Hallo zusammen,

ich denk mal habe nen Trojaner erwischt.. Bei mir hat sich die Startseite komplett verändert, und wenn ich im internet bin, trennt sich meine verbindung...

Hier habt ihr schon mal meine HijackThis Log file..

Logfile of HijackThis v1.99.1
Scan saved at 21:25:36, on 10.04.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\GEMEIN~1\aol\ACS\AOLacsd.exe
C:\WINDOWS\System32\gearsec.exe
C:\Programme\Norton AntiVirus\navapsvc.exe
C:\Programme\Norton AntiVirus\SAVScan.exe
C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Programme\Java\j2re1.4.2_03\bin\jusched.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\Synaptics\SynTP\SynTPLpr.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\HP\Digital Imaging\Unload\hpqcmon.exe
C:\Programme\HP\HP Share-to-Web\hpgs2wnd.exe
C:\Programme\iPod\bin\iPodService.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\Programme\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Programme\HP\hpcoretech\hpcmpmgr.exe
C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLDial.exe
C:\Programme\ISTsvc\istsvc.exe
C:\WINDOWS\sredrbko.exe
C:\Dokumente und Einstellungen\nedim sierif\Internet Optimizer\optimize.exe
C:\Programme\HP\HP Share-to-Web\hpgs2wnf.exe
C:\Programme\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\PROGRA~1\COMMON~1\kfrr\kfrrm.exe
C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\ISW\alice\signup\Tray.exe
C:\Programme\WebSiteViewer\127703.dlr
C:\WINDOWS\System32\taskmgr.exe
C:\Dokumente und Einstellungen\nedim sierif\Lokale Einstellungen\Temp\Temporäres Verzeichnis 2 für hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TY...lion&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.jimbutt.com/stuffs/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY...lion&pf=laptop
R3 - URLSearchHook: transURL Class - {C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70} - C:\WINDOWS\System32\SEARCH~1.DLL (file missing)
O1 - Hosts: 60.50.170.0
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {A0269420-A638-4509-889C-8FC3CC85DA7E} - C:\WINDOWS\drexinit.dll
O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - C:\Programme\SideFind\sfbho.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: ISTbar - {FAA356E4-D317-42a6-AB41-A3021C6E7D52} - C:\Programme\ISTbar\istbarcm.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Cpqset] C:\Programme\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Programme\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Programme\Gemeinsame Dateien\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Programme\HP\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Programme\HP\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Programme\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programme\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [IST Service] C:\Programme\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [db7ZA1] C:\WINDOWS\sredrbko.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Dokumente und Einstellungen\nedim sierif\Internet Optimizer\optimize.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [kfrr] C:\PROGRA~1\COMMON~1\kfrr\kfrrm.exe
O4 - Global Startup: AOL 9.0 Tray-Symbol.lnk = C:\Programme\AOL 9.0\aoltray.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\Programme\SideFind\sidefind.dll (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=Q304&bd=pavilion&pf=laptop
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by15fd.bay15.hotmail.msn.com/...s/MsnPUpld.cab
O16 - DPF: {7C559105-9ECF-42B8-B3F7-832E75EDD959} (Installer Class) - http://www.xxxtoolbar.com/ist/softwa...06_regular.cab
O16 - DPF: {FFCEABDA-C04E-7F4A-E9B6-DFA72B2F49FB} - http://213.200.210.10/dl/101/00732_100.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\GEMEIN~1\aol\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect-Dienst (navapsvc) - Symantec Corporation - C:\Programme\Norton AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programme\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\GEMEIN~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

@Greko
system und IE updaten

lade escan
download
anleitung
EscanErgebnis
Teile uns das Ergebnis des eScan mit: "öffne die mwav.log -> Bearbeiten -> Suchen -> infected oder tagged eingeben -> Weitersuchen -> Treffer markieren/kopieren und ins Forum übertragen."

chaosman

Wie ich das sehe, liegt die Veränderung der Startpage unter anderem an folgendem Eintrag :

C:\Programme\ISTsvc\istsvc.exe
O3 - Toolbar: ISTbar - {FAA356E4-D317-42a6-AB41-A3021C6E7D52} - C:\Programme\ISTbar\istbarcm.dll

Überdien hinaus sehe ich noch ein paar Einträge, die auch net in Ordnung sind , oder zumindest sehr fraghaft :

O4 - HKCU\..\Run: [kfrr] C:\PROGRA~1\COMMON~1\kfrr\kfrrm.exe
O4 - HKLM\..\Run: [db7ZA1] C:\WINDOWS\sredrbko.exe
O16 - DPF: {7C559105-9ECF-42B8-B3F7-832E75EDD959} (Installer Class) - http://www.xxxtoolbar.com/ist/softw...006_regular.cab
O16 - DPF: {FFCEABDA-C04E-7F4A-E9B6-DFA72B2F49FB} - http://213.200.210.10/dl/101/00732_100.exe

Wie empfohlen, mit eScan scannen lassen und Log hier posten

Gruß
Andy

P.S.: Die o.g. Dateien einfach nur zu löschen, wird vermutlich gar nix bringen

@Greko

ich denk mal habe nen Trojaner erwischt..

Ich glaube -mehr als einen. Und die Ursache ist

Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

dein ungepatchtes Windows.
Zusätlich zum Beitrag von FancyAndy:

O4 - HKLM\..\Run: [Internet Optimizer] "C:\Dokumente und Einstellungen\nedim sierif\Internet Optimizer\optimize.exe

Programm über Software/Systemsteuerung deinstallieren, Eintrag fixen.

Das sind mit eScan rausgekommen.. TEIL 1


Mon Apr 11 00:41:19 2005 => File C:\WINDOWS\System32\systr.dll infected by "Trojan-Downloader.Win32.WarSpy.a" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:21 2005 => File C:\Programme\ISTbar\istbarcm.dll infected by "Trojan-Downloader.Win32.IstBar.ik" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:21 2005 => File C:\Programme\SideFind\sfbho.dll infected by "not-a-virus:AdWare.ToolBar.SideFind" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:22 2005 => File C:\WINDOWS\System32\systr.dll infected by "Trojan-Downloader.Win32.WarSpy.a" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:28 2005 => File C:\WINDOWS\ias.exe infected by "not-a-virus:Porn-Downloader.Win32.TibSystems" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:31 2005 => File C:\Programme\ISTsvc\istsvc.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:32 2005 => File C:\WINDOWS\sredrbko.exe infected by "Trojan-Downloader.Win32.IstBar.ij" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:32 2005 => File C:\DOKUME~1\NEDIMS~1\INTERN~1\optimize.exe infected by "Trojan-Downloader.Win32.Dyfuca.dx" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:32 2005 => File C:\PROGRA~1\COMMON~1\kfrr\kfrrm.exe infected by "Trojan-Downloader.Win32.TSUpdate.k" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:45 2005 => System found infected with DyFuCA Spyware/Adware ({40b1d454-9ca4-43cc-86aa-cb175eac52fb})! Action taken: No Action Taken.

Mon Apr 11 00:41:45 2005 => File System Found infected by "DyFuCA Spyware/Adware" Virus. Action Taken: No Action Taken.


Mon Apr 11 00:41:45 2005 => System found infected with DyFuCA Spyware/Adware ({1c01d150-91a4-4de0-9bf8-a35d1bdf1001})! Action taken: No Action Taken.
Mon Apr 11 00:41:45 2005 => File System Found infected by "DyFuCA Spyware/Adware" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:45 2005 => System found infected with DyFuCA Spyware/Adware ({00000010-6f7d-442c-93e3-4a4827c2e4c8})! Action taken: No Action Taken.
Mon Apr 11 00:41:45 2005 => File System Found infected by "DyFuCA Spyware/Adware" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:45 2005 => System found infected with IstBAR Spyware/Adware ({0985c112-2562-46f2-8da6-92648ba4630f})! Action taken: No Action Taken.
Mon Apr 11 00:41:45 2005 => File System Found infected by "IstBAR Spyware/Adware" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:45 2005 => System found infected with IstBAR Spyware/Adware ({67907b3c-a6ef-4a01-99ad-3fcd5f526429})! Action taken: No Action Taken.
Mon Apr 11 00:41:45 2005 => File System Found infected by "IstBAR Spyware/Adware" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:45 2005 => System found infected with SideFind Spyware/Adware ({8cba1b49-8144-4721-a7b1-64c578c9eed7})! Action taken: No Action Taken.
Mon Apr 11 00:41:45 2005 => File System Found infected by "SideFind Spyware/Adware" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:45 2005 => System found infected with SideFind Spyware/Adware ({58634367-d62b-4c2c-86be-5aac45cdb671})! Action taken: No Action Taken.
Mon Apr 11 00:41:45 2005 => File System Found infected by "SideFind Spyware/Adware" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:45 2005 => System found infected with SideFind Spyware/Adware ({d0288a41-9855-4a9b-8316-babe243648da})! Action taken: No Action Taken.
Mon Apr 11 00:41:45 2005 => File System Found infected by "SideFind Spyware/Adware" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:45 2005 => System found infected with SideFind Spyware/Adware ({339d8aff-0b42-4260-ad82-78ce605a9543})! Action taken: No Action Taken.
Mon Apr 11 00:41:45 2005 => File System Found infected by "SideFind Spyware/Adware" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:45 2005 => System found infected with SideFind Spyware/Adware ({a36a5936-cfd9-4b41-86bd-319a1931887f})! Action taken: No Action Taken.
Mon Apr 11 00:41:45 2005 => File System Found infected by "SideFind Spyware/Adware" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:45 2005 => System found infected with SideFind Spyware/Adware ({10e42047-deb9-4535-a118-b3f6ec39b807})! Action taken: No Action Taken.
Mon Apr 11 00:41:45 2005 => File System Found infected by "SideFind Spyware/Adware" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:45 2005 => System found infected with SideFind Spyware/Adware ({a3fdd654-a057-4971-9844-4ed8e67dbbb8})! Action taken: No Action Taken.
Mon Apr 11 00:41:45 2005 => File System Found infected by "SideFind Spyware/Adware" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:45 2005 => System found infected with XXXToolbar Spyware/Adware ({7C559105-9ECF-42B8-B3F7-832E75EDD959})! Action taken: No Action Taken.
Mon Apr 11 00:41:45 2005 => File System Found infected by "XXXToolbar Spyware/Adware" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:45 2005 => System found infected with Alexa Spyware/Adware ({c95fe080-8f5d-11d2-a20b-00aa003c157a})! Action taken: No Action Taken.
Mon Apr 11 00:41:45 2005 => File System Found infected by "Alexa Spyware/Adware" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:45 2005 => System found infected with IEHijacker.Hotoffers Spyware/Adware ({12345678-0000-0010-8000-00aaff6d2ea4})! Action taken: No Action Taken.
Mon Apr 11 00:41:45 2005 => File System Found infected by "IEHijacker.Hotoffers Spyware/Adware" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:45 2005 => System found infected with sidefind Spyware/Adware! Action taken: No Action Taken.
Mon Apr 11 00:41:45 2005 => File System Found infected by "sidefind Spyware/Adware" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:45 2005 => System found infected with istsvc Spyware/Adware! Action taken: No Action Taken.
Mon Apr 11 00:41:45 2005 => File System Found infected by "istsvc Spyware/Adware" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:45 2005 => System found infected with powerscan Spyware/Adware! Action taken: No Action Taken.
Mon Apr 11 00:41:45 2005 => File System Found infected by "powerscan Spyware/Adware" Virus. Action Taken: No Action Taken

Mon Apr 11 00:41:45 2005 => System found infected with power scan Spyware/Adware! Action taken: No Action Taken.
Mon Apr 11 00:41:45 2005 => File System Found infected by "power scan Spyware/Adware" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:45 2005 => System found infected with istbar Spyware/Adware! Action taken: No Action Taken.
Mon Apr 11 00:41:45 2005 => File System Found infected by "istbar Spyware/Adware" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:45 2005 => System found infected with DyFuCA Spyware/Adware! Action taken: No Action Taken.
Mon Apr 11 00:41:45 2005 => File System Found infected by "DyFuCA Spyware/Adware" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:45 2005 => System found infected with ameopt Spyware/Adware! Action taken: No Action Taken.
Mon Apr 11 00:41:45 2005 => File System Found infected by "ameopt Spyware/Adware" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:45 2005 => System found infected with kapabout Spyware/Adware! Action taken: No Action Taken.
Mon Apr 11 00:41:45 2005 => File System Found infected by "kapabout Spyware/Adware" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:45 2005 => System found infected with 180Solutions Spyware/Adware! Action taken: No Action Taken.
Mon Apr 11 00:41:45 2005 => File System Found infected by "180Solutions Spyware/Adware" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:45 2005 => System found infected with ist Spyware/Adware! Action taken: No Action Taken.
Mon Apr 11 00:41:45 2005 => File System Found infected by "ist Spyware/Adware" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:45 2005 => System found infected with tsa Spyware/Adware! Action taken: No Action Taken.
Mon Apr 11 00:41:45 2005 => File System Found infected by "tsa Spyware/Adware" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:45 2005 => System found infected with Internet Optimizer Spyware/Adware! Action taken: No Action Taken.
Mon Apr 11 00:41:45 2005 => File System Found infected by "Internet Optimizer Spyware/Adware" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:41:45 2005 => System found infected with avenue media Spyware/Adware! Action taken: No Action Taken.
Mon Apr 11 00:41:45 2005 => File System Found infected by "avenue media Spyware/Adware" Virus. Action Taken: No Action Taken.

TEIL 2:

Mon Apr 11 00:41:46 2005 => System found infected with WebSiteViewer Spyware/Adware! Action taken: No Action Taken.
Mon Apr 11 00:41:46 2005 => File System Found infected by "WebSiteViewer Spyware/Adware" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:42:24 2005 => File C:\WINDOWS\39.exe infected by "not-a-virus:Porn-Downloader.Win32.TibSystems" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:44:29 2005 => File C:\DOKUME~1\NEDIMS~1\LOKALE~1\Temp\Del22.tmp infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:44:45 2005 => File C:\DOKUME~1\NEDIMS~1\LOKALE~1\Temp\iinstall.exe infected by "Trojan-Downloader.Win32.IstBar.ir" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:51:34 2005 => File C:\DOKUME~1\NEDIMS~1\LOKALE~1\TEMPOR~1\Content.IE5\KHK163G1\0006_regular[1].cab infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:51:36 2005 => File C:\DOKUME~1\NEDIMS~1\LOKALE~1\TEMPOR~1\Content.IE5\KHK163G1\127703[1].exe infected by "not-a-virus:Porn-Downloader.Win32.TibSystems" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:51:49 2005 => File C:\DOKUME~1\NEDIMS~1\LOKALE~1\TEMPOR~1\Content.IE5\KHK163G1\dropper[1].chm infected by "Trojan-Dropper.Win32.Small.ut" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:52:08 2005 => File C:\DOKUME~1\NEDIMS~1\LOKALE~1\TEMPOR~1\Content.IE5\M7MRA9QZ\00732_100[1].exe infected by "Trojan.Win32.Dialer.ba" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:52:19 2005 => File C:\DOKUME~1\NEDIMS~1\LOKALE~1\TEMPOR~1\Content.IE5\M7MRA9QZ\cmctl[1].dll infected by "not-a-virus:AdWare.AdMir.a" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:52:29 2005 => File C:\DOKUME~1\NEDIMS~1\LOKALE~1\TEMPOR~1\Content.IE5\M7MRA9QZ\istbarcm[1].dll infected by "Trojan-Downloader.Win32.IstBar.ik" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:52:29 2005 => File C:\DOKUME~1\NEDIMS~1\LOKALE~1\TEMPOR~1\Content.IE5\M7MRA9QZ\istdownload[1].exe infected by "Trojan-Downloader.Win32.IstBar.ir" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:52:32 2005 => File C:\DOKUME~1\NEDIMS~1\LOKALE~1\TEMPOR~1\Content.IE5\M7MRA9QZ\prompt[2].php infected by "Trojan-Downloader.JS.IstBar.k" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:57:39 2005 => File C:\Dokumente und Einstellungen\nedim sierif\Lokale Einstellungen\Temp\Del22.tmp infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken.

Mon Apr 11 00:57:49 2005 => File C:\Dokumente und Einstellungen\nedim sierif\Lokale Einstellungen\Temp\iinstall.exe infected by "Trojan-Downloader.Win32.IstBar.ir" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:01:35 2005 => File C:\Dokumente und Einstellungen\nedim sierif\Lokale Einstellungen\Temporary Internet Files\Content.IE5\KHK163G1\0006_regular[1].cab infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:01:37 2005 => File C:\Dokumente und Einstellungen\nedim sierif\Lokale Einstellungen\Temporary Internet Files\Content.IE5\KHK163G1\127703[1].exe infected by "not-a-virus:Porn-Downloader.Win32.TibSystems" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:01:43 2005 => File C:\Dokumente und Einstellungen\nedim sierif\Lokale Einstellungen\Temporary Internet Files\Content.IE5\KHK163G1\dropper[1].chm infected by "Trojan-Dropper.Win32.Small.ut" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:01:52 2005 => File C:\Dokumente und Einstellungen\nedim sierif\Lokale Einstellungen\Temporary Internet Files\Content.IE5\M7MRA9QZ\00732_100[1].exe infected by "Trojan.Win32.Dialer.ba" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:01:57 2005 => File C:\Dokumente und Einstellungen\nedim sierif\Lokale Einstellungen\Temporary Internet Files\Content.IE5\M7MRA9QZ\cmctl[1].dll infected by "not-a-virus:AdWare.AdMir.a" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:02:02 2005 => File C:\Dokumente und Einstellungen\nedim sierif\Lokale Einstellungen\Temporary Internet Files\Content.IE5\M7MRA9QZ\istbarcm[1].dll infected by "Trojan-Downloader.Win32.IstBar.ik" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:02:02 2005 => File C:\Dokumente und Einstellungen\nedim sierif\Lokale Einstellungen\Temporary Internet Files\Content.IE5\M7MRA9QZ\istdownload[1].exe infected by "Trojan-Downloader.Win32.IstBar.ir" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:02:05 2005 => File C:\Dokumente und Einstellungen\nedim sierif\Lokale Einstellungen\Temporary Internet Files\Content.IE5\M7MRA9QZ\prompt[2].php infected by "Trojan-Downloader.JS.IstBar.k" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:51:37 2005 => File C:\Programme\ISTbar\cmctl.dll infected by "not-a-virus:AdWare.AdMir.a" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:22 2005 => File C:\Programme\Norton AntiVirus\Quarantine\035E3166 infected by "not-a-virus:Porn-Downloader.Win32.TibSystems" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:22 2005 => File C:\Programme\Norton AntiVirus\Quarantine\03811DF0 infected by "Trojan-Downloader.Win32.Dyfuca.dx" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:22 2005 => File C:\Programme\Norton AntiVirus\Quarantine\1A7E2964 infected by "Trojan-Downloader.Win32.Dyfuca.dx" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:23 2005 => File C:\Programme\Norton AntiVirus\Quarantine\25B0581D infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:23 2005 => File C:\Programme\Norton AntiVirus\Quarantine\260F6562 infected by "not-a-virus:AdWare.ToolBar.SideFind" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:23 2005 => File C:\Programme\Norton AntiVirus\Quarantine\2BCC2D47 infected by "not-a-virus:AdWare.PowerScan.d" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:23 2005 => File C:\Programme\Norton AntiVirus\Quarantine\319F2161 infected by "not-a-virus:AdWare.ToolBar.SideFind" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:23 2005 => File C:\Programme\Norton AntiVirus\Quarantine\35C95169 infected by "Trojan-Downloader.Win32.Ani.c" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:23 2005 => File C:\Programme\Norton AntiVirus\Quarantine\3D2F5D60 infected by "Trojan-Dropper.Win32.Small.ut" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:24 2005 => File C:\Programme\Norton AntiVirus\Quarantine\3D955367 infected by "not-a-virus:Porn-Downloader.Win32.TibSystems" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:24 2005 => File C:\Programme\Norton AntiVirus\Quarantine\50952828 infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:24 2005 => File C:\Programme\Norton AntiVirus\Quarantine\54163C9E infected by "not-a-virus:AdWare.ToolBar.SideFind" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:24 2005 => File C:\Programme\Norton AntiVirus\Quarantine\54B64B64 infected by "Trojan-Downloader.Win32.TSUpdate.j" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:24 2005 => File C:\Programme\Norton AntiVirus\Quarantine\5B370E99 infected by "not-a-virus:AdWare.Xupiter.m" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:24 2005 => File C:\Programme\Norton AntiVirus\Quarantine\5CBD1CB9 infected by "not-a-virus:AdWare.Serpo.c" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:25 2005 => File C:\Programme\Norton AntiVirus\Quarantine\60460763 infected by "not-a-virus:AdWare.PowerScan.d" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:25 2005 => File C:\Programme\Norton AntiVirus\Quarantine\68E51149 infected by "Trojan-Downloader.JS.IstBar.k" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:25 2005 => File C:\Programme\Norton AntiVirus\Quarantine\6B38589C infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:25 2005 => File C:\Programme\Norton AntiVirus\Quarantine\6C207D9D infected by "Trojan.Win32.Dialer.ba" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:25 2005 => File C:\Programme\Norton AntiVirus\Quarantine\6C265195 infected by "Trojan.Win32.Dialer.ba" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:25 2005 => File C:\Programme\Norton AntiVirus\Quarantine\6C2A7B92 infected by "Trojan.Win32.Dialer.ba" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:25 2005 => File C:\Programme\Norton AntiVirus\Quarantine\6C304F8B infected by "not-a-virus:Porn-Dialer.Win32.Tibs" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:25 2005 => File C:\Programme\Norton AntiVirus\Quarantine\6C337987 infected by "not-a-virus:Porn-Downloader.Win32.TibSystems" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:26 2005 => File C:\Programme\Norton AntiVirus\Quarantine\6C372384 infected by "not-a-virus:Porn-Downloader.Win32.TibSystems" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:26 2005 => File C:\Programme\Norton AntiVirus\Quarantine\6C3A4D80 infected by "Trojan-Downloader.Win32.TSUpdate.j" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:26 2005 => File C:\Programme\Norton AntiVirus\Quarantine\6C3D777C infected by "Trojan-Downloader.Win32.IstBar.ij" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:26 2005 => File C:\Programme\Norton AntiVirus\Quarantine\6C412179 infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:26 2005 => File C:\Programme\Norton AntiVirus\Quarantine\6C444B75 infected by "Trojan-Downloader.Win32.TSUpdate.l" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:26 2005 => File C:\Programme\Norton AntiVirus\Quarantine\6C477572 infected by "Trojan-Downloader.Win32.Dyfuca.gen" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:27 2005 => File C:\Programme\Norton AntiVirus\Quarantine\6C4A1F6E infected by "not-a-virus:AdWare.PowerScan.d" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:27 2005 => File C:\Programme\Norton AntiVirus\Quarantine\6C4E496A infected by "not-a-virus:AdWare.Serch.a" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:27 2005 => File C:\Programme\Norton AntiVirus\Quarantine\6C5B715C infected by "Trojan-Downloader.Win32.TSUpdate.j" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:28 2005 => File C:\Programme\Norton AntiVirus\Quarantine\730F5EE4 infected by "Trojan-Downloader.Win32.Dyfuca.gen" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:29 2005 => File C:\Programme\Norton AntiVirus\Quarantine\754179F8 infected by "Trojan-Downloader.Win32.TSUpdate.k" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:55:29 2005 => File C:\Programme\Norton AntiVirus\Quarantine\77677F60 infected by "Trojan-Downloader.Win32.TSUpdate.j" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:58:09 2005 => File C:\Programme\WebSiteViewer\127703.dlr infected by "not-a-virus:Porn-Dialer.Win32.Tibs" Virus. Action Taken: No Action Taken.

Mon Apr 11 01:58:10 2005 => File C:\Programme\WebSiteViewer\127703.exe infected by "not-a-virus:Porn-Downloader.Win32.TibSystems" Virus. Action Taken: No Action Taken

Mon Apr 11 01:58:10 2005 => File C:\Programme\WebSiteViewer\13901504temp.exe infected by "not-a-virus:Porn-Downloader.Win32.TibSystems" Virus. Action Taken: No Action Taken.

Mon Apr 11 02:14:06 2005 => File C:\System Volume Information\_restore{EF7FF593-AE32-4FA7-BFAC-8B7AC1FAC358}\RP19\A0007436.exe infected by "Trojan-Dropper.Win32.Small.ut" Virus. Action Taken: No Action Taken.

Mon Apr 11 02:14:14 2005 => File C:\System Volume Information\_restore{EF7FF593-AE32-4FA7-BFAC-8B7AC1FAC358}\RP19\A0007505.exe infected by "not-a-virus:Porn-Downloader.Win32.TibSystems" Virus. Action Taken: No Action Taken.

Mon Apr 11 02:14:14 2005 => File C:\System Volume Information\_restore{EF7FF593-AE32-4FA7-BFAC-8B7AC1FAC358}\RP19\A0007516.exe infected by "not-a-virus:Porn-Downloader.Win32.TibSystems" Virus. Action Taken: No Action Taken.

Mon Apr 11 02:14:15 2005 => File C:\System Volume Information\_restore{EF7FF593-AE32-4FA7-BFAC-8B7AC1FAC358}\RP19\A0007525.exe infected by "not-a-virus:Porn-Downloader.Win32.TibSystems" Virus. Action Taken: No Action Taken.

Mon Apr 11 02:14:15 2005 => File C:\System Volume Information\_restore{EF7FF593-AE32-4FA7-BFAC-8B7AC1FAC358}\RP19\A0007526.exe infected by "not-a-virus:Porn-Downloader.Win32.TibSystems" Virus. Action Taken: No Action Taken.

Mon Apr 11 02:14:15 2005 => File C:\System Volume Information\_restore{EF7FF593-AE32-4FA7-BFAC-8B7AC1FAC358}\RP19\A0007528.exe infected by "not-a-virus:Porn-Downloader.Win32.TibSystems" Virus. Action Taken: No Action Taken.

Mon Apr 11 02:14:15 2005 => File C:\System Volume Information\_restore{EF7FF593-AE32-4FA7-BFAC-8B7AC1FAC358}\RP19\A0007529.exe infected by "not-a-virus:Porn-Downloader.Win32.TibSystems" Virus. Action Taken: No Action Taken.

Mon Apr 11 02:14:15 2005 => File C:\System Volume Information\_restore{EF7FF593-AE32-4FA7-BFAC-8B7AC1FAC358}\RP19\A0007530.exe infected by "Trojan-Downloader.Win32.TSUpdate.l" Virus. Action Taken: No Action Taken.

Mon Apr 11 02:14:15 2005 => File C:\System Volume Information\_restore{EF7FF593-AE32-4FA7-BFAC-8B7AC1FAC358}\RP19\A0007531.exe infected by "Trojan-Downloader.Win32.TSUpdate.j" Virus. Action Taken: No Action Taken.

Mon Apr 11 02:14:15 2005 => File C:\System Volume Information\_restore{EF7FF593-AE32-4FA7-BFAC-8B7AC1FAC358}\RP19\A0007532.exe infected by "not-a-virus:AdWare.Xupiter.m" Virus. Action Taken: No Action Taken.

Mon Apr 11 02:14:15 2005 => File C:\System Volume Information\_restore{EF7FF593-AE32-4FA7-BFAC-8B7AC1FAC358}\RP19\A0007533.dll infected by "Trojan-Downloader.Win32.Dyfuca.gen" Virus. Action Taken: No Action Taken.

Mon Apr 11 02:14:15 2005 => File C:\System Volume Information\_restore{EF7FF593-AE32-4FA7-BFAC-8B7AC1FAC358}\RP19\A0007534.dll infected by "not-a-virus:AdWare.Serpo.c" Virus. Action Taken: No Action Taken.

Mon Apr 11 02:14:15 2005 => File C:\System Volume Information\_restore{EF7FF593-AE32-4FA7-BFAC-8B7AC1FAC358}\RP19\A0007535.exe infected by "not-a-virus:AdWare.PowerScan.d" Virus. Action Taken: No Action Taken.

Mon Apr 11 02:14:15 2005 => File C:\System Volume Information\_restore{EF7FF593-AE32-4FA7-BFAC-8B7AC1FAC358}\RP19\A0007536.dll infected by "not-a-virus:AdWare.Serch.a" Virus. Action Taken: No Action Taken.

Mon Apr 11 02:14:16 2005 => File C:\System Volume Information\_restore{EF7FF593-AE32-4FA7-BFAC-8B7AC1FAC358}\RP19\A0007537.dll infected by "not-a-virus:AdWare.ToolBar.SideFind" Virus. Action Taken: No Action Taken.

Mon Apr 11 02:14:16 2005 => File C:\System Volume Information\_restore{EF7FF593-AE32-4FA7-BFAC-8B7AC1FAC358}\RP19\A0007539.exe infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken.

Mon Apr 11 02:14:16 2005 => File C:\System Volume Information\_restore{EF7FF593-AE32-4FA7-BFAC-8B7AC1FAC358}\RP19\A0007553.dll infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken.

Mon Apr 11 02:14:17 2005 => File C:\System Volume Information\_restore{EF7FF593-AE32-4FA7-BFAC-8B7AC1FAC358}\RP19\A0007554.exe infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken.

Mon Apr 11 02:14:17 2005 => File C:\System Volume Information\_restore{EF7FF593-AE32-4FA7-BFAC-8B7AC1FAC358}\RP19\A0007555.exe infected by "not-a-virus:Porn-Downloader.Win32.TibSystems" Virus. Action Taken: No Action Taken.

Mon Apr 11 02:14:22 2005 => File C:\System Volume Information\_restore{EF7FF593-AE32-4FA7-BFAC-8B7AC1FAC358}\RP21\A0007613.exe infected by "not-a-virus:Porn-Downloader.Win32.TibSystems" Virus. Action Taken: No Action Taken.

Mon Apr 11 02:14:54 2005 => File C:\WINDOWS\39.exe infected by "not-a-virus:Porn-Downloader.Win32.TibSystems" Virus. Action Taken: No Action Taken.

Mon Apr 11 02:15:21 2005 => File C:\WINDOWS\Downloaded Program Files\00732_100.exe infected by "Trojan.Win32.Dialer.ba" Virus. Action Taken: No Action Taken.

Mon Apr 11 02:15:21 2005 => File C:\WINDOWS\Downloaded Program Files\CONFLICT.1\00732_100.exe infected by "Trojan.Win32.Dialer.ba" Virus. Action Taken: No Action Taken.

Mon Apr 11 02:15:21 2005 => File C:\WINDOWS\Downloaded Program Files\istactivex.dll infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: No Action Taken.




So das waren jetzt alle.. Und noch etwas, gestern während ich mein rechner mit eScan gescannt habe, hat sich IE von sich selber geöffnet (mit p.ornoseiten), obwohl ich nihct online war..

und dieser Meldung ist sehr oft gekommen...

Your Windows is corrupted with spyware virus.
You must patch your PC urgently to protect your Sysstem.
Private info is accessed by ports:

-8080
-3128
You can patch your PC for free now and delete all spyware viruses.
Click OK to choose and download free spyware removal using Anti SPY.

OK oder Abbrechen... Ich habe jedesmal abgebrochen..

Naja, schau ma mal wie es jetzt weiter läuft...

Danke für die HIlfe...

und hier das total ergebnis...

Mon Apr 11 02:28:40 2005 => Total Objects Scanned: 71040
Mon Apr 11 02:28:40 2005 => Total Virus(es) Found: 128
Mon Apr 11 02:28:40 2005 => Total Disinfected Files: 0
Mon Apr 11 02:28:40 2005 => Total Files Renamed: 0
Mon Apr 11 02:28:40 2005 => Total Deleted Objects: 0
Mon Apr 11 02:28:40 2005 => Total Errors: 3
Mon Apr 11 02:28:40 2005 => Time Elapsed: 01:46:50
Mon Apr 11 02:28:40 2005 => Virus Database Date: 2005/04/07
Mon Apr 11 02:28:40 2005 => Virus Database Count: 125034

Mon Apr 11 02:28:40 2005 => Scan Completed.

Kann das sich einer anschauen, bitte....

@Greko

speichere alle dialer auf diskette oder cd zwecks beweismittel gegen hohe telefonrechnungen.

system und IE updaten,
lade spybot
und Ad-Aware
beide installieren und updaten.

systemwiederherstellung deaktivieren, neu booten, systemwiederherstellung aktivieren.
Temporary Internet Files
Leere diese Ordner:
C:\Dokumente und Einstellungen\*Benutzername*\Lokale Einstellungen\Temp
C:\WINDOWS\Downloaded Program Files
C:\Dokumente und Einstellungen\*Benutzername*\Lokale Einstellungen\Temporary Internet Files
leere dein papierkorb
leere der quarantäne ordner von norton

wechsle dann in den abgesicherten modus und lösche alle gefundene ergebnisse manuell, bis auf C:\System Volume Information\_restore und Temp dateien.
neu booten, neues HJT logfile posten
chaosman