Vor der URL http://ehttp.cc/

#1 Hallo hoffe mir kann jemand helfen.
Bei einigen Seitenaufrufen hängt sich vor der eingegebenen URL ein http://ehttp.cc/ dazu????

Habe AdAware laufen lassen jedoch ohne Erfolg.
Online Virenscan geht nicht weil mir jede Seite sagt "kein Active X" obwohl ich meine Sicherheitsstufe schon auf niedrig geschaltet und ZoneAlarm deaktiviert habe.

Code

Logfile of HijackThis v1.97.7
Scan saved at 21:50:36, on 05.04.2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP1 (5.00.2920.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
M:\Programme\IBM\SQLLIB\BIN\db2jds.exe
M:\Programme\IBM\SQLLIB\BIN\db2sec.exe
M:\Programme\IBM\SQLLIB\bin\db2dasstm.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\mgabg.exe
C:\mysql\bin\mysqld-nt.exe
C:\Programme\Norton AntiVirus\navapsvc.exe
C:\WINNT\system32\regsvc.exe
C:\Programme\Norton AntiVirus\SAVScan.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\PDesk\PDesk.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\Programme\Logitech\MouseWare\system\em_exec.exe
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINNT\system32\sstray.exe
C:\WINNT\system32\internat.exe
C:\Programme\Siemens\Gigaset WLAN Adapter\WLM.exe
C:\Programme\Nokia\PC Suite für den Nokia 9210i Communicator\ECTaskScheduler.exe
C:\Programme\Nokia\PC Suite für den Nokia 9210i Communicator\ConnectState.exe
C:\Programme\Winamp\winampa.exe
C:\PROGRA~1\Nokia\PCSUIT~1\BROADC~1.EXE
M:\Programme\IBM\SQLLIB\bin\db2fmp.exe
C:\WINNT\System32\svchost.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Dokumente und Einstellungen\Rok\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://homepage.com
%00@www.e-finder.cc/search/ (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://homepage.com
%00@www.e-finder.cc/search/ (obfuscated)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.com
%00@www.e-finder.cc/hp/ (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://homepage.com
%00@www.e-finder.cc/search/ (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://homepage.com
%00@www.e-finder.cc/search/ (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://homepage.com
%00@www.e-finder.cc/search/ (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.com
%00@www.e-finder.cc/hp/ (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://homepage.com
%00@www.e-finder.cc/search/ (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://homepage.com
%00@www.e-finder.cc/search/ (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://homepage.com
%00@www.e-finder.cc/search/ (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://homepage.com
%00@www.e-finder.cc/search/ (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://homepage.com
%00@www.e-finder.cc/search/ (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Inode
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://homepage.com
%00@www.e-finder.cc/search/ (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = http://homepage.com
%00@www.e-finder.cc/search/ (obfuscated)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINNT\System32\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [Windows MeTaLRoCk service] metalrock.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [Zone Labs Client] C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\RunServices: [Windows MeTaLRoCk service] metalrock.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Startup: Gigaset WLAN Adapter Monitor.lnk = C:\Programme\Siemens\Gigaset WLAN Adapter\WLM.exe
O4 - Startup: PC Suite für den Nokia 9210i Communicator Aufgabenplaner.lnk = ?
O4 - Startup: PC Suite für den Nokia 9210i Communicator.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: SYSTRAN: &Alle Rahmen übersetzen - C:\Programme\Systran\Premium\menuTranslateAll.html
O8 - Extra context menu item: SYSTRAN: &Nach Aktualisierungen durchsuchen - C:\Programme\Systran\Premium\menuUpdate.html
O8 - Extra context menu item: SYSTRAN: &Optionen - C:\Programme\Systran\Premium\menuConfigure.html
O8 - Extra context menu item: SYSTRAN: &Registrieren - C:\Programme\Systran\Premium\menuRegister.html
O8 - Extra context menu item: SYSTRAN: &Übersetzen - C:\Programme\Systran\Premium\menuTranslate.html
O8 - Extra context menu item: SYSTRAN: Übersetzungstemporärspeicher &leeren - C:\Programme\Systran\Premium\menuClearCache.html
O9 - Extra button: @sysiecom.dll,-2100 (HKLM)
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2102 (HKLM)
O9 - Extra button: @sysiecom.dll,-2103 (HKLM)
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2105 (HKLM)
O9 - Extra button: @sysiecom.dll,-2115 (HKLM)
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2117 (HKLM)
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2108 (HKLM)
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2111 (HKLM)
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2114 (HKLM)
O9 - Extra button: ICQ Lite (HKLM)
O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)
O13 - DefaultPrefix: http://%65%68%74%74%70%2E%63%63/?
O13 - WWW Prefix: http://%65%68%74%74%70%2E%63%63/?
O13 - WWW. Prefix: http://
O16 - DPF: {11111111-1111-1111-1111-111111111123} - ms-its:mhtml:file://C:\ss.MHT!http://64.237.47.178//chm.chm::/1/e.exe
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://pub.plan.at/mgaxctrlde.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall-Kontrolle) - http://housecall.trendmicro-europe.com/housecall/Xscan53.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37991.6945717593
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{21394005-0434-41D7-AA79-1D81F9B5D357}: NameServer = 195.58.160.2,195.58.161.3
O17 - HKLM\System\CCS\Services\Tcpip\..\{7E287AF9-A5CF-4FA6-81BA-3BB2A9FFB1D5}: NameServer = 195.58.160.2 195.58.161.3

#2 Das hier fixen:

Code

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://homepage.com
%00@www.e-finder.cc/search/ (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://homepage.com
%00@www.e-finder.cc/search/ (obfuscated)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.com
%00@www.e-finder.cc/hp/ (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://homepage.com
%00@www.e-finder.cc/search/ (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://homepage.com
%00@www.e-finder.cc/search/ (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://homepage.com
%00@www.e-finder.cc/search/ (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.com
%00@www.e-finder.cc/hp/ (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://homepage.com
%00@www.e-finder.cc/search/ (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://homepage.com
%00@www.e-finder.cc/search/ (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://homepage.com
%00@www.e-finder.cc/search/ (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://homepage.com
%00@www.e-finder.cc/search/ (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://homepage.com
%00@www.e-finder.cc/search/ (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Inode
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://homepage.com
%00@www.e-finder.cc/search/ (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = http://homepage.com
%00@www.e-finder.cc/search/ (obfuscated)

O13 - DefaultPrefix: http://%65%68%74%74%70%2E%63%63/?
O13 - WWW Prefix: http://%65%68%74%74%70%2E%63%63/?

O16 - DPF: {11111111-1111-1111-1111-111111111123} - ms-its:mhtml:file://C:\ss.MHT!http://64.237.47.178//chm.chm::/1/e.exe

Das sieht eigenartig aus:

Zitat

C:\Programme\Systran\Premium\menuClearCache.html
O9 - Extra button: @sysiecom.dll,-2100 (HKLM)
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2102 (HKLM)
O9 - Extra button: @sysiecom.dll,-2103 (HKLM)
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2105 (HKLM)
O9 - Extra button: @sysiecom.dll,-2115 (HKLM)
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2117 (HKLM)
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2108 (HKLM)
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2111 (HKLM)
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2114 (HKLM)

Datei suchen und unt4er http://www.kaspersky.com/remoteviruschk.html mal prüfen.
__________
Durchsuchen --> Aussuchen --> Untersuchen

#3 Virus, bitte fixen:

O4 - HKLM\..\Run: [Windows MeTaLRoCk service] metalrock.exe
O4 - HKLM\..\RunServices: [Windows MeTaLRoCk service] metalrock.exe

Dann neu starten und hier durcharbeiten.(Sieht u.a. nach cws aus):
http://board.protecus.de/t9373.htm
__________
MfG Ralf
SEO-Spam Hunter

#4 Noch eine Sache: Den IE updaten wäre wirklich ratsam.
__________
Durchsuchen --> Aussuchen --> Untersuchen

#5 Oder gar keinen IE benutzen (der funzt doch eh net richtig)
__________
E-Mail: therion at ninth-art dot de
IRC: megatherion @ Freenode