Bitte um Hilfe!!!!

AirKnee

Hallo!
Keine Ahnung wieso, aber ich scheine mir bagle.bq eingefangen zu haben (dabei bin ich mir sicher, keine e-Mail Anghänge geöffnet zu haben, die mir nicht wirklich sicher vorgekommen sind). Auf jeden Fall besagt dies eScan in seinem log-file. HIER:



Sat Jul 09 22:39:45 2005 => **********************************************************
Sat Jul 09 22:39:45 2005 => MicroWorld AntiVirus & Spyware Toolkit Utility.
Sat Jul 09 22:39:45 2005 => Copyright © 2003-2005, MicroWorld Technologies Inc.
Sat Jul 09 22:39:45 2005 =>
Sat Jul 09 22:39:45 2005 => Support:
Sat Jul 09 22:39:45 2005 => Web:
Sat Jul 09 22:39:45 2005 => **********************************************************
Sat Jul 09 22:39:45 2005 => Version 6.4.1 (C:\Bases_X\mwavscan.com)
Sat Jul 09 22:39:45 2005 => Log File: C:\Bases_X\MWAV.LOG
Sat Jul 09 22:39:45 2005 => User Account:
Sat Jul 09 22:39:45 2005 => Windows Root Folder:
Sat Jul 09 22:39:45 2005 => Windows Sys32 Folder: C:\WINDOWS\system32
Sat Jul 09 22:39:45 2005 => OS: Windows NT
Sat Jul 09 22:39:45 2005 => Latest Date of files inside MWAV: 09 Jul 2005 14:10:47.

Sat Jul 09 22:39:45 2005 => Options Selected by User:
Sat Jul 09 22:39:45 2005 => Memory Check: Enabled
Sat Jul 09 22:39:45 2005 => Registry Check: Enabled
Sat Jul 09 22:39:45 2005 => StartUp Folder Check: Enabled
Sat Jul 09 22:39:45 2005 => System Folder Check: Enabled
Sat Jul 09 22:39:45 2005 => System Area Check: Disabled
Sat Jul 09 22:39:45 2005 => Services Check: Enabled
Sat Jul 09 22:39:45 2005 => Drive Check: Disabled
Sat Jul 09 22:39:45 2005 => All Drive Check :Enabled
Sat Jul 09 22:39:45 2005 => Folder Check: Disabled



Sat Jul 09 22:40:53 2005 => ***** Scanning Registry and File system for Adware/Spyware *****
Sat Jul 09 22:42:24 2005 => System found infected with CWS.therealsearch Spyware/Adware (waol.exe)! Action taken: No Action Taken.
Sat Jul 09 22:42:24 2005 => Object "CWS.therealsearch Spyware/Adware" found in File System! Action Taken: No Action Taken.



Sat Jul 09 22:43:48 2005 => File C:\WINDOWS\_MSRSTRT.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

Sat Jul 09 22:52:27 2005 => Scanning File C:\Dokumente und Einstellungen\NAme\Anwendungsdaten\Thunderbird\Profiles\fl160j1r.default\Mail\pop.gmx.net\Drafts.msf
Sat Jul 09 22:52:27 2005 => Scanning Folder: C:\Dokumente und Einstellungen\Namel\Anwendungsdaten\Thunderbird\Profiles\fl160j1r.default\Mail\pop.gmx.net\Drafts.sbd\*.*
Sat Jul 09 22:52:27 2005 => Scanning File C:\Dokumente und Einstellungen\Namel\Anwendungsdaten\Thunderbird\Profiles\fl160j1r.default\Mail\pop.gmx.net\Inbox
Sat Jul 09 22:53:53 2005 => File C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Thunderbird\Profiles\fl160j1r.default\Mail\pop.gmx.net\Inbox infected by "Email-Worm.Win32.Bagle.bq" Virus! Action Taken: No Action Taken.


Sat Jul 09 23:22:18 2005 => Scanning File C:\Programme\Pinnacle\Studio 9\OEM\hfx55StudioPatch.exe
Sat Jul 09 23:22:20 2005 => File C:\Programme\Pinnacle\Studio 9\OEM\hfx55StudioPatch.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

Sat Jul 09 23:22:20 2005 => Scanning File C:\Programme\Pinnacle\Studio 9\OEM\hfx55StudioSilent.exe
Sat Jul 09 23:23:13 2005 => File C:\Programme\Pinnacle\Studio 9\OEM\hfx55StudioSilent.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

SSun Jul 10 00:21:57 2005 => File C:\WINDOWS\_MSRSTRT.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.



Sun Jul 10 00:25:10 2005 => ***** Checking for specific ITW Viruses *****
Sun Jul 10 00:25:10 2005 => Checking for Welchia Virus...
Sun Jul 10 00:25:11 2005 => Checking for LovGate Virus...
Sun Jul 10 00:25:11 2005 => Checking for CodeRed Virus...
Sun Jul 10 00:25:11 2005 => Checking for OpaServ Virus...
Sun Jul 10 00:25:11 2005 => Checking for Sobig.e Virus...
Sun Jul 10 00:25:11 2005 => Checking for Winupie Virus...
Sun Jul 10 00:25:11 2005 => Checking for Swen Virus...
Sun Jul 10 00:25:11 2005 => Checking for JS.Fortnight Virus...
Sun Jul 10 00:25:11 2005 => Checking for Novarg Virus...
Sun Jul 10 00:25:11 2005 => Checking for Pagabot Virus...
Sun Jul 10 00:25:11 2005 => Checking for Parite.b Virus...
Sun Jul 10 00:25:11 2005 => Checking for Parite.a Virus...
Sun Jul 10 00:25:11 2005 => Checking for Adware.SeekSeek Virus...

Sun Jul 10 00:25:11 2005 => ***** Scanning complete. *****

Sun Jul 10 00:25:11 2005 => Total Objects Scanned: 53613
Sun Jul 10 00:25:12 2005 => Total Virus(es) Found: 6
Sun Jul 10 00:25:12 2005 => Total Dis

Files: 0
Sun Jul 10 00:25:12 2005 => Total Files Renamed: 0
Sun Jul 10 00:25:12 2005 => Total Deleted Objects: 0
Sun Jul 10 00:25:12 2005 => Total Errors: 305
Sun Jul 10 00:25:12 2005 => Time Elapsed: 01:41:25
Sun Jul 10 00:25:12 2005 => Virus Database Date: 2005/07/09
Sun Jul 10 00:25:12 2005 => Virus Database Count: 138722

Sun Jul 10 00:25:12 2005 => Scan Completed.



Könntet ihr mir BITTE helfen, meine Rechner wieder flott zu bekommen? Anbei noch ein aktuelles HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 11:09:02, on 11.07.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Programme\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Programme\Cisco Systems\VPN Client\cvpnd.exe
C:\Programme\Atguard\iamserv.exe
C:\Programme\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Programme\MSI\AV Wizard\AVExe.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\PROGRA~1\Atguard\iamapp.exe
C:\Programme\CyberLink\PowerCinema\PCMService.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programme\ICQPlus\vplus.exe
C:\Programme\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Programme\Cisco Systems\VPN Client\vpngui.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Dokumente und Einstellungen\Daniel\Desktop\Security\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [KTPWare] C:\Programme\Elantech\ktp3.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AV Wizard] C:\Programme\MSI\AV Wizard\AVExe.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [iamapp] C:\PROGRA~1\Atguard\iamapp.exe
O4 - HKLM\..\Run: [PCMService] "C:\Programme\CyberLink\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [ICQ Plus] "C:\Programme\ICQPlus\vplus.exe"
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Programme\Cisco Systems\VPN Client\vpngui.exe
O8 - Extra context menu item: Easy-WebPrint - Drucken - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint - Vorschau - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Programme\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Programme\ICQ\ICQ.exe
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.targa.de
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http:/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1120496407234
O17 - HKLM\System\CCS\Services\Tcpip\..\{3DF1346F-A82A-4B8E-A309-B15523AB15AC}: Domain = mip.uni-hannover.de
O17 - HKLM\System\CCS\Services\Tcpip\..\{3DF1346F-A82A-4B8E-A309-B15523AB15AC}: NameServer = 130.75.1.32,130.75.1.40
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList =
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList =
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Programme\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Programme\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Programme\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: WRQ IAM (iamServ) - WRQ, Inc. - C:\Programme\Atguard\iamserv.exe



Wäre echt dankbar über entsprechend fachmännische Hilfe