Wahrscheinlich ist dieser Computer schon so zerfressen, dass man ihn neu installieren musste. Doch das ist leider nicht möglich, da das nicht mein Comp ist, sondern eine Leihgabe von meiner Praktikantenstelle. Also möchte ich nicht unbedingt dorthin gehen und sagen "hey, euer computer hat n paar viren und troyaner. Macht ma format C://

Bitte dringendst um Hilfe
hier die Logfile

Logfile of HijackThis v1.99.1
Scan saved at 15:28:33, on 30.3.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\AVPersonal\AVGUARD.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Schönherr Personal Firewall\driver\spfirewallsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\carpserv.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\System32\rpcnet32.exe
C:\Program Files\Schönherr Personal Firewall\bin\sppfw.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\ALGU.EXE
C:\WINDOWS\System32\SPOOLSV32.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Don Razaghi\Desktop\HijackThis1991.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://default.home
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default.home
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://saunalahti.fi
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll
O2 - BHO: ATDP Class - {E3D3AFEE-2172-4ef5-8509-1638AFFF0374} - C:\WINDOWS\atlass.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Cryptographic Service] C:\WINDOWS\System32\xskqhwm.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [zufoltxl] c:\windows\system32\zufoltxl.exe
O4 - HKLM\..\Run: [Protocol Settings] rpcnet32.exe
O4 - HKLM\..\Run: [sixtysix] C:\WINDOWS\sixtypopsix.exe
O4 - HKLM\..\Run: [Securepoint Personal Firewall] "C:\Program Files\Schönherr Personal Firewall\bin\sppfw.exe"
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [ap9h4qmo] C:\WINDOWS\System32\ap9h4qmo.exe
O4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\RunServices: [System] mah.exe
O4 - HKLM\..\RunServices: [Protocol Settings] rpcnet32.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [System] mah.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Protocol Settings] rpcnet32.exe
O4 - HKCU\..\Run: [ALGU] C:\WINDOWS\System32\ALGU.EXE
O4 - HKCU\..\Run: [SPOOLSV32] C:\WINDOWS\System32\SPOOLSV32.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {E3DC627E-C207-4BA5-8C69-1403B72DDEB9} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {E3DC627E-C207-4BA5-8C69-1403B72DDEB9} - (no file) (HKCU)
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{21472284-23EB-48C4-AF54-AF48036A2E86}: NameServer = 69.50.176.197,195.225.176.31
O17 - HKLM\System\CCS\Services\Tcpip\..\{306587A8-0737-46AD-8174-6F8F9BBFBD9C}: NameServer = 69.50.176.197 195.225.176.31
O17 - HKLM\System\CCS\Services\Tcpip\..\{A75E8502-B36E-4541-9BB5-D88E6777CD71}: NameServer = 69.50.176.197,195.225.176.31
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O21 - SSODL: Web Event Logger - {79FEACFF-FFCE-815E-A900-316290B5B738} - C:\WINDOWS\System32\Jieieaad.dll (file missing)
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Hardware Clock Driver (hwclock) - Conexant Systems - (no file)
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Unknown owner - C:\Program Files\Norton AntiVirus\navapsvc.exe (file missing)
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: ScriptBlocking Service (SBService) - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Securepoint Personal Firewall (spfirewallsvc) - Securepoint Latinoamerica S.A. de C.V. - C:\Program Files\Schönherr Personal Firewall\driver\spfirewallsvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

Nachtrag von mir:
Auffällig finde eine Datei namens ATLAS.dll die bei jedem Antivir-scan gefunden und gelöscht wird aber immer wieder erscheint. Auch manuell hab ichs schon versucht, nach 2 sek ist das ding wieder da.

Ausserdem hatte ich starke probleme mit dem IE.
er hat die startseite nicht aufgerufen und immer ne viruswarnung gebracht...ja logisch, aber was tun. Irgendwie hab ichs trotzdem geschafft, wieder ins netz zu kommen.

Hab mal diesen escan geladen und getestet
hier die errschreckende wahrheit:

Wed Mar 30 18:44:00 2005 => Total Objects Scanned: 46345
Wed Mar 30 18:44:00 2005 => Total Virus(es) Found: 98
Wed Mar 30 18:44:00 2005 => Total Disinfected Files: 0
Wed Mar 30 18:44:00 2005 => Total Files Renamed: 0
Wed Mar 30 18:44:00 2005 => Total Deleted Objects: 0
Wed Mar 30 18:44:00 2005 => Total Errors: 4
Wed Mar 30 18:44:00 2005 => Time Elapsed: 00:49:53
Wed Mar 30 18:44:00 2005 => Virus Database Date: 2005/03/30
Wed Mar 30 18:44:00 2005 => Virus Database Count: 124022

hier noch die betroffenen dateien:

File C:\WINDOWS\System32\rpcnet32.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\ALGU.EXE infected by "Trojan-Dropper.Win32.Small.vb" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\SPOOLSV32.EXE infected by "Trojan-Dropper.Win32.Small.vb" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\atlass.dll infected by "Trojan-Downloader.Win32.Small.aai" Virus. Action Taken: No Action Taken.
File System Found infected by "SideFind Spyware/Adware" Virus. Action Taken: No Action Taken.
File System Found infected by "Alexa Spyware/Adware" Virus. Action Taken: No Action Taken.
File System Found infected by "180Solutions Spyware/Adware" Virus. Action Taken: No Action Taken.
File System Found infected by "VX2 Spyware/Adware" Virus. Action Taken: No Action Taken.
File System Found infected by "ameopt Spyware/Adware" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\a95kfrhe.exe infected by "not-a-virus:AdWare.Sahat.o" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\ATLASSUI.exe infected by "Trojan.Win32.StartPage.ig" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\ceres.dll infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\msxmidi.exe infected by "Trojan-Dropper.Win32.Small.vb" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\sideb.exe infected by "not-a-virus:AdWare.ToolBar.EliteBar.z" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\unstall.exe infected by "not-a-virus:AdWare.MediaMotor.c" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\63mm.exe infected by "not-a-virus:AdWare.MediaMotor.a" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\cpdst2.exe infected by "Trojan-Dropper.Win32.Juntador.c" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\dosxpd.exe infected by "not-a-virus:AdWare.Msnagent.a" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\fixmapirs.exe infected by "not-a-virus:AdWare.FindSpy.a" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\gamma.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\hochkaod3.exe infected by "not-a-virus:AdWare.Sahat.o" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\loudc.exe infected by "not-a-virus:AdWare.WinAD.ab" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\q17i9a4j.exe infected by "not-a-virus:AdWare.Sahat.o" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\r.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\DONRAZ~1\LOCALS~1\Temp\drp12.tmp\thnall2c.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\DONRAZ~1\LOCALS~1\Temp\temp.fr96D7\EliteToolBar version 60.dll infected by "not-a-virus:AdWare.ToolBar.EliteBar.af" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\DONRAZ~1\LOCALS~1\Temp\temp.frF7C9 infected by "Trojan.Win32.Agent.ay" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\DONRAZ~1\LOCALS~1\Temp\THI1EDE.tmp\ceres.cab infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\DONRAZ~1\LOCALS~1\Temp\THI1EDE.tmp\ceres.dll infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\DONRAZ~1\LOCALS~1\Temp\THI2509.tmp\elitetrp.exe infected by "not-a-virus:AdWare.ToolBar.EliteBar.ac" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\DONRAZ~1\LOCALS~1\Temp\THI26E5.tmp\farmmext.cab infected by "Trojan-Downloader.Win32.Stubby.c" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\DONRAZ~1\LOCALS~1\Temp\THI3C4A.tmp\farmmext.cab infected by "Trojan-Downloader.Win32.Stubby.c" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\DONRAZ~1\LOCALS~1\Temp\THI6C8.tmp\Ceres.dll infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\DONRAZ~1\LOCALS~1\Temp\THI6C8.tmp\csnopol.cab infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\DONRAZ~1\LOCALS~1\TEMPOR~1\Content.IE5\ODQRO163\sideb[1].exe infected by "not-a-virus:AdWare.ToolBar.EliteBar.z" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\DONRAZ~1\LOCALS~1\TEMPOR~1\Content.IE5\SH6JK9EJ\sideb[1].exe infected by "not-a-virus:AdWare.ToolBar.EliteBar.z" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\DONRAZ~1\LOCALS~1\TEMPOR~1\Content.IE5\STAJ8HMN\tb[1].txt infected by "not-a-virus:AdWare.ToolBar.ToolBand.a" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Don Razaghi\Local Settings\Temp\drp12.tmp\thnall2c.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Don Razaghi\Local Settings\Temp\temp.fr96D7\EliteToolBar version 60.dll infected by "not-a-virus:AdWare.ToolBar.EliteBar.af" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Don Razaghi\Local Settings\Temp\temp.frF7C9 infected by "Trojan.Win32.Agent.ay" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Don Razaghi\Local Settings\Temp\THI1EDE.tmp\ceres.cab infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Don Razaghi\Local Settings\Temp\THI1EDE.tmp\ceres.dll infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Don Razaghi\Local Settings\Temp\THI2509.tmp\elitetrp.exe infected by "not-a-virus:AdWare.ToolBar.EliteBar.ac" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Don Razaghi\Local Settings\Temp\THI26E5.tmp\farmmext.cab infected by "Trojan-Downloader.Win32.Stubby.c" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Don Razaghi\Local Settings\Temp\THI3C4A.tmp\farmmext.cab infected by "Trojan-Downloader.Win32.Stubby.c" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Don Razaghi\Local Settings\Temp\THI6C8.tmp\Ceres.dll infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Don Razaghi\Local Settings\Temp\THI6C8.tmp\csnopol.cab infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Don Razaghi\Local Settings\Temporary Internet Files\Content.IE5\ODQRO163\sideb[1].exe infected by "not-a-virus:AdWare.ToolBar.EliteBar.z" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Don Razaghi\Local Settings\Temporary Internet Files\Content.IE5\SH6JK9EJ\sideb[1].exe infected by "not-a-virus:AdWare.ToolBar.EliteBar.z" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Don Razaghi\Local Settings\Temporary Internet Files\Content.IE5\STAJ8HMN\tb[1].txt infected by "not-a-virus:AdWare.ToolBar.ToolBand.a" Virus. Action Taken: No Action Taken.
File C:\Program Files\AVPersonal\INFECTED\ATLASS.DLL.VIR infected by "Trojan-Downloader.Win32.Small.aai" Virus. Action Taken: No Action Taken.
File C:\Program Files\AVPersonal\INFECTED\farmmext.VIR infected by "Trojan-Downloader.Win32.Stubby.c" Virus. Action Taken: No Action Taken.
File C:\Program Files\AVPersonal\INFECTED\optimize.VIR infected by "Trojan-Downloader.Win32.Dyfuca.du" Virus. Action Taken: No Action Taken.
File C:\Program Files\AVPersonal\INFECTED\sixtypopsix.VIR infected by "Trojan.Win32.LowZones.am" Virus. Action Taken: No Action Taken.
File C:\Program Files\AVPersonal\INFECTED\SVSS32.EXE.VIR infected by "Backdoor.Win32.SdBot.gen" Virus. Action Taken: No Action Taken.
File C:\Program Files\AVPersonal\INFECTED\SVSS32.VIR infected by "Backdoor.Win32.SdBot.gen" Virus. Action Taken: No Action Taken.
File C:\Program Files\AVPersonal\INFECTED\SVSS32.VIR00 infected by "Backdoor.Win32.SdBot.gen" Virus. Action Taken: No Action Taken.
File C:\Program Files\Media Access\MediaAccC.dll infected by "not-a-virus:AdWare.WiAD.af" Virus. Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-725345543-1580436667-1343024091-1003\Dc19.exe infected by "Trojan.Win32.StartPage.ig" Virus. Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-725345543-1580436667-1343024091-1003\Dc20.exe infected by "Trojan.Win32.StartPage.ig" Virus. Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-725345543-1580436667-1343024091-1003\Dc21.exe infected by "Trojan.Win32.StartPage.ig" Virus. Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-725345543-1580436667-1343024091-1003\Dc22.exe infected by "Trojan.Win32.StartPage.ig" Virus. Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-725345543-1580436667-1343024091-1003\Dc23.exe infected by "Trojan.Win32.StartPage.ig" Virus. Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-725345543-1580436667-1343024091-1003\Dc24.exe infected by "Trojan.Win32.StartPage.ig" Virus. Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-725345543-1580436667-1343024091-1003\Dc25.exe infected by "Trojan.Win32.StartPage.ig" Virus. Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-725345543-1580436667-1343024091-1003\Dc26.exe infected by "Trojan.Win32.StartPage.ig" Virus. Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-725345543-1580436667-1343024091-1003\Dc27.exe infected by "Trojan.Win32.StartPage.ig" Virus. Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-725345543-1580436667-1343024091-1003\Dc28.exe infected by "Trojan.Win32.StartPage.ig" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\a95kfrhe.exe infected by "not-a-virus:AdWare.Sahat.o" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\ATLASSUI.exe infected by "Trojan.Win32.StartPage.ig" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\ceres.dll infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\msxmidi.exe infected by "Trojan-Dropper.Win32.Small.vb" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\sideb.exe infected by "not-a-virus:AdWare.ToolBar.EliteBar.z" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\63mm.exe infected by "not-a-virus:AdWare.MediaMotor.a" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8OPX80Z0\istdownload[2].exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\cpdst2.exe infected by "Trojan-Dropper.Win32.Juntador.c" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\dosxpd.exe infected by "not-a-virus:AdWare.Msnagent.a" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\fixmapirs.exe infected by "not-a-virus:AdWare.FindSpy.a" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\gamma.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\hochkaod3.exe infected by "not-a-virus:AdWare.Sahat.o" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\loudc.exe infected by "not-a-virus:AdWare.WinAD.ab" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\q17i9a4j.exe infected by "not-a-virus:AdWare.Sahat.o" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\r.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\Temp\12214533.dll infected by "not-a-virus:AdWare.ToolBar.EliteBar.z" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\Temp\17693902.dll infected by "not-a-virus:AdWare.ToolBar.EliteBar.z" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\Temp\954272.dll infected by "not-a-virus:AdWare.ToolBar.EliteBar.af" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\Temp\drivestats.exe infected by "not-a-virus:AdWare.WiAD.af" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\Temp\fbYbEjj.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\Temp\gamssiteA.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\Temp\mm_reco.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\Temp\THI24DF.tmp\Ceres.dll infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\Temp\THI24DF.tmp\csnopol.cab infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\Temp\THI34B4.tmp\farmmext.cab infected by "Trojan-Downloader.Win32.Stubby.c" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\Temp\THI477B.tmp\ceres.cab infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\Temp\THI477B.tmp\ceres.dll infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\Temp\THI625F.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\Temp\THI71A6.tmp\farmmext.cab infected by "Trojan-Downloader.Win32.Stubby.c" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\unstall.exe infected by "not-a-virus:AdWare.MediaMotor.c" Virus. Action Taken: No Action Taken.

Was schlagt ihr als nächsten schritt vor, was kann ich tun
Bitte helft mir, ich weis nich weiter, leider kenn ich mich ja auch nicht besonders gut aus mit dem zeug und bin auf hilfe angewiesen

Danke schon mal

Clone

@ clone

C:\WINDOWS\System32\rpcnet32.exe infected by "Backdoor.Win32.Rbot.gen"
schon alleine der sagt das hier neu aufgesetzt werden muss.

Zitat von Sophos

http://www.sophos.de/virusinfo/analyses/w32rbotpe.html

Doch das ist leider nicht möglich, da das nicht mein Comp ist, sondern eine Leihgabe von meiner Praktikantenstelle. Also möchte ich nicht unbedingt dorthin gehen und sagen "hey, euer computer hat n paar viren und troyaner. Macht ma format C://

Wenn Du den Rechner so von der Praktikantenstelle bekommen hast, dann sollte es doch kein Problem den bereinigen zu lassen. Wenn er natürlich sauber war dann hast Du wahrscheinlich ein Problem.
Meine Empfehlung hier ist Neuaufsetzen, hier die hilfe dazu http://www.trojaner-board.de/showpos...28&postcount=2