Fiese Werbung - Bitte um Logcheck

rock-kittie

Hallo,

in letzter Zeit öffnet sich andauernd bei mir irgendwelche Werbung !
Deswegen müsst ihr mir bitte helfen =)
bitte checkt mal diesen Log:


Logfile of HijackThis v1.99.1
Scan saved at 22:45:50, on 21.06.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\TWFpa2U\command.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programme\Network Monitor\netmon.exe
C:\Programme\Spyware Doctor\sdhelp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
C:\Programme\SurfAccuracy\SAcc.exe
C:\WINDOWS\vdxlrsy.exe
C:\Programme\Gemeinsame Dateien\Logitech\QCDriver\LVCOMS.EXE
C:\Programme\QuickTime\qttask.exe
C:\Programme\MessengerPlus! 3\MsgPlus.exe
C:\Programme\outlook\outlook.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programme\ipwins\ipwins.exe
C:\Programme\PopUp@DevNull V1.20\PopUp_DevNull.exe
C:\Programme\ICQLite\ICQLite.exe
C:\programme\zango\zango.exe
C:\Programme\webHancer\Programs\whagent.exe
C:\Programme\webHancer\Programs\whsurvey.exe
C:\WINDOWS\system32\winlog.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\WNSXS~1\nopdb.exe
C:\WINDOWS\?dobe\l?ass.exe
C:\Programme\U.S. Robotics\Wireless Access 802.11b\Config.exe
C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\msconfig.exe
C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\taskmgr.exe
C:\Programme\PC-TV\WinManager\WinManager.exe
C:\Programme\Weather\Weather.exe
C:\WINDOWS\system32\devldr32.exe
c:\progra~1\intern~1\iexplore.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Messenger\newemail.exe
C:\Programme\TClock\TClock.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\DOKUME~1\Meike_2\LOKALE~1\Temp\Temporäres Verzeichnis 2 für hijackthis_199.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = h***p://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h***p://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h***p://www.knuddels.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h***p://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = h***p://searchbar.findthewebsiteyouneed.com
R3 - URLSearchHook: (no name) - {ABB111F4-AD31-F9E5-68A4-885D41C042CD} - C:\WINDOWS\system32\xrnufbe.dll
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O2 - BHO: Zango Search Assistant Helper /fleok=1D8A83A5C5E315789FA575760EA83FA5EF80752B94E3D87A5F7F40203CC4 - {56F1D444-11BF-4879-A12B-79CF0177F038} - c:\programme\zango\zangohook.dll
O2 - BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} - C:\Programme\webHancer\programs\whiehlpr.dll
O2 - BHO: Internet Explorer Web Content Catcher - {FFF4E223-7019-4ce7-BE03-D7D3C8CCE884} - C:\Programme\DNS\Catcher.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll
O3 - Toolbar: Ad Nuker - {459CAF0F-CA9F-4d69-A1A9-B0699D07AB8A} - C:\WINDOWS\system32\NukerBand.dll
O3 - Toolbar: Toolbar888 - {77FBF9B8-1D37-4FF2-9CED-192D8E3ABA6F} - C:\Programme\Toolbar888\ToolBar888.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: ToolBar888 - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - C:\Programme\ToolBar888\MyToolBar.dll
O4 - HKLM\..\Run: [RemoteControl] C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SurfAccuracy] C:\Programme\SurfAccuracy\SAcc.exe
O4 - HKLM\..\Run: [ReJf5vH] C:\WINDOWS\vdxlrsy.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Programme\Gemeinsame Dateien\Logitech\QCDriver\LVCOMS.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programme\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [outlook] C:\Programme\outlook\outlook.exe /auto
O4 - HKLM\..\Run: [keyboard] C:\\keyboard25.exe
O4 - HKLM\..\Run: [newname] C:\\newname25.exe
O4 - HKLM\..\Run: [waf3fac5.dll] RUNDLL32.EXE waf3fac5.dll,I2 000469590af3fac5
O4 - HKLM\..\Run: [defender] C:\\defender23.exe
O4 - HKLM\..\Run: [IpWins] C:\Programme\ipwins\ipwins.exe
O4 - HKLM\..\Run: [PopUp_DevNull] "C:\Programme\PopUp@DevNull V1.20\PopUp_DevNull.exe"
O4 - HKLM\..\Run: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [zango] "c:\programme\zango\zango.exe"
O4 - HKLM\..\Run: [mode each bows window] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BlahCopyModeEach\slow cast.exe
O4 - HKLM\..\Run: [webHancer Agent] C:\Programme\webHancer\Programs\whagent.exe
O4 - HKLM\..\Run: [webHancer Survey Companion] C:\Programme\webHancer\Programs\whsurvey.exe
O4 - HKLM\..\Run: [winlog] winlog.exe
O4 - HKLM\..\RunServices: [winlog] winlog.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [KeepHtm] C:\DOKUME~1\Meike_2\ANWEND~1\ADMINB~1\soap mess.exe
O4 - HKCU\..\Run: [Urms] "C:\PROGRA~1\WNSXS~1\nopdb.exe" -vt yazr
O4 - HKCU\..\Run: [DNS] C:\Programme\Gemeinsame Dateien\mc-110-12-0000140.exe
O4 - HKCU\..\Run: [Htflqg] C:\WINDOWS\?dobe\l?ass.exe
O4 - HKCU\..\Run: [TClock.exe] C:\Programme\TClock\tclock_install.exe
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - Startup: Weather.lnk = C:\Programme\Weather\Weather.exe
O4 - Global Startup: Configuration Utility.lnk = C:\Programme\U.S. Robotics\Wireless Access 802.11b\Config.exe
O4 - Global Startup: msconfig.exe
O4 - Global Startup: taskmgr.exe
O4 - Global Startup: WinManager.lnk = C:\Programme\PC-TV\WinManager\WinManager.exe
O8 - Extra context menu item: &Google-Suche - res://c:\programme\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: &Ins Deutsche übersetzen - res://c:\programme\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: &MyToolBar Search - res://C:\Programme\ToolBar888\MyToolBar.dll/MENUSEARCH.HTM
O8 - Extra context menu item: Im Cache gespeicherte Seite - res://c:\programme\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Verweisseiten - res://c:\programme\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Ähnliche Seiten - res://c:\programme\google\GoogleToolbar1.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - h**p://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} (MediaGatewayX) - h**p://static.zangocash.com/cab/Seekmo/ie/bridge-c9.cab
O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} - h**p://locator1.cdn.imagesrvr.com/sites/winfixer.com/www/pages/scanner_de/WinFixer2005ScannerInstallDE.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll C:\WINDOWS\system32\msiexec.dll
O20 - Winlogon Notify: Telephony - C:\WINDOWS\system32\ennql1551.dll
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\TWFpa2U\command.exe
O23 - Service: Network Monitor - Unknown owner - C:\Programme\Network Monitor\netmon.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Programme\Spyware Doctor\sdhelp.exe

Ich danke euch schon einmal im Vorraus.
Viele liebe Grüße
rock-kittie