so da bin ich wieder ich hoffe du bzw. ihr könnt mir jetzt weiter helfen!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\INSTALIERTE SOFTWARE\WICHTIG\ANTIVIR\AVGUARD.EXE
D:\instalierte software\wichtig\antivir\AVWUPSRV.EXE
C:\WINDOWS\Explorer.EXE
D:\instalierte software\wichtig\antivir\AVGNT.EXE
C:\WINDOWS\Mixer.exe
C:\Programme\Java\jre1.5.0_05\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programme\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
D:\instalierte software\wichtig\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\MSN Messenger\MsnMsgr.Exe
C:\Programme\Internet Explorer\iexplore.exe
D:\instalierte software\wichtig\winrar\WinRAR.exe
C:\DOKUME~1\petra\LOKALE~1\Temp\Rar$EX11.2865\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.de/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\instalierte software\wichtig\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [AVGCtrl] D:\instalierte software\wichtig\antivir\AVGNT.EXE /min
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programme\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,ClientStartup -s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\instalierte software\wichtig\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [RauchFrei] "C:\Programme\RauchFrei\RauchFrei.exe"
O4 - HKCU\..\Run: [WhenUSave] "C:\Programme\Save\Save.exe"
O4 - HKCU\..\Run: [WeatherCast] "C:\Programme\WeatherCast\Weather.exe" /q
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_05\bin\npjpi150_05.dll
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF252FF2-6D65-41A4-93FF-F0969260E582}: NameServer = 213.168.112.60 194.8.194.60
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - D:\INSTALIERTE SOFTWARE\WICHTIG\ANTIVIR\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - D:\instalierte software\wichtig\antivir\AVWUPSRV.EXE



hier der escan!

System found infected with bearshare Spyware/Adware ({558ec983-bedb-9168-b2de-31dbf0ee543e})! Action taken: No Action Taken.
Sun Dec 18 14:22:25 2005 => System found infected with bearshare Spyware/Adware ({9f95f736-0f62-4214-a4b4-caa6738d4c07})! Action taken: No Action Taken.
Sun Dec 18 14:22:25 2005 => System found infected with bearshare Spyware/Adware ({5f95e1af-2620-4f15-bdf9-7fdce4607e17})! Action taken: No Action Taken.
Offending file found: C:\WINDOWS\iun6002.exe
Sun Dec 18 14:32:49 2005 => System found infected with zipitpro Spyware/Adware (iun6002.exe)! Action taken: No Action Taken


Offending file found: C:\WINDOWS\TEMP\_istmp2.dir\mydll.dll
Sun Dec 18 14:32:51 2005 => System found infected with advsearch Spyware/Adware (mydll.dll)! Action taken: No Action Taken.

Sun Dec 18 14:32:51 2005 => Offending Folder found: C:\Programme\Gemeinsame Dateien\whenu
Sun Dec 18 14:32:51 2005 => Object "whenu/savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.

Sun Dec 18 14:32:55 2005 => Offending file found: C:\Dokumente und Einstellungen\petra\Desktop\bearshare.lnk
Sun Dec 18 14:32:55 2005 => System found infected with bearshare Spyware/Adware (bearshare.lnk)! Action taken: No Action Taken.

Sun Dec 18 14:32:55 2005 => Offending file found: C:\Dokumente und Einstellungen\petra\Desktop\internet.lnk
Sun Dec 18 14:32:55 2005 => System found infected with ezula Spyware/Adware (internet.lnk)! Action taken: No Action Taken.

Sun Dec 18 14:32:56 2005 => Offending file found: C:\Dokumente und Einstellungen\petra\Lokale Einstellungen\temporary internet files\content.ie5\4hab6n05\show_ads[2].js
Sun Dec 18 14:32:56 2005 => System found infected with whenu.savenow Spyware/Adware (show_ads[2].js)! Action taken: No Action Taken.

Sun Dec 18 14:32:56 2005 => Offending file found: C:\Dokumente und Einstellungen\petra\Lokale Einstellungen\Temporary Internet Files\content.ie5\4hab6n05\show_ads[2].js
Sun Dec 18 14:32:56 2005 => System found infected with whenu.savenow Spyware/Adware (show_ads[2].js)! Action taken: No Action Taken.

Sun Dec 18 14:32:57 2005 => Offending file found: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\bearshare.lnk
Sun Dec 18 14:32:57 2005 => System found infected with bearshare Spyware/Adware (bearshare.lnk)! Action taken: No Action Taken.

Sun Dec 18 14:32:57 2005 => Offending file found: C:\Dokumente und Einstellungen\All Users\Startmenü\programme\bearshare.lnk
Sun Dec 18 14:32:57 2005 => System found infected with bearshare Spyware/Adware (bearshare.lnk)! Action taken: No Action Taken.

Sun Dec 18 14:32:58 2005 => Offending file found: C:\WINDOWS\iun6002.exe
Sun Dec 18 14:32:58 2005 => System found infected with zipitpro Spyware/Adware (C:\WINDOWS\iun6002.exe)! Action taken: No Action Taken.

File D:\instalierte software\wichtig\email\GcMail\Mails\gelöschte Mails.ms1 infected by "Trojan-Spy.HTML.Paylap.gl" Virus! Action Taken: No Action Taken.

Sun Dec 18 15:39:11 2005 => File D:\instalierte software\wichtig\email\GcMail\Mails\Posteingang.ms1 infected by "Trojan-Spy.HTML.Paylap.gl" Virus! Action Taken: No Action Taken.

File D:\software\BSINSTALLDE.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.z". Action Taken: No Action Taken.

File D:\software\GDiVX1.9.9.5.exe tagged as "not-a-virus:AdWare.Win32.NewDotNet". Action Taken: No Action Taken.

File D:\instalierte software\bearshare\Installer\saveinstwm.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.z". Action Taken: No Action Taken.


File D:\instalierte software\bearshare\Installer\BSINSTALLDE.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.z". Action Taken: No Action Taken.

ile C:\Programme\DAEMON Tools\SetupDTSB.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.bi". Action Taken: No Action Taken.

so ist das jetzt gut oder schlecht der hat ja jede menge gefunden!

ich hatte glaub ich einen kleinen fehler gemacht , hier noch mal der log:







Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu/savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.weathercast Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "zipitpro Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "advsearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "advsearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu/savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "ezula Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "zipitpro Spyware/Adware" found in File System! Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\DOKUME~1\petra\LOKALE~1\Temp\enableirsocketutil.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\cmmgr32.exe" refers to invalid object "C:\WINDOWS\System32\cmmgr32.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\HijackThis.exe" refers to invalid object "C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\Rar$EX00.637\hijackthis.exe". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".B5I". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".B5T". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".jad". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".met". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".MIX". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".mp4". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object "OpenWithList". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "New.net". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "WhenUSaveMsg". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{1ADD57B8-A7A9-4518-B9B5-862590FF9EB4}" refers to invalid object "C:\WINDOWS\system32\divxdec.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{1F73E9B1-8C3A-11D0-A3BE-00A0C9244436}" refers to invalid object "C:\WINDOWS\System32\ir50_32.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{2DE89781-DBF6-11D0-A30E-444553540000}" refers to invalid object "C:\WINDOWS\System32\ir50_32.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{30355649-0000-0010-8000-00AA00389B71}" refers to invalid object "C:\WINDOWS\System32\ir50_32.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{38BE3000-DBF4-11D0-860E-00A024CFEF6D}" refers to invalid object "C:\WINDOWS\System32\l3codecx.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{38BE3001-DBF4-11D0-860E-00A024CFEF6D}" refers to invalid object "C:\WINDOWS\System32\l3codecx.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{38BE3002-DBF4-11D0-860E-00A024CFEF6D}" refers to invalid object "C:\WINDOWS\System32\l3codecx.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{665A4443-D905-11D0-A30E-444553540000}" refers to invalid object "C:\WINDOWS\System32\ir50_32.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{665A4444-D905-11D0-A30E-444553540000}" refers to invalid object "C:\WINDOWS\System32\ir50_32.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{665A4445-D905-11D0-A30E-444553540000}" refers to invalid object "C:\WINDOWS\System32\ir50_32.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{665A4448-D905-11D0-A30E-444553540000}" refers to invalid object "C:\WINDOWS\System32\ir50_32.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{665A444A-D905-11D0-A30E-444553540000}" refers to invalid object "C:\WINDOWS\System32\ir50_32.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{78766964-0000-0010-8000-00AA00389B71}" refers to invalid object "C:\WINDOWS\system32\divxdec.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{7D8EA000-731E-11d0-AC50-00AA00BF35C4}" refers to invalid object "C:\WINDOWS\System32\l3codeca.acm". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{84725EA1-2FBC-11D1-BC86-00A0C969FC67}" refers to invalid object "C:\WINDOWS\System32\ir50_32.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{85516702-9C45-4A9C-861B-BC4492D355DC}" refers to invalid object "C:\WINDOWS\system32\DivXMedia.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{8DD6C641-98CB-11D1-9846-00A024CFEF6D}" refers to invalid object "C:\WINDOWS\System32\l3codecx.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A0717E52-8AC8-4dd9-8682-0B76775125E6}" refers to invalid object "C:\WINDOWS\system32\divxsm.exe". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}" refers to invalid object "C:\Programme\Save\ACM.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{AB1D8565-40E9-4616-984D-98465687E82C}" refers to invalid object "C:\Programme\Messenger\msgsc.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B69003B3-C55E-4b48-836C-BC5946FC3B28}" refers to invalid object "C:\Programme\Messenger\msgsc.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{BA11F969-397A-4146-AC96-236C3D76711D}" refers to invalid object "C:\WINDOWS\system32\DivXMedia.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C1C0FE00-F3C2-11D0-91D4-444553540000}" refers to invalid object "C:\WINDOWS\System32\ir50_32.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C55A1680-CD5A-11CF-8D29-444553540000}" refers to invalid object "D:\instalierte software\GDiVX Player\regobj.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C69E8F40-D5C8-11D0-A520-145405C10000}" refers to invalid object "C:\WINDOWS\System32\ivfsrc.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C69E8F41-D5C8-11D0-A520-145405C10000}" refers to invalid object "C:\WINDOWS\System32\ivfsrc.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C69E8F42-D5C8-11D0-A520-145405C10000}" refers to invalid object "C:\WINDOWS\System32\ivfsrc.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C69E8F43-D5C8-11D0-A520-145405C10000}" refers to invalid object "C:\WINDOWS\System32\ivfsrc.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E0B8F398-BB08-4298-87F0-34502693902E}" refers to invalid object ""C:\Programme\Messenger\msmsgs.exe"". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E369A160-F3C2-11D0-91D4-444553540000}" refers to invalid object "C:\WINDOWS\System32\ir50_32.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E3A3B1D9-5675-43c0-BF04-37BE11939FB7}" refers to invalid object ""C:\Programme\Messenger\msmsgs.exe"". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{FB7199AB-79BF-11d2-8D94-0000F875C541}" refers to invalid object "C:\Programme\Messenger\msgsc.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{53CED51D-432B-45B2-A3E0-0CE2C24235D4}" refers to invalid object "C:\Programme\Messenger\msmsgs.exe". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{665A4446-D905-11D0-A30E-444553540000}" refers to invalid object "ir50_32.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{957BF83F-EE5A-42EB-8CE5-6267011F0EF9}" refers to invalid object "C:\WINDOWS\system32\divxsm.tlb". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{DE10C540-810E-11CF-BBE7-444553540000}" refers to invalid object "D:\instalierte software\GDiVX Player\regobj.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}" refers to invalid object "C:\Programme\Save\ACM.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{E02AD29E-80F5-46C6-B416-9B3EBDDF057E}" refers to invalid object "C:\Programme\Messenger\msmsgs.exe". Action Taken: No Action Taken.
Entry "HKCR\.sll" refers to invalid object "SSLFile". Action Taken: No Action Taken.
Entry "HKCR\Alg.AlgSetup" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken.
Entry "HKCR\Alg.AlgSetup.1" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken.
Entry "HKCR\Connection Manager Profile\shell\open\command" refers to invalid object "C:\WINDOWS\System32\CMMGR32.EXE "%1"". Action Taken: No Action Taken.
Entry "HKCR\divFile\shell\open\command" refers to invalid object ""D:\instalierte software\divx\DivX Player\DivX Player.exe" "%1"". Action Taken: No Action Taken.
Entry "HKCR\divxFile\shell\open\command" refers to invalid object ""D:\instalierte software\divx\DivX Player\DivX Player.exe" "%1"". Action Taken: No Action Taken.
Entry "HKCR\divxTicketFile\shell\open\command" refers to invalid object ""D:\instalierte software\divx\DivX Player\DivX Player.exe" "%1"". Action Taken: No Action Taken.
Entry "HKCR\dpsFile\shell\open\command" refers to invalid object ""D:\instalierte software\divx\DivX Player\DivX Player.exe" "%1"". Action Taken: No Action Taken.
Entry "HKCR\dxuFile\shell\open\command" refers to invalid object ""D:\instalierte software\divx\DivX Player\DivX Player.exe" "%1"". Action Taken: No Action Taken.
Entry "HKCR\ed2k\shell\open\command" refers to invalid object ""D:\instalierte software\eMule.de\emule.exe" "%1"". Action Taken: No Action Taken.
Entry "HKCR\FlashGet.Document\shell\open\command" refers to invalid object "D:\INSTAL~1\FlashGet\flashget.exe "%1"". Action Taken: No Action Taken.
Entry "HKCR\Plenoptic.Plenoptic" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.
Entry "HKCR\Plenoptic.Plenoptic.1" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.
Entry "HKCR\ppifile\shell\open\command" refers to invalid object "%SystemRoot%\System32\msppcnfg.exe /Config %1". Action Taken: No Action Taken.
Entry "HKCR\RTCCore.RTCClient" refers to invalid object "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action Taken: No Action Taken.
Entry "HKCR\RTCCore.RTCClient.1" refers to invalid object "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action Taken: No Action Taken.
Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.
Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr.1" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.
Entry "HKCR\WMPShell.HWEventHandler" refers to invalid object "{9B186A8F-F520-4eeb-B553-118304AC46C5}". Action Taken: No Action Taken.
Entry "HKCR\WMPShell.HWEventHandler.1" refers to invalid object "{9B186A8F-F520-4eeb-B553-118304AC46C5}". Action Taken: No Action Taken.
File C:\Programme\DAEMON Tools\SetupDTSB.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.bi". Action Taken: No Action Taken.
File D:\instalierte software\bearshare\Installer\BSINSTALLDE.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.z". Action Taken: No Action Taken.
File D:\instalierte software\bearshare\Installer\saveinstwm.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.z". Action Taken: No Action Taken.
File D:\instalierte software\wichtig\email\GcMail\Mails\gelöschte Mails.ms1 infected by "Trojan-Spy.HTML.Paylap.gl" Virus! Action Taken: No Action Taken.
File D:\instalierte software\wichtig\email\GcMail\Mails\Posteingang.ms1 infected by "Trojan-Spy.HTML.Paylap.gl" Virus! Action Taken: No Action Taken.
File D:\software\BSINSTALLDE.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.z". Action Taken: No Action Taken.
File D:\software\GDiVX1.9.9.5.exe tagged as "not-a-virus:AdWare.Win32.NewDotNet". Action Taken: No Action Taken.

Bitte mach alles so wie ich es geschrieben habe!
Wo sind die Ergebnisse der Online-Scans?
Wieso postest du das eScan-Ergebnis nicht mit der Find.bat?
Hast du die Software überhaupt deinstalliert, bzw. die Einträge mit HijackThis gefixt? Es schaut jedenfalls nich so aus...

hallo haui klar hab ich das so gemacht wie du geschrieben hast, in der beschreibung steht doch ich soll mir die target etc einträge raussuchen und hier reinkopieren! die scan´s von adaware und s&D haben nix mehr gefunden!

Wo ist das Ergebnis der Datei-Überprüfung?
Lies in der eScan-Anleitung bitte den Teil über die Find.bat
Hast du die Einträge bei deaktiviertem TeaTimer gefixt?

hallo ich schicke jetzt mal ein direkt link zu der log.datei. mein kopf ist schon am rauchen

http://service.gmx.net/mc/7CjcF1Vh4x...kaEolR5SeSd5Wo

ich weiß echt nicht mehr weiter jungs bin jetzt völlig auf euch angewiesen!