go" Virus. Action Taken: No Action Taken.

Tue Jan 04 05:00:36 2005 => ***** Scanning complete. *****

Tue Jan 04 05:00:36 2005 => Total Files Scanned: 210680
Tue Jan 04 05:00:36 2005 => Total Virus(es) Found: 203
Tue Jan 04 05:00:36 2005 => Total Disinfected Files: 0
Tue Jan 04 05:00:36 2005 => Total Files Renamed: 0
Tue Jan 04 05:00:36 2005 => Total Deleted Files: 0
Tue Jan 04 05:00:36 2005 => Total Errors: 119
Tue Jan 04 05:00:36 2005 => Time Elapsed: 04:53:18
Tue Jan 04 05:00:36 2005 => Virus Database Date: 2005/01/04
Tue Jan 04 05:00:37 2005 => Virus Database Count: 114628

Tue Jan 04 05:00:37 2005 => Scan Completed.

Tut mir Leid, dass das soviel geworden ist. Aber vieles ist wahrscheinlich einfach doppelt ... Die ganze Log Datei war 30 MB groß ...

Hallo,

bei der Durchseuchung,um es mal milde zu formulieren,macht es keinen Sinn das System zu retten,da mindestens (habs nur überflogen weil ich zur Arbeit muss) 2 Backdoor´s auf dem Rechner aktiv sind.

Dir bleibt daher leider nur dies übrig,befolge die Links genau!

http://www.trojaner-board.de/showpos...28&postcount=2

Gruss

Hi,

für mich kommt leider ein Neuaufsetzten von XP wirklich nur im extremsten Notfall in Frage. Da mache ich lieber eine Nacht durch und befreie den Rechner von allen Intrudern per Hand ...

Bin jetzt gerade dabei, alle Einträge, die mir escan als infiziert angezeigt hat, zu löschen. ich hoffe, das ist richtig ...