hi kati
fixe bitte im abgesicherten modus:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.media-search.net/nph-...k=sbar1_srchbtn
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.media-search.net/nph-...ok=stmpl1&find=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.media-search.net/nph-...ok=stmpl1&find=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.media-search.net/nph-...k=sbar1_srchbtn
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.media-search.net/nph-...ok=stmpl1&find=
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.media-search.net/nph-...ok=stmpl1&find=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.media-search.net/nph-...ok=stmpl1&find=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.media-search.net/nph-...ok=stmpl1&find=
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = hhttp://search.media-search.net/nph-search.cgi?track=mssrc&look=stmpl1&find=
R3 - URLSearchHook: WebSearch Class - {9368D063-44BE-49B9-BD14-BB9663FD38FC} - C:\PROGRAMME\SE\V11\SE.DLL
O1 - Hosts: 216.177.73.139 auto.search.msn.com
O1 - Hosts: 216.177.73.139 search.netscape.com
O1 - Hosts: 216.177.73.139 ieautosearch
O2 - BHO: (no name) - {A096A159-4E58-45A9-8EE6-B11466851181} - (no file)
O2 - BHO: (no name) - {000004CC-E4FF-4F2C-BC30-DBEF0B983BC9} - (no file)
O2 - BHO: Natural Language Navigation - {60E78CAC-E9A7-4302-B9EE-8582EDE22FBF} - C:\WINDOWS\SYSTEM\BHO001.DLL
O2 - BHO: UCmore toolbar - {ED8DB0FD-D8F4-4b2c-BB5B-9EF040FE104D} - (no file)
O2 - BHO: WebBho Class - {00041A26-7033-432C-94C7-6371DE343822} - C:\PROGRAMME\SE\V11\SE.DLL
O3 - Toolbar: (no name) - {53CBEE82-D747-11d3-9ED0-005004189684} - (no file)
O3 - Toolbar: (no name) - {53CBEE82-D747-11d3-9ED0-005004189684} - (no file)
O4 - HKLM\..\Run: [WindowEnhancer] "C:\PROGRAMME\WINEX\V2\WINEX.EXE" /U
O4 - HKLM\..\Run: [Media-Search] "C:\PROGRAMME\MSNET\V9\MSNET.EXE" /H
O4 - HKLM\..\Run: [CMESys] "C:\PROGRAMME\GEMEINSAME DATEIEN\CMEII\CMESYS.EXE"
O4 - HKLM\..\Run: [Search-Exe] "C:\PROGRAMME\SE\V11\SE.EXE" /H
O4 - Startup: GStartup.lnk = C:\Programme\Gemeinsame Dateien\GMT\GMT.exe
O16 - DPF: {11111111-1111-1111-1111-111111111123} - file://c:\Recycled\1.exe

wenn du die einträge nicht kennst auch fixen:
O16 - DPF: {01E54593-BE14-4D6B-9310-37C0145EFE42} (AMI DicomDir TreeView Control 1.0) - FILE://F:\RADWORKS CD-VIEWER\CDVIEWER.CAB
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = kawo1.rwth-aachen.de
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 134.130.115.1,134.130.4.1,134.130.5.1
lade dir anschließend escan runter und gehe nach der anweisung hier:http://www.trojaner-board.de/42731-escan-anleitung.html vor
download: http://www.mwti.net/antivirus/free_utilities.asp
Teile uns dann das Ergebnis des eScan mit: welche Viren wurden auf Deinem Rechner gefunden: öffne die mwav.log -> Bearbeiten -> Suchen -> infected eingeben -> Weitersuchen -> Treffer markieren/kopieren und ins Forum übertragen.
sunshine

@sunshine ein teil fehlt^^ nämlich das löschen der befallenen dateien. die einträge kommen ja wieder, wenn die dateien noch vorhanden sind

also im abgesicherten modus noch diese dateien löschen:
-den ordner C:\PROGRAMME\WINEX\
-den ordner C:\PROGRAMME\MSNET\
-den ordner C:\PROGRAMME\GEMEINSAME DATEIEN\CMEII\
-den ordner C:\PROGRAMME\SE\
-den ordner C:\Programme\Gemeinsame Dateien\GMT\
-leere den papierkorb
-die datei BHO001.DLL im ordner C:\WINDOWS\SYSTEM\

hallo!

nachdem ich im hijackthis.exe die angegebenen dateien gefixt habe, hat die suche mittels escan folgende ergebnisse geliefert:

C:\WINDOWS\RSP001~1.DAT infected by "not-a-virus:AdWare.IGetNet" Virus.
C:\WINDOWS\newdotnet3_36.dll infected by "not-a-virus:AdWare.NewDotNet" Virus.
C:\WINDOWS\SYSTEM\RSP001.DLL infected by "not-a-virus:AdWare.IGetNet" Virus.
C:\WINDOWS\SYSTEM\Install_All.DLL infected by "not-a-virus:AdWare.IGetNet.b" Virus.
File C:\WINDOWS\SYSTEM\Update_com.DLL infected by "not-a-virus:AdWare.IGetNet" Virus.
File C:\WINDOWS\SYSTEM\RSP001.DLL infected by "not-a-virus:AdWare.IGetNet" Virus.
File C:\WINDOWS\SYSTEM\Install_All.DLL infected by "not-a-virus:AdWare.IGetNet.b" Virus.
File C:\WINDOWS\SYSTEM\Update_com.DLL infected by "not-a-virus:AdWare.IGetNet" Virus.
C:\WINDOWS\Anwendungsdaten\Mozilla\Profiles\default\mg274aky.slt\Mail\mail.kawo1.rwh-aachen.de\Trash infected by "Exploit.HTML.FileDownload" Virus.
C:\WINDOWS\RSP001~1.DAT infected by "not-a-virus:AdWare.IGetNet" Virus.
C:\WINDOWS\newdotnet3_36.dll infected by "not-a-virus:AdWare.NewDotNet" Virus.
C:\WINDOWS\Coder\_233-TAT-1-0-.exe infected by "not-a-virus:PornWare.Dialer.Generic" Virus.
C:\Programme\Twister\TwisterInstall.exe infected by "not-a-virus:AdWare.SaveNow.e" Virus.
C:\Programme\DownloadWare\Downloads\151.dat infected by "not-a-virus:AdWare.WindowEnhancer" Virus.
C:\Programme\DownloadWare\Downloads\205.dat infected by "not-a-virus:AdWare.WindowEnhancer" Virus.
C:\Programme\DownloadWare\Downloads\217.dat infected by "not-a-virus:AdWare.WindowEnhancer" Virus.
C:\Programme\DownloadWare\Downloads\201.dat infected by "not-a-virus:AdWare.SmartPops" Virus.
C:\Programme\DownloadWare\Temp\we.exe infected by "not-a-virus:AdWare.WindowEnhancer" Virus.
C:\Programme\DownloadWare\Temp\msinst.exe infected by "not-a-virus:AdWare.WindowEnhancer" Virus.
C:\Programme\DownloadWare\Temp\seinst.exe infected by "not-a-virus:AdWare.WindowEnhancer" Virus.
C:\Programme\DownloadWare\Temp\rh.exe infected by "not-a-virus:AdWare.SmartPops" Virus.
C:\Programme\DelFin\PromulGate\PgSDK.DLL infected by "not-a-virus:AdWare.DelphinMediaViewer.d" Virus.
C:\Programme\UCmore\UCMIE.dll infected by "not-a-virus:AdWare.ToolBar.Ucmore.a" Virus.
C:\Programme\UCmore\IUCmore.dll infected by "not-a-virus:AdWare.Toolbar.Ucmore" Virus.
C:\Programme\Recommended Hotfix - 421701D\v15\RH.exe infected by "not-a-virus:AdWare.SmartPops" Virus.
C:\_RESTORE\TEMP\A0023851.CPY infected by "not-a-virus:AdWare.IGetNet" Virus.
C:\_RESTORE\TEMP\A0023852.CPY infected by "not-a-virus:AdWare.WindowEnhancer" Virus.
C:\_RESTORE\TEMP\A0023855.CPY infected by "not-a-virus:AdWare.Gator.6041" Virus.
C:\_RESTORE\TEMP\A0023856.CPY infected by "not-a-virus:AdWare.Gator.6041" Virus.
C:\_RESTORE\TEMP\A0023857.CPY infected by "not-a-virus:AdWare.Gator.6041" Virus.
C:\_RESTORE\TEMP\A0023858.CPY infected by "not-a-virus:AdWare.Gator.5017" Virus.
C:\_RESTORE\TEMP\A0023859.CPY infected by "not-a-virus:AdWare.Gator.6041" Virus.
C:\_RESTORE\TEMP\A0023860.CPY infected by "not-a-virus:AdWare.Gator.6034" Virus.
C:\_RESTORE\TEMP\A0023861.CPY infected by "not-a-virus:AdWare.Gator.6041" Virus.
C:\_RESTORE\TEMP\A0023862.CPY infected by "not-a-virus:AdWare.Gator.6041" Virus.
C:\_RESTORE\TEMP\A0023870.CPY infected by "not-a-virus:AdWare.WindowEnhancer" Virus.
C:\_RESTORE\TEMP\A0023871.CPY infected by "not-a-virus:AdWare.Gator.6041" Virus.
Sun Feb 06 20:46:37 2005 => File C:\_RESTORE\TEMP\A0023872.CPY infected by "not-a-virus:AdWare.Gator.6034" Virus.
C:\_RESTORE\TEMP\A0023873.CPY infected by "not-a-virus:AdWare.Gator.6041" Virus.
C:\_RESTORE\TEMP\A0023874.CPY infected by "not-a-virus:AdWare.Gator.6041" Virus.
C:\_RESTORE\TEMP\A0023875.CPY infected by "not-a-virus:AdWare.Gator.3124" Virus.
C:\_RESTORE\TEMP\A0023876.CPY infected by "not-a-virus:AdWare.Gator.6041" Virus.
C:\_RESTORE\TEMP\A0023877.CPY infected by "not-a-virus:AdWare.Gator.6041" Virus.
C:\_RESTORE\TEMP\A0023878.CPY infected by "not-a-virus:AdWare.Gator.6041" Virus.
C:\_RESTORE\TEMP\A0023879.CPY infected by "not-a-virus:AdWare.Gator.6041" Virus.
C:\_RESTORE\TEMP\A0023880.CPY infected by "not-a-virus:AdWare.Gator.6041" Virus.
C:\_RESTORE\TEMP\A0023881.CPY infected by "not-a-virus:AdWare.Gator.6041" Virus.
C:\_RESTORE\TEMP\A0023882.CPY infected by "not-a-virus:AdWare.Gator.6041" Virus.
C:\_RESTORE\TEMP\A0023885.CPY infected by "not-a-virus:AdWare.WindowEnhancer" Virus.
C:\_RESTORE\TEMP\A0023886.CPY infected by "not-a-virus:AdWare.WindowEnhancer" Virus.
C:\_RESTORE\TEMP\A0023887.CPY infected by "not-a-virus:AdWare.WindowEnhancer" Virus.
C:\_RESTORE\TEMP\A0023888.CPY infected by "not-a-virus:AdWare.WindowEnhancer" Virus.
C:\_RESTORE\TEMP\A0016085.CPY infected by "not-a-virus:AdWare.DownloadWare" Virus.
C:\_RESTORE\TEMP\A0016089.CPY infected by "not-a-virus:PornWare.Dialer.Lagoon" Virus.
C:\_RESTORE\TEMP\A0017395.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0017397.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0017399.CPY infected by "not-a-virus:AdWare.BargainBuddy.a" Virus.
C:\_RESTORE\TEMP\A0017401.CPY infected by "not-a-virus:AdWare.TopMoxie.a" Virus.
C:\_RESTORE\TEMP\A0017418.CPY infected by "Trojan-Downloader.Win32.Small.fo" Virus.
Sun Feb 06 20:49:02 2005 => File C:\_RESTORE\TEMP\A0017914.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0017995.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0019176.CPY infected by "not-a-virus:AdWare.SmartPops" Virus.
C:\_RESTORE\TEMP\A0019185.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0019682.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0019686.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0019757.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0019772.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0019776.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0019780.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0019799.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0019803.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0019909.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0019913.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0019992.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
Sun Feb 06 20:49:31 2005 => File C:\_RESTORE\TEMP\A0019996.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0020009.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0020013.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0020067.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0020089.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0020117.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0020121.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0020151.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0020155.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0020462.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0020466.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0020525.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0020529.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0020613.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0020617.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0020629.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0020633.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0020756.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0020760.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0022740.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0022744.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0022748.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0022752.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0023751.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\TEMP\A0023755.CPY infected by "not-a-virus:AdWare.Gator.a" Virus.
C:\_RESTORE\ARCHIVE\FS1.CAB infected by "not-a-virus:AdWare.SaveNow.t" Virus.
C:\_RESTORE\ARCHIVE\FS77.CAB infected by "Trojan.Win32.Dialer.av" Virus.
C:\_RESTORE\ARCHIVE\FS78.CAB infected by "not-a-virus:AdWare.Cydoor" Virus.
C:\_RESTORE\ARCHIVE\FS106.CAB infected by "not-a-virus:AdWare.Gator.3202" Virus.
C:\_RESTORE\ARCHIVE\FS108.CAB infected by "not-a-virus:AdWare.Gator.3202" Virus.
C:\_RESTORE\ARCHIVE\FS157.CAB infected by "not-a-virus:AdWare.Gator.5115" Virus.
C:\Program Files\HijackThis\backups\backup-20050206-190034-357.dll infected by "not-a-virus:AdWare.IGetNet" Virus.
C:\Program Files\HijackThis\backups\backup-20050206-190034-555.dll infected by "not-a-virus:AdWare.WindowEnhancer" Virus.

....danke!
kati

@kati309
diese dateien auf diskette sichern zwecks beweismittel, sind dialer
C:\WINDOWS\Coder\_233-TAT-1-0-.exe infected by "not-a-virus:PornWare.Dialer.Generic" Virus.
C:\_RESTORE\TEMP\A0016089.CPY infected by "not-a-virus:PornWare.Dialer.Lagoon" Virus.

du hast ja einiges im system
deaktiviere die systemwiederherstellung.

lade LSP-Fix download
lade spybot download
update spybot
lade adaware download
update adaware
lade clearprog bei www.clearprog.de
deinstalliere über systemsteuerung, software, den eintrag NewDotNet, NewNet oder ähnliches

wechsle in den abgesicherten modus,
lasse spybot scannen, alles löschen was es vorschlägt.(DSO Exploit löscht es nicht, ist nicht tragisch)
lasse adaware scannen
alles löschen was es findet.
clearprog laufen lassen, alle häkchen bei windows und IE setzen, alles löschen

diese dateien manuell löschen
C:\Program Files\HijackThis\backups\backup-20050206-190034-357.dll infected by "not-a-virus:AdWare.IGetNet" Virus.
C:\Program Files\HijackThis\backups\backup-20050206-190034-555.dll infected by "not-a-virus:AdWare.WindowEnhancer" Virus.
C:\WINDOWS\RSP001~1.DAT infected by "not-a-virus:AdWare.IGetNet" Virus.
C:\WINDOWS\newdotnet3_36.dll infected by "not-a-virus:AdWare.NewDotNet" Virus.
C:\WINDOWS\SYSTEM\RSP001.DLL infected by "not-a-virus:AdWare.IGetNet" Virus.
C:\WINDOWS\SYSTEM\Install_All.DLL infected by "not-a-virus:AdWare.IGetNet.b" Virus.
File C:\WINDOWS\SYSTEM\Update_com.DLL infected by "not-a-virus:AdWare.IGetNet" Virus.
File C:\WINDOWS\SYSTEM\RSP001.DLL infected by "not-a-virus:AdWare.IGetNet" Virus.
File C:\WINDOWS\SYSTEM\Install_All.DLL infected by "not-a-virus:AdWare.IGetNet.b" Virus.
File C:\WINDOWS\SYSTEM\Update_com.DLL infected by "not-a-virus:AdWare.IGetNet" Virus.
C:\WINDOWS\Anwendungsdaten\Mozilla\Profiles\defaul t\mg274aky.slt\Mail\mail.kawo1.rwh-aachen.de\Trash infected by "Exploit.HTML.FileDownload" Virus.
C:\WINDOWS\RSP001~1.DAT infected by "not-a-virus:AdWare.IGetNet" Virus.
C:\WINDOWS\newdotnet3_36.dll infected by "not-a-virus:AdWare.NewDotNet" Virus.
C:\WINDOWS\Coder\_233-TAT-1-0-.exe infected by "not-a-virus:PornWare.Dialer.Generic" Virus.
C:\Programme\Twister\TwisterInstall.exe infected by "not-a-virus:AdWare.SaveNow.e" Virus.
C:\Programme\DownloadWare\Downloads\151.dat infected by "not-a-virus:AdWare.WindowEnhancer" Virus.
C:\Programme\DownloadWare\Downloads\205.dat infected by "not-a-virus:AdWare.WindowEnhancer" Virus.
C:\Programme\DownloadWare\Downloads\217.dat infected by "not-a-virus:AdWare.WindowEnhancer" Virus.
C:\Programme\DownloadWare\Downloads\201.dat infected by "not-a-virus:AdWare.SmartPops" Virus.
C:\WINDOWS\Coder\_233-TAT-1-0-.exe infected by "not-a-virus:PornWare.Dialer.Generic" Virus.
C:\_RESTORE\TEMP\A0016089.CPY infected by "not-a-virus:PornWare.Dialer.Lagoon" Virus.

neu booten, systemwiederherstellung aktivieren.
ich würde mich an deiner stell mal gedanken machen über dein surfverhaltenund deine systemsicherheit.

chaosman