Es geht doch, hat aber 2 Stunden gedauert.

und wo hast du die Ergebnisse

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Funde für "infected"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Wed Jun 29 09:08:24 2005 => File c:\winnt\system32\gkbmwl.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:08:24 2005 => File C:\winnt\system32\eliterhw32.exe infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:08:24 2005 => File C:\WINNT\alchem.exe infected by "Trojan-Downloader.Win32.Alchemic" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:08:25 2005 => File C:\WINNT\system32\langm.exe infected by "Trojan-Downloader.Win32.VB.dj" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:08:25 2005 => File C:\WINNT\system32\uartzq.exe infected by "Trojan-Downloader.Win32.VB.dx" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:08:26 2005 => File C:\PROGRA~1\COMMON~1\kfww\kfwwm.exe infected by "Trojan-Downloader.Win32.TSUpdate.k" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:08:26 2005 => File C:\WINNT\sfita.exe infected by "Trojan.Win32.Favadd.o" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:08:26 2005 => File C:\Programme\sf\sf.exe infected by "Trojan-Downloader.Win32.Small.hs" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:08:55 2005 => System found infected with Alexa Spyware/Adware ({c95fe080-8f5d-11d2-a20b-00aa003c157a})! Action taken: No Action Taken.
Wed Jun 29 09:08:55 2005 => System found infected with VX2 Spyware/Adware ({92daf5c1-2135-4e0c-b7a0-259abfcd3904})! Action taken: No Action Taken.
Wed Jun 29 09:08:55 2005 => System found infected with VX2 Spyware/Adware ({bb0d5adc-028d-4185-9288-722ddce2c757})! Action taken: No Action Taken.
Wed Jun 29 09:08:55 2005 => System found infected with VX2 Spyware/Adware ({00000049-8f91-4d9c-9573-f016e7626484})! Action taken: No Action Taken.
Wed Jun 29 09:08:55 2005 => System found infected with ElitebarBHO Spyware/Adware ({825cf5bd-8862-4430-b771-0c15c5ca8def})! Action taken: No Action Taken.
Wed Jun 29 09:08:55 2005 => System found infected with ElitebarBHO Spyware/Adware ({28caeff3-0f18-4036-b504-51d73bd81abc})! Action taken: No Action Taken.
Wed Jun 29 09:08:55 2005 => System found infected with adshooter Spyware/Adware ({c109664b-ceb1-420b-b353-d55a561536dd})! Action taken: No Action Taken.
Wed Jun 29 09:08:55 2005 => System found infected with adshooter Spyware/Adware ({f43085a3-5fbd-4954-b7bf-00a8f1a1b9fe})! Action taken: No Action Taken.
Wed Jun 29 09:08:55 2005 => System found infected with Favoriteman Spyware/Adware ({53F066F0-A4C0-4F46-83EB-2DFD03F938CF})! Action taken: No Action Taken.
Wed Jun 29 09:08:55 2005 => System found infected with eUniverse Spyware/Adware ({5D60FF48-95BE-4956-B4C6-6BB168A70310})! Action taken: No Action Taken.
Wed Jun 29 09:08:55 2005 => System found infected with BetterInternet Adware (ceresdll.ceresdllobj)! Action taken: No Action Taken.
Wed Jun 29 09:09:48 2005 => System found infected with AdDestroyer Spyware/Adware (popoops.dll)! Action taken: No Action Taken.
Wed Jun 29 09:09:48 2005 => System found infected with AdDestroyer Spyware/Adware (popoops2.dll)! Action taken: No Action Taken.
Wed Jun 29 09:09:48 2005 => System found infected with AdDestroyer Spyware/Adware (swlad1.dll)! Action taken: No Action Taken.
Wed Jun 29 09:09:48 2005 => System found infected with AdDestroyer Spyware/Adware (swlad2.dll)! Action taken: No Action Taken.
Wed Jun 29 09:09:48 2005 => System found infected with AdDestroyer Spyware/Adware (swrt01.dll)! Action taken: No Action Taken.
Wed Jun 29 09:10:40 2005 => File C:\WINNT\rico.exe infected by "Trojan-Downloader.Win32.VB.dx" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:10:45 2005 => File C:\WINNT\istinstall_si.exe infected by "Trojan-Downloader.Win32.Small.gl" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:10:46 2005 => File C:\WINNT\protector.exe infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:12:21 2005 => File C:\WINNT\system32\bnmpntwd.exe infected by "Trojan-Downloader.Win32.VB.dj" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:12:24 2005 => File C:\WINNT\system32\polall1m.exe infected by "Trojan-Downloader.Win32.Agent.ae" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:12:41 2005 => File C:\WINNT\system32\vm_d.dll infected by "Trojan-Downloader.Win32.IstBar.gen" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:12:42 2005 => File C:\WINNT\system32\vm_d.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:12:42 2005 => File C:\WINNT\system32\25108661.exe infected by "Trojan-Downloader.Win32.VB.dx" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:12:45 2005 => File C:\WINNT\system32\setup_incred_3.exe infected by "Trojan-Downloader.Win32.Keenval.e" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:14:45 2005 => File C:\WINNT\system32\elitecav32.exe infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:14:45 2005 => File C:\WINNT\system32\elitegjv32.exe infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:15:59 2005 => File C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\THI13E5.tmp\polall1m.exe infected by "Trojan-Downloader.Win32.Agent.ae" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:16:00 2005 => File C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\iinstall.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:16:00 2005 => File C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\alchem.cab infected by "Trojan-Downloader.Win32.Alchemic" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:16:00 2005 => File C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\bundlersi.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:16:01 2005 => File C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\alchem.exe infected by "Trojan-Downloader.Win32.Alchemic" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:16:02 2005 => File C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\ts_8_new.exe infected by "Trojan-Downloader.Win32.TSUpdate.f" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:16:03 2005 => File C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\tsinstall_4_0_3_8_b17.exe infected by "Trojan-Downloader.Win32.TSUpdate.k" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:16:04 2005 => File C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\GLFBDGLFBD.EXE infected by "Trojan-Downloader.Win32.TSUpdate.f" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:20:08 2005 => File C:\WINNT\system32\bnmpntwd.exe infected by "Trojan-Downloader.Win32.VB.dj" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:20:11 2005 => File C:\WINNT\system32\polall1m.exe infected by "Trojan-Downloader.Win32.Agent.ae" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:20:31 2005 => File C:\WINNT\system32\vm_d.dll infected by "Trojan-Downloader.Win32.IstBar.gen" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:20:32 2005 => File C:\WINNT\system32\vm_d.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:20:32 2005 => File C:\WINNT\system32\25108661.exe infected by "Trojan-Downloader.Win32.VB.dx" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:20:35 2005 => File C:\WINNT\system32\setup_incred_3.exe infected by "Trojan-Downloader.Win32.Keenval.e" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:23:22 2005 => File C:\WINNT\system32\elitecav32.exe infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:23:22 2005 => File C:\WINNT\system32\elitegjv32.exe infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:32:01 2005 => File C:\WINNT\rico.exe infected by "Trojan-Downloader.Win32.VB.dx" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:33:02 2005 => File C:\WINNT\istinstall_si.exe infected by "Trojan-Downloader.Win32.Small.gl" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:33:06 2005 => File C:\WINNT\protector.exe infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:47:47 2005 => File C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\THI13E5.tmp\polall1m.exe infected by "Trojan-Downloader.Win32.Agent.ae" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:47:48 2005 => File C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\iinstall.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:47:48 2005 => File C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\alchem.cab infected by "Trojan-Downloader.Win32.Alchemic" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:47:48 2005 => File C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\bundlersi.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:47:49 2005 => File C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\alchem.exe infected by "Trojan-Downloader.Win32.Alchemic" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:47:50 2005 => File C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\ts_8_new.exe infected by "Trojan-Downloader.Win32.TSUpdate.f" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:47:51 2005 => File C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\tsinstall_4_0_3_8_b17.exe infected by "Trojan-Downloader.Win32.TSUpdate.k" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:47:52 2005 => File C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\GLFBDGLFBD.EXE infected by "Trojan-Downloader.Win32.TSUpdate.f" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:58:26 2005 => File C:\Programme\Windows Media Player\wmplayer.exe infected by "Trojan-Downloader.Win32.VB.dj" Virus! Action Taken: No Action Taken.
Wed Jun 29 09:58:46 2005 => Scanning Folder: C:\Programme\AVPersonal\INFECTED\*.*
Wed Jun 29 11:07:00 2005 => File C:\Programme\ISTsvc\istsvc.exe infected by "Trojan-Downloader.Win32.IstBar.fr" Virus! Action Taken: No Action Taken.
Wed Jun 29 11:07:02 2005 => File C:\Programme\Common Files\updater\delupdat.exe infected by "Trojan-Downloader.Win32.Keenval" Virus! Action Taken: No Action Taken.
Wed Jun 29 11:07:02 2005 => File C:\Programme\Common Files\updater\sui.exe infected by "Trojan-Downloader.Win32.Keenval" Virus! Action Taken: No Action Taken.
Wed Jun 29 11:07:03 2005 => File C:\Programme\Common Files\kfww\kfwwa.exe infected by "Trojan-Downloader.Win32.TSUpdate.l" Virus! Action Taken: No Action Taken.
Wed Jun 29 11:07:03 2005 => File C:\Programme\Common Files\kfww\kfwwl.exe infected by "Trojan-Downloader.Win32.TSUpdate.j" Virus! Action Taken: No Action Taken.
Wed Jun 29 11:10:23 2005 => File C:\Programme\IncrediFind\BHO\IncFindBHO.dll infected by "Trojan-Downloader.Win32.Keenval.e" Virus! Action Taken: No Action Taken.
Wed Jun 29 11:28:17 2005 => File C:\updaterInstall_112.exe infected by "Trojan-Downloader.Win32.Keenval" Virus! Action Taken: No Action Taken.
Wed Jun 29 11:28:47 2005 => File C:\checkgfie.exe infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
Wed Jun 29 11:49:21 2005 => Total Disinfected Files: 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~

FF (mei netscape packt des ganze irgendwie net auf einmal

Funde für "tagged"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Wed Jun 29 09:08:10 2005 => File C:\WINNT\system32\lsp.dll tagged as "not-a-virus:AdWare.Sahat.f". Action Taken: No Action Taken.
Wed Jun 29 09:08:17 2005 => File C:\WINNT\ceres.dll tagged as "not-a-virus:AdWare.BetterInternet.d". Action Taken: No Action Taken.
Wed Jun 29 09:08:24 2005 => File C:\Programme\Web_Rebates\WebRebates0.exe tagged as "not-a-virus:AdWare.HelpExpress". Action Taken: No Action Taken.
Wed Jun 29 09:10:38 2005 => File C:\WINNT\_MSRSTRT.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Wed Jun 29 09:10:39 2005 => File C:\WINNT\96wu19rd.exe tagged as "not-a-virus:AdWare.F1Organizer.h". Action Taken: No Action Taken.
Wed Jun 29 09:10:45 2005 => File C:\WINNT\preInsTT.exe tagged as "not-a-virus:AdWare.BiSpy.f". Action Taken: No Action Taken.
Wed Jun 29 09:10:46 2005 => File C:\WINNT\SAHUninstall.exe tagged as "not-a-virus:AdWare.Sahat.f". Action Taken: No Action Taken.
Wed Jun 29 09:10:46 2005 => File C:\WINNT\snbho.exe tagged as "not-a-virus:AdWare.ToolBar.ImiBar.e". Action Taken: No Action Taken.
Wed Jun 29 09:10:46 2005 => File C:\WINNT\pxckdlauninstall.exe tagged as "not-a-virus:AdWare.BHO.NoName.f". Action Taken: No Action Taken.
Wed Jun 29 09:12:17 2005 => File C:\WINNT\system32\msbb321.dll tagged as "not-a-virus:AdWare.180Solutions". Action Taken: No Action Taken.
Wed Jun 29 09:12:23 2005 => File C:\WINNT\system32\msbb.exe tagged as "not-a-virus:AdWare.180Solutions". Action Taken: No Action Taken.
Wed Jun 29 09:12:29 2005 => File C:\WINNT\system32\SWRT01.dll tagged as "not-a-virus:AdWare.VirtualBouncer.g". Action Taken: No Action Taken.
Wed Jun 29 09:12:30 2005 => File C:\WINNT\system32\SWLAD2.dll tagged as "not-a-virus:AdWare.VirtualBouncer.g". Action Taken: No Action Taken.
Wed Jun 29 09:12:30 2005 => File C:\WINNT\system32\SWLAD1.dll tagged as "not-a-virus:AdWare.VirtualBouncer.g". Action Taken: No Action Taken.
Wed Jun 29 09:12:30 2005 => File C:\WINNT\system32\lsp.dll tagged as "not-a-virus:AdWare.Sahat.f". Action Taken: No Action Taken.
Wed Jun 29 09:12:34 2005 => File C:\WINNT\system32\SplWbr.dll tagged as "not-a-virus:AdWare.VirtualBouncer.j". Action Taken: No Action Taken.
Wed Jun 29 09:12:40 2005 => File C:\WINNT\system32\shawn_1.dll tagged as "not-a-virus:AdWare.ToolBar.EliteBar.ac". Action Taken: No Action Taken.
Wed Jun 29 09:12:41 2005 => File C:\WINNT\system32\PopOops2.dll tagged as "not-a-virus:AdWare.VirtualBouncer.g". Action Taken: No Action Taken.
Wed Jun 29 09:12:42 2005 => File C:\WINNT\system32\PopOops.dll tagged as "not-a-virus:AdWare.VirtualBouncer.g". Action Taken: No Action Taken.
Wed Jun 29 09:12:43 2005 => File C:\WINNT\system32\k404SearchSetup_MS17.exe tagged as "not-a-virus:AdWare.ToolBar.404Search.a". Action Taken: No Action Taken.
Wed Jun 29 09:12:46 2005 => File C:\WINNT\system32\ATPartners.dll tagged as "not-a-virus:AdWare.F1Organizer.c". Action Taken: No Action Taken.
Wed Jun 29 09:12:47 2005 => File C:\WINNT\system32\BO2809040510.exe tagged as "not-a-virus:AdWare.VirtualBouncer.d". Action Taken: No Action Taken.
Wed Jun 29 09:13:02 2005 => File C:\WINNT\system32\WebRebates.exe tagged as "not-a-virus:AdWare.WebRebates.g". Action Taken: No Action Taken.
Wed Jun 29 09:13:03 2005 => File C:\WINNT\system32\SahHtml.exe tagged as "not-a-virus:AdWare.Sahat.f". Action Taken: No Action Taken.
Wed Jun 29 09:13:06 2005 => File C:\WINNT\system32\SYSsfitb.dll tagged as "not-a-virus:AdWare.ToolBar.SearchIt.d". Action Taken: No Action Taken.
Wed Jun 29 09:13:22 2005 => File C:\WINNT\system32\SHAgentNew.dll tagged as "not-a-virus:AdWare.Sahat.g". Action Taken: No Action Taken.
Wed Jun 29 09:13:32 2005 => File C:\WINNT\system32\sahagent1018.exe tagged as "not-a-virus:AdWare.Sahat.a". Action Taken: No Action Taken.
Wed Jun 29 09:14:44 2005 => File C:\WINNT\system32\lcinstaller.exe tagged as "not-a-virus:AdWare.WinAD.ab". Action Taken: No Action Taken.
Wed Jun 29 09:14:45 2005 => File C:\WINNT\system32\replaceSearch.dll tagged as "not-a-virus:AdWare.ReSearch.a". Action Taken: No Action Taken.
Wed Jun 29 09:15:59 2005 => File C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\THI13E5.tmp\twaintec.cab tagged as "not-a-virus:AdWare.BiSpy.f". Action Taken: No Action Taken.
Wed Jun 29 09:15:59 2005 => File C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\THI13E5.tmp\twaintec.dll tagged as "not-a-virus:AdWare.BiSpy.f". Action Taken: No Action Taken.
Wed Jun 29 09:15:59 2005 => File C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\THI13E5.tmp\preInsTT.exe tagged as "not-a-virus:AdWare.BiSpy.f". Action Taken: No Action Taken.
Wed Jun 29 09:16:00 2005 => File C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\GLB17.tmp tagged as "not-a-virus:AdWare.VirtualBouncer.j". Action Taken: No Action Taken.
Wed Jun 29 09:16:02 2005 => File C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\DrTemp\ceres.cab tagged as "not-a-virus:AdWare.BetterInternet.d". Action Taken: No Action Taken.
Wed Jun 29 09:16:02 2005 => File C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\DrTemp\ceres.dll tagged as "not-a-virus:AdWare.BetterInternet.d". Action Taken: No Action Taken.
Wed Jun 29 09:16:04 2005 => File C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\drp24.tmp\thnall5c.exe tagged as "not-a-virus:AdWare.BetterInternet". Action Taken: No Action Taken.
Wed Jun 29 09:16:05 2005 => File C:\DOKUME~1\ADMINI~1\LOKALE~1\TEMPOR~1\Content.IE5\K9AV0TU7\thnall5c[1].exe tagged as "not-a-virus:AdWare.BetterInternet". Action Taken: No Action Taken.
Wed Jun 29 09:16:11 2005 => File C:\DOKUME~1\ADMINI~1\LOKALE~1\TEMPOR~1\Content.IE5\GSISLS05\ceres[1].cab tagged as "not-a-virus:AdWare.BetterInternet.d". Action Taken: No Action Taken.
Wed Jun 29 09:20:04 2005 => File C:\WINNT\system32\msbb321.dll tagged as "not-a-virus:AdWare.180Solutions". Action Taken: No Action Taken.
Wed Jun 29 09:20:10 2005 => File C:\WINNT\system32\msbb.exe tagged as "not-a-virus:AdWare.180Solutions". Action Taken: No Action Taken.
Wed Jun 29 09:20:16 2005 => File C:\WINNT\system32\SWRT01.dll tagged as "not-a-virus:AdWare.VirtualBouncer.g". Action Taken: No Action Taken.
Wed Jun 29 09:20:19 2005 => File C:\WINNT\system32\SWLAD2.dll tagged as "not-a-virus:AdWare.VirtualBouncer.g". Action Taken: No Action Taken.
Wed Jun 29 09:20:19 2005 => File C:\WINNT\system32\SWLAD1.dll tagged as "not-a-virus:AdWare.VirtualBouncer.g". Action Taken: No Action Taken.
Wed Jun 29 09:20:19 2005 => File C:\WINNT\system32\lsp.dll tagged as "not-a-virus:AdWare.Sahat.f". Action Taken: No Action Taken.
Wed Jun 29 09:20:23 2005 => File C:\WINNT\system32\SplWbr.dll tagged as "not-a-virus:AdWare.VirtualBouncer.j". Action Taken: No Action Taken.
Wed Jun 29 09:20:29 2005 => File C:\WINNT\system32\shawn_1.dll tagged as "not-a-virus:AdWare.ToolBar.EliteBar.ac". Action Taken: No Action Taken.
Wed Jun 29 09:20:30 2005 => File C:\WINNT\system32\PopOops2.dll tagged as "not-a-virus:AdWare.VirtualBouncer.g". Action Taken: No Action Taken.
Wed Jun 29 09:20:31 2005 => File C:\WINNT\system32\PopOops.dll tagged as "not-a-virus:AdWare.VirtualBouncer.g". Action Taken: No Action Taken.
Wed Jun 29 09:20:33 2005 => File C:\WINNT\system32\k404SearchSetup_MS17.exe tagged as "not-a-virus:AdWare.ToolBar.404Search.a". Action Taken: No Action Taken.
Wed Jun 29 09:20:36 2005 => File C:\WINNT\system32\ATPartners.dll tagged as "not-a-virus:AdWare.F1Organizer.c". Action Taken: No Action Taken.
Wed Jun 29 09:20:37 2005 => File C:\WINNT\system32\BO2809040510.exe tagged as "not-a-virus:AdWare.VirtualBouncer.d". Action Taken: No Action Taken.
Wed Jun 29 09:20:52 2005 => File C:\WINNT\system32\WebRebates.exe tagged as "not-a-virus:AdWare.WebRebates.g". Action Taken: No Action Taken.
Wed Jun 29 09:20:53 2005 => File C:\WINNT\system32\SahHtml.exe tagged as "not-a-virus:AdWare.Sahat.f". Action Taken: No Action Taken.
Wed Jun 29 09:20:56 2005 => File C:\WINNT\system32\SYSsfitb.dll tagged as "not-a-virus:AdWare.ToolBar.SearchIt.d". Action Taken: No Action Taken.
Wed Jun 29 09:21:14 2005 => File C:\WINNT\system32\SHAgentNew.dll tagged as "not-a-virus:AdWare.Sahat.g". Action Taken: No Action Taken.
Wed Jun 29 09:21:32 2005 => File C:\WINNT\system32\sahagent1018.exe tagged as "not-a-virus:AdWare.Sahat.a". Action Taken: No Action Taken.
Wed Jun 29 09:23:21 2005 => File C:\WINNT\system32\lcinstaller.exe tagged as "not-a-virus:AdWare.WinAD.ab". Action Taken: No Action Taken.
Wed Jun 29 09:23:22 2005 => File C:\WINNT\system32\replaceSearch.dll tagged as "not-a-virus:AdWare.ReSearch.a". Action Taken: No Action Taken.
Wed Jun 29 09:31:43 2005 => File C:\WINNT\_MSRSTRT.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Wed Jun 29 09:31:45 2005 => File C:\WINNT\Downloaded Program Files\lsp_.dll tagged as "not-a-virus:AdWare.Sahat.f". Action Taken: No Action Taken.
Wed Jun 29 09:31:45 2005 => File C:\WINNT\Downloaded Program Files\SAHAgent_.exe tagged as "not-a-virus:AdWare.Sahat.d". Action Taken: No Action Taken.
Wed Jun 29 09:31:45 2005 => File C:\WINNT\Downloaded Program Files\SAHUninstall_.exe tagged as "not-a-virus:AdWare.Sahat.f". Action Taken: No Action Taken.
Wed Jun 29 09:31:45 2005 => File C:\WINNT\Downloaded Program Files\SahHtml_.exe tagged as "not-a-virus:AdWare.Sahat.f". Action Taken: No Action Taken.
Wed Jun 29 09:31:46 2005 => File C:\WINNT\Downloaded Program Files\WEBInstaller.dll tagged as "not-a-virus:AdWare.Sahat.c". Action Taken: No Action Taken.
Wed Jun 29 09:32:01 2005 => File C:\WINNT\96wu19rd.exe tagged as "not-a-virus:AdWare.F1Organizer.h". Action Taken: No Action Taken.
Wed Jun 29 09:33:02 2005 => File C:\WINNT\preInsTT.exe tagged as "not-a-virus:AdWare.BiSpy.f". Action Taken: No Action Taken.
Wed Jun 29 09:33:05 2005 => File C:\WINNT\wt\wtbgm\wtbgmtt.exe tagged as "not-a-virus:AdWare.WinAD". Action Taken: No Action Taken.
Wed Jun 29 09:33:05 2005 => File C:\WINNT\wt\wtvh.dll tagged as "not-a-virus:AdWare.WildTangent.b". Action Taken: No Action Taken.
Wed Jun 29 09:33:05 2005 => File C:\WINNT\SAHUninstall.exe tagged as "not-a-virus:AdWare.Sahat.f". Action Taken: No Action Taken.
Wed Jun 29 09:33:06 2005 => File C:\WINNT\snbho.exe tagged as "not-a-virus:AdWare.ToolBar.ImiBar.e". Action Taken: No Action Taken.
Wed Jun 29 09:33:07 2005 => File C:\WINNT\pxckdlauninstall.exe tagged as "not-a-virus:AdWare.BHO.NoName.f". Action Taken: No Action Taken.
Wed Jun 29 09:47:47 2005 => File C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\THI13E5.tmp\twaintec.cab tagged as "not-a-virus:AdWare.BiSpy.f". Action Taken: No Action Taken.
Wed Jun 29 09:47:47 2005 => File C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\THI13E5.tmp\twaintec.dll tagged as "not-a-virus:AdWare.BiSpy.f". Action Taken: No Action Taken.
Wed Jun 29 09:47:47 2005 => File C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\THI13E5.tmp\preInsTT.exe tagged as "not-a-virus:AdWare.BiSpy.f". Action Taken: No Action Taken.
Wed Jun 29 09:47:48 2005 => File C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\GLB17.tmp tagged as "not-a-virus:AdWare.VirtualBouncer.j". Action Taken: No Action Taken.
Wed Jun 29 09:47:50 2005 => File C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\DrTemp\ceres.cab tagged as "not-a-virus:AdWare.BetterInternet.d". Action Taken: No Action Taken.
Wed Jun 29 09:47:50 2005 => File C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\DrTemp\ceres.dll tagged as "not-a-virus:AdWare.BetterInternet.d". Action Taken: No Action Taken.
Wed Jun 29 09:47:52 2005 => File C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\drp24.tmp\thnall5c.exe tagged as "not-a-virus:AdWare.BetterInternet". Action Taken: No Action Taken.
Wed Jun 29 09:47:55 2005 => File C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temporary Internet Files\Content.IE5\K9AV0TU7\thnall5c[1].exe tagged as "not-a-virus:AdWare.BetterInternet". Action Taken: No Action Taken.
Wed Jun 29 09:48:00 2005 => File C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temporary Internet Files\Content.IE5\GSISLS05\ceres[1].cab tagged as "not-a-virus:AdWare.BetterInternet.d". Action Taken: No Action Taken.
Wed Jun 29 11:07:03 2005 => File C:\Programme\Common Files\kfww\kfwwp.exe tagged as "not-a-virus:AdWare.Xupiter.m". Action Taken: No Action Taken.
Wed Jun 29 11:19:10 2005 => File C:\Programme\Web_Rebates\WebRebates1.exe tagged as "not-a-virus:AdWare.WebRebates.b". Action Taken: No Action Taken.
Wed Jun 29 11:19:10 2005 => File C:\Programme\Web_Rebates\disp1150.exe tagged as "not-a-virus:AdWare.WebRebates.b". Action Taken: No Action Taken.
Wed Jun 29 11:19:12 2005 => File C:\Programme\RealVNC\WinVNC\othread2.dll tagged as not-a-virus:RemoteAdmin.Win32.WinVNC-based.c. No Action Taken.
Wed Jun 29 11:22:26 2005 => File C:\Programme\DivX\DivX Pro Codec\Gain_Trickler.exe tagged as "not-a-virus:AdWare.Gator.3202". Action Taken: No Action Taken.
Wed Jun 29 11:23:31 2005 => File C:\Programme\Opera7\Plugins\npwthost.dll tagged as "not-a-virus:AdWare.WildTangent.b". Action Taken: No Action Taken.
Wed Jun 29 11:25:23 2005 => File C:\Programme\Netscape\Netscape\Plugins\npwthost.dll tagged as "not-a-virus:AdWare.WildTangent.b". Action Taken: No Action Taken.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Statistiken:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Wed Jun 29 11:49:21 2005 => Total Virus(es) Found: 176
Wed Jun 29 11:49:21 2005 => Total Errors: 272
Wed Jun 29 11:49:21 2005 => Time Elapsed: 02:41:14
Wed Jun 29 11:49:21 2005 => Total Objects Scanned: 88250
Wed Jun 29 11:49:21 2005 => Virus Database Date: 2005/06/28
Wed Jun 29 12:00:02 2005 => Virus Database Date: 2005/06/28
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
~~~~~~~ © Haui ;-) ~~~~~~~
~~~~~~~ Dank an Cidre ~~~~~~~

Was soll ich jetzt machen?

Vorhin, als ich das mit den zwei Stunden geschrieben hab, war er noch nicht fertig, außerdem hab ich nebenbei noch andere sachen zu tun.

Ja, wie gefragt, was mach ich jetzt?
Ne schnelle Antwort wär toll! Damit ich weiter aufräumen kann..!

Wenn ich überlege, dass ich das daheim noch drei mal machen darf...

Bei dieser Durchseuchung solltest du das System neu aufsetzen.

Ist aber ein Rechner in der Arbeit, ich hab mir nur aus Spaß mal (so ein bisschen) die Zeit genommen, denen mal zu zeigen, warum hier nix funktioniert..
kann ich denn gar nix machen??
Mit System neu aufsetzen kenne ich mich 1. überaupt nicht aus,
2. Macht das hier eh keiner.
Hoffentlich sind meine eigenen Rechner nicht auch so verseucht,
der eine wurde erst neu aufgesetzt..

Sag mir wenigstens, was ich hier fixen muss
Für den Rest können die mich dann mal *g*


Logfile of HijackThis v1.99.1
Scan saved at 13:10:05, on 29.06.2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\msdtc.exe
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\PROGRA~1\DIRECT~1\DUService.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\llssrv.exe
C:\WINNT\System32\mgabg.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\tcpsvcs.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Programme\RealVNC\WinVNC\WinVNC.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\Programme\Gemeinsame Dateien\System\MSSearch\bin\mssearch.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\winnt\system32\gkbmwl.exe
C:\Programme\DirectUpdate\DUControl.exe
C:\PROGRA~1\ICQ\ICQ.exe
C:\PROGRA~1\COMMON~1\kfww\kfwwm.exe
C:\WINNT\sfita.exe
C:\WINNT\system32\acsetups.exe
C:\Programme\sf\sf.exe
C:\Programme\Strokeit\strokeit.exe
C:\PROGRA~1\COMMON~1\kfww\kfwwa.exe
C:\WINNT\system32\cf.exe
C:\WINNT\system32\ermcapt.exe
C:\WINNT\explorer.exe
C:\Programme\Netscape\Netscape\Netscp.exe
C:\WINNT\system32\wuauclt.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\WINNT\System32\mdm.exe
C:\Programme\Web_Rebates\WebRebates0.exe
C:\Programme\Web_Rebates\WebRebates1.exe
C:\Programme\Adobe\Acrobat 5.0\Reader\AcroRd32.exe
C:\Programme\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = h**p://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://h**p://websearch.shopnav.com/...\BI&id=5.20013
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://h**p://websearch.shopnav.com/...\BI&id=5.20013
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://linux/***datenbank/index.php3
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://www.searchforit.com/searchbar
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://h**p://websearch.shopnav.com/...\BI&id=5.20013
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://h**p://websearch.shopnav.com/...\BI&id=5.20013
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = h**p://www.searchforit.com/searchbar
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.shopnav.com/q.cgi?q=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer bereitgestellt von Lycos Europe
R3 - URLSearchHook: IncrediFindBHO Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL
O1 - Hosts: 12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com
O2 - BHO: CeresObj Class - {00000049-8F91-4D9C-9573-F016E7626484} - C:\WINNT\ceres.dll
O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINNT\systb.dll
O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINNT\EliteToolBar\EliteToolBar version 60.dll (file missing)
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINNT\EliteToolBar\EliteToolBar version 60.dll (file missing)
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [gkbmwl] c:\winnt\system32\gkbmwl.exe
O4 - HKLM\..\Run: [checkrun] C:\winnt\system32\eliterhw32.exe
O4 - HKLM\..\Run: [WebRebates0] "C:\Programme\Web_Rebates\WebRebates0.exe"
O4 - HKLM\..\Run: [alchem] C:\WINNT\alchem.exe
O4 - HKLM\..\Run: [Mirabilis ICQ] C:\PROGRA~1\ICQ\ICQNet.exe
O4 - HKLM\..\Run: [DUControl] C:\Programme\DirectUpdate\DUControl.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinVNC] "C:\Programme\RealVNC\WinVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [cf] C:\WINNT\system32\cf.exe
O4 - HKLM\..\Run: [ermcapt] C:\WINNT\system32\ermcapt.exe
O4 - HKLM\..\Run: [Win Server Updt] C:\WINNT\pxckdla.exe
O4 - HKCU\..\Run: [kfww] C:\PROGRA~1\COMMON~1\kfww\kfwwm.exe
O4 - HKCU\..\Run: [sfita] C:\WINNT\sfita.exe
O4 - HKCU\..\Run: [sf] C:\Programme\sf\sf.exe
O4 - HKCU\..\Run: [StrokeIt] C:\Programme\Strokeit\strokeit.exe
O4 - Startup: Virtual Bouncer.lnk = C:\Programme\VBouncer\VirtualBouncer.exe
O4 - Startup: AdDestroyer.lnk = C:\Programme\AdDestroyer\AdDestroyer.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Web Rebates - file://C:\Programme\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: DirectUpdate engine (DirectUpdate) - http://www.directupdate.net/ - C:\PROGRA~1\DIRECT~1\DUService.exe
O23 - Service: Verwaltungsdienst für die Verwaltung logischer Datenträger (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: MGABGEXE - Matrox Graphics Inc. - C:\WINNT\System32\mgabg.exe
O23 - Service: %NVSVC.desc% (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Programme\RealVNC\WinVNC\WinVNC.exe" -service (file missing)

Zitat von cof6656

Ist aber ein Rechner in der Arbeit, ich hab mir nur aus Spaß mal (so ein bisschen) die Zeit genommen, denen mal zu zeigen, warum hier nix funktioniert..

Wende dich an den Admin.

kann ich denn gar nix machen??

Neu aufsetzen.

Mit System neu aufsetzen kenne ich mich 1. überaupt nicht aus,

Deshalb ist da eine Anleitung.

2. Macht das hier eh keiner.

Dann seid so nett und trennt eure Rechner vom Internet.
Um Auto zu fahren braucht man einen Führerschein, aber ins Internet darf jeder...

Sag mir wenigstens, was ich hier fixen muss

Um mal bei den Autos zu bleiben: der Rechner hat einen Totalschaden.

Was heißt hier ins Internet darf jeder?

Ist nun mal nich jeder so klug wie du.
Was kann ich denn dafür, wenn die ihre Rechner nich sicher machen??

Danke schön!!! :aplaus:

Was heißt hier ins Internet darf jeder?

Das sollte aus dem Kontext zu erkennen sein.

Ist nun mal nich jeder so klug wie du.

Da hast du völlig Recht.

Was kann ich denn dafür, wenn die ihre Rechner nich sicher machen??

Wenn es nicht dein Rechner ist: Nichts.

tja da würde ich sagen, bin ich sehr froh, dass es ncht meiner ist ^^

sowas wie nen admin besitzen die hier nicht.
die "firma" hat drei feste mitarbeiter *g*

da ich zu blöd für sowas bin, macht mei paps des immer, der
is ooch admin.

mei du.. der unternimmt nix, hab ihm bescheid gesagt, dass
wahrscheinlich eh alle seine rechner so derb im eimer sind,
aber er meinte nur "läuft doch" *g*

ich denk mir mal meinen teil.
übel ist nur, dass von hier emails etc an kunden verschickt
werden. und dass die hp auch hier erstellt wird.
aber naja. nicht mein problem.

jedenfalls danke, soweit.
ich komme wieder.
(wenn meine rechner dran sind )