Trojaner-Board - MSN Search schaltet sich dazwischen

Code:

Logfile of HijackThis v1.99.0

Scan saved at 18:37:59, on 18.01.2005

Platform: Windows 2000 SP4 (WinNT 5.00.2195)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
 

Running processes:

C:\WINNT\System32\smss.exe

C:\WINNT\system32\winlogon.exe

C:\WINNT\system32\services.exe

C:\WINNT\system32\lsass.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\system32\LEXBCES.EXE

C:\WINNT\system32\spoolsv.exe

C:\WINNT\system32\LEXPPS.EXE

C:\WINNT\System32\svchost.exe

C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe

C:\WINNT\system32\nvsvc32.exe

C:\WINNT\system32\regsvc.exe

C:\WINNT\system32\MSTask.exe

C:\WINNT\System32\WBEM\WinMgmt.exe

C:\WINNT\Explorer.EXE

F:\D-Tools\daemon.exe

C:\WINNT\system32\ctfmon.exe

C:\WINNT\system32\rundll32.exe

C:\WINNT\system32\rundll32.exe

F:\firefox\firefox.exe

F:\Programme\ICQLite\ICQLite.exe

F:\mirc\polaris2001v4.0\mirc32.exe

F:\mirc\polaris2001v4.0\mirc32.exe

E:\hijackthis199\HijackThis.exe
 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = H:\WINNT\System32\blank.htm

R3 - Default URLSearchHook is missing

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - f:\AReader5.1\Acrobat\ActiveX\AcroIEHelper.ocx

O2 - BHO: (no name) - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\winnt\downloaded program files\googletoolbar1.dll

O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - F:\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - F:\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\winnt\downloaded program files\googletoolbar1.dll

O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon

O4 - HKLM\..\Run: [DAEMON Tools-1033] "F:\D-Tools\daemon.exe"  -lang 1033

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [SurfBuddy] rundll32 "C:\Program Files\SurfBuddy\sbuddy.dll",run

O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe

O4 - HKCU\..\Run: [SurfBuddy] rundll32 "C:\Program Files\SurfBuddy\sbuddy.dll",run

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O8 - Extra context menu item: Mit &Google suchen - C:\Dokumente und Einstellungen\loli1\Anwendungsdaten\TuneUp Software\TuneUp Utilities\Web\gsearch.tui

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll

O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/de/bi.../GoogleNav.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{2AAB0A64-B735-4881-9FF8-29FD2CF6A04F}: NameServer = 217.237.150.141 217.237.150.97

O17 - HKLM\System\CCS\Services\Tcpip\..\{7E49C7C4-BBC8-46B1-B4E9-CAC1DB3464C7}: NameServer = 209.47.15.118,64.157.143.38,

O23 - Service: Apache - Unknown - F:\EasyPHP\Apache\apache.exe

O23 - Service: Verwaltungsdienst für die Verwaltung logischer Datenträger - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe

O23 - Service: LexBce Server - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE

O23 - Service: MySql - Unknown - F:\EasyPHP\MySql\bin\mysqld-nt.exe

O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe

Ich kann aber ehrlichgesgagt nichts wirklich übles hier erkennen!
Hoffe jemand findet was, thx im Vorraus.

loli

[EDIT]
Dachte ich poste den Qulltext der Suche auch mal, mom:

HTML-Code:

<HTML><HEAD><TITLE>MSN Search -- More Useful Everyday</TITLE>
 <META http-equiv=MSThemeCompatible content=Yes>
 <META http-equiv=Content-Type content=text/html;charset=utf-8>
 <LINK href="images/en-us_CSS_Classic.css" type=text/css rel=stylesheet>
 <META content="MSHTML 6.00.2800.1106" name=GENERATOR></HEAD>
 
 <BODY bgColor=#ffffff leftMargin=0 topMargin=0 marginheight="0" marginwidth="0">
 <TABLE cellPadding=25>

  <TBODY>

  <TR>

    <TD width=400><A name=top></A><a href="http://search.findwhatevernow.com/search.jsp?AF=cmgrb&term=news"><IMG style="MARGIN-RIGHT: 10px" 

      src="images/dns-info.gif" 

      align=absMiddle border=0 width="40" height="41"></a><SPAN class=h1>We can't 

      find <SPAN 

      class="h1 blue">"www.google.com"</SPAN></SPAN><BR>
 

      <BR><SPAN class=r>You can 

      try again by typing the URL in the address bar above. <BR>Or, search the 

      Web: </SPAN>
 <form method="GET" action="http://search.findwhatevernow.com/search.jsp" name="SearchForm">
 <input type="hidden" name="AF" maxlength="800" size="15" value="cmgrb">

      <TABLE cellSpacing=0 cellPadding=0 border=0>

        <TBODY>

        <TR>

          <TD vAlign=top colSpan=2></TD></TR>

        <TR>

          <TD><NOBR><INPUT class=qform id=q maxLength=800 size=50 name=term VCARD_NAME="SearchText">&nbsp;&nbsp;&nbsp;<INPUT id=submitbutton type=submit value=Search></NOBR><BR>Go 

            to <A class=blue 

            href="http://search.findwhatevernow.com/search.jsp?AF=cmgrb&term=online+casino">MSN 

            Search</A> to see complete results for 

      "www.google.com".</TD></TR></TBODY></TABLE><BR></FORM>
 

      <UL></UL><BR><SPAN class=r><A 

      href="http://search.findwhatevernow.com/search.jsp?AF=cmgrb&term=debt%2Bconsolidation">Check 

      availability or register the domain name 'www.google.com'.</A></SPAN>

      <HR class=l align=left>

      <BR>

      <A 

      href="http://search.findwhatevernow.com/search.jsp?AF=cmgrb&term=viagra">More 

      information about this error</A>.<BR>

      <A class="i gray" 

      href="http://search.findwhatevernow.com/search.jsp?AF=cmgrb&term=travel">About Results</A><BR>

      <BR><SPAN class=b>Powered by <A 

      href="http://search.findwhatevernow.com/search.jsp?AF=cmgrb&term=dvds"><IMG 

      alt="MSN Search" 

      src="images/msnDNSLogo.gif" 

      align=absMiddle border=0></A>&nbsp;<A 

      href="http://search.findwhatevernow.com/search.jsp?AF=cmgrb&term=credit%2Bcards">MSN 

      Search</A></SPAN><BR><BR>
 

      <DIV style="PADDING-LEFT: 10px; PADDING-BOTTOM: 3px" width="100%"><SPAN 

      class=cr2>�2003 Microsoft Corporation. All rights 

      reserved.&nbsp;&nbsp; Terms of Use &nbsp;&nbsp; TRUSTe Approved Privacy 

      Statement&nbsp;&nbsp;</SPAN></DIV></TD></TR></TBODY></TABLE>
 
 </BODY></HTML>
 

Werd einfach nich schlau draus, vorallem, da er als Quelle die Google-Url (Hier: http://www.google.com/search?q=balinea+monitor+22+zoll&sourceid=firefox&start=0&start=0&ie=utf-8&oe=utf-8 ) angibt :((

[/EDIT]