Folgende Einträge Fixen.(Du kannst auch das ganze Log-File auf dieser Site in das Feld kopieren und dann auf Alalyze klicken: Automatische Auswertung: http://www.hijackthis.de/ )

C:\programme\180solutions\sais.exe  
Nasty   running process. (sais.exe)
180Solutions adware   This is a nasty process! You should fix it and try to delete it manually!

  C:\WINDOWS\System32\rpc.exe  
Nasty   running process. (rpc.exe)
Added as result of a W32/Rbot-MD worm infection   This is a nasty process! You should fix it and try to delete it manually!

O4 - HKLM\..\Run: [msupdate] update.exe  
Nasty   The entered application msupdate was identified: Microsoft IT Update. Hit rate: 36 % (result)   Must be fixed!

O4 - HKLM\..\Run: [sais] c:\programme\180solutions\sais.exe  
Nasty   The entered application sais was identified: sais. Hit rate: 99 % (result)   Must be fixed!
  O4 - HKLM\..\Run: [BullsEye Network] C:\Programme\BullsEye Network\bin\bargains.exe  
Nasty   The entered application BullsEye Network was identified: BullsEye Network. Hit rate: 99 % (result)   Must be fixed!
  O4 - HKLM\..\Run: [WebRebates0] "C:\Programme\Web_Rebates\WebRebates0.exe"  
Nasty   The entered application WebRebates0 was identified: WebRebates0. Hit rate: 99 % (result)   Must be fixed!

O4 - HKLM\..\Run: [Remote Procedure Call For Windows 32bit.] rpc.exe  
Nasty   The entered application Remote Procedure Call For Windows 32bit. was identified: Remote Procedure Call For Windows 32bit. Hit rate: 98 % (result)   Must be fixed!
  O4 - HKLM\..\Run: [Zonealarm] iexplore.exe  
Nasty   The entered application Zonealarm was identified: Iexplore Services. Hit rate: 56 % (result)   Must be fixed!
  O4 - HKLM\..\Run: [Microsoft Update] wuampd.exe  
Nasty   The entered application Microsoft Update was identified: Microsoft Update. Hit rate: 56 % (result)   Must be fixed!
  O4 - HKLM\..\Run: [Cryptographic Service] C:\WINDOWS\System32\hfahg.exe  
Nasty   The entered application Cryptographic Service was identified: Cryptographic Service. Hit rate: 59 % (result)   Must be fixed!

O4 - HKLM\..\RunServices: [msupdate] update.exe  
Nasty   The entered application msupdate was identified: Microsoft IT Update. Hit rate: 36 % (result)   Must be fixed!
  O4 - HKLM\..\RunServices: [Winupdate Service] winxp2.exe  
Nasty   The entered application Winupdate Service was identified: blah service. Hit rate: 61 % (result)   Must be fixed!
  O4 - HKLM\..\RunServices: [Remote Procedure Call For Windows 32bit.] rpc.exe  
Nasty   The entered application Remote Procedure Call For Windows 32bit. was identified: Remote Procedure Call For Windows 32bit. Hit rate: 98 % (result)   Must be fixed!
  O4 - HKLM\..\RunServices: [Zonealarm] iexplore.exe  
Nasty   The entered application Zonealarm was identified: Iexplore Services. Hit rate: 56 % (result)   Must be fixed!
  O4 - HKLM\..\RunServices: [Microsoft Update] wuampd.exe  
Nasty   The entered application Microsoft Update was identified: Microsoft Update. Hit rate: 56 % (result)   Must be fixed!
  O4 - HKLM\..\RunServices: [Quicktime Mediaplayer] winmplyer32.exe  
Nasty   The entered application Quicktime Mediaplayer was identified: Quicktime Pro 3.0. Hit rate: 55 % (result)   Must be fixed!
  O4 - HKLM\..\RunServices: [wvsvc] wvsvc.exe  
Nasty   The entered application wvsvc was identified: wvsvc. Hit rate: 99 % (result)   Must be fixed!
  O4 - HKLM\..\RunOnce: [Zonealarm] iexplore.exe  
Nasty   The entered application Zonealarm was identified: Iexplore Services. Hit rate: 56 % (result)   Must be fixed!

O4 - HKCU\..\Run: [Zonealarm] iexplore.exe  
Nasty   The entered application Zonealarm was identified: Iexplore Services. Hit rate: 56 % (result)   Must be fixed!
  O4 - HKCU\..\Run: [Microsoft Update] wuampd.exe  
Nasty   The entered application Microsoft Update was identified: Microsoft Update. Hit rate: 56 % (result)   Must be fixed!
  O4 - HKCU\..\Run: [wvsvc] wvsvc.exe  
Nasty   The entered application wvsvc was identified: wvsvc. Hit rate: 99 % (result)   Must be fixed!
  O4 - HKCU\..\RunOnce: [Zonealarm] iexplore.exe  
Nasty   The entered application Zonealarm was identified: Iexplore Services. Hit rate: 56 % (result)   Must be fixed!

  O8 - Extra context menu item: Web Rebates - file://C:\Programme\Web_Rebates\Sy1150\Tp1150\scri1150a.htm  
Nasty   The entry Web Rebates has been identified as nasty.    
  O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\Programme\SideFind\sidefind.dll (file missing)  
Unnecessarily   Unknown buttons or entries in the 'Extras'-menu should be fixed.   To be fixed if the entry 'SideFind ' is unknown.
Unnecessary (deactivated) entry that can be fixed.

 O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php?bt=ie&p=8834206f89bf27adc9234f32ec26b f46c2a28aaed342e73f787e9285152496a5bd6f5a72bda930f548f1f0d009ed7943e3 bffa1f54:7f 9a299c5336e6010bf86feeb96d7cf4  
Nasty   This entry is possibly nasty.   Should be fixed.

 O16 - DPF: {386A771C-E96A-421F-8BA7-32F1B706892F} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares/v4.0/0006_regular.cab  
Nasty   This entry is possibly nasty.   Should be fixed.

O16 - DPF: {92CA8ACC-4E99-4A2A-93F1-B2C5CADC8613} (OPInstall Control) - http://a14.g.akamai.net/f/14/7141/144000s/download.opistat.com/opistat/activex/o pinstall_gr_4.1.0.18.cab  
Nasty   This entry is possibly nasty.   Should be fixed.

O16 - DPF: {E0B795B4-FD95-4ABD-A375-27962EFCE8CF} - http://install.serviceurl.de/StarInstall.ocx  
Nasty   This entry is possibly nasty.   Should be fixed.

O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup/downloader/imloader.cab  
Nasty   This entry is possibly nasty.   Should be fixed.

Mit der Auswertungsseite hat es nicht geklappt, kam immer die Meldung: FILE ERROR! (*.log / *.txt, 100KB Files only).

Und wo den Logfile fixen? Unter dem Programm HijackThis, wo ich den Logfile erstellt habe? Läßt sich dann aber nicht in das Feld kopieren.

Habe gescannt, dann versucht, das Ergebnis zu löschen, um den Logfile reinzukopieren. Ging aber nicht zu löschen.

Wo war der Fehler?

Gruß

Johanna

Mit der Auswertungsseite hat es nicht geklappt, kam immer die Meldung: FILE ERROR! (*.log / *.txt, 100KB Files only).

Und wo den Logfile fixen? Unter dem Programm HijackThis, wo ich den Logfile erstellt habe? Läßt sich dann aber nicht in das Feld kopieren.

Habe gescannt, dann versucht, das Ergebnis zu löschen, um den Logfile reinzukopieren. Ging aber nicht zu löschen.

Wo war der Fehler?

Gruß

Johanna

Hallo, das Log-File kannst du nicht fixen.
Du musst HijackThis starten und auf 'scan' klicken.
Dann die Einträge, welche du fixen willst mit einem Häkchen versehen und anschliessend auf 'fix checked' klicken.

Hallo,

habe ich nun so gemacht. Nur die ersten beiden Einträge habe ich nicht gefunden unter C:

Was kann ich noch machen, damit er wieder schneller läuft?

Sind bestimmt noch nicht alle Viren verschwunden, oder?

Trotz Firewall hatte Spybot wieder was gefunden.

Beim Einschalten kommt auch eine Meldung: C:\Windows/system32/Explorer.exe ist keine zulässige Win32-Anwendung.

Für weitere Hilfe sehr dankbar.

Gruß

Johanna

Habe alles so gemacht, wie beschrieben. Bekomme auch diesmal die Meldung, der Pattern file LPT$VPN fehlt.

Komme an der Stelle nicht weiter.

Was nun?

Gruß

Johanna

Vielen Dank. Habe das aber zwischenzeitlich hinbekommen. Habe es mir aber trotzdem nochmal runtergeladen.

CPU liegt leider immer noch bei 80 - 100%. Die Auslagerungsdatei (was auch immer das bedeutet) bei 400 MB.

Was kann ich noch tun?

Gruß

Johanna

Und wie chaut das Hijackthis-Log jetzt aus?

Müsste ja einiges weg sein.
Oder poste mal das syclean.log liegt im sysclean-Ordner

Gruß

Das Syscleanlog ist ja ewig lang. Das müßte ich in mehrere Beiträge schreiben. Bis ein Beitrag endlich gesendet wird, dauert das ja ewig. Evtl. als E-Mail schicken.

Hier das Logfile of HijackThis v1.98.2
Scan saved at 23:11:21, on 22.11.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\avmclient\avmbtservice.exe
C:\Programme\avmclient\panapp.exe
C:\Programme\avmclient\AvmObexService.exe
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\iexplore.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\LTSMMSG.exe
C:\Programme\Synaptics\SynTP\SynTPLpr.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
C:\Programme\avmclient\bluefritz.exe
C:\Programme\avmclient\AvmObex.exe
C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Programme\QuickTime\qttask.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\update.exe
C:\programme\180solutions\sais.exe
C:\Program Files\Windows AdControl\WinAdCtl.exe
C:\WINDOWS\System32\rpc.exe
C:\WINDOWS\System32\wuampd.exe
C:\WINDOWS\mmups.exe
C:\WINDOWS\suploads.exe
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\msex.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Programme\FRITZ!\Iwatch.exe
C:\Programme\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Programme\avmclient\AvmObex.exe
C:\Program Files\Windows AdControl\WinAdAlt.exe
C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Programme\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Programme\FRITZ!\FriWeb32.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Dokumente und Einstellungen\PT 67\Eigene Dateien\Petra\HijackThis19802.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://find-on-the-net.com/search.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.medion.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.ebay.de/
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O1 - Hosts: 127.0.0.3 n-glx.s-redirect.com
O1 - Hosts: 127.0.0.3 x.full-tgp.net
O1 - Hosts: 127.0.0.3 counter.sexmaniack.com
O1 - Hosts: 127.0.0.3 autoescrowpay.com
O1 - Hosts: 127.0.0.3 www.autoescrowpay.com
O1 - Hosts: 127.0.0.3 www.awmdabest.com
O1 - Hosts: 127.0.0.3 www.sexfiles.nu
O1 - Hosts: 127.0.0.3 awmdabest.com
O1 - Hosts: 127.0.0.3 sexfiles.nu
O1 - Hosts: 127.0.0.3 allforadult.com
O1 - Hosts: 127.0.0.3 www.allforadult.com
O1 - Hosts: 127.0.0.3 www.iframe.biz
O1 - Hosts: 127.0.0.3 iframe.biz
O1 - Hosts: 127.0.0.3 www.newiframe.biz
O1 - Hosts: 127.0.0.3 newiframe.biz
O1 - Hosts: 127.0.0.3 www.vesbiz.biz
O1 - Hosts: 127.0.0.3 vesbiz.biz
O1 - Hosts: 127.0.0.3 www.pizdato.biz
O1 - Hosts: 127.0.0.3 pizdato.biz
O1 - Hosts: 127.0.0.3 www.aaasexypics.com
O1 - Hosts: 127.0.0.3 aaasexypics.com
O1 - Hosts: 127.0.0.3 www.virgin-tgp.net
O1 - Hosts: 127.0.0.3 virgin-tgp.net
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:\WINDOWS\2_0_1browserhelper2.dll (file missing)
O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - C:\Programme\SideFind\sfbho.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: YourSiteBar - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - C:\PROGRA~1\YOURSI~1\ysb.dll
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LTSMMSG] LTSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [AVMBlueClient] C:\Programme\avmclient\bluefritz.exe
O4 - HKLM\..\Run: [AVMBLUEOBEX] C:\Programme\avmclient\AvmObex.exe -pushclient -ftpclient
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Winupdate Service] winxp2.exe
O4 - HKLM\..\Run: [Windows AdControl] C:\Program Files\Windows AdControl\WinAdCtl.exe
O4 - HKLM\..\Run: [mediamotor.exe] C:\WINDOWS\mmups.exe
O4 - HKLM\..\Run: [loads.exe] C:\WINDOWS\suploads.exe
O4 - HKLM\..\Run: [Quicktime Mediaplayer] winmplyer32.exe
O4 - HKLM\..\Run: [wvsvc] wvsvc.exe
O4 - HKLM\..\Run: [bcvkr] C:\WINDOWS\bcvkr.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NEWSEX] C:\msex.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [AOLMIcon] C:\Programme\Gemeinsame Dateien\aolshare\AOLMIcon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: ISDNWatch.lnk = C:\Programme\FRITZ!\Iwatch.exe
O4 - Global Startup: officejet 6100.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.medion.com/
O16 - DPF: {26CBF141-7D0F-46E1-AA06-718958B6E4D2} - http://download.ebay.com/turbo_lister/DE/install.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-9.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20041101/qtinstall.info.apple.com/pthalo/de/win/QuickTimeInstaller.exe
O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.141/code/PWActiveXImgCtl.CAB
O16 - DPF: {771A1334-6B08-4A6B-AEDC-CF994BA2CEBE} (Installer Class) - http://www.ysbweb.com/ist/softwares/v4.0/ysb_regular.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} (IObjSafety.DemoCtl) - http://cabs.media-motor.net/cabs/alien.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6F12BFA2-5028-494B-95BA-F8F07CF00CE1}: NameServer = 192.168.120.252,192.168.120.253