egal welchen begriff ich in eine suchmaschine eingebe, die ersten 10 ergebnisse sind immer die selben... ich habe leider keine ahnung wie ich das beheben kann.
erbitte höflichst rat.
danke

Hi,
welche Ergebnisse sind das; und poste mal ein HiJackThis -Logfile rein.

meisstens eine liste anderer suchmaschinen; oft:www.unlimitedhosting.co.nz

mein logfile:
Logfile of HijackThis v1.99.0
Scan saved at 12:45:26, on 19.01.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\TuneUp Utilities 2004\WinStylerThemeSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\crypserv.exe
C:\Programme\CA\eTrust Antivirus\InoRpc.exe
C:\Programme\CA\eTrust Antivirus\InoRT.exe
C:\Programme\CA\eTrust Antivirus\InoTask.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\CA\ETRUST~1\realmon.exe
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\Dit.exe
C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\PROGRA~1\GEMEIN~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
C:\USBStorage\USBDetector.exe
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
C:\PROGRA~1\GEMEIN~1\PCSuite\Services\SERVIC~1.EXE
C:\Programme\ICQLite\ICQLite.exe
C:\Corel\Graphics8\Programs\MFIndexer.exe
C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\DitExp.exe
C:\WINDOWS\System32\alg.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\iMesh\Client\iMeshClient.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Dokumente und Einstellungen\wolf\Desktop\HijackThis.exe

R3 - URLSearchHook: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - (no file)
O2 - BHO: Explorer Class - {962F12AE-2773-4BEB-99EA-B5C3AB9A6606} - C:\WINDOWS\System32\DSMANA~1.DLL
O2 - BHO: Pop Class - {A9AEE0DD-89E1-40EE-8749-A18650CC2175} - C:\WINDOWS\winsx.dll
O3 - Toolbar: Search Bar - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - (no file)
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\GEMEIN~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [USBDetector] C:\USBStorage\USBDetector.exe
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -minimize
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: Corel MEDIA FOLDERS INDEXER 8.LNK = C:\Corel\Graphics8\Programs\MFIndexer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: CA-Lizenz-Client - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: CA-Lizenzserver - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: Crypkey License - Unknown - crypserv.exe (file missing)
O23 - Service: eTrust Antivirus RPC Server - Computer Associates International, Inc. - C:\Programme\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server - Computer Associates International, Inc. - C:\Programme\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server - Computer Associates International, Inc. - C:\Programme\CA\eTrust Antivirus\InoTask.exe
O23 - Service: Ereignisprotokoll-Überwachung - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TuneUp WinStyler Theme Service - TuneUp Software GmbH - C:\Programme\TuneUp Utilities 2004\WinStylerThemeSvc.exe

danke, dass du dich meiner annimmst!!!

Bitte als erstes die Datei:
C:\WINDOWS\winsx.dll
online bei Jotti scannen und das Ergebnis (10 Zeilen) posten.
cacatoa

ich hoffe ich habe das richtig gemacht...

File: winsx.dll
Status: MIGHT BE INFECTED/MALWARE (Sandbox emulation took a long time and/or runtime packers were found, this is suspicious. Normally programs aren't packed and don't force the sandbox into lengthy emulation. Do realize no scanner issued any warning, the file can very well be harmless. Caution is advised, however.)
Packers detected: UPX

AntiVir No viruses found (0.17 seconds taken)
Avast No viruses found (1.52 seconds taken)
BitDefender No viruses found (0.77 seconds taken)
ClamAV No viruses found (0.79 seconds taken)
Dr.Web No viruses found (1.10 seconds taken)
F-Prot Antivirus No viruses found (0.12 seconds taken)
Kaspersky Anti-Virus No viruses found (1.13 seconds taken)
mks_vir No viruses found (0.42 seconds taken)
NOD32 No viruses found (0.78 seconds taken)
Norman Virus Control No viruses found (0.19 seconds taken)


vielen dank

Dann mach bitte folgendes:
Lade Dir den eScan herunter (Beachte die Anleitung) und lass ihn im abgesicherten Modus laufen (dauert ca. 1 Stunde.) Danach neu booten und das Ergebnis posten (Öffne die mwav.log -> Bearbeiten -> Suchen -> infected eingeben -> Weitersuchen -> Treffer markieren/kopieren und ins Forum übertragen.)
cacatoa

File C:\WINDOWS\eqinpev.exe infected by "Trojan.Win32.StartPage.qp" Virus

File C:\WINDOWS\uxeecgh.exe infected by "Trojan.Win32.StartPage.qp" Virus

File C:\WINDOWS\system32\fastvideoplayer.dll infected by "Trojan-Downloader.Win32.Dyfuca.dn" Virus

File C:\WINDOWS\system32\jhflddgj.exe infected by "Trojan.Win32.StartPage.qp" Virus

File C:\DOKUME~1\wolf\LOKALE~1\Temp\asmfiles.cab infected by "not-a-virus:AdWare.Altnet.b" Virus

File C:\DOKUME~1\wolf\LOKALE~1\TEMPOR~1\Content.IE5\0XUR81AR\tbd_web[1].htm infected by "Exploit.CodeBaseExec" Virus

File C:\DOKUME~1\wolf\LOKALE~1\TEMPOR~1\Content.IE5\41AFG9Q3\count1[1].jar infected by "Trojan.Java.Needy.c" Virus

File C:\DOKUME~1\wolf\LOKALE~1\TEMPOR~1\Content.IE5\41AFG9Q3\msits[1].exe infected by "Trojan-Downloader.Win32.Delf.cb" Virus

File C:\DOKUME~1\wolf\LOKALE~1\TEMPOR~1\Content.IE5\DG318QB6\count1[1].jar infected by "Trojan.Java.Needy.c" Virus

File C:\DOKUME~1\wolf\LOKALE~1\TEMPOR~1\Content.IE5\KX2RKXQR\ipreg32[1].cab infected by "Trojan-Downloader.Win32.Domcom.a" Virus

File C:\DOKUME~1\wolf\LOKALE~1\TEMPOR~1\Content.IE5\LN7BLDSE\loaderadv156[1].jar infected by "Trojan.Java.ClassLoader.h" Virus

File C:\DOKUME~1\wolf\LOKALE~1\TEMPOR~1\Content.IE5\LVSEX2HX\loaderadv157[1].jar infected by "Trojan.Java.ClassLoader.h" Virus

File C:\DOKUME~1\wolf\LOKALE~1\TEMPOR~1\Content.IE5\W5YFOL6B\update[1].exe infected by "Trojan-Downloader.Win32.Agent.fs" Virus

File C:\Dokumente und Einstellungen\wolf\Lokale Einstellungen\Temp\asmfiles.cab infected by "not-a-virus:AdWare.Altnet.b" Virus

File C:\Dokumente und Einstellungen\wolf\Lokale Einstellungen\Temporary Internet Files\Content.IE5\0XUR81AR\tbd_web[1].htm infected by "Exploit.CodeBaseExec" Virus

File C:\Dokumente und Einstellungen\wolf\Lokale Einstellungen\Temporary Internet Files\Content.IE5\41AFG9Q3\count1[1].jar infected by "Trojan.Java.Needy.c" Virus

File C:\Dokumente und Einstellungen\wolf\Lokale Einstellungen\Temporary Internet Files\Content.IE5\41AFG9Q3\msits[1].exe infected by "Trojan-Downloader.Win32.Delf.cb" Virus

File C:\Dokumente und Einstellungen\wolf\Lokale Einstellungen\Temporary Internet Files\Content.IE5\DG318QB6\count1[1].jar infected by "Trojan.Java.Needy.c" Virus

File C:\Dokumente und Einstellungen\wolf\Lokale Einstellungen\Temporary Internet Files\Content.IE5\KX2RKXQR\ipreg32[1].cab infected by "Trojan-Downloader.Win32.Domcom.a" Virus

File C:\Dokumente und Einstellungen\wolf\Lokale Einstellungen\Temporary Internet Files\Content.IE5\LN7BLDSE\loaderadv156[1].jar infected by "Trojan.Java.ClassLoader.h" Virus

File C:\Dokumente und Einstellungen\wolf\Lokale Einstellungen\Temporary Internet Files\Content.IE5\LVSEX2HX\loaderadv157[1].jar infected by "Trojan.Java.ClassLoader.h" Virus

File C:\Dokumente und Einstellungen\wolf\Lokale Einstellungen\Temporary Internet Files\Content.IE5\W5YFOL6B\update[1].exe infected by "Trojan-Downloader.Win32.Agent.fs" Virus

File C:\Program Files\Altnet\Download Manager\adm25.dll infected by "not-a-virus:AdWare.Altnet.a" Virus

File C:\Program Files\Altnet\Download Manager\adm4.dll infected by "not-a-virus:AdWare.Altnet.a" Virus

File C:\Program Files\Altnet\Download Manager\adm4005.exe infected by "not-a-virus:AdWare.Altnet.a" Virus

File C:\Program Files\Altnet\Download Manager\admprog.dll infected by "not-a-virus:AdWare.Altnet.a" Virus

File C:\Program Files\Altnet\Download Manager\asmps.dll infected by "not-a-virus:AdWare.Altnet.b" Virus

File C:\Program Files\Altnet\Points Manager\sysdetect.dll infected by "not-a-virus:AdWare.BrilliantDigital.1007" Virus

Scanning File C:\Programme\CA\eTrust Antivirus\Lang\German\Help\inocit\curing_an_infected_file_after_a_scan.html

Scanning File C:\Programme\CA\eTrust Antivirus\Lang\German\Help\inocit\deleting_an_infected_file_after_a_scan.html

Scanning File C:\Programme\CA\eTrust Antivirus\Lang\German\Help\inocit\infected_files.html

Scanning File C:\Programme\CA\eTrust Antivirus\Lang\German\Help\inocit\infected_files_02.html
Scanning File C:\Programme\CA\eTrust Antivirus\Lang\German\Help\inocit\infected_object.html

Scanning File C:\Programme\CA\eTrust Antivirus\Lang\German\Help\inocit\moving_an_infected_file_after_a_scan.html

Scanning File C:\Programme\CA\eTrust Antivirus\Lang\German\Help\inocit\remove_infected_macros.html

Scanning File C:\Programme\CA\eTrust Antivirus\Lang\German\Help\inocit\renaming_an_infected_file_after_a_scan.html

Scanning File C:\Programme\CA\eTrust Antivirus\Lang\German\Help\inocit\send_infected_files_only.html

Scanning File C:\Programme\CA\eTrust Antivirus\Lang\German\Help\inocit\viewing_details_about_an_infected_file.html

File C:\Programme\Gemeinsame Dateien\rtlsnqoc\alfouoae\dfdncoeq.exe infected by "not-a-virus:AdWare.Gator.a" Virus

File C:\Programme\Gemeinsame Dateien\rtlsnqoc\rmaosbsacu\uqdlcnruo.exe infected by "not-a-virus:AdWare.Gator.a" Virus

File C:\System Volume Information\_restore{4B3C2B70-D81F-4475-A29F-AA7CF176A979}\RP92\A0010334.EXE infected by "not-a-virus:AdWare.Toolbar.MyWay.b" Virus

File C:\System Volume Information\_restore{4B3C2B70-D81F-4475-A29F-AA7CF176A979}\RP92\A0010337.dll infected by "not-a-virus:AdWare.Gator.6041" Virus

File C:\System Volume Information\_restore{4B3C2B70-D81F-4475-A29F-AA7CF176A979}\RP92\A0010338.dll infected by "not-a-virus:AdWare.Gator.6041" Virus

File C:\System Volume Information\_restore{4B3C2B70-D81F-4475-A29F-AA7CF176A979}\RP92\A0010339.dll infected by "not-a-virus:AdWare.Gator.5017" Virus

File C:\System Volume Information\_restore{4B3C2B70-D81F-4475-A29F-AA7CF176A979}\RP92\A0010340.dll infected by "not-a-virus:AdWare.Gator.6041" Virus

File C:\System Volume Information\_restore{4B3C2B70-D81F-4475-A29F-AA7CF176A979}\RP92\A0010343.exe infected by "not-a-virus:AdWare.Gator.6041" Virus

File C:\System Volume Information\_restore{4B3C2B70-D81F-4475-A29F-AA7CF176A979}\RP92\A0010366.DLL infected by "not-a-virus:AdWare.ToolBar.MyWay.f" Virus

File C:\System Volume Information\_restore{4B3C2B70-D81F-4475-A29F-AA7CF176A979}\RP92\A0010367.exe infected by "not-a-virus:AdWare.Gator.6034" Virus

File C:\System Volume Information\_restore{4B3C2B70-D81F-4475-A29F-AA7CF176A979}\RP92\A0010368.dll infected by "not-a-virus:AdWare.Gator.6041" Virus

File C:\System Volume Information\_restore{4B3C2B70-D81F-4475-A29F-AA7CF176A979}\RP92\A0010369.dll infected by "not-a-virus:AdWare.Gator.6041" Virus

File C:\System Volume Information\_restore{4B3C2B70-D81F-4475-A29F-AA7CF176A979}\RP92\A0010370.dll infected by "not-a-virus:AdWare.Gator.3124" Virus

File C:\System Volume Information\_restore{4B3C2B70-D81F-4475-A29F-AA7CF176A979}\RP92\A0010371.dll infected by "not-a-virus:AdWare.Gator.6041" Virus

File C:\System Volume Information\_restore{4B3C2B70-D81F-4475-A29F-AA7CF176A979}\RP92\A0010372.dll infected by "not-a-virus:AdWare.Gator.6041" Virus

File C:\System Volume Information\_restore{4B3C2B70-D81F-4475-A29F-AA7CF176A979}\RP92\A0010373.dll infected by "not-a-virus:AdWare.Gator.6041" Virus

File C:\System Volume Information\_restore{4B3C2B70-D81F-4475-A29F-AA7CF176A979}\RP92\A0010374.dll infected by "not-a-virus:AdWare.Gator.6041" Virus

File C:\System Volume Information\_restore{4B3C2B70-D81F-4475-A29F-AA7CF176A979}\RP92\A0010377.dll infected by "not-a-virus:AdWare.Gator.6041" Virus

File C:\System Volume Information\_restore{4B3C2B70-D81F-4475-A29F-AA7CF176A979}\RP92\A0010378.dll infected by "not-a-virus:AdWare.Gator.6041" Virus

File C:\System Volume Information\_restore{4B3C2B70-D81F-4475-A29F-AA7CF176A979}\RP92\A0010382.dll infected by "not-a-virus:AdWare.Aureate" Virus

File C:\System Volume Information\_restore{4B3C2B70-D81F-4475-A29F-AA7CF176A979}\RP92\A0010384.DLL infected by "not-a-virus:AdWare.ToolBar.MyWay.g" Virus

File C:\System Volume Information\_restore{4B3C2B70-D81F-4475-A29F-AA7CF176A979}\RP92\A0010385.dll infected by "not-a-virus:AdWare.Gator.6041" Virus

File C:\System Volume Information\_restore{4B3C2B70-D81F-4475-A29F-AA7CF176A979}\RP94\A0011282.exe infected by "Trojan.Win32.StartPage.qp" Virus

15:48:35 File C:\System Volume Information\_restore{4B3C2B70-D81F-4475-A29F-AA7CF176A979}\RP94\A0011283.exe infected by "Trojan.Win32.StartPage.qp" Virus

File C:\System Volume Information\_restore{4B3C2B70-D81F-4475-A29F-AA7CF176A979}\RP94\A0011284.exe infected by "Trojan.Win32.StartPage.qp" Virus

File C:\WINDOWS\Downloaded Program Files\update.exe infected by "Trojan-Downloader.Win32.Agent.fs" Virus

File C:\WINDOWS\eqinpev.exe infected by "Trojan.Win32.StartPage.qp" Virus

File C:\WINDOWS\system32\fastvideoplayer.dll infected by "Trojan-Downloader.Win32.Dyfuca.dn" Virus

File C:\WINDOWS\Temp\Altnet\adm.exe infected by "not-a-virus:AdWare.Altnet.a" Virus

File C:\WINDOWS\Temp\Altnet\adm25.dll infected by "not-a-virus:AdWare.Altnet.a" Virus

File C:\WINDOWS\Temp\Altnet\adm4.dll infected by "not-a-virus:AdWare.Altnet.a" Virus

File C:\WINDOWS\Temp\Altnet\admprog.dll infected by "not-a-virus:AdWare.Altnet.a" Virus

File C:\WINDOWS\Temp\Altnet\mysearch.cab infected by "not-a-virus:AdWare.ToolBar.MyWay.g" Virus

File C:\WINDOWS\Temp\Altnet\pmfiles.cab infected by "not-a-virus:AdWare.BrilliantDigital.1007" Virus

File C:\WINDOWS\Temp\Altnet\Setup.exe infected by "not-a-virus:AdWare.Altnet.b" Virus

File C:\WINDOWS\uehbica.exe infected by "Trojan.Win32.StartPage.qp" Virus

File C:\WINDOWS\uxeecgh.exe infected by "Trojan.Win32.StartPage.qp" Virus

Hi, wolferl,
lade Dir clearprog 1.4.1 final runter, mache alle häkchen bei IE und Windows und clicke auf Löschen. Wenn fertig, beenden.
Dann sind alle temporary internet files... und temp files gelöscht.
Dann Systemwiederherstellung ausschalten, Rechner ausschalten, rechner anschalten, Systemwiederherstellung wieder an, dann sind die "System volume information\restore weg.
Den Rest der bleibt, erst mal im abgesicherten Modus manuell löschen.
Dann neues Logfile posten.
cacatoa

Logfile of HijackThis v1.99.0
Scan saved at 22:08:33, on 20.01.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\TuneUp Utilities 2004\WinStylerThemeSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\crypserv.exe
C:\Programme\CA\eTrust Antivirus\InoRpc.exe
C:\Programme\CA\eTrust Antivirus\InoRT.exe
C:\Programme\CA\eTrust Antivirus\InoTask.exe
C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\CA\ETRUST~1\realmon.exe
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\Dit.exe
C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\PROGRA~1\GEMEIN~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
C:\USBStorage\USBDetector.exe
C:\PROGRA~1\GEMEIN~1\PCSuite\Services\SERVIC~1.EXE
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
C:\Programme\ICQLite\ICQLite.exe
C:\Corel\Graphics8\Programs\MFIndexer.exe
C:\WINDOWS\DitExp.exe
C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Programme\Internet Explorer\iexplore.exe

Hi, wolferl,
bitte das komplette Logfile, im normalen Modus erstellt, posten.
cacatoa

sorry, hab den rest irgendwie übersehen...

Logfile of HijackThis v1.99.0
Scan saved at 22:08:33, on 20.01.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\TuneUp Utilities 2004\WinStylerThemeSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\crypserv.exe
C:\Programme\CA\eTrust Antivirus\InoRpc.exe
C:\Programme\CA\eTrust Antivirus\InoRT.exe
C:\Programme\CA\eTrust Antivirus\InoTask.exe
C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\CA\ETRUST~1\realmon.exe
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\Dit.exe
C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\PROGRA~1\GEMEIN~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
C:\USBStorage\USBDetector.exe
C:\PROGRA~1\GEMEIN~1\PCSuite\Services\SERVIC~1.EXE
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
C:\Programme\ICQLite\ICQLite.exe
C:\Corel\Graphics8\Programs\MFIndexer.exe
C:\WINDOWS\DitExp.exe
C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Dokumente und Einstellungen\wolf\Desktop\HijackThis.exe

R3 - URLSearchHook: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - (no file)
O2 - BHO: Explorer Class - {962F12AE-2773-4BEB-99EA-B5C3AB9A6606} - C:\WINDOWS\System32\DSMANA~1.DLL
O2 - BHO: Pop Class - {A9AEE0DD-89E1-40EE-8749-A18650CC2175} - C:\WINDOWS\winsx.dll
O3 - Toolbar: Search Bar - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - (no file)
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\GEMEIN~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [USBDetector] C:\USBStorage\USBDetector.exe
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -minimize
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: Corel MEDIA FOLDERS INDEXER 8.LNK = C:\Corel\Graphics8\Programs\MFIndexer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: CA-Lizenz-Client - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: CA-Lizenzserver - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: Crypkey License - Unknown - crypserv.exe (file missing)
O23 - Service: eTrust Antivirus RPC Server - Computer Associates International, Inc. - C:\Programme\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server - Computer Associates International, Inc. - C:\Programme\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server - Computer Associates International, Inc. - C:\Programme\CA\eTrust Antivirus\InoTask.exe
O23 - Service: Ereignisprotokoll-Überwachung - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TuneUp WinStyler Theme Service - TuneUp Software GmbH - C:\Programme\TuneUp Utilities 2004\WinStylerThemeSvc.exe

Schau in Deine Privaten Nachrichten.

Logfile of HijackThis v1.99.0
Scan saved at 22:08:33, on 20.01.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\TuneUp Utilities 2004\WinStylerThemeSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\crypserv.exe
C:\Programme\CA\eTrust Antivirus\InoRpc.exe
C:\Programme\CA\eTrust Antivirus\InoRT.exe
C:\Programme\CA\eTrust Antivirus\InoTask.exe
C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\CA\ETRUST~1\realmon.exe
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\Dit.exe
C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\PROGRA~1\GEMEIN~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
C:\USBStorage\USBDetector.exe
C:\PROGRA~1\GEMEIN~1\PCSuite\Services\SERVIC~1.EXE
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
C:\Programme\ICQLite\ICQLite.exe
C:\Corel\Graphics8\Programs\MFIndexer.exe
C:\WINDOWS\DitExp.exe
C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Dokumente und Einstellungen\wolf\Desktop\HijackThis.exe

R3 - URLSearchHook: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - (no file)
O2 - BHO: Explorer Class - {962F12AE-2773-4BEB-99EA-B5C3AB9A6606} - C:\WINDOWS\System32\DSMANA~1.DLL
O2 - BHO: Pop Class - {A9AEE0DD-89E1-40EE-8749-A18650CC2175} - C:\WINDOWS\winsx.dll
O3 - Toolbar: Search Bar - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - (no file)
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\GEMEIN~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [USBDetector] C:\USBStorage\USBDetector.exe
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -minimize
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: Corel MEDIA FOLDERS INDEXER 8.LNK = C:\Corel\Graphics8\Programs\MFIndexer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: CA-Lizenz-Client - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: CA-Lizenzserver - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: Crypkey License - Unknown - crypserv.exe (file missing)
O23 - Service: eTrust Antivirus RPC Server - Computer Associates International, Inc. - C:\Programme\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server - Computer Associates International, Inc. - C:\Programme\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server - Computer Associates International, Inc. - C:\Programme\CA\eTrust Antivirus\InoTask.exe
O23 - Service: Ereignisprotokoll-Überwachung - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TuneUp WinStyler Theme Service - TuneUp Software GmbH - C:\Programme\TuneUp Utilities 2004\WinStylerThemeSvc.exe

Hi, wolf,
bitte die folgenden mit HJT im abgesicherten modus fixen:
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
R3 - URLSearchHook: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - (no file)
O2 - BHO: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - (no file)
O3 - Toolbar: Search Bar - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - (no file)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O23 - Service: Crypkey License - Unknown - crypserv.exe (file missing)

Dann folgende Datei manuell löschen:
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe

Es sei denn Du hast P2P absichtlich, dann lassen und auch die O16.

Trotz des eScan bitte die folgenden 2 Dateien mal bei Jotti online scannen lassen:
C:\WINDOWS\System32\DSMANA~1.DLL
C:\WINDOWS\winsx.dll

Bitte berichte über das (10-zeilige) Ergebnis.
Nach dem Fixen neues Logfile posten.
cacatoa

@ wolf:
Wenn Jotti nicht funktioniert, dann vorerst mal den nehmen.
cacatoa