Wer kann helfen??
 

Immer wenn ich den IE öffne erscheint eine Seite mit:
about:blank
Und es erscheint
Quick Web Search



viagra |xanax| phentermine |online pharmacy| carisoprodol |hydrocodone| valium |cialis| fioricet
texas holdem |party poker| roulette |online gambling| blackjack |slots| casino | adult games
webhosting |domain registration| bonus server | voice mail | work at home
adult movies |personal photos| sex dating |free online dating| xxx dvd |asian sex| fetish
rv finance |visa platinum| merchant account | mortgage
spyware |adware| popup blocker |firewall| soft



wie bekomme ich das wieder weg?


mein Scan:

Mon Feb 21 22:44:25 2005 => ***** Scanning complete. *****
Mon Feb 21 22:44:25 2005 => Total Files Scanned: 38552
Mon Feb 21 22:44:25 2005 => Total Virus(es) Found: 11
Mon Feb 21 22:44:25 2005 => Total Disinfected Files: 0
Mon Feb 21 22:44:25 2005 => Total Files Renamed: 0
Mon Feb 21 22:44:25 2005 => Total Deleted Files: 0
Mon Feb 21 22:44:25 2005 => Total Errors: 3
Mon Feb 21 22:44:25 2005 => Time Elapsed: 00:57:47
Mon Feb 21 22:44:25 2005 => Virus Database Date: 2005/02/14
Mon Feb 21 22:44:25 2005 => Virus Database Count: 118236

Mon Feb 21 22:44:25 2005 => Scan Completed.

Mon Feb 21 22:47:01 2005 => Virus Database Date: 2005/02/14
Mon Feb 21 22:47:01 2005 => Virus Database Count: 118236
Mon Feb 21 22:47:21 2005 => AV Library Unloaded (3)...


File C:\WINDOWS\SYSTEM\connmie.exe infected by "not-a-virus:AdWare.FindSpy.a" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM\truettf.exe infected by "not-a-virus:AdWare.Msnagent.a" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM\dxconf.exe infected by "not-a-virus:AdWare.FindSpy.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\ARCHIVE\FS3.CAB infected by "Trojan-Dropper.Win32.Small.lx" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\ARCHIVE\FS6.CAB infected by "not-a-virus:AdWare.FindSpy.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\ARCHIVE\FS9.CAB infected by "not-a-virus:AdWare.FindSpy.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\ARCHIVE\FS10.CAB infected by "not-a-virus:AdWare.FindSpy.a" Virus. Action Taken: No Action Taken.
File C:\_RESTORE\ARCHIVE\FS2.CAB infected by "Trojan.Win32.Dialer.gd" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM\connmie.exe infected by "not-a-virus:AdWare.FindSpy.a" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM\truettf.exe infected by "not-a-virus:AdWare.Msnagent.a" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM\dxconf.exe infected by "not-a-virus:AdWare.FindSpy.a" Virus. Action Taken: No Action Taken.

Hi,

muss Dich irgentwie übersehen haben,

kennst Du die folgende IP-Adresse:

DNS-Server: ns1.kloth.net
DNS-Server-Adresse: 213.133.98.149#53

Non-authoritative answer:
149.125.161.206.in-addr.arpa name = ah1-p4id-88.advancedhosters.com.

Authoritative answers can be found from:
149.125.161.206.in-addr.arpa nameserver = ns1.advancedhosters.com.
149.125.161.206.in-addr.arpa nameserver = ns2.advancedhosters.com.
ns2.advancedhosters.com internet address = 66.111.40.90

Wenn nicht dann das hier
ausführen

boote in den abgesicherten Modus und lösche alle von eScan erkannten Dateien
Papierkorb leeren

im abgesicherten Modus mit HJT fixen:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\SYSTEM\SFCMAN32.DLL/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\SYSTEM\SFCMAN32.DLL/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\SYSTEM\SFCMAN32.DLL/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\SYSTEM\SFCMAN32.DLL/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\SYSTEM\SFCMAN32.DLL/sp.html (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\SYSTEM\SFCMAN32.DLL/sp.html (obfuscated)
O2 - BHO: (no name) - {53BE443D-66A1-4444-99B2-8DFBB0361034} - C:\WINDOWS\SYSTEM\SFCMAN32.DLL
O18 - Filter: text/html - {56EA2D8E-2ACA-4719-929C-1991CE9F9342} - C:\WINDOWS\SYSTEM\SFCMAN32.DLL
O18 - Filter: text/plain - {56EA2D8E-2ACA-4719-929C-1991CE9F9342} - C:\WINDOWS\SYSTEM\SFCMAN32.DLL

wenn Du oben genannte IP nicht kennst dann fixe auch noch den Eintrag, wenn er nicht schon weg ist.
O15 - Trusted IP range: 206.161.125.149

lösche von Hand folgende Dateien:

C:\WINDOWS\SYSTEM\SFCMAN32.DLL/sp.html
C:\WINDOWS\SYSTEM\SFCMAN32.DLL

neu booten neues Logfile

Besten Dank!!!!
scheint als ob jetzt alles wieder gut läuft!!!
Gruss
Pferdenoni

das wäre nur gut

poste nochmal das neue HJT Logfile