Immer noch smartsearch.ws - Trotz Details im Forum

#16 Ja, das ist das richtige!

Die IEXPLORER.exe finde ich nicht mehr in deinen Logs. Vieleicht reicht es dann scon alles zu "fix"en was mir "R" anfaengt und das sollte auch noch raus:

O16 - DPF: {15C3C7A4-9676-11D3-9799-0060087190B9} - http://www.movieplugin.com/plugin/plugin.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)

MfG Ralf
__________
MfG Ralf
SEO-Spam Hunter

#17 Danke!

Alles was mit "R" versteh ich nicht...

#18 Ich meinte das hier:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.msn.de/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm

Koenntest du mir die C:\WINDOWS\SYSTEM\blank.htm an virus@protecus.de schicken?

<g>
__________
MfG Ralf
SEO-Spam Hunter

#19 New Log file!!!!!! (Merijn)

StartupList report, 31.01.2004, 18:34:05
StartupList version: 1.52
Started from : C:\dreamcast\Eigene Dateien\My Music\HijackThis.EXE
Detected: Windows XP (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP1 (6.00.2600.0000)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Sygate\SPF\Smc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\RAMfreer\RAMfreer.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\ICQLite\ICQLite.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\WinSweep\WSMonitor.exe
C:\Programme\WinSweep\WSPopup.exe
C:\WINDOWS\System32\msiexec.exe
C:\Programme\Opera7\opera.exe
C:\dreamcast\Eigene Dateien\My Music\HijackThis.exe

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
nwiz = nwiz.exe /install
RAMfreer = C:\Programme\RAMfreer\RAMfreer.exe
WinPatrol = C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe
SmcService = C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
NeroCheck = C:\WINDOWS\system32\NeroCheck.exe
QuickTime Task = "C:\Programme\QuickTime\qttask.exe" -atboottime
ICQ Lite = C:\Programme\ICQLite\ICQLite.exe -minimize
THGuard = "C:\Programme\TrojanHunter 3.8\THGuard.exe"
AVGCtrl = C:\Programme\AVPersonal\AVGNT.EXE /min

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

WINSWEEP = C:\Programme\WinSweep\WinSweep.Exe /AUTO
WINSWEEP Popupblocker = C:\Programme\WinSweep\WSPopup.Exe /STEP1 /SOUND

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

ICQ Lite = C:\Programme\ICQLite\ICQLite.exe -trayboot

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\scrnsave.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Programmstart beschleunigen.job
Erinnerung für den Deinstallationsablauf.job
Liquid Audio Auto Update Agent.job

--------------------------------------------------

Enumerating Download Program Files:

[CV3 Class]
InProcServer32 = C:\WINDOWS\System32\wuv3is.dll
CODEBASE = http://windowsupdate.microsoft.com/R1092/V31Controls/x86/w98/de/actsetup.cab

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll

--------------------------------------------------
End of report, 4.802 bytes
Report generated in 0,080 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only