Hallo jungs ich kanns nicht glauben aber mein pc ist schon wieder am spinnen und zwar hängt er sich jetzt jedes mal auf wenn ich winrar,mediaplayer öffne! why? Ich habe Windoof xp prof.
amd 1200Mhz, 256mb Ram
er lief doich vorher auch immer einwandfrei auf xp! das problem ist aufeinmal gekommen!


ogfile of HijackThis v1.99.1
Scan saved at 11:17:30, on 18.12.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\INSTALIERTE SOFTWARE\WICHTIG\ANTIVIR\AVGUARD.EXE
D:\instalierte software\wichtig\antivir\AVWUPSRV.EXE
C:\WINDOWS\Explorer.EXE
D:\instalierte software\wichtig\antivir\AVGNT.EXE
C:\WINDOWS\Mixer.exe
C:\Programme\Java\jre1.5.0_05\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programme\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
D:\instalierte software\wichtig\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\MSN Messenger\MsnMsgr.Exe
C:\Programme\Internet Explorer\iexplore.exe
D:\instalierte software\wichtig\winrar\WinRAR.exe
C:\DOKUME~1\petra\LOKALE~1\Temp\Rar$EX11.2865\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.de/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\instalierte software\wichtig\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [AVGCtrl] D:\instalierte software\wichtig\antivir\AVGNT.EXE /min
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programme\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,ClientStartup -s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\instalierte software\wichtig\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [RauchFrei] "C:\Programme\RauchFrei\RauchFrei.exe"
O4 - HKCU\..\Run: [WhenUSave] "C:\Programme\Save\Save.exe"
O4 - HKCU\..\Run: [WeatherCast] "C:\Programme\WeatherCast\Weather.exe" /q
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_05\bin\npjpi150_05.dll
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF252FF2-6D65-41A4-93FF-F0969260E582}: NameServer = 213.168.112.60 194.8.194.60
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - D:\INSTALIERTE SOFTWARE\WICHTIG\ANTIVIR\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - D:\instalierte software\wichtig\antivir\AVWUPSRV.EXE

Hallo,

du hast/hattest einiges an Spy- bzw. Adware auf dem System. Es ist durchaus möglich, dass diese für Instabilität deines Systems verantwortlich ist.

RauchFrei.exe

Kennst du das? Hast du es absichtlich installiert? Ich kann es mir nicht vorstellen...
-> Überprüfe diese Datei auf http://virusscan.jotti.org/de und www.virustotal.com und poste das jeweilige Ergebnis.

Lade dir zur Sicherheit LSP-Fix herunter. Solltest du nach der Entfernung von New.Net keine Internetverbindung mehr aufbauen können, musst du die New.Net-Einträge damit entfernen. Wird aber wohl nicht nötig sein.

Deinstalliere dann, falls möglich, die folgenden Anwendungen über Systemsteuerung-> Software

New.Net bzw. NewDotNet
RauchFrei
WhenUSave, SaveNow o.ä
WeatherCast

Starte den PC im abgesicherten Modus.
Scanne mit einem aktualisierten Spybot S&D und Ad-Aware und lass alle Probleme beheben.

Achte darauf, dass der TeaTimer von Spybot S&D deaktiviert ist!

Fixe mit HijackThis:

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,ClientStartup -s
O4 - HKCU\..\Run: [RauchFrei] "C:\Programme\RauchFrei\RauchFrei.exe"
O4 - HKCU\..\Run: [WhenUSave] "C:\Programme\Save\Save.exe"
O4 - HKCU\..\Run: [WeatherCast] "C:\Programme\WeatherCast\Weather.exe" /q

Lösche diese Verzeichnisse im Windows-Explorer:

C:\Programme\NewDotNet
C:\Programme\RauchFrei
C:\Programme\Save\
C:\Programme\WeatherCast

Lösche die temporären Dateien von Windows und vom Internet Explorer mit ClearProg.

Scanne wie beschrieben mit eScan.

Poste die Ergebnisse von eScan (-> Find.bat) und ein neues HijackThis-Logfile. Außderdem bitte noch das jeweils mehrzeilige Ergebnis des Datei-Scans.

so da bin ich wieder ich hoffe du bzw. ihr könnt mir jetzt weiter helfen!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\INSTALIERTE SOFTWARE\WICHTIG\ANTIVIR\AVGUARD.EXE
D:\instalierte software\wichtig\antivir\AVWUPSRV.EXE
C:\WINDOWS\Explorer.EXE
D:\instalierte software\wichtig\antivir\AVGNT.EXE
C:\WINDOWS\Mixer.exe
C:\Programme\Java\jre1.5.0_05\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programme\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
D:\instalierte software\wichtig\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\MSN Messenger\MsnMsgr.Exe
C:\Programme\Internet Explorer\iexplore.exe
D:\instalierte software\wichtig\winrar\WinRAR.exe
C:\DOKUME~1\petra\LOKALE~1\Temp\Rar$EX11.2865\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.de/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\instalierte software\wichtig\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [AVGCtrl] D:\instalierte software\wichtig\antivir\AVGNT.EXE /min
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programme\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,ClientStartup -s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\instalierte software\wichtig\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [RauchFrei] "C:\Programme\RauchFrei\RauchFrei.exe"
O4 - HKCU\..\Run: [WhenUSave] "C:\Programme\Save\Save.exe"
O4 - HKCU\..\Run: [WeatherCast] "C:\Programme\WeatherCast\Weather.exe" /q
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_05\bin\npjpi150_05.dll
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF252FF2-6D65-41A4-93FF-F0969260E582}: NameServer = 213.168.112.60 194.8.194.60
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - D:\INSTALIERTE SOFTWARE\WICHTIG\ANTIVIR\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - D:\instalierte software\wichtig\antivir\AVWUPSRV.EXE



hier der escan!

System found infected with bearshare Spyware/Adware ({558ec983-bedb-9168-b2de-31dbf0ee543e})! Action taken: No Action Taken.
Sun Dec 18 14:22:25 2005 => System found infected with bearshare Spyware/Adware ({9f95f736-0f62-4214-a4b4-caa6738d4c07})! Action taken: No Action Taken.
Sun Dec 18 14:22:25 2005 => System found infected with bearshare Spyware/Adware ({5f95e1af-2620-4f15-bdf9-7fdce4607e17})! Action taken: No Action Taken.
Offending file found: C:\WINDOWS\iun6002.exe
Sun Dec 18 14:32:49 2005 => System found infected with zipitpro Spyware/Adware (iun6002.exe)! Action taken: No Action Taken


Offending file found: C:\WINDOWS\TEMP\_istmp2.dir\mydll.dll
Sun Dec 18 14:32:51 2005 => System found infected with advsearch Spyware/Adware (mydll.dll)! Action taken: No Action Taken.

Sun Dec 18 14:32:51 2005 => Offending Folder found: C:\Programme\Gemeinsame Dateien\whenu
Sun Dec 18 14:32:51 2005 => Object "whenu/savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.

Sun Dec 18 14:32:55 2005 => Offending file found: C:\Dokumente und Einstellungen\petra\Desktop\bearshare.lnk
Sun Dec 18 14:32:55 2005 => System found infected with bearshare Spyware/Adware (bearshare.lnk)! Action taken: No Action Taken.

Sun Dec 18 14:32:55 2005 => Offending file found: C:\Dokumente und Einstellungen\petra\Desktop\internet.lnk
Sun Dec 18 14:32:55 2005 => System found infected with ezula Spyware/Adware (internet.lnk)! Action taken: No Action Taken.

Sun Dec 18 14:32:56 2005 => Offending file found: C:\Dokumente und Einstellungen\petra\Lokale Einstellungen\temporary internet files\content.ie5\4hab6n05\show_ads[2].js
Sun Dec 18 14:32:56 2005 => System found infected with whenu.savenow Spyware/Adware (show_ads[2].js)! Action taken: No Action Taken.

Sun Dec 18 14:32:56 2005 => Offending file found: C:\Dokumente und Einstellungen\petra\Lokale Einstellungen\Temporary Internet Files\content.ie5\4hab6n05\show_ads[2].js
Sun Dec 18 14:32:56 2005 => System found infected with whenu.savenow Spyware/Adware (show_ads[2].js)! Action taken: No Action Taken.

Sun Dec 18 14:32:57 2005 => Offending file found: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\bearshare.lnk
Sun Dec 18 14:32:57 2005 => System found infected with bearshare Spyware/Adware (bearshare.lnk)! Action taken: No Action Taken.

Sun Dec 18 14:32:57 2005 => Offending file found: C:\Dokumente und Einstellungen\All Users\Startmenü\programme\bearshare.lnk
Sun Dec 18 14:32:57 2005 => System found infected with bearshare Spyware/Adware (bearshare.lnk)! Action taken: No Action Taken.

Sun Dec 18 14:32:58 2005 => Offending file found: C:\WINDOWS\iun6002.exe
Sun Dec 18 14:32:58 2005 => System found infected with zipitpro Spyware/Adware (C:\WINDOWS\iun6002.exe)! Action taken: No Action Taken.

File D:\instalierte software\wichtig\email\GcMail\Mails\gelöschte Mails.ms1 infected by "Trojan-Spy.HTML.Paylap.gl" Virus! Action Taken: No Action Taken.

Sun Dec 18 15:39:11 2005 => File D:\instalierte software\wichtig\email\GcMail\Mails\Posteingang.ms1 infected by "Trojan-Spy.HTML.Paylap.gl" Virus! Action Taken: No Action Taken.

File D:\software\BSINSTALLDE.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.z". Action Taken: No Action Taken.

File D:\software\GDiVX1.9.9.5.exe tagged as "not-a-virus:AdWare.Win32.NewDotNet". Action Taken: No Action Taken.

File D:\instalierte software\bearshare\Installer\saveinstwm.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.z". Action Taken: No Action Taken.


File D:\instalierte software\bearshare\Installer\BSINSTALLDE.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.z". Action Taken: No Action Taken.

ile C:\Programme\DAEMON Tools\SetupDTSB.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.bi". Action Taken: No Action Taken.

so ist das jetzt gut oder schlecht der hat ja jede menge gefunden!

ich hatte glaub ich einen kleinen fehler gemacht , hier noch mal der log:







Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu/savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.weathercast Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "zipitpro Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "advsearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "advsearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu/savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "ezula Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "zipitpro Spyware/Adware" found in File System! Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\DOKUME~1\petra\LOKALE~1\Temp\enableirsocketutil.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\cmmgr32.exe" refers to invalid object "C:\WINDOWS\System32\cmmgr32.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\HijackThis.exe" refers to invalid object "C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\Rar$EX00.637\hijackthis.exe". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".B5I". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".B5T". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".jad". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".met". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".MIX". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".mp4". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object "OpenWithList". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "New.net". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "WhenUSaveMsg". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{1ADD57B8-A7A9-4518-B9B5-862590FF9EB4}" refers to invalid object "C:\WINDOWS\system32\divxdec.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{1F73E9B1-8C3A-11D0-A3BE-00A0C9244436}" refers to invalid object "C:\WINDOWS\System32\ir50_32.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{2DE89781-DBF6-11D0-A30E-444553540000}" refers to invalid object "C:\WINDOWS\System32\ir50_32.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{30355649-0000-0010-8000-00AA00389B71}" refers to invalid object "C:\WINDOWS\System32\ir50_32.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{38BE3000-DBF4-11D0-860E-00A024CFEF6D}" refers to invalid object "C:\WINDOWS\System32\l3codecx.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{38BE3001-DBF4-11D0-860E-00A024CFEF6D}" refers to invalid object "C:\WINDOWS\System32\l3codecx.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{38BE3002-DBF4-11D0-860E-00A024CFEF6D}" refers to invalid object "C:\WINDOWS\System32\l3codecx.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{665A4443-D905-11D0-A30E-444553540000}" refers to invalid object "C:\WINDOWS\System32\ir50_32.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{665A4444-D905-11D0-A30E-444553540000}" refers to invalid object "C:\WINDOWS\System32\ir50_32.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{665A4445-D905-11D0-A30E-444553540000}" refers to invalid object "C:\WINDOWS\System32\ir50_32.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{665A4448-D905-11D0-A30E-444553540000}" refers to invalid object "C:\WINDOWS\System32\ir50_32.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{665A444A-D905-11D0-A30E-444553540000}" refers to invalid object "C:\WINDOWS\System32\ir50_32.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{78766964-0000-0010-8000-00AA00389B71}" refers to invalid object "C:\WINDOWS\system32\divxdec.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{7D8EA000-731E-11d0-AC50-00AA00BF35C4}" refers to invalid object "C:\WINDOWS\System32\l3codeca.acm". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{84725EA1-2FBC-11D1-BC86-00A0C969FC67}" refers to invalid object "C:\WINDOWS\System32\ir50_32.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{85516702-9C45-4A9C-861B-BC4492D355DC}" refers to invalid object "C:\WINDOWS\system32\DivXMedia.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{8DD6C641-98CB-11D1-9846-00A024CFEF6D}" refers to invalid object "C:\WINDOWS\System32\l3codecx.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A0717E52-8AC8-4dd9-8682-0B76775125E6}" refers to invalid object "C:\WINDOWS\system32\divxsm.exe". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}" refers to invalid object "C:\Programme\Save\ACM.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{AB1D8565-40E9-4616-984D-98465687E82C}" refers to invalid object "C:\Programme\Messenger\msgsc.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B69003B3-C55E-4b48-836C-BC5946FC3B28}" refers to invalid object "C:\Programme\Messenger\msgsc.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{BA11F969-397A-4146-AC96-236C3D76711D}" refers to invalid object "C:\WINDOWS\system32\DivXMedia.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C1C0FE00-F3C2-11D0-91D4-444553540000}" refers to invalid object "C:\WINDOWS\System32\ir50_32.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C55A1680-CD5A-11CF-8D29-444553540000}" refers to invalid object "D:\instalierte software\GDiVX Player\regobj.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C69E8F40-D5C8-11D0-A520-145405C10000}" refers to invalid object "C:\WINDOWS\System32\ivfsrc.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C69E8F41-D5C8-11D0-A520-145405C10000}" refers to invalid object "C:\WINDOWS\System32\ivfsrc.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C69E8F42-D5C8-11D0-A520-145405C10000}" refers to invalid object "C:\WINDOWS\System32\ivfsrc.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C69E8F43-D5C8-11D0-A520-145405C10000}" refers to invalid object "C:\WINDOWS\System32\ivfsrc.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E0B8F398-BB08-4298-87F0-34502693902E}" refers to invalid object ""C:\Programme\Messenger\msmsgs.exe"". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E369A160-F3C2-11D0-91D4-444553540000}" refers to invalid object "C:\WINDOWS\System32\ir50_32.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E3A3B1D9-5675-43c0-BF04-37BE11939FB7}" refers to invalid object ""C:\Programme\Messenger\msmsgs.exe"". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{FB7199AB-79BF-11d2-8D94-0000F875C541}" refers to invalid object "C:\Programme\Messenger\msgsc.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{53CED51D-432B-45B2-A3E0-0CE2C24235D4}" refers to invalid object "C:\Programme\Messenger\msmsgs.exe". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{665A4446-D905-11D0-A30E-444553540000}" refers to invalid object "ir50_32.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{957BF83F-EE5A-42EB-8CE5-6267011F0EF9}" refers to invalid object "C:\WINDOWS\system32\divxsm.tlb". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{DE10C540-810E-11CF-BBE7-444553540000}" refers to invalid object "D:\instalierte software\GDiVX Player\regobj.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}" refers to invalid object "C:\Programme\Save\ACM.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{E02AD29E-80F5-46C6-B416-9B3EBDDF057E}" refers to invalid object "C:\Programme\Messenger\msmsgs.exe". Action Taken: No Action Taken.
Entry "HKCR\.sll" refers to invalid object "SSLFile". Action Taken: No Action Taken.
Entry "HKCR\Alg.AlgSetup" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken.
Entry "HKCR\Alg.AlgSetup.1" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken.
Entry "HKCR\Connection Manager Profile\shell\open\command" refers to invalid object "C:\WINDOWS\System32\CMMGR32.EXE "%1"". Action Taken: No Action Taken.
Entry "HKCR\divFile\shell\open\command" refers to invalid object ""D:\instalierte software\divx\DivX Player\DivX Player.exe" "%1"". Action Taken: No Action Taken.
Entry "HKCR\divxFile\shell\open\command" refers to invalid object ""D:\instalierte software\divx\DivX Player\DivX Player.exe" "%1"". Action Taken: No Action Taken.
Entry "HKCR\divxTicketFile\shell\open\command" refers to invalid object ""D:\instalierte software\divx\DivX Player\DivX Player.exe" "%1"". Action Taken: No Action Taken.
Entry "HKCR\dpsFile\shell\open\command" refers to invalid object ""D:\instalierte software\divx\DivX Player\DivX Player.exe" "%1"". Action Taken: No Action Taken.
Entry "HKCR\dxuFile\shell\open\command" refers to invalid object ""D:\instalierte software\divx\DivX Player\DivX Player.exe" "%1"". Action Taken: No Action Taken.
Entry "HKCR\ed2k\shell\open\command" refers to invalid object ""D:\instalierte software\eMule.de\emule.exe" "%1"". Action Taken: No Action Taken.
Entry "HKCR\FlashGet.Document\shell\open\command" refers to invalid object "D:\INSTAL~1\FlashGet\flashget.exe "%1"". Action Taken: No Action Taken.
Entry "HKCR\Plenoptic.Plenoptic" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.
Entry "HKCR\Plenoptic.Plenoptic.1" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.
Entry "HKCR\ppifile\shell\open\command" refers to invalid object "%SystemRoot%\System32\msppcnfg.exe /Config %1". Action Taken: No Action Taken.
Entry "HKCR\RTCCore.RTCClient" refers to invalid object "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action Taken: No Action Taken.
Entry "HKCR\RTCCore.RTCClient.1" refers to invalid object "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action Taken: No Action Taken.
Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.
Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr.1" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.
Entry "HKCR\WMPShell.HWEventHandler" refers to invalid object "{9B186A8F-F520-4eeb-B553-118304AC46C5}". Action Taken: No Action Taken.
Entry "HKCR\WMPShell.HWEventHandler.1" refers to invalid object "{9B186A8F-F520-4eeb-B553-118304AC46C5}". Action Taken: No Action Taken.
File C:\Programme\DAEMON Tools\SetupDTSB.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.bi". Action Taken: No Action Taken.
File D:\instalierte software\bearshare\Installer\BSINSTALLDE.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.z". Action Taken: No Action Taken.
File D:\instalierte software\bearshare\Installer\saveinstwm.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.z". Action Taken: No Action Taken.
File D:\instalierte software\wichtig\email\GcMail\Mails\gelöschte Mails.ms1 infected by "Trojan-Spy.HTML.Paylap.gl" Virus! Action Taken: No Action Taken.
File D:\instalierte software\wichtig\email\GcMail\Mails\Posteingang.ms1 infected by "Trojan-Spy.HTML.Paylap.gl" Virus! Action Taken: No Action Taken.
File D:\software\BSINSTALLDE.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.z". Action Taken: No Action Taken.
File D:\software\GDiVX1.9.9.5.exe tagged as "not-a-virus:AdWare.Win32.NewDotNet". Action Taken: No Action Taken.

Bitte mach alles so wie ich es geschrieben habe!
Wo sind die Ergebnisse der Online-Scans?
Wieso postest du das eScan-Ergebnis nicht mit der Find.bat?
Hast du die Software überhaupt deinstalliert, bzw. die Einträge mit HijackThis gefixt? Es schaut jedenfalls nich so aus...

hallo haui klar hab ich das so gemacht wie du geschrieben hast, in der beschreibung steht doch ich soll mir die target etc einträge raussuchen und hier reinkopieren! die scan´s von adaware und s&D haben nix mehr gefunden!

Wo ist das Ergebnis der Datei-Überprüfung?
Lies in der eScan-Anleitung bitte den Teil über die Find.bat
Hast du die Einträge bei deaktiviertem TeaTimer gefixt?

hallo ich schicke jetzt mal ein direkt link zu der log.datei. mein kopf ist schon am rauchen

http://service.gmx.net/mc/7CjcF1Vh4x...kaEolR5SeSd5Wo

ich weiß echt nicht mehr weiter jungs bin jetzt völlig auf euch angewiesen!

Bitte nimm dir die Zeit und lies die Anleitungen und das was ich geschrieben habe aufmerksam durch. So kommen wir jedenfalls nicht weiter...

P.S. Ich habe weder die Zeit noch Lust dazu dein 3mb großes Log auszuwerten...
In der Anleitung ist beschrieben, wie man die Zusammenfassung erstellt!

wo find ich den die find.bat!

die ist in keinem ordner endhalten

s. Fußnote [5]

erstmal danke haui für deine geduld, jetzt hab auch ich das kapiert hier der log!



Funde für "infected"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Sun Dec 18 14:22:25 2005 => System found infected with bearshare Spyware/Adware ({558ec983-bedb-9168-b2de-31dbf0ee543e})! Action taken: No Action Taken.
Sun Dec 18 14:22:25 2005 => System found infected with bearshare Spyware/Adware ({9f95f736-0f62-4214-a4b4-caa6738d4c07})! Action taken: No Action Taken.
Sun Dec 18 14:22:25 2005 => System found infected with bearshare Spyware/Adware ({5f95e1af-2620-4f15-bdf9-7fdce4607e17})! Action taken: No Action Taken.
Sun Dec 18 14:23:00 2005 => Total Disinfected Files: 0
Sun Dec 18 14:23:47 2005 => System found infected with bearshare Spyware/Adware ({905d0df2-3a0a-4d94-853c-54a12a745905})! Action taken: No Action Taken.
Sun Dec 18 14:32:46 2005 => System found infected with bearshare Spyware/Adware ({558ec983-bedb-9168-b2de-31dbf0ee543e})! Action taken: No Action Taken.
Sun Dec 18 14:32:46 2005 => System found infected with bearshare Spyware/Adware ({9f95f736-0f62-4214-a4b4-caa6738d4c07})! Action taken: No Action Taken.
Sun Dec 18 14:32:46 2005 => System found infected with bearshare Spyware/Adware ({5f95e1af-2620-4f15-bdf9-7fdce4607e17})! Action taken: No Action Taken.
Sun Dec 18 14:32:46 2005 => System found infected with bearshare Spyware/Adware ({905d0df2-3a0a-4d94-853c-54a12a745905})! Action taken: No Action Taken.
Sun Dec 18 14:32:47 2005 => System found infected with whenu.savenow Spyware/Adware ({c285d18d-43a2-4aef-83fb-bf280e660a97})! Action taken: No Action Taken.
Sun Dec 18 14:32:49 2005 => System found infected with zipitpro Spyware/Adware (iun6002.exe)! Action taken: No Action Taken.
Sun Dec 18 14:32:50 2005 => System found infected with advsearch Spyware/Adware (mydll.dll)! Action taken: No Action Taken.
Sun Dec 18 14:32:51 2005 => System found infected with advsearch Spyware/Adware (mydll.dll)! Action taken: No Action Taken.
Sun Dec 18 14:32:55 2005 => System found infected with bearshare Spyware/Adware (bearshare.lnk)! Action taken: No Action Taken.
Sun Dec 18 14:32:55 2005 => System found infected with ezula Spyware/Adware (internet.lnk)! Action taken: No Action Taken.
Sun Dec 18 14:32:56 2005 => System found infected with whenu.savenow Spyware/Adware (show_ads[2].js)! Action taken: No Action Taken.
Sun Dec 18 14:32:56 2005 => System found infected with whenu.savenow Spyware/Adware (show_ads[2].js)! Action taken: No Action Taken.
Sun Dec 18 14:32:57 2005 => System found infected with bearshare Spyware/Adware (bearshare.lnk)! Action taken: No Action Taken.
Sun Dec 18 14:32:57 2005 => System found infected with bearshare Spyware/Adware (bearshare.lnk)! Action taken: No Action Taken.
Sun Dec 18 14:32:58 2005 => System found infected with zipitpro Spyware/Adware (C:\WINDOWS\iun6002.exe)! Action taken: No Action Taken.
Sun Dec 18 15:37:42 2005 => Scanning Folder: D:\instalierte software\wichtig\antivir\INFECTED\*.*
Sun Dec 18 15:38:45 2005 => File D:\instalierte software\wichtig\email\GcMail\Mails\gelöschte Mails.ms1 infected by "Trojan-Spy.HTML.Paylap.gl" Virus! Action Taken: No Action Taken.
Sun Dec 18 15:39:11 2005 => File D:\instalierte software\wichtig\email\GcMail\Mails\Posteingang.ms1 infected by "Trojan-Spy.HTML.Paylap.gl" Virus! Action Taken: No Action Taken.
Sun Dec 18 15:43:42 2005 => Total Disinfected Files: 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Funde für "tagged"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Sun Dec 18 14:36:55 2005 => File C:\Programme\DAEMON Tools\SetupDTSB.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.bi". Action Taken: No Action Taken.
Sun Dec 18 15:12:16 2005 => File D:\instalierte software\bearshare\Installer\BSINSTALLDE.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.z". Action Taken: No Action Taken.
Sun Dec 18 15:12:16 2005 => File D:\instalierte software\bearshare\Installer\saveinstwm.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.z". Action Taken: No Action Taken.
Sun Dec 18 15:42:18 2005 => File D:\software\BSINSTALLDE.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.z". Action Taken: No Action Taken.
Sun Dec 18 15:43:12 2005 => File D:\software\GDiVX1.9.9.5.exe tagged as "not-a-virus:AdWare.Win32.NewDotNet". Action Taken: No Action Taken.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Funde für "offending"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Sun Dec 18 14:32:48 2005 => Offending Key found: HKLM\Software\Microsoft\Windows\CurrentVersion\uninstall\bearshare !!!
Sun Dec 18 14:32:48 2005 => Offending Key found: HKCU\appevents\eventlabels\bearsharechatnotifymsg !!!
Sun Dec 18 14:32:48 2005 => Offending Key found: HKCU\appevents\schemes\apps\bearshare !!!
Sun Dec 18 14:32:48 2005 => Offending Key found: HKLM\Software\magnet\handlers\bearshare !!!
Sun Dec 18 14:32:48 2005 => Offending Key found: HKLM\Software\bearshare !!!
Sun Dec 18 14:32:48 2005 => Offending value found in HKCU\Software\Microsoft\Windows\CurrentVersion\Run: whenusave !!!
Sun Dec 18 14:32:48 2005 => Offending value found in HKCU\Software\Microsoft\Windows\CurrentVersion\Run: weathercast !!!
Sun Dec 18 14:32:48 2005 => Offending value found in HKLM\Software\Licenses: {i56b3cf0d9ab991e1} !!!
Sun Dec 18 14:32:48 2005 => Offending value found in HKLM\Software\Licenses: {056b3cf0d9ab991e1} !!!
Sun Dec 18 14:32:49 2005 => Offending file found: C:\WINDOWS\iun6002.exe
Sun Dec 18 14:32:50 2005 => Offending file found: C:\WINDOWS\TEMP\_istmp1.dir\mydll.dll
Sun Dec 18 14:32:51 2005 => Offending file found: C:\WINDOWS\TEMP\_istmp2.dir\mydll.dll
Sun Dec 18 14:32:51 2005 => Offending Folder found: C:\Programme\Gemeinsame Dateien\whenu
Sun Dec 18 14:32:55 2005 => Offending file found: C:\Dokumente und Einstellungen\petra\Desktop\bearshare.lnk
Sun Dec 18 14:32:55 2005 => Offending file found: C:\Dokumente und Einstellungen\petra\Desktop\internet.lnk
Sun Dec 18 14:32:56 2005 => Offending file found: C:\Dokumente und Einstellungen\petra\Lokale Einstellungen\temporary internet files\content.ie5\4hab6n05\show_ads[2].js
Sun Dec 18 14:32:56 2005 => Offending file found: C:\Dokumente und Einstellungen\petra\Lokale Einstellungen\Temporary Internet Files\content.ie5\4hab6n05\show_ads[2].js
Sun Dec 18 14:32:57 2005 => Offending file found: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\bearshare.lnk
Sun Dec 18 14:32:57 2005 => Offending file found: C:\Dokumente und Einstellungen\All Users\Startmenü\programme\bearshare.lnk
Sun Dec 18 14:32:58 2005 => Offending file found: C:\WINDOWS\iun6002.exe
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Statistiken:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Sun Dec 18 14:23:00 2005 => Total Virus(es) Found: 3
Sun Dec 18 15:43:42 2005 => Total Virus(es) Found: 32
Sun Dec 18 14:23:00 2005 => Total Errors: 0
Sun Dec 18 15:43:42 2005 => Total Errors: 109
Sun Dec 18 14:23:00 2005 => Time Elapsed: 00:01:19
Sun Dec 18 15:43:42 2005 => Time Elapsed: 01:11:51
Sun Dec 18 14:23:00 2005 => Total Objects Scanned: 600
Sun Dec 18 15:43:42 2005 => Total Objects Scanned: 46425
Sun Dec 18 14:13:29 2005 => Virus Database Date: 2005/12/12
Sun Dec 18 14:14:11 2005 => Virus Database Date: 2005/12/18
Sun Dec 18 14:21:22 2005 => Virus Database Date: 2005/12/18
Sun Dec 18 14:23:04 2005 => Virus Database Date: 2005/12/18
Sun Dec 18 14:30:53 2005 => Virus Database Date: 2005/12/18
Sun Dec 18 15:43:42 2005 => Virus Database Date: 2005/12/18
Sun Dec 18 16:19:11 2005 => Virus Database Date: 2005/12/18
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

und wird jemand hieraus schlau`?

habe glaub ich einen großen hinweis:aplaus: und zwar, habe ich mal den taskmanager gestartet und bin dann in den icoming ordner gegangen und siehe die auslagerungsdatei steigt und steigt und steigt von selbst über 1000mb usw, ohne das ich irgend eine datei öffne! könnte das der fehler sein und wenn ja wie beseitige ich dies?