meine log files

Sebbel

hallo

hab folgendes prob:
wenn ich bei google nach ner adresse suche, z.B. ebay
dann zeigt er mir ja dann welche an, klicke ich da drauf, dann lande ich ganz woanders, sieht man auch schon an der url und eben das man auf ner ganz anderen seite ist. mache ich dann zurück und klicke nochmal auf das selbe, dann lande ich bei der richtigen seite (z.B. ebay)

habe ad-aware 6.0 von lavasoft drauf und von kaspersky die firewall sowie anti-virus.

ad-aware findet bei mir andauernd so 5-10 sachen. firewall blockiert mehrfach am tag nen angriff "helkern" und mit anti-virus war nix zufinden.

hoffe ihr könnt mir helfen ohne das ich neu-installieren muss, weil is erst vor knapp 2 wochen gemacht worden, und bin froh wieder halbwegs alles drauf zuhaben

hier mal meine files:
eScan

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Funde für "infected"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Thu Nov 17 04:09:07 2005 => System found infected with adware.toolbar.sbsoft.h Spyware/Adware ({08bec6aa-49fc-4379-3587-4b21e286c19e})! Action taken: No Action Taken.
Thu Nov 17 04:09:09 2005 => System found infected with redv Spyware/Adware (insthelp.dll)! Action taken: No Action Taken.
Thu Nov 17 04:09:15 2005 => System found infected with redv Spyware/Adware (insthelp.dll)! Action taken: No Action Taken.
Thu Nov 17 04:09:15 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: No Action Taken.
Thu Nov 17 04:09:15 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: No Action Taken.
Thu Nov 17 04:09:15 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: No Action Taken.
Thu Nov 17 04:09:16 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: No Action Taken.
Thu Nov 17 04:09:16 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: No Action Taken.
Thu Nov 17 04:09:16 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: No Action Taken.
Thu Nov 17 04:09:16 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: No Action Taken.
Thu Nov 17 04:09:16 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: No Action Taken.
Thu Nov 17 04:09:16 2005 => System found infected with whenu.savenow Spyware/Adware (show_ads[2].js)! Action taken: No Action Taken.
Thu Nov 17 04:09:16 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: No Action Taken.
Thu Nov 17 04:09:16 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: No Action Taken.
Thu Nov 17 04:09:16 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: No Action Taken.
Thu Nov 17 04:09:16 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: No Action Taken.
Thu Nov 17 04:09:16 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: No Action Taken.
Thu Nov 17 04:09:16 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: No Action Taken.
Thu Nov 17 04:09:16 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: No Action Taken.
Thu Nov 17 04:09:16 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: No Action Taken.
Thu Nov 17 04:09:16 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: No Action Taken.
Thu Nov 17 04:09:16 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: No Action Taken.
Thu Nov 17 04:09:16 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: No Action Taken.
Thu Nov 17 04:09:17 2005 => System found infected with whenu.savenow Spyware/Adware (show_ads[2].js)! Action taken: No Action Taken.
Thu Nov 17 04:09:17 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: No Action Taken.
Thu Nov 17 04:09:17 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: No Action Taken.
Thu Nov 17 04:09:17 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: No Action Taken.
Thu Nov 17 04:09:18 2005 => System found infected with zipitpro Spyware/Adware (C:\WINDOWS\iun6002.exe)! Action taken: No Action Taken.
Thu Nov 17 04:16:39 2005 => Scanning File C:\Programme\Kaspersky Anti-Virus Personal\Infected.wav
Thu Nov 17 04:47:25 2005 => Total Disinfected Files: 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Funde für "tagged"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Thu Nov 17 04:40:48 2005 => File G:\Downloads Programme\Codec.Pack.Elisoft.v14.0.zip tagged as "not-a-virus:AdWare.Win32.Gator.4104". Action Taken: No Action Taken.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Funde für "offending"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Thu Nov 17 04:09:08 2005 => Offending Key found: HKCU\Software\gnu !!!
Thu Nov 17 04:09:09 2005 => Offending file found: C:\DOKUME~1\Daniel\LOKALE~1\Temp\insthelp.dll
Thu Nov 17 04:09:12 2005 => Offending Folder found: G:\Eigene Dateien\ea games\die sims 2\music\cas
Thu Nov 17 04:09:15 2005 => Offending file found: C:\Dokumente und Einstellungen\Daniel\Lokale Einstellungen\temp\insthelp.dll
Thu Nov 17 04:09:15 2005 => Offending file found: C:\Dokumente und Einstellungen\Daniel\Lokale Einstellungen\temporary internet files\content.ie5\0pmfk52z\common[1].js
Thu Nov 17 04:09:15 2005 => Offending file found: C:\Dokumente und Einstellungen\Daniel\Lokale Einstellungen\temporary internet files\content.ie5\1z06fnjs\common[1].js
Thu Nov 17 04:09:15 2005 => Offending file found: C:\Dokumente und Einstellungen\Daniel\Lokale Einstellungen\temporary internet files\content.ie5\4rvf6495\common[1].js
Thu Nov 17 04:09:16 2005 => Offending file found: C:\Dokumente und Einstellungen\Daniel\Lokale Einstellungen\temporary internet files\content.ie5\7747she3\common[1].js
Thu Nov 17 04:09:16 2005 => Offending file found: C:\Dokumente und Einstellungen\Daniel\Lokale Einstellungen\temporary internet files\content.ie5\a955cgzw\common[1].js
Thu Nov 17 04:09:16 2005 => Offending file found: C:\Dokumente und Einstellungen\Daniel\Lokale Einstellungen\temporary internet files\content.ie5\kt6jwhav\common[1].js
Thu Nov 17 04:09:16 2005 => Offending file found: C:\Dokumente und Einstellungen\Daniel\Lokale Einstellungen\temporary internet files\content.ie5\q1vw14fq\common[1].js
Thu Nov 17 04:09:16 2005 => Offending file found: C:\Dokumente und Einstellungen\Daniel\Lokale Einstellungen\temporary internet files\content.ie5\qyf54ta1\common[1].js
Thu Nov 17 04:09:16 2005 => Offending file found: C:\Dokumente und Einstellungen\Daniel\Lokale Einstellungen\temporary internet files\content.ie5\qyf54ta1\show_ads[2].js
Thu Nov 17 04:09:16 2005 => Offending file found: C:\Dokumente und Einstellungen\Daniel\Lokale Einstellungen\temporary internet files\content.ie5\rn5zztcw\common[1].js
Thu Nov 17 04:09:16 2005 => Offending file found: C:\Dokumente und Einstellungen\Daniel\Lokale Einstellungen\temporary internet files\content.ie5\tssvdpwp\common[1].js
Thu Nov 17 04:09:16 2005 => Offending file found: C:\Dokumente und Einstellungen\Daniel\Lokale Einstellungen\temporary internet files\content.ie5\w1ezwlqn\common[1].js
Thu Nov 17 04:09:16 2005 => Offending file found: C:\Dokumente und Einstellungen\Daniel\Lokale Einstellungen\Temporary Internet Files\content.ie5\0pmfk52z\common[1].js
Thu Nov 17 04:09:16 2005 => Offending file found: C:\Dokumente und Einstellungen\Daniel\Lokale Einstellungen\Temporary Internet Files\content.ie5\1z06fnjs\common[1].js
Thu Nov 17 04:09:16 2005 => Offending file found: C:\Dokumente und Einstellungen\Daniel\Lokale Einstellungen\Temporary Internet Files\content.ie5\4rvf6495\common[1].js
Thu Nov 17 04:09:16 2005 => Offending file found: C:\Dokumente und Einstellungen\Daniel\Lokale Einstellungen\Temporary Internet Files\content.ie5\7747she3\common[1].js
Thu Nov 17 04:09:16 2005 => Offending file found: C:\Dokumente und Einstellungen\Daniel\Lokale Einstellungen\Temporary Internet Files\content.ie5\a955cgzw\common[1].js
Thu Nov 17 04:09:16 2005 => Offending file found: C:\Dokumente und Einstellungen\Daniel\Lokale Einstellungen\Temporary Internet Files\content.ie5\kt6jwhav\common[1].js
Thu Nov 17 04:09:16 2005 => Offending file found: C:\Dokumente und Einstellungen\Daniel\Lokale Einstellungen\Temporary Internet Files\content.ie5\q1vw14fq\common[1].js
Thu Nov 17 04:09:16 2005 => Offending file found: C:\Dokumente und Einstellungen\Daniel\Lokale Einstellungen\Temporary Internet Files\content.ie5\qyf54ta1\common[1].js
Thu Nov 17 04:09:17 2005 => Offending file found: C:\Dokumente und Einstellungen\Daniel\Lokale Einstellungen\Temporary Internet Files\content.ie5\qyf54ta1\show_ads[2].js
Thu Nov 17 04:09:17 2005 => Offending file found: C:\Dokumente und Einstellungen\Daniel\Lokale Einstellungen\Temporary Internet Files\content.ie5\rn5zztcw\common[1].js
Thu Nov 17 04:09:17 2005 => Offending file found: C:\Dokumente und Einstellungen\Daniel\Lokale Einstellungen\Temporary Internet Files\content.ie5\tssvdpwp\common[1].js
Thu Nov 17 04:09:17 2005 => Offending file found: C:\Dokumente und Einstellungen\Daniel\Lokale Einstellungen\Temporary Internet Files\content.ie5\w1ezwlqn\common[1].js
Thu Nov 17 04:09:17 2005 => Offending Folder found: G:\Eigene Dateien\ea games\die sims 2\music\cas
Thu Nov 17 04:09:18 2005 => Offending file found: C:\WINDOWS\iun6002.exe
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Statistiken:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Thu Nov 17 04:47:25 2005 => Total Virus(es) Found: 32
Thu Nov 17 04:47:25 2005 => Total Errors: 73
Thu Nov 17 04:47:25 2005 => Time Elapsed: 00:39:09
Thu Nov 17 04:47:25 2005 => Total Objects Scanned: 58653
Thu Nov 17 04:07:50 2005 => Virus Database Date: 2005/11/17
Thu Nov 17 04:47:25 2005 => Virus Database Date: 2005/11/17
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~ © Haui ;-) ~~~~~~~
~~~~~~~ Dank an Cidre ~~~~~~~


und hijack

Logfile of HijackThis v1.99.1
Scan saved at 03:00:11, on 17.11.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\T-DSL SpeedManager\SpeedMgr.exe
C:\Programme\Kaspersky Anti-Hacker\KAVPF.exe
C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis2\kernel.exe
C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis2\sc_watch.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
C:\Programme\T-DSL SpeedManager\tsmsvc.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\T-Online\T-ONLI~2\BASIS-~1\Basis2\PROFIL~1.EXE
C:\PROGRA~1\T-Online\T-ONLI~2\Notifier\Notifier.exe
C:\Programme\eMule\emule.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Acrobat 5.0\Reader\AcroRd32.exe
C:\Programme\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://w*w.google.de/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [T-DSL SpeedMgr] "C:\Programme\T-DSL SpeedManager\SpeedMgr.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Programme\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\system32\mstask.exe
O4 - Global Startup: Kaspersky Anti-Hacker.lnk = C:\Programme\Kaspersky Anti-Hacker\KAVPF.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Klicke hier um das Projekt xp-AntiSpy zu unterstützen - {9ECC61EA-EE8C-4409-9447-EECC5040BE9C} - C:\Programme\xp-AntiSpy\sponsoring\sponsor.html (HKCU)
O9 - Extra 'Tools' menuitem: Unterstützung für xp-AntiSpy - {9ECC61EA-EE8C-4409-9447-EECC5040BE9C} - C:\Programme\xp-AntiSpy\sponsoring\sponsor.html (HKCU)
O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1131711443421
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{387DF7A2-A095-499F-AE51-DD472BDFAB85}: NameServer = 85.255.114.12,85.255.112.6
O17 - HKLM\System\CCS\Services\Tcpip\..\{77F7D8BE-79DC-47EB-B385-BF8E027C510D}: NameServer = 85.255.114.12,85.255.112.6
O17 - HKLM\System\CCS\Services\Tcpip\..\{91D90095-3DBD-46C5-897B-931D1FADD5D1}: NameServer = 85.255.114.12,85.255.112.6
O17 - HKLM\System\CCS\Services\Tcpip\..\{987FDE65-F717-490E-BBD1-414545F8C314}: NameServer = 217.237.149.225 194.25.2.129
O17 - HKLM\System\CCS\Services\Tcpip\..\{9A89971E-6115-4122-A45D-37F169A5C34F}: NameServer = 85.255.114.12,85.255.112.6
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Programme\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: TSMService - T-Systems Nova, Berkom - C:\Programme\T-DSL SpeedManager\tsmsvc.exe