Kann mir bitte jemand helfen bzw. einen Link posten wo ich erfahre wie ich weiter vor gehen muss. Habe mein System mit Hijack gescannt (siehe Anhang). Bin gerade dabei diesen escan durchzuführen.

Ich habe in einigen Threads was gelesen von "im abgesicherten Modus Datein entfernen", dann aber diese Threads aus den Augen verloren (dank des Befalls schließt sich der explorer immer).

Danke für jede Hilfe!!!

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\RunDll32.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\mHotkey.exe
C:\Programme\Medion Home Cinema XL II\PowerCinema\PCMService.exe
C:\WINDOWS\System32\PRISMSTA.EXE
C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe
C:\Office50\SOINTGR.EXE
C:\Programme\AVPersonal\AVGNT.EXE
C:\WINDOWS\DitExp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\DOKUME~1\mao\LOKALE~1\Temp\mwavscan.com
C:\DOKUME~1\mao\LOKALE~1\Temp\kavss.exe
C:\Dokumente und Einstellungen\mao\Lokale Einstellungen\Temp\Temporäres Verzeichnis 6 für hijackthis_199.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotoffers.info/018/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [PCMService] "C:\Programme\Medion Home Cinema XL II\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [PRISMSTA.EXE] PRISMSTA.EXE START
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [Lexmark X73 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe
O4 - HKLM\..\Run: [Lexmark X73 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe
O4 - HKLM\..\Run: [SO5 Integrator Pass Two] C:\Office50\SOINTGR.EXE
O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [sp] rundll32 C:\DOKUME~1\mao\LOKALE~1\Temp\se.dll,DllInstall
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pu...sh/swflash.cab
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: CA-Lizenz-Client (CA_LIC_CLNT) - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: CA-Lizenzserver (CA_LIC_SRVR) - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Ereignisprotokoll-Überwachung (LogWatch) - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Und hier noch mein Resultat von escan:

File C:\WINDOWS\System32\systr.dll infected by "Trojan-Downloader.Win32.WarSpy.a" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\systr.dll infected by "Trojan-Downloader.Win32.WarSpy.a" Virus. Action Taken: No Action Taken.
File System Found infected by "Alexa Spyware/Adware" Virus. Action Taken: No Action Taken.
File System Found infected by "IEHijacker.Hotoffers Spyware/Adware" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\mao\LOKALE~1\Temp\Temporäres Verzeichnis 1 für hijackthis_199.zip\hijackthis.log infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\mao\LOKALE~1\Temp\Temporäres Verzeichnis 2 für hijackthis_199.zip\hijackthis.log infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.
File C:\DOKUME~1\mao\LOKALE~1\Temp\Temporäres Verzeichnis 3 für hijackthis_199.zip\hijackthis.log infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.
File C:\Dokumente und Einstellungen\mao\Lokale Einstellungen\Temp\Temporäres Verzeichnis 1 für hijackthis_199.zip\hijackthis.log infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.
File C:\Dokumente und Einstellungen\mao\Lokale Einstellungen\Temp\Temporäres Verzeichnis 2 für hijackthis_199.zip\hijackthis.log infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.
File C:\Dokumente und Einstellungen\mao\Lokale Einstellungen\Temp\Temporäres Verzeichnis 3 für hijackthis_199.zip\hijackthis.log infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.
File C:\LXKX73\scan\setup.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\LXKX73\scan\SETUPX73PART2.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Programme\LexmarkX73\RemoveX73.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Programme\LexmarkX73\SETUPX73PART2.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Programme\LexmarkX73\X73Twain.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Programme\Packs Land\setup\gendel32.ex_ tagged as not-a-virus:RiskWare.Tool.Gendel. No Action Taken.
File C:\System Volume Information\_restore{C7E87882-F72B-4CC6-B94B-0C5CDA4414CA}\RP161\A0015768.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\System Volume Information\_restore{C7E87882-F72B-4CC6-B94B-0C5CDA4414CA}\RP161\A0015829.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\System Volume Information\_restore{C7E87882-F72B-4CC6-B94B-0C5CDA4414CA}\RP161\A0015830.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\System Volume Information\_restore{C7E87882-F72B-4CC6-B94B-0C5CDA4414CA}\RP161\A0015854.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\System Volume Information\_restore{C7E87882-F72B-4CC6-B94B-0C5CDA4414CA}\RP161\A0015855.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\treibersoftware\cjxp73lg.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File D:\Tools\DiVX Video\DivX505Bundle.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File D:\Treiber\lexmark\cjxp73lg.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File D:\Treiber\lexmark\scan\setup.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File D:\Treiber\lexmark\scan\SETUPX73PART2.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.