Trojaner-Board - Falsche Seiten bei Google

Hallo, brauche Hilfe. Wenn ich im Windows Internet Explorer bei Google auf die Suchergebnisse klicke, werden immer andere Seiten angezeigt.

Habe combofix, hijackthis und datfind schon durchlaufen lassen und poste hier mal die Ergebnisse. Danke schon mal für Eure Hilfe. Gruß, UWE

combofix:

ComboFix 07-08-14.4 - "UWE JANSEN" 2007-08-14 18:37:30.1 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1031.18.183 [GMT 2:00]
* Created a new restore point

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\DOKUME~1\UWEJAN~1\ANWEND~1\ShoppingReport
C:\DOKUME~1\UWEJAN~1\ANWEND~1\ShoppingReport\cs\Config.xml
C:\DOKUME~1\UWEJAN~1\ANWEND~1\ShoppingReport\cs\db\Aliases.dbs
C:\DOKUME~1\UWEJAN~1\ANWEND~1\ShoppingReport\cs\db\Sites.dbs
C:\DOKUME~1\UWEJAN~1\ANWEND~1\ShoppingReport\cs\dwld\WhiteList.xip
C:\DOKUME~1\UWEJAN~1\ANWEND~1\ShoppingReport\cs\persist.dbs
C:\DOKUME~1\UWEJAN~1\ANWEND~1\ShoppingReport\cs\report\aggr_storage.xml
C:\DOKUME~1\UWEJAN~1\ANWEND~1\ShoppingReport\cs\report\send_storage.xml
C:\DOKUME~1\UWEJAN~1\ANWEND~1\ShoppingReport\cs\res1\WhiteList.dbs
C:\Programme\ShoppingReport
C:\Programme\ShoppingReport\cs\persist.dbs
C:\Programme\ShoppingReport\Uninst.exe
C:\WINDOWS\system32\kdcvn.exe

((((((((((((((((((((((((( Files Created from 2007-07-14 to 2007-08-14 )))))))))))))))))))))))))))))))

2007-08-14 18:36 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-14 13:35 <DIR> d-------- C:\WINDOWS\system32\GroupPolicy
2007-08-14 13:35 <DIR> d-------- C:\Programme\Hitman Pro
2007-08-14 00:45 <DIR> d-------- C:\Programme\a-squared Free
2007-08-13 23:53 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Spybot - Search & Destroy
2007-08-13 23:17 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2007-08-13 23:10 <DIR> d-------- C:\WINDOWS\pss
2007-08-13 13:33 278,528 --a------ C:\WINDOWS\system32\livesnth.dll
2007-08-09 14:21 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Installations
2007-08-08 16:31 22,016 --a------ C:\WINDOWS\system32\drivers\MSIRCOMM.sys
2007-08-08 16:31 22,016 --a------ C:\WINDOWS\system32\dllcache\msircomm.sys
2007-08-05 10:05 86,016 -ra------ C:\WINDOWS\system32\ZSPOOL.DLL
2007-08-05 10:05 442,368 -ra------ C:\WINDOWS\system32\zshp1018.exe
2007-08-05 10:05 28,672 -ra------ C:\WINDOWS\system32\zlm.dll
2007-08-05 10:05 28,672 -ra------ C:\WINDOWS\system32\IMF32.DLL
2007-08-05 10:05 24,576 -ra------ C:\WINDOWS\system32\ZTAG32.DLL
2007-08-05 10:05 143,360 -ra------ C:\WINDOWS\apptune1018.exe
2007-08-05 10:05 106,496 -ra------ C:\WINDOWS\system32\vshp1018.dll
2007-08-05 10:05 102,400 -ra------ C:\WINDOWS\system32\zlhp1018.dll
2007-08-05 10:05 <DIR> d--h----- C:\Programme\Zenographics
2007-08-05 10:05 <DIR> d-------- C:\Programme\Hewlett-Packard
2007-08-04 16:32 <DIR> d-------- C:\Programme\Gemeinsame Dateien\xing shared
2007-08-01 14:02 <DIR> d-------- C:\DOKUME~1\UWEJAN~1\ANWEND~1\OpenOffice.org2
2007-08-01 13:45 <DIR> d-------- C:\Programme\OpenOffice.org 2.2
2007-07-30 19:01 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Google
2007-07-26 16:01 <DIR> d-------- C:\WINDOWS\system32\URTTemp
2007-07-26 16:01 <DIR> d-------- C:\DOKUME~1\UWEJAN~1\ANWEND~1\T-Online
2007-07-26 16:00 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\T-Online
2007-07-26 15:59 <DIR> d-------- C:\Programme\T-Online
2007-07-26 15:59 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Marmiko Shared
2007-07-26 15:39 <DIR> d-------- C:\Programme\Learn2.com
2007-07-26 15:38 153,088 --a------ C:\WINDOWS\system32\jgdwmie.dll
2007-07-26 15:37 <DIR> d-------- C:\Programme\Gemeinsame Dateien\aolshare
2007-07-26 15:37 <DIR> d-------- C:\Programme\AOL 9.0
2007-07-23 17:34 14,037 --a------ C:\WINDOWS\system32\drivers\mdc8021x.sys
2007-07-23 17:34 <DIR> d--h----- C:\DOKUME~1\UWEJAN~1\WLANProfiles
2007-07-23 17:33 970,752 --a------ C:\WINDOWS\system32\W70MLRES.DLL
2007-07-23 17:33 970,752 --a------ C:\WINDOWS\system32\W20MLRES.DLL
2007-07-23 17:32 <DIR> d-------- C:\WINDOWS\SMSC
2007-07-23 17:31 69,504 --a------ C:\WINDOWS\system32\drivers\Rtlnic51.sys
2007-07-20 19:08 <DIR> d-------- C:\Programme\MSXML 4.0
2007-07-20 19:08 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Downloaded Installations
2007-07-20 18:02 <DIR> d-------- C:\Programme\Canon
2007-07-20 14:49 854 --a------ C:\WINDOWS\checkip.dat
2007-07-18 15:05 <DIR> d-------- C:\DOKUME~1\UWEJAN~1\ANWEND~1\Template
2007-07-18 15:03 0 --a------ C:\DOKUME~1\UWEJAN~1\ANWEND~1\wklnhst.dat
2007-07-18 15:00 <DIR> d-------- C:\Programme\Microsoft Works

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-13 11:57 --------- d-------- C:\Programme\CDBurnerXP Pro 3
2007-07-13 11:50 1024 -r-h----- C:\WINDOWS\system32\NTIMPEG2.dll
2007-07-13 11:50 1024 -r-h----- C:\WINDOWS\system32\NTICDMK32.dll
2007-07-12 21:29 --------- d-------- C:\DOKUME~1\UWEJAN~1\ANWEND~1\DataLayer
2007-07-12 21:17 --------- d-------- C:\DOKUME~1\UWEJAN~1\ANWEND~1\Nokia Multimedia Player
2007-07-12 16:50 --------- d-------- C:\DOKUME~1\UWEJAN~1\ANWEND~1\Nokia
2007-07-12 16:49 --------- d-------- C:\DOKUME~1\UWEJAN~1\ANWEND~1\PC Suite
2007-07-12 16:13 --------- d-------- C:\Programme\Sitecom
2007-06-28 16:00 --------- d-------- C:\Programme\MAGIX
2007-06-28 16:00 --------- d-------- C:\Programme\Gemeinsame Dateien\MAGIX Shared
2007-06-21 14:42 103720 --a------ C:\WINDOWS\system32\AOLDial.dll
2007-06-17 22:20 --------- d-------- C:\DOKUME~1\UWEJAN~1\ANWEND~1\WinRAR
2007-06-17 21:40 --------- d-------- C:\Programme\BoxCloud
2007-05-16 17:12 85504 --------- C:\WINDOWS\system32\dllcache\wabimp.dll
2007-05-16 17:12 510976 --------- C:\WINDOWS\system32\dllcache\wab32.dll
2007-05-16 17:11 86528 --------- C:\WINDOWS\system32\dllcache\directdb.dll
2007-05-16 17:11 683520 --a------ C:\WINDOWS\system32\inetcomm.dll
2007-05-16 17:11 683520 --------- C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-05-16 17:11 1314816 --------- C:\WINDOWS\system32\dllcache\msoe.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HostManager"="C:\Programme\Gemeinsame Dateien\AOL\1178968852\ee\AOLSoftware.exe" [2006-09-26 02:52]
"UIStarter"="C:\Programme\Nokia\Card Phone 2.0\Setup\CardPhoneUIStarter.exe" [1999-10-28 13:42]
"TkBellExe"="C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2007-08-04 16:31]
"SunJavaUpdateSched"="C:\Programme\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"SoundMan"="SOUNDMAN.EXE" [2003-06-20 19:55 C:\WINDOWS\SOUNDMAN.EXE]
"RemoteControl"="C:\Programme\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-21 11:52]
"QuickTime Task"="C:\Programme\QuickTime\qttask.exe" [2005-12-31 18:14]
"PRONoMgr.exe"="C:\Programme\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe" [2004-02-05 16:33]
"OrderReminder"="C:\Programme\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2006-01-30 18:00]
"LManager"="C:\PROGRA~1\LAUNCH~1\CPLBCL53.EXE" [2004-03-18 01:04]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-05-29 11:26]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-05-29 11:14]
"Camera Detector"="C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.exe" [2003-11-04 10:17]
"Apoint"="C:\Programme\Apoint2K\Apoint.exe" [2002-07-25 04:49]
"AOLDialer"="C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLDial.exe" [2007-06-21 14:42]
"AGRSMMSG"="AGRSMMSG.exe" [2003-06-23 10:35 C:\WINDOWS\AGRSMMSG.exe]
"Adobe Reader Speed Launcher"="C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="~C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" []
"MsnMsgr"="~C:\Programme\MSN Messenger\MsnMsgr.exe" []
"Mozilla Quick Launch"="C:\Programme\Netscape\Netscape\Netscp.exe" [2003-06-24 12:09]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:57]

C:\Dokumente und Einstellungen\UWE JANSEN\Startmen�\Programme\Autostart\
OpenOffice.org 2.2.lnk - C:\Programme\OpenOffice.org 2.2\program\quickstart.exe [2007-02-02 17:54:56]
HcwSyncIt.lnk - C:\Programme\WinTV\Scheduler\EPG\TvTv\HcwSyncIt.exe [2007-01-10 21:49:30]

C:\Dokumente und Einstellungen\All Users\Startmen�\Programme\Autostart\
Microsoft Office.lnk - C:\Programme\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56]
BlueSoleil.lnk - C:\Programme\Sitecom\IVT BlueSoleil\BlueSoleil.exe [2006-07-16 17:33:36]
AutoStart IR.lnk - C:\Programme\WinTV\Ir.exe [2007-01-10 21:49:45]
AOL 9.0 Tray-Symbol.lnk - C:\Programme\AOL 9.0\aoltray.exe [2007-07-26 15:38:35]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring]
C:\WINDOWS\system32\LgNotify.dll 2004-03-03 16:48 110592 C:\WINDOWS\system32\LgNotify.dll

R3 DKbFltr;Dritek HotKey Keyboard Filter Driver;C:\WINDOWS\system32\Drivers\DKbFltr.sys
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;C:\Programme\MAGIX\Common\Database\bin\fbserver.exe
S3 HCW77BDA;Hauppauge Nova-T Stick DVB-T Tuner;C:\WINDOWS\system32\Drivers\hcw70bda.sys
S3 hcw99rc;Hauppauge Nova-DT IR Driver;C:\WINDOWS\system32\Drivers\hcw99rc.sys
S3 MSIRCOMM;Microsoft IR Communications Driver;C:\WINDOWS\system32\DRIVERS\MSIRCOMM.sys
S3 ncp2;ncp2;C:\WINDOWS\system32\DRIVERS\ncp2.sys
S3 w70n51;Intel(R) PRO/Wireless 7100 Adapter-Treiber;C:\WINDOWS\system32\DRIVERS\w70n51.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b2092c40-bb5d-11db-9dd5-00038a000015}]
AutoRun\command- F:\LaunchU3.exe

*Newly Created Service* - ATWPKT2

Contents of the 'Scheduled Tasks' folder
2007-07-05 09:21:32 C:\WINDOWS\Tasks\WinTV_00.job
2007-07-05 02:10:04 C:\WINDOWS\Tasks\!WinTV_00.job - C:\PROGRA~1\WINTV\Scheduler\StayAwake.exe
2007-08-14 16:21:06 C:\WINDOWS\Tasks\Auf Updates für Windows Live Toolbar prüfen.job

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-14 18:43:00
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-14 18:45:01 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-08-14 18:45

--- E O F ---

hijackthis:

Logfile of HijackThis v1.99.1

[edit]
bitte editiere zukünftig deine links, wie es dir u.a. hier angezeigt wird:
http://www.trojaner-board.de/22771-a...tml#post171958

danke
GUA
[/edit]