Hhijackthis.log BITTE HILFE

Geraldine

Hallo

Ich habe den about:blank. Bekomme ihn nicht weg. Fast alles schon ausprobiert. Kann mir jemand bitte helfen!!!

Geraldine


p.s. Hier meine log:

Logfile of HijackThis v1.97.7
Scan saved at 11:30:12, on 23.06.2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\SCardSvr.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\Ati2evxx.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Programme\Cisco Systems\VPN Client\cvpnd.exe
C:\WINNT\System32\svchost.exe
C:\Programme\F-Secure\Anti-Virus\fsgk32st.exe
C:\Programme\F-Secure\Anti-Virus\FSGK32.EXE
C:\Programme\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Programme\F-Secure\Common\FSMA32.EXE
C:\Programme\F-Secure\Common\FSMB32.EXE
C:\Programme\KEN!\KENSERV.EXE
C:\Programme\F-Secure\Common\FCH32.EXE
C:\Programme\GFI\LANguard Network Security Scanner 3\sscansvc.exe
C:\Programme\F-Secure\Common\FAMEH32.EXE
C:\Programme\KEN!\KENCAPI.EXE
C:\Programme\KEN!\KENINET.EXE
C:\Programme\KEN!\KENPROXY.EXE
C:\Programme\KEN!\KENMAIL.EXE
C:\Programme\KEN!\KENDNS.EXE
C:\Programme\KEN!\KENSOCKS.EXE
C:\Programme\KEN!\KENMAP.EXE
C:\Programme\KEN!\KENFTPGW.EXE
C:\Programme\KEN!\KENF4K.EXE
C:\Programme\KEN!\KENCRON.EXE
C:\Programme\FRITZ!\FriFax32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\SCARDS32.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Programme\F-Secure\Common\FNRB32.EXE
C:\Programme\F-Secure\Common\FIH32.EXE
C:\Programme\F-Secure\Anti-Virus\fsav32.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\RunDll32.exe
C:\Programme\KEN!\kentbsrv.exe
C:\Programme\F-Secure\Common\FSM32.EXE
C:\winnt\rundll32.exe
C:\Programme\WinZip\WZQKPICK.EXE
C:\Programme\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
C:\WINNT\system32\mshta.exe
C:\WINNT\system32\mshta.exe
C:\WINNT\system32\mshta.exe
C:\WINNT\system32\mshta.exe
C:\WINNT\system32\mshta.exe
C:\WINNT\system32\mshta.exe
C:\WINNT\system32\mshta.exe
C:\WINNT\system32\mshta.exe
C:\WINNT\system32\mshta.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\WINNT\system32\rundll32.exe
C:\Programme\F-Secure\Anti-Virus\fssm32.exe
C:\Dokumente und Einstellungen\Administrator.CD\Desktop\about blank\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.1.13:4480
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
O1 - Hosts: 213.159.117.235 auto.search.msn.com
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [KEN Taskbar Service] "C:\Programme\KEN!\kentbsrv.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Programme\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Programme\F-Secure\TNB\TNBUtil.exe" /CHECKALL
O4 - HKLM\..\Run: [Soundmx] \soundmx.exe
O4 - HKLM\..\Run: [Winhost] C:\WINNT\winh.exe
O4 - HKCU\..\Run: [runwin32] C:\WINNT\runwin32.exe
O4 - HKCU\..\Run: [wininet32] C:\WINNT\wininet32.exe
O4 - HKCU\..\Run: [sr64] C:\Dokumente und Einstellungen\Administrator.CD\Anwendungsdaten\Microsoft\sr64\lmkpdeaf.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Programme\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE
O14 - IERESET.INF: START_PAGE_URL=hxxp://192.168.1.26:3128/ken2000.html
O16 - DPF: {02C20140-76F8-4763-83D5-B660107B7A90} - hxxp://63.219.181.7/cax.cab
O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://c:\MAIN.MHT!hxxp://213.159.117.235/buka.chm::/x.exe
O16 - DPF: {11010101-1001-1111-1000-110112345678} - ms-its:mhtml:file://c:\nosuch.mht!hxxp://69.31.79.180/winsearchie32.chm::/winsearchie32.exe
O16 - DPF: {11010101-1001-1111-1000-114893999762} - ms-its:mhtml:file://c:\nosuch.mht!hxxp://lab-wire.com/pop/chm/hiruvim.chm::/d_hiruvim.exe
O16 - DPF: {11010101-1001-1111-1000-115560297488} - ms-its:mhtml:file://c:\nosuch.mht!hxxp://lab-wire.com/pop/chm/tony3.chm::/d_tony3.exe
O16 - DPF: {11111111-1111-1111-1111-111111111123} - ms-its:mhtml:file://c:\nosuch.mht!hxxp://www.ruworld.com/mx/chm/files.chm::/file.exe
O16 - DPF: {11111111-1111-1111-1111-111111111157} - ms-its:mhtml:file://c:\nosuch.mht!hxxp://213.159.117.131/legal/x.chm::/load.exe
O16 - DPF: {11410708-1001-1111-1000-110415061728} - ms-its:mhtml:file://c:\nosuch.mht!hxxp://lab-wire.com/pop/chm/hiruvim.chm::/d_hiruvim.exe
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - file://C:\RPC\msrdp.cab
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} - hxxp://www.mt-download.com/MediaTicketsInstaller.cab
O16 - DPF: {AD688740-5246-40C3-AF27-098693046834} - hxxp://www.xpehbam.biz/exploit.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = CD.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{2F76176D-486E-402F-B20A-45B145D13BC1}: NameServer = 192.168.120.252,192.168.120.253
O17 - HKLM\System\CCS\Services\Tcpip\..\{C84D177B-8D58-4522-BE05-2B77C84CD6CF}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{F0D975B1-9038-48E7-A69B-A3FE0B116CD4}: NameServer = 192.168.114.254
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = CD.local
O17 - HKLM\System\CS1\Services\Tcpip\..\{2F76176D-486E-402F-B20A-45B145D13BC1}: NameServer = 192.168.120.252,192.168.120.253
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = CD.local
O17 - HKLM\System\CS2\Services\Tcpip\..\{2F76176D-486E-402F-B20A-45B145D13BC1}: NameServer = 192.168.120.252,192.168.120.253
O18 - Protocol hijack: about - {53B95211-7D77-11D2-9F82-00104B107C96}