Hallo,

seit einigen Tagen habe ich enorme Probleme mit Spyware. Habe bisher alles durchlaufen lassen und es nützt nix. Nun habe ich wieder HijackThis versucht und hab das auf www.hijackthis.de auswerten lassen. Es gibt da aber drei Einträge, die sich nicht fixen lassen. Es sind die drei Einträge mit 01 (fettgedruckt)

Hier nun mein log:

Logfile of HijackThis v1.99.0
Scan saved at 13:33:08, on 25.01.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\TBPanel.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\WINDOWS\System32\cleanmgr.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe
C:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis2\kernel.exe
C:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis2\sc_watch.exe
C:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis2\PROFIL~1.EXE
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.t-online.de
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.t-online.de
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Messenger\ycomp.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Gainward] C:\WINDOWS\TBPanel.exe /A
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [gcasServ] "C:\Programme\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{4633D25C-BE6C-4B03-BB73-55D8341B080D}: NameServer = 217.237.149.161 217.237.151.225
O23 - Service: AntiVir Service - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: EPSON Printer Status Agent2 - SEIKO EPSON CORPORATION - C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe
O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TuneUp WinStyler Theme Service - TuneUp Software GmbH - C:\Programme\TuneUp Utilities 2004\WinStylerThemeSvc.exe
O23 - Service: Ulead Burning Helper - Ulead Systems, Inc. - C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe

Ich hoffe, Ihr könnt helfen!!

Fixen im abgesicherten Modus bei deaktivierter Systemwiederherstellung!
Außerdem ist Dein System nicht gepatcht. Also windows-update besuchen.
cacatoa

Hallo,

danke für die Antwort.
Wie gehe ich in den sicheren Modus und deaktiviere die systemwiederherstellung???

DANKE!!

Abgesicherter Modus , Systemwiederherstellung:
Linke Maustaste Arbeitspaltz, eigenschaften, Registerkarte Systemwiederherstellung, Auf allen Laufwerken deaktivieren, o.k.

Nicht vergessen, nach derm scan wieder ganz normal hochbooten und Systemwiederherstellung aktivieren.
cacatoa

Hallo,

das habe ich gemacht. Dann war alles weg und jetzt habe ich es wieder!!
Außerdem habe ich mit Spybot Search and Destroy 17 Shädlinge durch Coolwwwsearch gefunden, die sich nicht löschen lassen!!
WAS JETZT?????????

Mach einen spybot-scan im abgesicherten Modus.
Spybot löscht doch.
Edit:
War die Systemwiederherstellung deaktiviert? Sicher?

Hallo

die war 100% aktiviert!! Spybot wollte die einträge auch im abgesicherten modus nicht löschen!! WAS SOLL ICH DENN MACHEN???

Zitat von kareena
die war 100% aktiviert!

Die Systemwiederherstellung soll deaktiviert sein.

das mein ich ja..sorry , ich war in eile!!

Geh mal bei Spybot auf "Werkzeuge" und mach ein Häkchen bei "Hosts-Datei"
laß dann nochmal laufen

habe ich gemacht und er hat auch nur dann gelöscht, wenn ich immer einer einzeln hab löschen lassen. Aber es ist wenige sekunden später wieder da gewesen!!

Ich sende liebe wieder meinen neuen HJT Log:

Logfile of HijackThis v1.99.0
Scan saved at 15:23:13, on 25.01.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\TBPanel.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Programme\Microsoft AntiSpyware\gcasServ.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\Microsoft AntiSpyware\gcasDtServ.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe
C:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis2\kernel.exe
C:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis2\sc_watch.exe
C:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis2\PROFIL~1.EXE
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Spybot - Search & Destroy\SpybotSD.exe
C:\Programme\Yahoo!\Messenger\YPager.exe
C:\Programme\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.t-online.de
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.t-online.de
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Gainward] C:\WINDOWS\TBPanel.exe /A
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [gcasServ] "C:\Programme\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Programme\Yahoo!\Messenger\ypager.exe -quiet
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{4633D25C-BE6C-4B03-BB73-55D8341B080D}: NameServer = 217.237.149.161 217.237.151.225
O23 - Service: AntiVir Service - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: EPSON Printer Status Agent2 - SEIKO EPSON CORPORATION - C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe
O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TuneUp WinStyler Theme Service - TuneUp Software GmbH - C:\Programme\TuneUp Utilities 2004\WinStylerThemeSvc.exe
O23 - Service: Ulead Burning Helper - Ulead Systems, Inc. - C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe

Hi,
irgendwas stört mich da.
Deshalb eScan runterladen und genau nach der Anleitung im abgesicherten Modus ausführen.
Poste dann das Ergebnis (Öffne die mwav.log -> Bearbeiten -> Suchen -> infected eingeben -> Weitersuchen -> Treffer markieren/kopieren und ins Forum übertragen).
cacaota

HI;

vorhin wollt er irgendwie nix posten. Hier sind die Zeilen, es ist aber alles jetzt wieder da!!!!!!!!!!!

Tue Jan 25 17:10:21 2005 => File C:\WINDOWS\iewww.exe infected by "Trojan.Win32.StartPage.oh" Virus. Action Taken: File Deleted.
Tue Jan 25 17:11:04 2005 => File C:\WINDOWS\System32\EG_AUTH.dll infected by "Trojan.Win32.P2E.as" Virus. Action Taken: File Deleted.
Tue Jan 25 17:11:29 2005 => File C:\WINDOWS\System32\luxxam.exe infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: File Deleted.
Tue Jan 25 17:35:29 2005 => ERROR!!! MS_ScanAndClean return ffffffff
Tue Jan 25 17:35:30 2005 => C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\09I781AV\Place=fullbanner2&transactionID=1083930253312&Site=wettercom&SubSite=wetter&SubSubSite=weltwetter&SubSubSubSite=forecast&tp ic=0y1n2y3n&ttempmin=1n2n3n4y5n6n possibly infected and removed by background antivirus package!
Tue Jan 25 17:35:30 2005 => Scanning File C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\09I781AV\Place=fullbanner2&transactionID=1085217183500&Site=pro7de&SubSite=home&SubSubSite=home&flashversion=7&windowheight=429&wind owwidth=761&adsize=468x60&tagheig
Tue Jan 25 17:35:30 2005 => ERROR!!! MS_ScanAndClean return ffffffff
Tue Jan 25 17:35:30 2005 => C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\09I781AV\Place=fullbanner2&transactionID=1085217183500&Site=pro7de&SubSite=home&SubSubSite=home&flashversion=7&windowheight=429&wind owwidth=761&adsize=468x60&tagheig possibly infected and removed by background antivirus package!
Tue Jan 25 17:35:30 2005 => Scanning File C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\09I781AV\Place=squarebutton1&transactionID=1083930216875&Site=wettercom&SubSite=home&SubSubSite=home&SubSubSubSite=home&flashversion =7&sowefo_ausschluss=powerlayer_p
Tue Jan 25 17:35:30 2005 => ERROR!!! MS_ScanAndClean return ffffffff
Tue Jan 25 17:35:30 2005 => C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\09I781AV\Place=squarebutton1&transactionID=1083930216875&Site=wettercom&SubSite=home&SubSubSite=home&SubSubSubSite=home&flashversion =7&sowefo_ausschluss=powerlayer_p possibly infected and removed by background antivirus package!
Tue Jan 25 17:35:30 2005 => Scanning File C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\09I781AV\Place=squarebutton1&transactionID=1083930232843&Site=wettercom&SubSite=wetter&SubSubSite=weltwetter&SubSubSubSite=forecast& flashversion=7&tpic=0y1y2y3n&ttem
Tue Jan 25 17:35:30 2005 => ERROR!!! MS_ScanAndClean return ffffffff
Tue Jan 25 17:35:30 2005 => C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\09I781AV\Place=squarebutton1&transactionID=1083930232843&Site=wettercom&SubSite=wetter&SubSubSite=weltwetter&SubSubSubSite=forecast& flashversion=7&tpic=0y1y2y3n&ttem possibly infected and removed by background antivirus package!
Tue Jan 25 17:35:30 2005 => Scanning File C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\09I781AV\Place=squarebutton1&transactionID=1084009430406&Site=wettercom&SubSite=wetter&SubSubSite=weltwetter&SubSubSubSite=home&flas hversion=7&sowefo_ausschluss=powe
Tue Jan 25 17:35:30 2005 => ERROR!!! MS_ScanAndClean return ffffffff
Tue Jan 25 17:35:30 2005 => C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\09I781AV\Place=squarebutton1&transactionID=1084009430406&Site=wettercom&SubSite=wetter&SubSubSite=weltwetter&SubSubSubSite=home&flas hversion=7&sowefo_ausschluss=powe possibly infected and removed by background antivirus package!
Tue Jan 25 17:35:30 2005 => Scanning File C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\09I781AV\Place=squarebutton1&transactionID=1085217183500&Site=pro7de&SubSite=home&SubSubSite=home&flashversion=7&windowheight=429&wi ndowwidth=761&sowefo_ausschluss=p
Tue Jan 25 17:35:30 2005 => ERROR!!! MS_ScanAndClean return ffffffff
Tue Jan 25 17:35:30 2005 => C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\09I781AV\Place=squarebutton1&transactionID=1085217183500&Site=pro7de&SubSite=home&SubSubSite=home&flashversion=7&windowheight=429&wi ndowwidth=761&sowefo_ausschluss=p possibly infected and removed by background antivirus package!
Tue Jan 25 17:35:30 2005 => Scanning File C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\25RSLK72\Place=fullbanner2&transactionID=1083930226625&Site=wettercom&SubSite=wetter&SubSubSite=deutschlandwetter&SubSubSubSite=home &tpic=0n1n2y3y&ttempmin=1n2n3n4n5
Tue Jan 25 17:35:30 2005 => ERROR!!! MS_ScanAndClean return ffffffff
Tue Jan 25 17:35:30 2005 => C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\25RSLK72\Place=fullbanner2&transactionID=1083930226625&Site=wettercom&SubSite=wetter&SubSubSite=deutschlandwetter&SubSubSubSite=home &tpic=0n1n2y3y&ttempmin=1n2n3n4n5 possibly infected and removed by background antivirus package!
Tue Jan 25 17:35:31 2005 => Scanning File C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\25RSLK72\Place=fullbanner2&transactionID=1083930249484&Site=wettercom&SubSite=wetter&SubSubSite=weltwetter&SubSubSubSite=forecast&tp ic=0y1y2n3n&ttempmin=1n2n3n4n5y6n
Tue Jan 25 17:35:31 2005 => ERROR!!! MS_ScanAndClean return ffffffff
Tue Jan 25 17:35:31 2005 => C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\25RSLK72\Place=fullbanner2&transactionID=1083930249484&Site=wettercom&SubSite=wetter&SubSubSite=weltwetter&SubSubSubSite=forecast&tp ic=0y1y2n3n&ttempmin=1n2n3n4n5y6n possibly infected and removed by background antivirus package!
Tue Jan 25 17:35:31 2005 => Scanning File C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\25RSLK72\Place=fullbanner2&transactionID=1085907836875&Site=sat1de&SubSite=home&SubSubSite=home&SubSubSubSite=home&flashversion=7&wi ndowheight=1&windowwidth=761&adsi
Tue Jan 25 17:35:31 2005 => ERROR!!! MS_ScanAndClean return ffffffff
Tue Jan 25 17:35:31 2005 => C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\25RSLK72\Place=fullbanner2&transactionID=1085907836875&Site=sat1de&SubSite=home&SubSubSite=home&SubSubSubSite=home&flashversion=7&wi ndowheight=1&windowwidth=761&adsi possibly infected and removed by background antivirus package!
Tue Jan 25 17:35:31 2005 => Scanning Folder: C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\3ZPFJTSS\*.*
Tue Jan 25 17:35:31 2005 => Scanning File C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\3ZPFJTSS\Place=fullbanner1&transactionID=1085217183500&Site=pro7de&SubSite=home&SubSubSite=home&flashversion=7&windowheight=429&wind owwidth=761&sowefo_ausschluss=pow
Tue Jan 25 17:35:31 2005 => ERROR!!! MS_ScanAndClean return ffffffff
Tue Jan 25 17:35:31 2005 => C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\3ZPFJTSS\Place=fullbanner1&transactionID=1085217183500&Site=pro7de&SubSite=home&SubSubSite=home&flashversion=7&windowheight=429&wind owwidth=761&sowefo_ausschluss=pow possibly infected and removed by background antivirus package!

ICH POSTE ZWEI EINTRÄGE WEIL ER SONST NICHT WILL!

DOCH DREI:

Tue Jan 25 17:35:31 2005 => Scanning File C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\3ZPFJTSS\Place=rectangle1&transactionID=1085907836875&Site=sat1de&SubSite=home&SubSubSite=home&SubSubSubSite=home&flashversion=7&win dowheight=1&windowwidth=761&sowef
Tue Jan 25 17:35:31 2005 => ERROR!!! MS_ScanAndClean return ffffffff
Tue Jan 25 17:35:31 2005 => C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\3ZPFJTSS\Place=rectangle1&transactionID=1085907836875&Site=sat1de&SubSite=home&SubSubSite=home&SubSubSubSite=home&flashversion=7&win dowheight=1&windowwidth=761&sowef possibly infected and removed by background antivirus package!
Tue Jan 25 17:35:31 2005 => Scanning Folder: C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\3ZPJ3HCW\*.*
Tue Jan 25 17:35:31 2005 => Scanning File C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\3ZPJ3HCW\Place=fullbanner2&transactionID=1083930232203&Site=wettercom&SubSite=wetter&SubSubSite=weltwetter&SubSubSubSite=current&tpi c=0n1y2n3n&ttempmin=1n2n3n4n5y6n7
Tue Jan 25 17:35:31 2005 => ERROR!!! MS_ScanAndClean return ffffffff
Tue Jan 25 17:35:31 2005 => C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\3ZPJ3HCW\Place=fullbanner2&transactionID=1083930232203&Site=wettercom&SubSite=wetter&SubSubSite=weltwetter&SubSubSubSite=current&tpi c=0n1y2n3n&ttempmin=1n2n3n4n5y6n7 possibly infected and removed by background antivirus package!
Tue Jan 25 17:35:31 2005 => Scanning File C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\3ZPJ3HCW\Place=fullbanner2&transactionID=1083930261562&Site=wettercom&SubSite=wetter&SubSubSite=weltwetter&SubSubSubSite=forecast&tp ic=0y1n2n3n&ttempmin=1n2n3n4n5y6n
Tue Jan 25 17:35:31 2005 => ERROR!!! MS_ScanAndClean return ffffffff
Tue Jan 25 17:35:31 2005 => C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\3ZPJ3HCW\Place=fullbanner2&transactionID=1083930261562&Site=wettercom&SubSite=wetter&SubSubSite=weltwetter&SubSubSubSite=forecast&tp ic=0y1n2n3n&ttempmin=1n2n3n4n5y6n possibly infected and removed by background antivirus package!
Tue Jan 25 17:35:31 2005 => Scanning Folder: C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\628LEI73\*.*
Tue Jan 25 17:35:31 2005 => Scanning File C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\628LEI73\Place=squarebutton1&transactionID=1083930248453&Site=wettercom&SubSite=wetter&SubSubSite=weltwetter&SubSubSubSite=forecast& flashversion=7&tpic=0y1y2n3n&ttem
Tue Jan 25 17:35:31 2005 => ERROR!!! MS_ScanAndClean return ffffffff
Tue Jan 25 17:35:31 2005 => C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\628LEI73\Place=squarebutton1&transactionID=1083930248453&Site=wettercom&SubSite=wetter&SubSubSite=weltwetter&SubSubSubSite=forecast& flashversion=7&tpic=0y1y2n3n&ttem possibly infected and removed by background antivirus package!
Tue Jan 25 17:35:31 2005 => Scanning File C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\628LEI73\Place=squarebutton1&transactionID=1083930260218&Site=wettercom&SubSite=wetter&SubSubSite=weltwetter&SubSubSubSite=forecast& flashversion=7&tpic=0y1n2n3n&ttem
Tue Jan 25 17:35:31 2005 => ERROR!!! MS_ScanAndClean return ffffffff
Tue Jan 25 17:35:31 2005 => C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\628LEI73\Place=squarebutton1&transactionID=1083930260218&Site=wettercom&SubSite=wetter&SubSubSite=weltwetter&SubSubSubSite=forecast& flashversion=7&tpic=0y1n2n3n&ttem possibly infected and removed by background antivirus package!
Tue Jan 25 17:35:32 2005 => Scanning Folder: C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\7EJ5PH3V\*.*
Tue Jan 25 17:35:32 2005 => Scanning File C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\7EJ5PH3V\Place=fullbanner2&transactionID=1084009427781&Site=wettercom&SubSite=wetter&SubSubSite=weltwetter&SubSubSubSite=home&adsize =468x60&tagheight=60&tagwidth=468
Tue Jan 25 17:35:32 2005 => ERROR!!! MS_ScanAndClean return ffffffff
Tue Jan 25 17:35:32 2005 => C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\7EJ5PH3V\Place=fullbanner2&transactionID=1084009427781&Site=wettercom&SubSite=wetter&SubSubSite=weltwetter&SubSubSubSite=home&adsize =468x60&tagheight=60&tagwidth=468 possibly infected and removed by background antivirus package!
Tue Jan 25 17:35:32 2005 => Scanning Folder: C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\8927GTE3\*.*

Tue Jan 25 17:35:32 2005 => Scanning File C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\8927GTE3\Place=fullbanner2&transactionID=1083930229218&Site=wettercom&SubSite=wetter&SubSubSite=weltwetter&SubSubSubSite=overview&tp ic=0y1y2y3y&ttempmin=1n2n3n4y5y6n
Tue Jan 25 17:35:32 2005 => ERROR!!! MS_ScanAndClean return ffffffff
Tue Jan 25 17:35:32 2005 => C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\8927GTE3\Place=fullbanner2&transactionID=1083930229218&Site=wettercom&SubSite=wetter&SubSubSite=weltwetter&SubSubSubSite=overview&tp ic=0y1y2y3y&ttempmin=1n2n3n4y5y6n possibly infected and removed by background antivirus package!
Tue Jan 25 17:35:32 2005 => Scanning File C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\8927GTE3\Place=squarebutton1&transactionID=1083930244859&Site=wettercom&SubSite=wetter&SubSubSite=weltwetter&SubSubSubSite=forecast& flashversion=7&tpic=0y1n2n3y&ttem
Tue Jan 25 17:35:32 2005 => ERROR!!! MS_ScanAndClean return ffffffff
Tue Jan 25 17:35:32 2005 => C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\8927GTE3\Place=squarebutton1&transactionID=1083930244859&Site=wettercom&SubSite=wetter&SubSubSite=weltwetter&SubSubSubSite=forecast& flashversion=7&tpic=0y1n2n3y&ttem possibly infected and removed by background antivirus package!
Tue Jan 25 17:35:32 2005 => Scanning File C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\8927GTE3\Place=squarebutton1&transactionID=1084009423734&Site=wettercom&SubSite=wetter&SubSubSite=weltwetter&SubSubSubSite=home&flas hversion=7&sowefo_ausschluss=powe
Tue Jan 25 17:35:32 2005 => ERROR!!! MS_ScanAndClean return ffffffff
Tue Jan 25 17:35:32 2005 => C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\8927GTE3\Place=squarebutton1&transactionID=1084009423734&Site=wettercom&SubSite=wetter&SubSubSite=weltwetter&SubSubSubSite=home&flas hversion=7&sowefo_ausschluss=powe possibly infected and removed by background antivirus package!
Tue Jan 25 17:35:32 2005 => Scanning Folder: C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\C8CBIYDF\*.*
Tue Jan 25 17:35:32 2005 => Scanning File C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\C8CBIYDF\Place=squarebutton1&transactionID=1083930227625&Site=wettercom&SubSite=wetter&SubSubSite=weltwetter&SubSubSubSite=overview& flashversion=7&tpic=0y1y2y3y&ttem
Tue Jan 25 17:35:32 2005 => ERROR!!! MS_ScanAndClean return ffffffff
Tue Jan 25 17:35:32 2005 => C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\C8CBIYDF\Place=squarebutton1&transactionID=1083930227625&Site=wettercom&SubSite=wetter&SubSubSite=weltwetter&SubSubSubSite=overview& flashversion=7&tpic=0y1y2y3y&ttem possibly infected and removed by background antivirus package!
Tue Jan 25 17:35:32 2005 => Scanning File C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\C8CBIYDF\Place=squarebutton1&transactionID=1083930255515&Site=wettercom&SubSite=wetter&SubSubSite=weltwetter&SubSubSubSite=forecast& flashversion=7&sowefo_ausschluss=
Tue Jan 25 17:35:32 2005 => ERROR!!! MS_ScanAndClean return ffffffff
Tue Jan 25 17:35:32 2005 => C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\C8CBIYDF\Place=squarebutton1&transactionID=1083930255515&Site=wettercom&SubSite=wetter&SubSubSite=weltwetter&SubSubSubSite=forecast& flashversion=7&sowefo_ausschluss= possibly infected and removed by background antivirus package!
Tue Jan 25 17:35:32 2005 => Scanning File C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\C8CBIYDF\Place=squarebutton1&transactionID=1083930264140&Site=wettercom&SubSite=wetter&SubSubSite=weltwetter&SubSubSubSite=forecast& flashversion=7&tpic=0n1y2n3n&ttem
Tue Jan 25 17:35:32 2005 => ERROR!!! MS_ScanAndClean return ffffffff
Tue Jan 25 17:35:32 2005 => C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\C8CBIYDF\Place=squarebutton1&transactionID=1083930264140&Site=wettercom&SubSite=wetter&SubSubSite=weltwetter&SubSubSubSite=forecast& flashversion=7&tpic=0n1y2n3n&ttem possibly infected and removed by background antivirus package!
Tue Jan 25 17:35:32 2005 => Scanning Folder: C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\CXIZ0X2N\*.*
Tue Jan 25 17:35:33 2005 => Scanning File C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\CXIZ0X2N\Place=squarebutton1&transactionID=1083930222468&Site=wettercom&SubSite=wetter&SubSubSite=deutschlandwetter&SubSubSubSite=ho me&flashversion=7&sowefo_ausschlu
Tue Jan 25 17:35:33 2005 => ERROR!!! MS_ScanAndClean return ffffffff
Tue Jan 25 17:35:33 2005 => C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\CXIZ0X2N\Place=squarebutton1&transactionID=1083930222468&Site=wettercom&SubSite=wetter&SubSubSite=deutschlandwetter&SubSubSubSite=ho me&flashversion=7&sowefo_ausschlu possibly infected and removed by background antivirus package!
Tue Jan 25 17:35:33 2005 => Scanning Folder: C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\CZMH81OO\*.*
Tue Jan 25 17:35:33 2005 => Scanning File C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\CZMH81OO\Place=popup1&transactionID=1083930260218&Site=wettercom&SubSite=wetter&SubSubSite=weltwetter&SubSubSubSite=forecast&flashve rsion=7&tpic=0y1n2n3n&ttempmin=1n
Tue Jan 25 17:35:33 2005 => ERROR!!! MS_ScanAndClean return ffffffff
Tue Jan 25 17:35:33 2005 => C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\CZMH81OO\Place=popup1&transactionID=1083930260218&Site=wettercom&SubSite=wetter&SubSubSite=weltwetter&SubSubSubSite=forecast&flashve rsion=7&tpic=0y1n2n3n&ttempmin=1n possibly infected and removed by background antivirus package!
Tue Jan 25 17:35:33 2005 => Scanning File C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\CZMH81OO\Place=squarebutton1&transactionID=1083930225234&Site=wettercom&SubSite=wetter&SubSubSite=deutschlandwetter&SubSubSubSite=ho me&flashversion=7&sowefo_ausschlu
Tue Jan 25 17:35:33 2005 => ERROR!!! MS_ScanAndClean return ffffffff
Tue Jan 25 17:35:33 2005 => C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\CZMH81OO\Place=squarebutton1&transactionID=1083930225234&Site=wettercom&SubSite=wetter&SubSubSite=deutschlandwetter&SubSubSubSite=ho me&flashversion=7&sowefo_ausschlu possibly infected and removed by background antivirus package!
Tue Jan 25 17:35:33 2005 => Scanning File C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\desktop.ini
Tue Jan 25 17:35:33 2005 => Scanning Folder: C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\EZE3QJW1\*.*
Tue Jan 25 17:35:33 2005 => Scanning File C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\EZE3QJW1\Place=popup1&transactionID=1084009433578&Site=wettercom&SubSite=reise&SubSubSite=reisewetter&SubSubSubSite=home&flashversio n=7&tpic=0y1y2n3n&ttempmin=1n2n3n
Tue Jan 25 17:35:33 2005 => ERROR!!! MS_ScanAndClean return ffffffff
Tue Jan 25 17:35:33 2005 => C:\Dokumente und Einstellungen\Hosna\Lokale Einstellungen\Temporary Internet Files\Content.IE5\EZE3QJW1\Place=popup1&transactionID=1084009433578&Site=wettercom&SubSite=reise&SubSubSite=reisewetter&SubSubSubSite=home&flashversio n=7&tpic=0y1y2n3n&ttempmin=1n2n3n possibly infected and removed by background antivirus package!