Hallo!
Vor einigen Tagen hat sich bei mir anscheinend ein Dialer reingeschliechen, den ich nicht wegkriegen konnte. Ich verwende zwar DSL, also ist eine hohe Telefonrechnung nicht zu erwarten, trotzdem ist es sehr lästig, da der Dialer auch noch die Startseite immer wieder auf http://s-redirect.com/?b=n-phil setzt, einige neue Favoriten und unter C:\Dokumente und Einstellungen\roman\Lokale Einstellungen\Temp Dateien wie z.B. l76irtw.exe, 014x8vngt2.exe, cxril1.exe etc erzeugt. Da ich kein Profi bin, bin ich mir nicht sicher, was gefahrlos gelöscht werden kann. Hier ist das HijackThis-Log:

Danke im Voraus für Hilfe!

MfG,
Ilia

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\Programme\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\WFXSVC.EXE
C:\UPS\WorldShip\Wshipservicecom.exe
C:\Programme\Symantec\WinFax\WFXMOD32.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\wfxsnt40.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\Programme\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\system32\winmm64.exe
C:\WINDOWS\syms.exe
C:\WINDOWS\64orms.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\DAP\DAP.EXE
C:\downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://s-redirect.com/?a=2&b=n-phil
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://s-redirect.com/?a=2&b=n-phil
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://s-redirect.com/?a=2&b=n-phil
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://s-redirect.com/?b=n-phil
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://s-redirect.com/?a=2&b=n-phil
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://s-redirect.com/?a=2&b=n-phil
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://s-redirect.com/?a=2&b=n-phil
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://s-redirect.com/?a=2&b=n-phil
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://s-redirect.com/?a=2&b=n-phil
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O1 - Hosts: 66.159.18.187 auto.search.msn.com
O1 - Hosts: 66.159.18.187 search.msn.com
O1 - Hosts: 66.159.18.187 srd.yahoo.com
O1 - Hosts: 66.159.18.187 www.n69.com
O1 - Hosts: 66.159.18.187 www.pillscash.com
O1 - Hosts: 66.159.18.187 cart.penispill.com
O1 - Hosts: 66.159.18.187 www.pillsmoney.com
O1 - Hosts: 66.159.18.187 www.pillmedics.com
O1 - Hosts: 66.159.18.187 www.big-penis.com
O1 - Hosts: 66.159.18.187 www.pluspills1.com
O1 - Hosts: 66.159.18.187 www.morepenis.com
O1 - Hosts: 66.159.18.187 www.1shoppingcart.com
O1 - Hosts: 66.159.18.187 www.herbalo.com
O1 - Hosts: 66.159.18.187 www.penilesecrets.com
O1 - Hosts: 66.159.18.187 www.penispill.com
O1 - Hosts: 66.159.18.187 penismedical.net
O1 - Hosts: 66.159.18.187 www.penismedical.net
O1 - Hosts: 66.159.18.187 www.herbalbucks.com
O1 - Hosts: 66.159.18.187 www.tv69.com
O1 - Hosts: 66.159.18.184 the.sextracker.com
O1 - Hosts: 66.159.18.184 lobby.sexlist.com
O1 - Hosts: 66.159.18.184 in.paycounter.com
O1 - Hosts: 66.159.18.184 adv.sexcounter.com
O1 - Hosts: 66.159.18.184 rd1.hitbox.com
O1 - Hosts: 66.159.18.184 refer.ccbill.com
O1 - Hosts: 66.159.18.184 www.ccbill.com
O1 - Hosts: 66.159.18.184 select.2000charge.com
O1 - Hosts: 66.159.18.184 secure.2000charge.com
O1 - Hosts: 66.159.18.184 www.signup.globill-systems.com
O1 - Hosts: 66.159.18.184 secure.visionbill.net
O1 - Hosts: 66.159.18.184 www.dibill.com
O1 - Hosts: 66.159.18.184 secure.dpbill.com
O1 - Hosts: 66.159.18.184 secure.dutchbilling.com
O1 - Hosts: 66.159.18.184 secure.pswbilling.com
O1 - Hosts: 66.159.18.184 www.maximumcash.com
O1 - Hosts: 66.159.18.184 www.adultrevenueservice.com
O1 - Hosts: 66.159.18.184 www.eroticacash.com
O1 - Hosts: 66.159.18.184 www.oxcash.com
O1 - Hosts: 66.159.18.184 track.oxcash.com
O1 - Hosts: 66.159.18.184 potd.oxcash.com
O1 - Hosts: 66.159.18.184 clicks2.oxcash.com
O1 - Hosts: 66.159.18.184 www.webmastersmakemoney.com
O1 - Hosts: 66.159.18.184 clicks.nastydollars.com
O1 - Hosts: 66.159.18.184 www.lightspeedcash.com
O1 - Hosts: 66.159.18.184 db.fetishcash.com
O1 - Hosts: 66.159.18.184 ctc.amateurpages.com
O1 - Hosts: 66.159.18.184 www2.karupspc.com
O1 - Hosts: 66.159.18.184 www.iteens.com
O1 - Hosts: 66.159.18.184 click.payserve.com
O1 - Hosts: 66.159.18.184 vip.mtree.com
O1 - Hosts: 66.159.18.184 c.fsx.com
O1 - Hosts: 66.159.18.184 adultfriendfinder.com
O1 - Hosts: 66.159.18.184 network.nocreditcard.com
O1 - Hosts: 66.159.18.184 php.offshoreclicks.com
O1 - Hosts: 66.159.18.184 links.lifetimebucks.com
O1 - Hosts: 66.159.18.184 cgi.gammae.com
O1 - Hosts: 66.159.18.184 click.passiondollars.com
O1 - Hosts: 66.159.18.184 www.fatpockets.com
O1 - Hosts: 66.159.18.184 link.siccash.com
O1 - Hosts: 66.159.18.184 www.clickcash.com
O1 - Hosts: 66.159.18.184 www.scoreland.com
O1 - Hosts: 66.159.18.184 www.makingitpay.com
O1 - Hosts: 66.159.18.184 www.hpic.com
O1 - Hosts: 66.159.18.184 referral.topbucks.com
O1 - Hosts: 66.159.18.184 partner.globill-systems.com
O1 - Hosts: 66.159.18.184 www.pornstardollars.com
O1 - Hosts: 66.159.18.184 traffic.acpay.com
O1 - Hosts: 66.159.18.184 www.cashforlink.com
O1 - Hosts: 66.159.18.184 clickcash.webpower.com
O1 - Hosts: 66.159.18.184 www.dollars4babes.com
O1 - Hosts: 66.159.18.184 www.sexfantasyzone.com
O1 - Hosts: 66.159.18.184 www.twistyscash.com
O1 - Hosts: 66.159.18.184 www.freeticketcash.com
O1 - Hosts: 66.159.18.184 www.hawgscash.com
O1 - Hosts: 66.159.18.184 www.freeezinebucks.com
O1 - Hosts: 66.159.18.184 www.nastydollars.com
O1 - Hosts: 66.159.18.184 www.deluxepass.com
O1 - Hosts: 66.159.18.184 clicks.oxcash.com
O1 - Hosts: 66.159.18.184 ww2.amateur-pages.com
O1 - Hosts: 66.159.18.184 stats.allliquid.com
O1 - Hosts: 66.159.18.184 secure1.websitebilling.com
O1 - Hosts: 66.159.18.184 www.adultmovienetwork.com
O1 - Hosts: 66.159.18.184 www.totally4freecash.com
O1 - Hosts: 66.159.18.184 network.nocreditcard.com
O1 - Hosts: 66.159.18.184 php.offshoreclicks.com
O1 - Hosts: 66.159.18.184 www.nocreditcard.com
O1 - Hosts: 66.159.18.184 media.fastclick.net
O1 - Hosts: 66.159.18.184 clicks.uni-cash.com
O1 - Hosts: 66.159.18.184 www.clubpix.com
O1 - Hosts: 66.159.18.184 programs.wegcash.com
O1 - Hosts: 66.159.18.184 in.cybererotica.com
O1 - Hosts: 66.159.18.184 www.cybererotica.com
O1 - Hosts: 66.159.18.184 cybererotica.com
O1 - Hosts: 66.159.18.184 dollartraffic.com
O1 - Hosts: 66.159.18.184 www.xxxesscash.com
O1 - Hosts: 66.159.18.184 www.maturemoney.com
O1 - Hosts: 66.159.18.184 www.xpays.com
O1 - Hosts: 66.159.18.184 www.trueclicks.com
O1 - Hosts: 66.159.18.184 www.sexhit.com
O1 - Hosts: 66.159.18.184 www.blacksonblondes.com
O1 - Hosts: 66.159.18.184 partners.hotgold.com
O2 - BHO: (no name) - {0096CC0A-623C-4829-AD9C-19AF0DC9D8FE} - C:\Programme\DAP\DAPIEBar.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar2.dll (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Programme\DAP\DAPIEBar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll (file missing)
O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Programme\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Programme\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programme\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [service] C:\WINDOWS\services.exe -serv
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [SpywareGuardPlus] C:\WINDOWS\system32\winmm64.exe
O4 - HKCU\..\Run: [syms] C:\WINDOWS\syms.exe
O4 - HKCU\..\Run: [64orms] C:\WINDOWS\64orms.exe
O4 - HKCU\..\Run: [CallerID Monitor] c:\programme\callerid monitor 1.5\callerid.exe
O8 - Extra context menu item: &Google Search - res://c:\programme\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\programme\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programme\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\programme\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\programme\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Run DAP (HKLM)
O9 - Extra button: Recherche-Assistent (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)

Hallo,

überprüfe zunächst einmal diese Dateien bei http://virusscan.jotti.org/de
und poste das Ergebnis:
C:\WINDOWS\syms.exe
C:\WINDOWS\64orms.exe
C:\WINDOWS\services.exe