habe folgendes Problem habe eScan durchlaufen lassen und habe dann die gefunden Viren und und einträge mit eScan-check löschen lassen.
Gleich danach habe ich nochmal eScan durchlaufen lassen und er hat wieder soviele einträge Gefunden siehe unten(Total Virus(es) Found 77) (Total Errors: 112)

was kann ich machen um die Störenfriede loszuwerden.

Ps. Norton AntiVirus findet nicht einen der Viren und Adaware auch nicht.

Vielen dank schonmal im vorraus für die Auswertung.


Tue Jun 07 19:21:09 2005 => ***** Checking for specific ITW Viruses *****
Tue Jun 07 19:21:09 2005 => Checking for Welchia Virus...
Tue Jun 07 19:21:09 2005 => Checking for LovGate Virus...
Tue Jun 07 19:21:09 2005 => Checking for CodeRed Virus...
Tue Jun 07 19:21:09 2005 => Checking for OpaServ Virus...
Tue Jun 07 19:21:09 2005 => Checking for Sobig.e Virus...
Tue Jun 07 19:21:09 2005 => Checking for Winupie Virus...
Tue Jun 07 19:21:09 2005 => Checking for Swen Virus...
Tue Jun 07 19:21:09 2005 => Checking for JS.Fortnight Virus...
Tue Jun 07 19:21:09 2005 => Checking for Novarg Virus...
Tue Jun 07 19:21:09 2005 => Checking for Pagabot Virus...
Tue Jun 07 19:21:09 2005 => Checking for Parite.b Virus...
Tue Jun 07 19:21:09 2005 => Checking for Parite.a Virus...
Tue Jun 07 19:21:09 2005 => Checking for Adware.SeekSeek Virus...

Tue Jun 07 19:21:09 2005 => ***** Scanning complete. *****

Tue Jun 07 19:21:09 2005 => Total Objects Scanned: 71129
Tue Jun 07 19:21:09 2005 => Total Virus(es) Found: 77
Tue Jun 07 19:21:09 2005 => Total Disinfected Files: 0
Tue Jun 07 19:21:09 2005 => Total Files Renamed: 0
Tue Jun 07 19:21:09 2005 => Total Deleted Objects: 0
Tue Jun 07 19:21:09 2005 => Total Errors: 112
Tue Jun 07 19:21:09 2005 => Time Elapsed: 02:00:02
Tue Jun 07 19:21:09 2005 => Virus Database Date: 2005/06/06
Tue Jun 07 19:21:09 2005 => Virus Database Count: 133635




Tue Jun 07 19:21:09 2005 => Scan Completed.

Tue Jun 07 19:23:42 2005 => Virus Database Date: 2005/06/06
Tue Jun 07 19:23:42 2005 => Virus Database Count: 133635
Tue Jun 07 19:23:44 2005 => AV Library Unloaded (3)...

@lilli
kann es sein das du was übersehen hast?

3. Möglichkeit - eScan-Checkb9 von Seeker:
Lade eScan-Checkb9 und entpacke das Archiv z.B. in den vorgeschlagenen Ordner 'C:\escheck' -> Installieren -> Datei -> eScan-Log öffnen -> mwav.log auswählen -> Haken setzen bei 'Backup der gelöschten Dateien anlegen' und 'Alle Dateien beim Neustart löschen' -> die gewünschten Dateien anhaken und auf den Button 'Dateien löschen' klicken.
Wichtig: Sollte abschließend ein erneuter Scan mit eScan durchgeführt werden, dann ist es zwingend notwendig, daß die 'mwav.log' zuvor gelöscht wird, da diese nicht überschrieben, sondern nur erweitert wird!

chaosman

Ja habe die mwav.log Datei ganz sicher gelöscht desewgen wundert es mich, dass der Scan immer noch soviele einträge gefunden hat.
Hier mal der Scan mit HijackThis. Vielleicht sieht man da was.


Logfile of HijackThis v1.99.1
Scan saved at 13:40:55, on 08.06.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\GEARSec.exe
C:\Programme\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Programme\Norton SystemWorks\Norton Ghost\Agent\PQV2iSvc.exe
C:\Programme\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\Programme\Norton SystemWorks\Norton Ghost\Agent\GhostTray.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\Programme\Messenger\msmsgs.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Dokumente und Einstellungen\Maja\Desktop\Neuer Ordner (2)\HijackThis.exe

R3 - Default URLSearchHook is missing
O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINDOWS\EliteToolBar\EliteToolBar version 60.dll (file missing)
O2 - BHO: &EliteSideBar - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - C:\WINDOWS\EliteSideBar\EliteSideBar 08.dll (file missing)
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINDOWS\EliteToolBar\EliteToolBar version 60.dll (file missing)
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [CorelDRAW ESSENTIALS14] C:\Programme\Corel\CorelDRAW ESSENTIALS 2\Register\Registration.exe /title="CorelDRAW ESSENTIALS" /date=061605 serial=ES02WBG-0090091-CML
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Norton Ghost 9.0] C:\Programme\Norton SystemWorks\Norton Ghost\Agent\GhostTray.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Programme\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O14 - IERESET.INF: START_PAGE_URL=h**p://www.versatel.de/internet-cd/
O15 - Trusted Zone: h**p://ny.contentmatch.net (HKLM)
O15 - Trusted Zone: h**p://awbeta.net-nucleus.com (HKLM)
O16 - DPF: {24311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab
O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab
O16 - DPF: {43331111-1111-1111-1111-611111195622} - file://c:\ex.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - h**p://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-18.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - h**p://messenger.msn.com/download/msnmessengersetupdownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{DCEC0496-BF68-4E69-BB8D-C495D458A075}: NameServer = 62.72.64.237 62.72.64.241
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - (no file)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto-Protect-Dienst (navapsvc) - Symantec Corporation - C:\Programme\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Programme\Norton SystemWorks\Norton Ghost\Agent\PQV2iSvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Programme\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programme\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\GEMEIN~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe

@lilli

Ja habe die mwav.log Datei ganz sicher gelöscht desewgen wundert es mich, dass der Scan immer noch soviele einträge gefunden hat.

eScan-Log enthält nur die Information von gefundener Malware, Malware selbst muss man manuell oder mit den anderen Tools entfernen. Das Löschen vom Log und das Löschen von Malware sind 2 verschiedene Paar Schuhe.

Hier mal der Scan mit HijackThis. Vielleicht sieht man da was.

chaosman hat dir aber dadrum gebeten, den eScan Log so zu posten, dass man sieht, wo 77 Viren gefünden wurden.

HJT soll aus einem speziell angelegten Ordner ausgeführt werden.
Benutzername musst du unerkennbar machen.
Warum ignorierst du die Anweisungen von Cidre?

Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Fehlt SP2

Elite Toolbar musst du deinstallieren.
BTW: AFAIK diese malware soll von Spybot S&D erkannt werden. Wahrscheinlich ist dein Database von Spybot nicht aktuell. Bitte updaten.

Bitte fixen.

R3 - Default URLSearchHook is missing
O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINDOWS\EliteToolBar\EliteToolBar version 60.dll (file missing)
O2 - BHO: &EliteSideBar - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - C:\WINDOWS\EliteSideBar\EliteSideBar 08.dll (file missing)
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINDOWS\EliteToolBar\EliteToolBar version 60.dll (file missing)
O15 - Trusted Zone: h**p://ny.contentmatch.net (HKLM)
O15 - Trusted Zone: h**p://awbeta.net-nucleus.com (HKLM)
O16 - DPF: {24311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab
O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab
O16 - DPF: {43331111-1111-1111-1111-611111195622} - file://c:\ex.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) -
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - (no file)

Dateien im abgesicherten Modus entfernen.

c:\ex.cab
c:\eied_s7.cab

Danach:

1.Systemwiederherstellung abschalten
2. Dieses Bereinigungsprogramm hilft dir, den ganzen Müll aus den Temp-Ordner und Papierkorb zu entfernen.
3. Infected-Ordner des Antivirus-Programms, ggf. auch von Spybot Search & Destroy, Ad-Aware usw. leeren. Der Name des Ordners sowie Pfad sind Programm- und Benutzerabhängig. Bitte RTFM zum AV-Programm. Bei einigen Programmen (z. B. AVPE) ist diese Option nicht im Programm integriert. In dem Fall soll dies manuell erfolgen.
4. eScan genau nach Anleitung (bitte ausdrucken und aufmerksam lesen) im abgesicherten Modus laufen lassen. Log hier Posten.

Object "SideFind Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "Alexa Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "ElitebarBHO Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "sidefind Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "istbar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "sais Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "eZula Spyware/Adware" found in File System! Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\EPUWALcontrol.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\EPUWALcontrol.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Chs.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Cht.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Esp.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Fra.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Ita.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Kor.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Nld.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Ptg.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Csy.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Dan.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Ell.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Esl.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Fin.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Hun.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Nor.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Plk.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Ptb.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Rus.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Sky.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Slv.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Sve.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Tha.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Trk.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Ahead\Nero BackItUp\BackItUp-Jpn.nls". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0A1D22C3-37BE-470C-9C29-E3074EE0574B}" refers to invalid object "C:\WINDOWS\EliteSideBar\EliteSideBar 08.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{825CF5BD-8862-4430-B771-0C15C5CA8DEF}" refers to invalid object "C:\WINDOWS\EliteToolBar\EliteToolBar version 60.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{86FC1FD1-BCF3-11D1-B76F-58BB04C10000}" refers to invalid object "D:\RUNTIME\mDxEmul.mom". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{86FC1FD3-BCF3-11D1-B76F-58BB04C10000}" refers to invalid object "D:\RUNTIME\mDxEmul.mom". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{BE8D0059-D24D-4919-B76F-99F4A2203647}" refers to invalid object "C:\WINDOWS\EliteSideBar\EliteSideBar 08.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{FACF11A2-5095-11D3-A9DE-00C0268E5C48}" refers to invalid object "D:\RUNTIME\mDxEmul.mom". Action Taken: No Action Taken.
File C:\WINDOWS\System32\msxct.exe tagged as "not-a-virus:AdWare.BargainBuddy.n". Action Taken: No Action Taken.
File C:\WINDOWS\System32\WinNB57.dll tagged as "not-a-virus:AdWare.NetNucleus". Action Taken: No Action Taken.
File C:\echeck\ECBackup\cpdst2.exe.bkp infected by "Trojan-Dropper.Win32.Juntador.c" Virus! Action Taken: No Action Taken.
File C:\echeck\ECBackup\egauth_1041_en_xp[1].cab.bkp infected by "Trojan.Win32.P2E.bt" Virus! Action Taken: No Action Taken.
File C:\echeck\ECBackup\fbybejj.exe.bkp infected by "Trojan-Downloader.Win32.IstBar.ju" Virus! Action Taken: No Action Taken.
File C:\echeck\ECBackup\fca0ivf.exe.bkp infected by "Trojan-Downloader.Win32.IstBar.ju" Virus! Action Taken: No Action Taken.
File C:\echeck\ECBackup\gbjde8.exe.bkp infected by "Trojan-Downloader.Win32.IstBar.jl" Virus! Action Taken: No Action Taken.
File C:\echeck\ECBackup\istdownload[2].exe.bkp infected by "Trojan-Downloader.Win32.IstBar.ju" Virus! Action Taken: No Action Taken.
File C:\echeck\ECBackup\istinstall_158604.exe.bkp infected by "Trojan-Downloader.Win32.IstBar.is" Virus! Action Taken: No Action Taken.
File C:\echeck\ECBackup\k5c8ky.exe.bkp infected by "Trojan-Downloader.Win32.IstBar.jl" Virus! Action Taken: No Action Taken.
File C:\echeck\ECBackup\mafqmw.exe.bkp infected by "Trojan-Downloader.Win32.IstBar.jl" Virus! Action Taken: No Action Taken.
File C:\echeck\ECBackup\microsoftv3.exe.bkp infected by "Backdoor.Win32.Rbot.gen" Virus! Action Taken: No Action Taken.
File C:\echeck\ECBackup\msua.exe.bkp infected by "Trojan-Dropper.Win32.Juntador.c" Virus! Action Taken: No Action Taken.
File C:\echeck\ECBackup\power_remove[1].exe.bkp infected by "Trojan-Downloader.Win32.IstBar.gi" Virus! Action Taken: No Action Taken.
File C:\echeck\ECBackup\uninstall.exe.bkp tagged as not-a-virus:Tool.Win32.Processor.1001. No Action Taken.
File C:\echeck\ECBackup\vbsys2.dll.bkp infected by "Trojan-Clicker.Win32.Agent.ac" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\071B3174.bkp infected by "Trojan-Downloader.Win32.Dyfuca.dx" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\071B3174.dll tagged as "not-a-virus:AdWare.ToolBar.SideFind". Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\0D144590.bkp infected by "Trojan-Downloader.Win32.IstBar.ij" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\12AC6D72.bkp infected by "Trojan-Downloader.Win32.Dyfuca.dt" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\1434178C.bkp infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\1EA21F79.bkp infected by "Trojan-Downloader.Win32.IstBar.ij" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\2A335B77.bkp infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\2E3E02EB.bkp infected by "Trojan-Downloader.Win32.Dyfuca.dt" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\355F54E7.bkp infected by "Trojan-Downloader.Win32.Dyfuca.gen" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\3C7F26E3.bkp infected by "Trojan-Downloader.Win32.IstBar.gen" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\41535375.bkp infected by "Trojan-Downloader.Win32.IstBar.gen" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\439F78DF.bkp infected by "Trojan-Downloader.Win32.Adload.a" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\4CE40F73.bkp infected by "Trojan-Downloader.Win32.IstBar.jm" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\5DA9643E.bkp infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\646A7D78.bkp infected by "Trojan.Win32.Dialer.eb" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\64FB18D7.bkp infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\64FE42D4.bkp infected by "Trojan-Downloader.Win32.Dyfuca.dp" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\65016CD0.bkp infected by "Trojan-Downloader.Win32.Adload.a" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\65016CD0.dll tagged as "not-a-virus:AdWare.AdMir.a". Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\65016CD0.exe infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\650516CC.bkp infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\650516CC.dll tagged as "not-a-virus:AdWare.ToolBar.EliteBar.z". Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\650840C9.bkp infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\650840C9.dll tagged as "not-a-virus:AdWare.ToolBar.EliteBar.af". Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\650840C9.exe tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\650E14C2.bkp infected by "Trojan-Downloader.Win32.IstBar.ik" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\65123EBE.bkp infected by "Trojan-Downloader.Win32.IstBar.gen" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\651568BB.bkp infected by "Trojan-Downloader.Win32.Dyfuca.dx" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\651568BB.dll tagged as "not-a-virus:AdWare.WinAD.ab". Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\651568BB.exe tagged as "not-a-virus:AdWare.BargainBuddy.n". Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\651568BB.tmp infected by "Trojan-Downloader.Win32.Dyfuca.dx" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\651812B7.bkp infected by "Trojan-Downloader.Win32.IstBar.jm" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\651812B7.dll tagged as "not-a-virus:AdWare.ToolBar.SideFind". Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\651812B7.exe tagged as "not-a-virus:AdWare.ToolBar.EliteBar.z". Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\651B3CB3.bkp infected by "Trojan-Dropper.Win32.Agent.hh" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\6BEA0835.bkp infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\6FFB3977.bkp infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\7B8B7575.bkp infected by "Trojan-Downloader.Win32.IstBar.ik" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton CleanSweep\Sicherungskopie\opti7665.BUD infected by "Trojan-Downloader.Win32.Dyfuca.ei" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\Downloaded Program Files\MirarSetup.exe tagged as "not-a-virus:AdWare.SaveNow.bj". Action Taken: No Action Taken.
File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\4HQF0LIB\ncase_new[1].exe tagged as "not-a-virus:AdWare.180Solutions". Action Taken: No Action Taken.
File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\4HQF0LIB\powerscan[1].exe tagged as "not-a-virus:AdWare.PowerScan.d". Action Taken: No Action Taken.
File C:\WINDOWS\system32\msxct.exe tagged as "not-a-virus:AdWare.BargainBuddy.n". Action Taken: No Action Taken.
File C:\WINDOWS\system32\WinNB57.dll tagged as "not-a-virus:AdWare.NetNucleus". Action Taken: No Action Taken.

@lilli
1.Warum hast du dein System nicht bereinigt, wie ich beschrieben habe - Temp-Ordner, Quarantäne-Ordner usw.?
2.Wo hast du das Programm eCheck genommen? Im Backup-Ordner von dem sind mehrere Trojaner und mindestens ein Backdoor drin

das heißt also am besten system neu aufsetzen?
oder bekommt man die sachen auch ohne neu aufzusetzten wieder im griff?

@lilli

das heißt also am besten system neu aufsetzen?

Ja

bekommt man die sachen auch ohne neu aufzusetzten wieder im griff?

Nein.
Bitte meine Fragen beantworten.