trojaner gefunden´und gelöscht, Problem besteht weiter

#1 Hallo zusammen. ich habe volgendes Problem:

Ich habe gestern dummerweise einen angeblichen video-codec runtergeladen. Als ich kurz darauf den Internet-Explorer wieder gestartet habe, erschien nicht meine Startseite, sondern zunächst eine leere seite, von dort wurde ich augenblicklich zur seite http://syssecuritysite.net/ umgeleitet und eine nachricht mit folgendem inhalt sprang auf:

Warning!

W32.myzor.FK@yf is a virus that infects files with .exe extentions. It attemps to steal password and privat information from the infected computer.
Type: Virus
Infection length: 138,293 bytes
Systems affected: windows 95, 98, me, nt (all versions), 2003, xp (all sevice packs)
Systems not affected: DOS, Epoc, linux, macintosh, novell netware, os/2, unix
Technical details:
1. creates files in %windir%\directory. By default, this is c:\windows.
2. Adds values to registry keys: HKEY_LOCAL_MNACHINE\software\microsoft\windows\currentVersion\run
3. Scans the harddrive for .exe filesand infects any executable files. Searches for password/information, wich it send to a remote attacker.
recomandations: Click "Ok" to download officialy approved security software. Always keep your patch levels up-to-date.

Wenn man dann auf ok klickt gelangt man auf eine neue Seite (http://malwarewipe.com/?rid=246). Dort kann man den (angeblichen?) Virenkiller malwareWipe herunterladen. Allerdings machte da bei mir mein Virenkiller eine Meldung, so dass ich das Programm schnell wieder entfernt.

Ich durfte weiterhin feststellen, dass, selbst wenn ich gar nichts im Netz machte immer wieder pop-ups aufsprangen, mit Werbung für AntiViren-Software und pornoseiten.

mehrere Virenscans später (ich benutze Avira AntiVir PersonalEdition Classic) wurde ein trojaner ([color="orange"]tr/zlob.p[/color]) mehrfach auf meinem PC entdeckt und auch vernichtet. Die pop-ups bleiben seitdem aus. Aber es ist mir nicht möglich meine startseite wieder einzurichten. Ich kannn zwar eine neue Startseite eingeben und auf übernehmen klicken. Aber wenn ich den IE später starte, erscheint wieder das selbe, was ich hier erklärt habe. Einen weiteren Virus kann meine Virensoftware nicht entdecken. Auch mit ad-aware SE habe ich keinen Erfolg.
Ansonsten funktioniert (noch) alles. ich hoffe ihr könnt mir helfen, dass das so bleibt und ich die Fehlfunktion loswerde.

Schonmal Danke
Tyrarachsa

P.S.: Mir müsst ihr alles für doof erklären. Ich kenne mich mit den meisten meiner programme ganz gut aus, aber danach hört es schon auf.


EDIT:
ich habe jetzt nochmal einen scan durchgeführt. Hier das Ergebnis:

Ad-Aware SE Build 1.06r1
Logfile Created on:Mittwoch, 19. Juli 2006 23:19:43
Created with Ad-Aware SE Personal, free for private use.
Using definitions file:SE1R115 17.07.2006
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

References detected during the scan:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
MRU List(TAC index:0):7 total references
Tracking Cookie(TAC index:3):4 total references
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Ad-Aware SE Settings
===========================
Set : Search for negligible risk entries
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan my Hosts file

Extended Ad-Aware SE Settings
===========================
Set : Unload recognized processes & modules during scan
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : During removal, unload Explorer and IE if necessary
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include reference summary in log file
Set : Include alternate data stream details in log file
Set : Play sound at scan completion if scan locates critical objects


19.07.2006 23:19:43 - Scan started. (Full System Scan)

MRU List Object Recognized!
Location: : C:\Dokumente und Einstellungen\tyrarachsa\recent
Description : list of recently opened documents


MRU List Object Recognized!
Location: : software\microsoft\directdraw\mostrecentapplication
Description : most recent application to use microsoft directdraw


MRU List Object Recognized!
Location: : S-1-5-21-583907252-764733703-1060284298-1000\software\microsoft\internet explorer
Description : last download directory used in microsoft internet explorer


MRU List Object Recognized!
Location: : S-1-5-21-583907252-764733703-1060284298-1000\software\microsoft\internet explorer\typedurls
Description : list of recently entered addresses in microsoft internet explorer


MRU List Object Recognized!
Location: : S-1-5-21-583907252-764733703-1060284298-1000\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru
Description : list of recent programs opened


MRU List Object Recognized!
Location: : S-1-5-21-583907252-764733703-1060284298-1000\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru
Description : list of recently saved files, stored according to file extension


MRU List Object Recognized!
Location: : S-1-5-21-583907252-764733703-1060284298-1000\software\microsoft\windows\currentversion\explorer\recentdocs
Description : list of recent documents opened


Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

#:1 [smss.exe]
FilePath : \SystemRoot\System32\
ProcessID : 168
ThreadCreationTime : 19.07.2006 19:59:59
BasePriority : Normal


#:2 [csrss.exe]
FilePath : \??\C:\WINNT\system32\
ProcessID : 192
ThreadCreationTime : 19.07.2006 20:00:09
BasePriority : Normal


#:3 [winlogon.exe]
FilePath : \??\C:\WINNT\system32\
ProcessID : 212
ThreadCreationTime : 19.07.2006 20:00:13
BasePriority : High


#:4 [services.exe]
FilePath : C:\WINNT\system32\
ProcessID : 240
ThreadCreationTime : 19.07.2006 20:00:15
BasePriority : Normal
FileVersion : 5.00.2195.6700
ProductVersion : 5.00.2195.6700
ProductName : Betriebssystem Microsoft(R) Windows (R) 2000
CompanyName : Microsoft Corporation
FileDescription : Anwendung für Dienste und Controller
InternalName : services.exe
LegalCopyright : Copyright (C) Microsoft Corp. 1981-1999
OriginalFilename : services.exe

#:5 [lsass.exe]
FilePath : C:\WINNT\system32\
ProcessID : 252
ThreadCreationTime : 19.07.2006 20:00:15
BasePriority : Normal
FileVersion : 5.00.2195.6695
ProductVersion : 5.00.2195.6695
ProductName : Betriebssystem Microsoft(R) Windows (R) 2000
CompanyName : Microsoft Corporation
FileDescription : LSA-Exe und Server-DLL
InternalName : lsasrv.dll and lsass.exe
LegalCopyright : Copyright (C) Microsoft Corp. 1981-1999
OriginalFilename : lsasrv.dll and lsass.exe

#:6 [svchost.exe]
FilePath : C:\WINNT\system32\
ProcessID : 428
ThreadCreationTime : 19.07.2006 20:00:22
BasePriority : Normal
FileVersion : 5.00.2134.1
ProductVersion : 5.00.2134.1
ProductName : Microsoft(R) Windows (R) 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : Copyright (C) Microsoft Corp. 1981-1999
OriginalFilename : svchost.exe

#:7 [spoolsv.exe]
FilePath : C:\WINNT\system32\
ProcessID : 456
ThreadCreationTime : 19.07.2006 20:00:22
BasePriority : Normal
FileVersion : 5.00.2195.6659
ProductVersion : 5.00.2195.6659
ProductName : Microsoft(R) Windows (R) 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Spooler SubSystem App
InternalName : spoolss.exe
LegalCopyright : Copyright (C) Microsoft Corp. 1981-1999
OriginalFilename : spoolss.exe

#:8 [w0svc.exe]
FilePath : C:\Programme\0190 Warner\
ProcessID : 484
ThreadCreationTime : 19.07.2006 20:00:22
BasePriority : Normal
FileVersion : 4.0.0.22
ProductVersion : 4.0
ProductName : 0190/0900 Warner
CompanyName : Mirko Böer
FileDescription : 0190/0900 Warner Service
InternalName : w0svc
LegalCopyright : Copyright © 2003-2004 Mirko Böer
OriginalFilename : w0svc.exe

#:9 [sched.exe]
FilePath : C:\Programme\AntiVir PersonalEdition Classic\
ProcessID : 496
ThreadCreationTime : 19.07.2006 20:00:22
BasePriority : Normal


#:10 [avguard.exe]
FilePath : C:\Programme\AntiVir PersonalEdition Classic\
ProcessID : 516
ThreadCreationTime : 19.07.2006 20:00:23
BasePriority : Normal


#:11 [svchost.exe]
FilePath : C:\WINNT\System32\
ProcessID : 532
ThreadCreationTime : 19.07.2006 20:00:23
BasePriority : Normal
FileVersion : 5.00.2134.1
ProductVersion : 5.00.2134.1
ProductName : Microsoft(R) Windows (R) 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : Copyright (C) Microsoft Corp. 1981-1999
OriginalFilename : svchost.exe

#:12 [nvsvc32.exe]
FilePath : C:\WINNT\system32\
ProcessID : 600
ThreadCreationTime : 19.07.2006 20:00:27
BasePriority : Normal
FileVersion : 6.14.10.8198
ProductVersion : 6.14.10.8198
ProductName : NVIDIA Driver Helper Service, Version 81.98
CompanyName : NVIDIA Corporation
FileDescription : NVIDIA Driver Helper Service, Version 81.98
InternalName : NVSVC
LegalCopyright : (C) NVIDIA Corporation. All rights reserved.
OriginalFilename : nvsvc32.exe

#:13 [regsvc.exe]
FilePath : C:\WINNT\system32\
ProcessID : 624
ThreadCreationTime : 19.07.2006 20:00:28
BasePriority : Normal
FileVersion : 5.00.2195.6701
ProductVersion : 5.00.2195.6701
ProductName : Microsoft(R) Windows (R) 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Remote Registry Service
InternalName : regsvc
LegalCopyright : Copyright (C) Microsoft Corp. 1981-1999
OriginalFilename : REGSVC.EXE

#:14 [mstask.exe]
FilePath : C:\WINNT\system32\
ProcessID : 684
ThreadCreationTime : 19.07.2006 20:00:32
BasePriority : Normal
FileVersion : 4.71.2195.6704
ProductVersion : 4.71.2195.6704
ProductName : Taskplaner für Microsoft® Windows®
CompanyName : Microsoft Corporation
FileDescription : Taskplaner-Engine
InternalName : TaskScheduler
LegalCopyright : Copyright (C) Microsoft Corp. 1997
OriginalFilename : mstask.exe

#:15 [explorer.exe]
FilePath : C:\WINNT\
ProcessID : 904
ThreadCreationTime : 19.07.2006 20:00:52
BasePriority : Normal
FileVersion : 5.00.3700.6690
ProductVersion : 5.00.3700.6690
ProductName : Betriebssystem Microsoft(R) Windows (R) 2000
CompanyName : Microsoft Corporation
FileDescription : Windows Explorer
InternalName : explorer
LegalCopyright : Copyright (C) Microsoft Corp. 1981-1999
OriginalFilename : EXPLORER.EXE

#:16 [winmgmt.exe]
FilePath : C:\WINNT\System32\WBEM\
ProcessID : 944
ThreadCreationTime : 19.07.2006 20:01:06
BasePriority : Normal
FileVersion : 1.50.1085.0100
ProductVersion : 1.50.1085.0100
ProductName : Windows Management Instrumentation
CompanyName : Microsoft Corporation
FileDescription : Windows-Verwaltungsinstrumentation
InternalName : WINMGMT
LegalCopyright : Copyright (C) Microsoft Corp. 1995-1999

#:17 [mspmspsv.exe]
FilePath : C:\WINNT\system32\
ProcessID : 952
ThreadCreationTime : 19.07.2006 20:01:08
BasePriority : Normal
FileVersion : 7.10.00.3059
ProductVersion : 7.10.00.3059
ProductName : Microsoft (R) DRM
CompanyName : Microsoft Corporation
FileDescription : WMDM PMSP Service
InternalName : MSPMSPSV.EXE
LegalCopyright : Copyright (C) Microsoft Corp. 1981-2000
OriginalFilename : MSPMSPSV.EXE

#:18 [svchost.exe]
FilePath : C:\WINNT\system32\
ProcessID : 964
ThreadCreationTime : 19.07.2006 20:01:08
BasePriority : Normal
FileVersion : 5.00.2134.1
ProductVersion : 5.00.2134.1
ProductName : Microsoft(R) Windows (R) 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : Copyright (C) Microsoft Corp. 1981-1999
OriginalFilename : svchost.exe

#:19 [dcomcfg.exe]
FilePath : C:\WINNT\system32\
ProcessID : 1084
ThreadCreationTime : 19.07.2006 20:01:20
BasePriority : Normal


#:20 [realsched.exe]
FilePath : C:\Programme\Gemeinsame Dateien\Real\Update_OB\
ProcessID : 1244
ThreadCreationTime : 19.07.2006 20:01:33
BasePriority : Normal
FileVersion : 0.1.0.3427
ProductVersion : 0.1.0.3427
ProductName : RealPlayer (32-bit)
CompanyName : RealNetworks, Inc.
FileDescription : RealNetworks Scheduler
InternalName : schedapp
LegalCopyright : Copyright © RealNetworks, Inc. 1995-2004
LegalTrademarks : RealAudio(tm) is a trademark of RealNetworks, Inc.
OriginalFilename : realsched.exe

#:21 [avgnt.exe]
FilePath : C:\Programme\AntiVir PersonalEdition Classic\
ProcessID : 1008
ThreadCreationTime : 19.07.2006 20:01:34
BasePriority : Normal


#:22 [qttask.exe]
FilePath : C:\Programme\QuickTime\
ProcessID : 1260
ThreadCreationTime : 19.07.2006 20:01:36
BasePriority : Normal
FileVersion : 7.1
ProductVersion : QuickTime 7.1
ProductName : QuickTime
CompanyName : Apple Computer, Inc.
FileDescription : QuickTime Task
InternalName : QuickTime Task
LegalCopyright : Copyright Apple Computer, Inc. 1989-2006
OriginalFilename : QTTask.exe

#:23 [winampa.exe]
FilePath : C:\Programme\Winamp\
ProcessID : 1276
ThreadCreationTime : 19.07.2006 20:01:36
BasePriority : Normal


#:24 [warn0190.exe]
FilePath : C:\PROGRA~1\0190WA~1\
ProcessID : 1280
ThreadCreationTime : 19.07.2006 20:01:57
BasePriority : Normal
FileVersion : 4.3.0.221
ProductVersion : 4.03
ProductName : 0190 Warner / 0900 Warner
CompanyName : Mirko Böer
FileDescription : 0190 Warner / 0900 Warner
LegalCopyright : Copyright © 2001 - 2004 Mirko Böer
Comments : http://www.wt-rate.com/

#:25 [zlclient.exe]
FilePath : C:\Programme\Zone Labs\ZoneAlarm\
ProcessID : 1328
ThreadCreationTime : 19.07.2006 20:02:01
BasePriority : Normal
FileVersion : 6.5.731.000
ProductVersion : 6.5.731.000
ProductName : Zone Labs Client
CompanyName : Zone Labs, LLC
FileDescription : Zone Labs Client
InternalName : zlclient
LegalCopyright : Copyright © 1998-2006, Zone Labs, LLC
OriginalFilename : zlclient.exe

#:26 [internat.exe]
FilePath : C:\WINNT\system32\
ProcessID : 1336
ThreadCreationTime : 19.07.2006 20:02:02
BasePriority : Normal
FileVersion : 5.00.2920.0000
ProductVersion : 5.00.2920.0000
ProductName : Betriebssystem Microsoft(R) Windows (R) 2000
CompanyName : Microsoft Corporation
FileDescription : Sprachanzeigeprogramm
InternalName : INTERNAT
LegalCopyright : Copyright (C) Microsoft Corp. 1994-1999
OriginalFilename : INTERNAT.EXE

#:27 [wkcalrem.exe]
FilePath : C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\
ProcessID : 1360
ThreadCreationTime : 19.07.2006 20:02:08
BasePriority : Normal
FileVersion : 5.00.2004.0
ProductVersion : 5.00.2004.0
ProductName : Microsoft® Works 2000
CompanyName : Microsoft® Corporation
FileDescription : Microsoft® Works Calendar Reminder Service
InternalName : WkCalRem
LegalCopyright : © 1999 Microsoft Corp. All rights reserved.
OriginalFilename : WKCALREM.EXE

#:28 [wzqkpick.exe]
FilePath : C:\Programme\WinZip\
ProcessID : 772
ThreadCreationTime : 19.07.2006 20:02:39
BasePriority : Normal
FileVersion : 1.0 (32-bit)
ProductVersion : 9.0 (6224g)
ProductName : WinZip
CompanyName : WinZip Computing, Inc.
FileDescription : WinZip Executable
InternalName : WZQKPICK.EXE
LegalCopyright : Copyright (c) WinZip Computing, Inc. 1991-2004 - All Rights Reserved
LegalTrademarks : WinZip is a registered trademark of WinZip Computing, Inc
OriginalFilename : WZQKPICK.EXE
Comments : StringFileInfo: German

#:29 [vsmon.exe]
FilePath : C:\WINNT\system32\ZoneLabs\
ProcessID : 1048
ThreadCreationTime : 19.07.2006 20:03:17
BasePriority : Normal
FileVersion : 6.5.731.000
ProductVersion : 6.5.731.000
ProductName : TrueVector Service
CompanyName : Zone Labs, LLC
FileDescription : TrueVector Service
InternalName : vsmon
LegalCopyright : Copyright © 1998-2006, Zone Labs, LLC
OriginalFilename : vsmon.exe

#:30 [wuauclt.exe]
FilePath : C:\WINNT\system32\
ProcessID : 1668
ThreadCreationTime : 19.07.2006 20:08:53
BasePriority : Normal
FileVersion : 5.8.0.2469 built by: lab01_n(wmbla)
ProductVersion : 5.8.0.2469
ProductName : Betriebssystem Microsoft® Windows®
CompanyName : Microsoft Corporation
FileDescription : Automatische Updates
InternalName : wuauclt.exe
LegalCopyright : © Microsoft Corporation. Alle Rechte vorbehalten.
OriginalFilename : wuauclt.exe

#:31 [iexplore.exe]
FilePath : C:\Programme\Internet Explorer\
ProcessID : 1576
ThreadCreationTime : 19.07.2006 20:12:39
BasePriority : Normal
FileVersion : 6.00.2800.1106
ProductVersion : 6.00.2800.1106
ProductName : Betriebssystem Microsoft® Windows®
CompanyName : Microsoft Corporation
FileDescription : Internet Explorer
InternalName : iexplore
LegalCopyright : © Microsoft Corporation. Alle Rechte vorbehalten.
OriginalFilename : IEXPLORE.EXE

#:32 [ad-aware.exe]
FilePath : C:\Programme\Lavasoft\Ad-Aware SE Personal\
ProcessID : 1656
ThreadCreationTime : 19.07.2006 21:19:13
BasePriority : Normal
FileVersion : 6.2.0.236
ProductVersion : SE 106
ProductName : Lavasoft Ad-Aware SE
CompanyName : Lavasoft Sweden
FileDescription : Ad-Aware SE Core application
InternalName : Ad-Aware.exe
LegalCopyright : Copyright © Lavasoft AB Sweden
OriginalFilename : Ad-Aware.exe
Comments : All Rights Reserved

Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 7


Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Registry Scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 7


Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 7


Started Tracking Cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


Tracking Cookie Object Recognized!
Type : IECache Entry
Data : tyrarachsa@tradedoubler[1].txt
TAC Rating : 3
Category : Data Miner
Comment : Hits:1
Value : Cookie:tyrarachsa@tradedoubler.com/
Expires : 14.07.2026 22:36:16
LastSync : Hits:1
UseCount : 0
Hits : 1

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : tyrarachsa@mediaplex[1].txt
TAC Rating : 3
Category : Data Miner
Comment : Hits:1
Value : Cookie:tyrarachsa@mediaplex.com/
Expires : 22.06.2009 02:00:00
LastSync : Hits:1
UseCount : 0
Hits : 1

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : tyrarachsa@as1.falkag[2].txt
TAC Rating : 3
Category : Data Miner
Comment : Hits:36
Value : Cookie:tyrarachsa@as1.falkag.de/
Expires : 17.09.2006 23:30:38
LastSync : Hits:36
UseCount : 0
Hits : 36

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : tyrarachsa@atdmt[2].txt
TAC Rating : 3
Category : Data Miner
Comment : Hits:2
Value : Cookie:tyrarachsa@atdmt.com/
Expires : 18.07.2011 02:00:00
LastSync : Hits:2
UseCount : 0
Hits : 2

Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 4
Objects found so far: 11



Deep scanning and examining files (C
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for C:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 11


Deep scanning and examining files (D
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for D:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 11


Scanning Hosts file......
Hosts file location:"C:\WINNT\system32\drivers\etc\hosts".
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Hosts file scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
2 entries scanned.
New critical objects:0
Objects found so far: 11




Performing conditional scans...
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Conditional scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 11

23:46:18 Scan Complete

Summary Of This Scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Total scanning time:00:26:35.194
Objects scanned:119226
Objects identified:4
Objects ignored:0
New critical objects:4


Vielleicht hilft das ja irgendwie weiter.

#2 1,
smitfraud.fix abarbeiten (Option 1 und 2 , lasse auch die registry mitreinigen - poste die scanreporte)
http://virus-protect.org/artikel/spyware/spywarequake.html

2.
arbeite das bitte ab und poste die logs
http://board.protecus.de/t23188.htm
__________
MfG Sabina

rund um die PC-Sicherheit