Bitte um Hilfe. Logfile anbei

blint

Ich würde mich wahnsinnig freuen, wenn mir jemand bei der Auswertung der Logfiles und der Systembereinigung helfen könnte. Anbei finden sich die Logfiles von eScan und Hijack aus dem abgesicherten Modus.

Was ich gerne wissen möchte ist:
Welche Dateien sind wirklich "schädlich"?
Was muss ich beim Löschvorgang beachten?
im abgesciherten Modus? muss ich die Systemwiederherstellung
deaktivieren? kann ich das nach Anleitung dieses Links machen auch wenn ich WIndows ME habe: http://www.bsi.bund.de/av/texte/wiederher_xp.htm ?
sind die datein ["not-a-virus:AdWare.Msnagent.a" Virus] wirklich vom messenger, braucht der die, kann/soll man die auch löschen?

bin relativ unbedarft und ohne ahnung, für jede hilfe sehr sehr dankbar

blint

Hijack:
Logfile of HijackThis v1.99.1
Scan saved at 21:18:50, on 03.04.2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\PCHEALTH\HELPCTR\BINARIES\HELPCTR.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\DESKTOP\VIRENDEN\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = http://targetclicks.net/srch.php?qq=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=www-proxy.t-online.de:80;ftp=ftp-proxy.t-online.de:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.t-online.de;localhost;<local>
R3 - URLSearchHook: (no name) - {8B3C0ACD-B93D-C03B-2136-4DB437A94647} - forces_elite.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMME\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: Name - {5AF7ED72-5EBC-4997-8D30-42228A872C97} - C:\WINDOWS\SYSTEM\MSRKH.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar1.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: Name - {F3FB7EFC-6108-403D-BA33-ABA92DB6D65A} - C:\WINDOWS\SYSTEM\MSRKH.DLL
O2 - BHO: Name - {45A523F8-FF82-482B-BC56-613F1F40567D} - C:\WINDOWS\SYSTEM\MSRKH.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Adaptec DirectCD] C:\Programme\DirectCD\DIRECTCD.EXE
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\PROGRAMME\AVPERSONAL\AVGCTRL.EXE /min
O4 - HKLM\..\Run: [WhatsNewBot] bhoserv.exe
O4 - HKLM\..\Run: [ERTYDF] MSTCPDLL.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKCU\..\Run: [WareOut] "C:\Programme\WareOut\WareOut.exe"
O4 - HKCU\..\Run: [34763] AppMasterCenter.exe
O4 - HKCU\..\Run: [zantu] hyandex.exe
O4 - HKCU\..\Run: [WinInitDll] WinInitDll.exe
O4 - Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Startup: Corel MEDIA FOLDERS INDEXER 8.LNK = C:\Programme\Corel\Graphics8\Programs\MFIndexer.exe
O4 - Startup: Sitecom WLAN Client Utility.lnk = C:\Programme\Sitecom\Sitecom WLAN\WLANUTL.exe
O4 - Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://C:\PROGRAMME\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html
O8 - Extra context menu item: Im Cache gespeicherte Seite - res://C:\PROGRAMME\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html
O8 - Extra context menu item: Ähnliche Seiten - res://C:\PROGRAMME\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html
O8 - Extra context menu item: Verweisseiten - res://C:\PROGRAMME\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O14 - IERESET.INF: START_PAGE_URL=http://www.t-online.de/service/redir/ie_t-online.htm
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com...43/yacscom.cab

eScan:
File C:\WINDOWS\SYSTEM\MSRKH.DLL infected by "Trojan-Downloader.Win32.Murlo.f" Virus. Action Taken: No Action Taken.
File System Found infected by "Alexa Spyware/Adware" Virus. Action Taken: No Action Taken.
File System Found infected by "180Solutions Spyware/Adware" Virus. Action Taken: No Action Taken.
File System Found infected by "VX2 Spyware/Adware" Virus. Action Taken: No Action Taken.
File System Found infected by "VB and VBA Program Settings Spyware/Adware" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM\dosxpd.exe infected by "not-a-virus:AdWare.Msnagent.a" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM\audissrp.exe infected by "Trojan-Clicker.Win32.Agent.cn" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM\fixmapirs.exe infected by "not-a-virus:AdWare.FindSpy.a" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM\autodmfp.exe infected by "Trojan-Dropper.Win32.Agent.gp" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM\docntrop.dll infected by "Trojan.Win32.StartPage.sl" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM\chkntfsfat.exe infected by "Trojan.Win32.StartPage.vt" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM\sprmove.exe infected by "Trojan-Dropper.Win32.Agent.hy" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM\dwcrnt.exe infected by "HackTool.Win32.Hidd.h" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM\fixdisk32.exe infected by "Trojan-Downloader.Win32.Agent.lf" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0004662.CPY infected by "Trojan-Downloader.Win32.Agent.lf" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0004734.CPY infected by "Trojan-Downloader.Win32.Agent.lf" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0004740.CPY infected by "not-a-virus:AdWare.Msnagent.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0004741.CPY infected by "Trojan-Clicker.Win32.Agent.cn" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0004742.CPY infected by "not-a-virus:AdWare.FindSpy.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0005844.CPY infected by "Trojan-Downloader.Win32.Agent.lf" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0005926.CPY infected by "Trojan-Downloader.Win32.Agent.lf" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0005940.CPY infected by "not-a-virus:AdWare.Msnagent.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0005941.CPY infected by "Trojan-Clicker.Win32.Agent.cn" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0005942.CPY infected by "not-a-virus:AdWare.FindSpy.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0005943.CPY infected by "not-a-virus:AdWare.Msnagent.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0005944.CPY infected by "Trojan-Clicker.Win32.Agent.cn" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0005945.CPY infected by "not-a-virus:AdWare.FindSpy.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0005947.CPY infected by "not-a-virus:AdWare.Msnagent.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0005948.CPY infected by "Trojan-Clicker.Win32.Agent.cn" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0005949.CPY infected by "not-a-virus:AdWare.FindSpy.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0005956.CPY infected by "Trojan-Downloader.Win32.Agent.lf" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0005991.CPY infected by "Trojan-Downloader.Win32.Agent.lf" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0006004.CPY infected by "not-a-virus:AdWare.Msnagent.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0006005.CPY infected by "Trojan-Clicker.Win32.Agent.cn" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0006006.CPY infected by "not-a-virus:AdWare.FindSpy.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0006125.CPY infected by "Trojan-Downloader.Win32.Agent.lf" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0006126.CPY infected by "not-a-virus:AdWare.Msnagent.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0006127.CPY infected by "Trojan-Clicker.Win32.Agent.cn" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0006128.CPY infected by "not-a-virus:AdWare.FindSpy.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0006136.CPY infected by "not-a-virus:AdWare.Msnagent.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0006137.CPY infected by "Trojan-Clicker.Win32.Agent.cn" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0006138.CPY infected by "not-a-virus:AdWare.FindSpy.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0006163.CPY infected by "not-a-virus:AdWare.Msnagent.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0006164.CPY infected by "Trojan-Clicker.Win32.Agent.cn" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0006165.CPY infected by "not-a-virus:AdWare.FindSpy.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0006172.CPY infected by "not-a-virus:AdWare.Msnagent.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0006173.CPY infected by "Trojan-Clicker.Win32.Agent.cn" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0006174.CPY infected by "not-a-virus:AdWare.FindSpy.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0006294.CPY infected by "not-a-virus:AdWare.Msnagent.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0006295.CPY infected by "Trojan-Clicker.Win32.Agent.cn" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0006296.CPY infected by "not-a-virus:AdWare.FindSpy.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0006319.CPY infected by "not-a-virus:AdWare.Msnagent.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0006320.CPY infected by "Trojan-Clicker.Win32.Agent.cn" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0006321.CPY infected by "not-a-virus:AdWare.FindSpy.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0006322.CPY infected by "not-a-virus:AdWare.Msnagent.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0006323.CPY infected by "Trojan-Clicker.Win32.Agent.cn" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0006324.CPY infected by "not-a-virus:AdWare.FindSpy.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0006357.CPY infected by "not-a-virus:AdWare.Msnagent.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0006358.CPY infected by "Trojan-Clicker.Win32.Agent.cn" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\TEMP\A0006359.CPY infected by "not-a-virus:AdWare.FindSpy.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\ARCHIVE\FS5.CAB infected by "not-a-virus:AdWare.Msnagent.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\ARCHIVE\FS10.CAB infected by "not-a-virus:AdWare.Msnagent.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\ARCHIVE\FS11.CAB infected by "not-a-virus:AdWare.Msnagent.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\ARCHIVE\FS12.CAB infected by "not-a-virus:AdWare.Msnagent.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\ARCHIVE\FS13.CAB infected by "not-a-virus:AdWare.Msnagent.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\ARCHIVE\FS14.CAB infected by "not-a-virus:AdWare.Msnagent.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\ARCHIVE\FS22.CAB infected by "not-a-virus:AdWare.Msnagent.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\ARCHIVE\FS23.CAB infected by "not-a-virus:AdWare.Msnagent.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\ARCHIVE\FS24.CAB infected by "not-a-virus:AdWare.Msnagent.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\ARCHIVE\FS26.CAB infected by "not-a-virus:AdWare.Msnagent.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\ARCHIVE\FS40.CAB infected by "Trojan-Downloader.Win32.Agent.lf" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\ARCHIVE\FS41.CAB infected by "Trojan-Downloader.Win32.Agent.lf" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\ARCHIVE\FS42.CAB infected by "Trojan-Downloader.Win32.Agent.lf" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\ARCHIVE\FS21.CAB infected by "not-a-virus:AdWare.Msnagent.a" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM\dosxpd.exe infected by "not-a-virus:AdWare.Msnagent.a" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM\audissrp.exe infected by "Trojan-Clicker.Win32.Agent.cn" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM\fixmapirs.exe infected by "not-a-virus:AdWare.FindSpy.a" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM\autodmfp.exe infected by "Trojan-Dropper.Win32.Agent.gp" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM\docntrop.dll infected by "Trojan.Win32.StartPage.sl" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM\chkntfsfat.exe infected by "Trojan.Win32.StartPage.vt" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM\sprmove.exe infected by "Trojan-Dropper.Win32.Agent.hy" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM\dwcrnt.exe infected by "HackTool.Win32.Hidd.h" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM\fixdisk32.exe infected by "Trojan-Downloader.Win32.Agent.lf" Virus. Action Taken: No Action Taken.
File C:\Programme\AVPersonal\INFECTED\FC0C6C8C.0C7 infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.
File C:\Programme\AVPersonal\INFECTED\6A4BA5BC.098 infected by "Trojan.Win32.StartPage.fw" Virus. Action Taken: No Action Taken.
File C:\Programme\AVPersonal\INFECTED\9345620F.1D1 infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.
File C:\Programme\AVPersonal\INFECTED\3ADD7F1C.26C infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.
File C:\Programme\AVPersonal\INFECTED\F42B6830.19B infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.
File C:\Programme\AVPersonal\INFECTED\A5581036.147 infected by "HackTool.Win32.Hidd.h" Virus. Action Taken: No Action Taken.
File C:\Programme\AVPersonal\INFECTED\728D3794.351 infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.
File C:\Programme\AVPersonal\INFECTED\EDE71CDE.081 infected by "HackTool.Win32.Hidd.h" Virus. Action Taken: No Action Taken.
File C:\Programme\AVPersonal\INFECTED\4CC0D898.125 infected by "HackTool.Win32.Hidd.h" Virus. Action Taken: No Action Taken.
File C:\Programme\AVPersonal\INFECTED\1823D5A2.3CB infected by "HackTool.Win32.Hidd.h" Virus. Action Taken: No Action Taken.
File C:\Recycled\Dc88\wocount.exe infected by "Trojan-Dropper.Win32.Agent.hy" Virus. Action Taken: No Action Taken.