Hallo Ihr Lieben.

vielleicht kann mir jemand von Euch helfen.

Hab mir was Bloedes eingefangen. Entweder Trojaner oder Virus. Mein Virenprogramm Avast hat ploetzlich Alarm geschlagen und ich hatte im Tool-Menue von meinem IE auf einmal das neue Menuitem "Start Spyware Remover" stehen. Ich Idiot hab dann auch noch drauf geklickt und es hat sich dann scheinbar etwas auf meinem Computer installiert.

Jetzt funktionieren ploetzlich IE Links nicht mehr. Wenn ich z.B. eine Googlesuche durchfuehre, muss ich bis zu drei mal auf den Link klicken bis sich die richtige Seite oeffnet, es oeffnen sich zunaechst naemlich irgendwelche anderen Seiten. Seltsam.
Ausserdem habe ich jetzt ein neues Spyware Programm "Kill&Clean", dass ich nie installiert habe.

Meine Virenprogramme sind machtlos. Es scheint irgendein Win32 problem zu sein.

Es waere sehr nett, wenn Ihr mal einen Blick auf meine Logfile werfen koenntet und mir sagen koennt, was ich tun soll. (Ich glaube es hat was mit dem fett-markierten Eintraegen zu tun: Kill&Clean und neue Menuitem) Und bitte bitte Schritt fuer Schritt erklaeren, da ich leider kein wirklicher Computer-Checker bin.

Vielen herzlichen DANK schon mal!
Liebe Gruesse,
Sanne

Hier mein Logfile:

ogfile of HijackThis v1.99.1
Scan saved at 3:06:30 PM, on 7/13/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\vpnunipassau\cvpnd.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\carpserv.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\HPQ\One-Touch\OneTouch.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Plaxo\2.8.1.2\PlaxoHelper.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\WISPTIS.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h*tp://w*w.yahoo.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h*tp://w*w.belgacom.net
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = h*tp://w*w.belgacom.net/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = w*w-cache.rz.uni-passau.de:3128
R3 - URLSearchHook: (no name) - {47DC35B2-F7AC-524D-E928-FF54C5363991} - Testimonials.dll (file missing)
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Messenger\ycomp.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - c:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Messenger\ycomp.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [QT4HPOT] C:\Program Files\HPQ\One-Touch\OneTouch.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ALDI_SUED_FotoSuite_Download] "C:\Program Files\ALDI Sued Foto Service\ALDI_Foto_Service\FotoSuite.exe" /autorun
O4 - HKLM\..\Run: [Device Detection] C:\Program Files\ALDI Süd Foto Service\ALDI Fotobuch Druck Service (Süd)\dd.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.8.1.2\PlaxoHelper.exe -a
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Universitaet Passau VPN Client.lnk = C:\Program Files\vpnunipassau\vpngui.exe
O8 - Extra context menu item: &Google-Suche - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Ins Deutsche übersetzen - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Im Cache gespeicherte Seite - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Verweisseiten - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Ähnliche Seiten - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Start spyware remover - {BF69DF00-2734-477F-8257-27CD04F88779} - C:\Program Files\KillAndClean\KillAndClean.exe (HKCU)
O9 - Extra 'Tools' menuitem: Start spyware remover - {BF69DF00-2734-477F-8257-27CD04F88779} - C:\Program Files\KillAndClean\KillAndClean.exe (HKCU)
O14 - IERESET.INF: START_PAGE_URL=h*tp://w*w.belgacom.net
O16 - DPF: EmailImport - h*tp://w*w.openbc.com/importtool/openBC.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - h*tp://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {35B7E48B-9D81-4C6C-9578-5FD4F620D886} (InstallShield Setup Player 2K2) - h*tps://w*w.openbc.com/sync/setup.exe
O16 - DPF: {FA9740A2-5802-42E2-B509-81186EEB3C42} (WABControl Class) - h*tps://w*w.linkedin.com/cab/wabctrl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{15FB9DDE-1FEB-4B5A-AD16-6A6193021981}: NameServer = 85.255.115.52,85.255.112.85
O17 - HKLM\System\CCS\Services\Tcpip\..\{3FFE7F98-529E-489F-AE7F-5BA4090EA975}: NameServer = 85.255.115.52,85.255.112.85
O17 - HKLM\System\CCS\Services\Tcpip\..\{7B351205-29DC-4BB6-AE6B-793C9F43DF38}: NameServer = 85.255.115.52,85.255.112.85
O17 - HKLM\System\CCS\Services\Tcpip\..\{A10AEC6B-D0BD-4A14-AE9C-F53F325AF378}: NameServer = 85.255.115.52,85.255.112.85
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.115.52 85.255.112.85
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.115.52 85.255.112.85
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.52 85.255.112.85
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\vpnunipassau\cvpnd.exe
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Dass Du Probleme hast, wundert mich nicht:

Logfile of HijackThis v1.99.1
Scan saved at 14:18:12, on 13.07.2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Ungewartetes System, SP2 fehlt ganz.

Dafür hast Du Deinen Provider in der Ukraine.
Es sind auch noch andere Sachen vorhanden. Mache einen escan genau nach Anleitung:

http://www.trojaner-board.de/showthread.php?t=24192

Lieber Felix,

vielen Dank fuer Deine schnelle Antwort:
Ich habe den escan durch gefuehrt. (Allerdings nicht im abgesicherten Modus). Es wurde Wareout Adware gefunden. Was kann ich dagegen tun?
Vielen Dank schon mal fuer die Hilfe!
Sanne

Hier ist die Logfile:

Thu Jul 13 16:41:30 2006 => Scanning File C:\WINDOWS\System32\svchost.exe
Thu Jul 13 16:41:30 2006 => Scanning File C:\WINDOWS\System32\locator.exe
Thu Jul 13 16:41:30 2006 => Scanning File C:\WINDOWS\system32\svchost.exe
Thu Jul 13 16:41:30 2006 => Scanning File C:\WINDOWS\System32\rsvp.exe
Thu Jul 13 16:41:30 2006 => Scanning File C:\WINDOWS\system32\lsass.exe
Thu Jul 13 16:41:30 2006 => Scanning File C:\WINDOWS\System32\DRIVERS\sbp2port.sys
Thu Jul 13 16:41:30 2006 => Scanning File C:\WINDOWS\System32\SCardSvr.exe
Thu Jul 13 16:41:30 2006 => Scanning File C:\WINDOWS\System32\SCardSvr.exe
Thu Jul 13 16:41:30 2006 => Scanning File C:\WINDOWS\System32\svchost.exe
Thu Jul 13 16:41:30 2006 => Scanning File C:\WINDOWS\SYSTEM32\DRIVERS\SDDRIVER.SYS
Thu Jul 13 16:41:30 2006 => Scanning File C:\WINDOWS\System32\DRIVERS\secdrv.sys
Thu Jul 13 16:41:30 2006 => Scanning File C:\WINDOWS\System32\svchost.exe
Thu Jul 13 16:41:30 2006 => Scanning File C:\WINDOWS\system32\svchost.exe
Thu Jul 13 16:41:30 2006 => Scanning File C:\WINDOWS\System32\DRIVERS\serenum.sys
Thu Jul 13 16:41:30 2006 => Scanning File C:\WINDOWS\System32\DRIVERS\serial.sys
Thu Jul 13 16:41:30 2006 => Scanning File C:\WINDOWS\System32\DRIVERS\sfloppy.sys
Thu Jul 13 16:41:30 2006 => Scanning File C:\WINDOWS\System32\svchost.exe
Thu Jul 13 16:41:30 2006 => Scanning File C:\WINDOWS\System32\svchost.exe
Thu Jul 13 16:41:30 2006 => Scanning File C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
Thu Jul 13 16:41:31 2006 => Scanning File C:\WINDOWS\System32\drivers\splitter.sys
Thu Jul 13 16:41:31 2006 => Scanning File C:\WINDOWS\system32\spoolsv.exe
Thu Jul 13 16:41:31 2006 => Scanning File C:\WINDOWS\System32\DRIVERS\sr.sys
Thu Jul 13 16:41:31 2006 => Scanning File C:\WINDOWS\System32\svchost.exe
Thu Jul 13 16:41:31 2006 => Scanning File C:\WINDOWS\System32\DRIVERS\srv.sys
Thu Jul 13 16:41:31 2006 => Scanning File C:\WINDOWS\System32\svchost.exe
Thu Jul 13 16:41:31 2006 => Scanning File C:\WINDOWS\System32\svchost.exe
Thu Jul 13 16:41:31 2006 => Scanning File C:\WINDOWS\System32\DRIVERS\strmdisp.sys
Thu Jul 13 16:41:31 2006 => Scanning File C:\WINDOWS\System32\DRIVERS\swenum.sys
Thu Jul 13 16:41:31 2006 => Scanning File C:\WINDOWS\System32\drivers\swmidi.sys
Thu Jul 13 16:41:31 2006 => Scanning File C:\WINDOWS\System32\dllhost.exe
Thu Jul 13 16:41:31 2006 => Scanning File C:\PROGRA~1\SYMANTEC\SYMEVENT.SYS
Thu Jul 13 16:41:31 2006 => Scanning File C:\PROGRA~1\COMMON~1\SYMANT~1\SECURI~1\SymWSC.exe
Thu Jul 13 16:41:32 2006 => Scanning File C:\WINDOWS\System32\DRIVERS\SynTP.sys
Thu Jul 13 16:41:32 2006 => Scanning File C:\WINDOWS\System32\drivers\sysaudio.sys
Thu Jul 13 16:41:32 2006 => Scanning File C:\WINDOWS\system32\smlogsvc.exe
Thu Jul 13 16:41:32 2006 => Scanning File C:\WINDOWS\System32\svchost.exe
Thu Jul 13 16:41:32 2006 => Scanning File C:\WINDOWS\System32\DRIVERS\tcpip.sys
Thu Jul 13 16:41:32 2006 => Scanning File C:\WINDOWS\System32\DRIVERS\termdd.sys
Thu Jul 13 16:41:32 2006 => Scanning File C:\WINDOWS\System32\svchost.exe
Thu Jul 13 16:41:32 2006 => Scanning File C:\WINDOWS\System32\svchost.exe
Thu Jul 13 16:41:32 2006 => Scanning File C:\WINDOWS\system32\svchost.exe
Thu Jul 13 16:41:32 2006 => Scanning File C:\WINDOWS\System32\wdfmgr.exe
Thu Jul 13 16:41:32 2006 => Scanning File C:\WINDOWS\System32\DRIVERS\update.sys
Thu Jul 13 16:41:32 2006 => Scanning File C:\WINDOWS\System32\svchost.exe
Thu Jul 13 16:41:32 2006 => Scanning File C:\WINDOWS\System32\svchost.exe
Thu Jul 13 16:41:32 2006 => Scanning File C:\WINDOWS\System32\ups.exe
Thu Jul 13 16:41:32 2006 => Scanning File C:\WINDOWS\System32\drivers\usbaudio.sys
Thu Jul 13 16:41:33 2006 => Scanning File C:\WINDOWS\System32\DRIVERS\usbccgp.sys
Thu Jul 13 16:41:33 2006 => Scanning File C:\WINDOWS\System32\DRIVERS\usbehci.sys
Thu Jul 13 16:41:33 2006 => Scanning File C:\WINDOWS\System32\DRIVERS\usbhub.sys
Thu Jul 13 16:41:33 2006 => Scanning File C:\WINDOWS\System32\DRIVERS\usbohci.sys
Thu Jul 13 16:41:33 2006 => Scanning File C:\WINDOWS\System32\DRIVERS\usbprint.sys
Thu Jul 13 16:41:33 2006 => Scanning File C:\WINDOWS\System32\DRIVERS\usbscan.sys
Thu Jul 13 16:41:33 2006 => Scanning File C:\WINDOWS\System32\DRIVERS\Usbsnx2k.SYS
Thu Jul 13 16:41:33 2006 => Scanning File C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS
Thu Jul 13 16:41:33 2006 => Scanning File C:\WINDOWS\System32\DRIVERS\usbuhci.sys
Thu Jul 13 16:41:33 2006 => Scanning File C:\WINDOWS\System32\drivers\vga.sys
Thu Jul 13 16:41:33 2006 => Scanning File C:\WINDOWS\System32\DRIVERS\viaide.sys
Thu Jul 13 16:41:33 2006 => Scanning File C:\WINDOWS\SYSTEM32\VSDATANT.SYS
Thu Jul 13 16:41:34 2006 => Scanning File C:\WINDOWS\System32\vssvc.exe
Thu Jul 13 16:41:34 2006 => Scanning File C:\WINDOWS\System32\svchost.exe
Thu Jul 13 16:41:34 2006 => Scanning File C:\WINDOWS\System32\DRIVERS\wanarp.sys
Thu Jul 13 16:41:34 2006 => Scanning File C:\WINDOWS\System32\drivers\wdmaud.sys
Thu Jul 13 16:41:34 2006 => Scanning File C:\WINDOWS\System32\svchost.exe
Thu Jul 13 16:41:34 2006 => Scanning File C:\WINDOWS\System32\DRIVERS\HSF_CNXT.sys
Thu Jul 13 16:41:34 2006 => Scanning File C:\WINDOWS\system32\svchost.exe
Thu Jul 13 16:41:34 2006 => Scanning File C:\WINDOWS\System32\svchost.exe
Thu Jul 13 16:41:34 2006 => Scanning File C:\WINDOWS\System32\wbem\wmiapsrv.exe
Thu Jul 13 16:41:34 2006 => Scanning File C:\WINDOWS\system32\svchost.exe
Thu Jul 13 16:41:34 2006 => Scanning File C:\WINDOWS\System32\svchost.exe

Thu Jul 13 16:41:34 2006 => Scanning HKLM\SYSTEM\CurrentControlSet\Services\VxD
Thu Jul 13 16:41:34 2006 => Scanning File C:\WINDOWS\system32\JAVASUP.VXD

Thu Jul 13 16:41:35 2006 => ***** Scanning Registry and File system for Adware/Spyware *****
Thu Jul 13 16:41:35 2006 => Loading Spyware Signatures from new External Database (Size: 161733).
Thu Jul 13 16:41:37 2006 => Indexed Spyware Databases Successfully Created...


Thu Jul 13 16:41:46 2006 => System found infected with unspypc Unclassified ({bf69df00-2734-477f-8257-27cd04f88779})! Action taken: No Action Taken.
Thu Jul 13 16:41:56 2006 => Offending Key found: HKLM\Software\Microsoft\Windows\CurrentVersion\uninstall\killandclean !!!
Thu Jul 13 16:41:56 2006 => Object "wareout Adware" found in File System! Action Taken: No Action Taken.

Thu Jul 13 16:41:56 2006 => Offending Key found: HKLM\Software\killandclean !!!
Thu Jul 13 16:41:56 2006 => Object "wareout Adware" found in File System! Action Taken: No Action Taken.

Thu Jul 13 16:41:57 2006 => Offending Key found: HKCU\Software\killandclean !!!
Thu Jul 13 16:41:57 2006 => Object "wareout Adware" found in File System! Action Taken: No Action Taken.

Hallo Sannemitvirenproblem,
Du kannst es kompliziert und schwierig haben,mit Programmen die du nicht kennst und eventuell falsch bedienst.Schlußendlich ,wenn das rum ist,kann dir keiner garantieren,das du wieder sauber bist und alleiniger Chef auf deiner Kiste.
Oder aber du folgst dieser Anleitung :http://www.trojaner-board.de/showthread.php?t=12154
Liest sie dir durch,bei Bedarf auch mehrmals,druckst sie aus und arbeitest dich Punkt für Punkt durch.
Dismissed-entscheide dich
Irrlicht