"Search for..." Startseite kommt immer wieder!

#331 Hallo@UhhhYeah

#ClaerProg..lade die neuste Version <1.4.1
http://www.clearprog.de/downloads.php
<und saeubere den Browser.
Das Programm löscht die Surfspuren des Internet Explorers ab Version 5.0, des Netscape/Mozilla und des Opera:
- Cookies
- Verlauf
- Temporäre Internetfiles (Cache)
- die eingetragenen URLs

KillBox
http://www.bleepingcomputer.com/files/killbox.php
http://download.broadbandmedic.com/
<Delete File on Reboot
und klick auf das rote Kreuz,

wenn gefragt wird, ob "Do you want to reboot? "----> klicke auf "no",und kopiere das naechste rein, erst beim letzten auf "yes"

C:\Dokumente und Einstellungen\2DooR\Lokale Einstellungen\Temp\wu.exe
C:\WINDOWS\tstlb.hta
C:\WINDOWS\msn.hta
C:\!Submit\archive.jar-2be2befc-57085166.zip
C:\!Submit\apptm32.dll
C:\!Submit\4d.tmp
C:\!Submit\4c.tmp
C:\WINDOWS\pkjju.dll
C:\WINDOWS\Downloaded Program Files\search.inf
C:\WINDOWS\Downloaded Program Files\installer_MARKETING2.exe
C:\WINDOWS\Downloaded Program Files\inst2.dll
C:\Programme\ClearSearch\CSSS.DLL
C:\Dokumente und Einstellungen\2DooR\Lokale Einstellungen\Temp\4D.tmp
C:\Dokumente und Einstellungen\2DooR\Lokale Einstellungen\Temp\4C.tmp
C:\Dokumente und Einstellungen\2DooR\Lokale Einstellungen\Temp\4D.tmp.exe
C:\WINDOWS\system32\nzzxp.dll
C:\!Submit\archive.jar-3c0d2e5b-3c328010.zip
F:\Utils3\HijackThis\backup-20050205-124635-306.dll
C:\!Submit\csss.dll
C:\!Submit\hdplugin1015.dll
C:\!Submit\hdplugin1018.dll
C:\!Submit\hdplugin1019.dll
C:\!Submit\inst2.dll
C:\!Submit\installer_marketing2.exe
C:\!Submit\msn.hta
C:\!Submit\msxu.exe
C:\!Submit\pskill.exe
C:\!Submit\search.inf
C:\!Submit\syskc32.exe
C:\!Submit\tstlb.hta
C:\!Submit\updater.exe
C:\!Submit\wu.exe
C:\!Submit\_1-web-1-0-.exe
C:\Programme\Gemeinsame Dateien\GMT\EGIEProcess.dll
F:\InternetDownloads\ezcdr_inst.exe
F:\InternetDownloads\mpb.exe

PC neustarten--> in den abgesicherten Modus

Start<Ausfuehren< schreib rein: %temp% --> loesche den Inhalt der Ordner (nicht die Ordner selbst) und loesche nur, was unbekannt ist, z,B. : wu.exe ,4D.tmp.exe

scanne mit dem Antivirus und poste mir das Log vom Scann
__________
MfG Sabina

rund um die PC-Sicherheit

#332 hi... also hab alles gemacht wie du gemeint hast... der antivirus hat nichts mehr gefunden... claerprog ausgeführt und die surfspuren gelöscht.... was mir aufgefallen ist dass jetzt im abgesicherten modus im taskmanager 5 dateien sind die ich so nicht kenne....

smss.exe, lsass.exe, services.exe, csrss.exe, kavss.exe, winlogon.exe

sind die böse??

was sollte ich nun weiter tun...? (im moment bin ich im abgesicherten modus)

#333 UhhhYeah

Bitte, was sollen diese Infos, du weisst doch schon, wie ich arbeite......poste das Log vom HijackThis
__________
MfG Sabina

rund um die PC-Sicherheit

#334 sorry war etwas am schlauch gestanden..

Logfile of HijackThis v1.99.0
Scan saved at 14:56:53, on 06.02.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
F:\hijackthis\HijackThis.exe

O2 - BHO: (no name) - {741F449C-9060-015F-109F-D04403FDE843} - C:\WINDOWS\system32\ntis.dll
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\GEMEIN~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] F:\Utils3\NOKIA6~1\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [SmcService] F:\Utils3\SYGATE~1\smc.exe -startgui
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [AVG7_Run] F:\AVGANT~1\avgw.exe /RUNONCE
O4 - Startup: Cardbus WLAN Utility.lnk = C:\Programme\RUNTOP\Cardbus WLAN Utility\WLANApp.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - F:\Utils3\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - F:\Utils3\ICQ\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O12 - Plugin for .3gp: C:\Programme\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .m4a: C:\Programme\Internet Explorer\PLUGINS\npqtplugin5.dll
O12 - Plugin for .mov: C:\Programme\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mp3: C:\Programme\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .mpeg: C:\Programme\Internet Explorer\PLUGINS\npqtplugin3.dll
O23 - Service: AntiVir Service - H+BEDV Datentechnik GmbH - F:\Utils3\Antivir\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - F:\Utils3\Antivir\AVWUPSRV.EXE
O23 - Service: Sygate Personal Firewall Pro - Sygate Technologies, Inc. - F:\Utils3\SygatePersonalFirewall\smc.exe

#335 Hallo@UhhhYeah

Download Registry Search Tool :
http://www.billsway.com/vbspage/vbsfiles/RegSrch.zip
Doppelklick:regsrch.vbs

kopiere rein:
{741F449C-9060-015F-109F-D04403FDE843}

Press 'OK'
warten, bis die Suche beendet ist. (Ergebnis bitte posten)

kopiere in die killbox--> loeschen--> PC neustarten
C:\WINDOWS\system32\ntis.dll

PC neustarten

Please download DllCompare from here
http://www.atribune.org/downloads/DllCompare.exe
<klick: Locate.com button.
wenn der Scan beendet ist
<klick:Compare button
<klick: und erstelle das Log--->bitte posten

CWShredder 2.12 [2004-12-13]--> scannen
http://www.majorgeeks.com/download3019.html
Log-->"make Report"--> poste das komplette Log

#Hoster-Tool : http://members.aol.com/toadbee/hoster.zip
Press 'Restore Original Hosts' and press 'OK'
Exit Program.


#neue Startseite
gehe zur Systemsteuerung --> Internetoptionen --> auf dem Reiter Allgemein bei Temporäre Internetdateien klickst du Dateien löschen --> auch bei Alle Offlineinhalte löschen das Häkchen setzen und mit OK bestätigen --> Auf den Reiter Programme gehen und dort auf Webeinstellungen zurücksetzen klicken, mit Ja bestätigen, fall Nachfrage kommt --> auf Übernehmen und abschließend auf OK klicken und stelle eine neue Startseite ein
__________
MfG Sabina

rund um die PC-Sicherheit

#336 ok hier das Log von dem Reg Search Tool

REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "{741F449C-9060-015F-109F-D04403FDE843}" 06.02.2005 15:13:45

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{741F449C-9060-015F-109F-D04403FDE843}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{741F449C-9060-015F-109F-D04403FDE843}\Data]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{741F449C-9060-015F-109F-D04403FDE843}\Data\MD]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{741F449C-9060-015F-109F-D04403FDE843}\InprocServer32]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks]
"{741F449C-9060-015F-109F-D04403FDE843}"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{741F449C-9060-015F-109F-D04403FDE843}]

hier das DLL Log


* DLLCompare Log version(1.0.0.127)
Files Found that Windows does not See or cannot Access
*Not everything listed here means you are infected!
________________________________________________

O^E says: "There were no files found "
________________________________________________

1.300 items found: 1.300 files, 0 directories.
Total of file sizes: 268.865.269 bytes 256,41 M

Administrator Account = Wahr

--------------------End log---------------------

und das CWshredder LOG komplett

**** Run Keys ****

RUN: [DataLayer] C:\PROGRA~1\GEMEIN~1\PCSuite\DATALA~1\DATALA~1.EXE
RUN: [PCSuiteTrayApplication] F:\Utils3\NOKIA6~1\NOKIAP~1\TRAYAP~1.EXE
RUN: [SmcService] F:\Utils3\SYGATE~1\smc.exe -startgui
RUN: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
RUN: [AVG7_Run] F:\AVGANT~1\avgw.exe /RUNONCE


**** Browser Helper Objects ****

BHO: [] C:\WINDOWS\system32\ntis.dll


**** IE Toolbars ****



**** IE Extensions ****

IEExt: [Web Browser Applet Control] C:\WINDOWS\system32\msjava.dll
IEExt: [ICQ Pro] F:\Utils3\ICQ\ICQ.exe
IEExt: [Messenger] C:\Programme\Messenger\msmsgs.exe


**** Hosts File Entries ****



**** IE Settings ****

Local Page: C:\WINDOWS\SYSTEM32\blank.htm
Search Bar: http://www.google.com
Search Page: http://www.google.com


**** IE Context Menu (Right click) ****



**** Layered Service Providers ****

LSP: MSAFD Irda [IrDA]
LSP: MSAFD Tcpip [TCP/IP]
LSP: MSAFD Tcpip [UDP/IP]
LSP: RSVP UDP Service Provider
LSP: RSVP TCP Service Provider
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{CB5FFAD4-E2E5-46F2-A3D0-00CB8EF59A4A}] SEQPACKET 0
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{CB5FFAD4-E2E5-46F2-A3D0-00CB8EF59A4A}] DATAGRAM 0
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{42BB03CF-7E47-4D5C-A3A4-638BCDF10B30}] SEQPACKET 1
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{42BB03CF-7E47-4D5C-A3A4-638BCDF10B30}] DATAGRAM 1
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{D0E4A2F8-8113-428A-AAA0-46DAD616A84E}] SEQPACKET 2
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{D0E4A2F8-8113-428A-AAA0-46DAD616A84E}] DATAGRAM 2
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{49F7611C-2BDC-468E-84B3-46D364D9A461}] SEQPACKET 3
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{49F7611C-2BDC-468E-84B3-46D364D9A461}] DATAGRAM 3
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{C1F8F1B7-B4A9-4FAF-B4BD-768A36BB7834}] SEQPACKET 4
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{C1F8F1B7-B4A9-4FAF-B4BD-768A36BB7834}] DATAGRAM 4
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{4459587C-C6B7-479E-A91D-0390C780F1E2}] SEQPACKET 5
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{4459587C-C6B7-479E-A91D-0390C780F1E2}] DATAGRAM 5
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{4EC82DDD-E9B7-4F32-8B5B-1E9D0B1E4C98}] SEQPACKET 6
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{4EC82DDD-E9B7-4F32-8B5B-1E9D0B1E4C98}] DATAGRAM 6
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{25BA4230-2E19-4E47-86EE-ABD466CA5499}] SEQPACKET 7
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{25BA4230-2E19-4E47-86EE-ABD466CA5499}] DATAGRAM 7
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{8CFBCDDA-DBED-43DC-9321-7617A052E610}] SEQPACKET 8
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{8CFBCDDA-DBED-43DC-9321-7617A052E610}] DATAGRAM 8


**** Blocked Control Panel Items ****

BLOCKED: [ncpa.cpl] No
BLOCKED: [odbccp32.cpl] No


**** Downloaded Program Files ****

DirectAnimation Java Classes []
Microsoft XML Parser for Java [file://C:\WINDOWS\Java\classes\xmldso.cab]
{8AD9C840-044E-11D1-B3E9-00805F499D93} [http://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab]
{A8658086-E6AC-4957-BC8E-7D54A7E8A78D} [http://www.microsoft.com/security/controls/DoomCln.CAB] C:\WINDOWS\Downloaded Program Files\DoomCln.dll
{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA} [http://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab]
{D27CDB6E-AE6D-11CF-96B8-444553540000} [http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab]


**** Windows Services ****

[Adobe LM Service] "C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe"
[Alerter] %SystemRoot%\System32\svchost.exe -k LocalService
[ALG] %SystemRoot%\System32\alg.exe
[AppMgmt] %SystemRoot%\system32\svchost.exe -k netsvcs
[Ati HotKey Poller] %SystemRoot%\System32\Ati2evxx.exe
[AudioSrv] %SystemRoot%\System32\svchost.exe -k netsvcs
[AVWUpSrv] F:\Utils3\Antivir\AVWUPSRV.EXE
[BITS] %SystemRoot%\System32\svchost.exe -k netsvcs
[Browser] %SystemRoot%\System32\svchost.exe -k netsvcs
[CiSvc] %SystemRoot%\system32\cisvc.exe
[ClipSrv] %SystemRoot%\system32\clipsrv.exe
[COMSysApp] C:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
[CryptSvc] %SystemRoot%\system32\svchost.exe -k netsvcs
[Dhcp] %SystemRoot%\System32\svchost.exe -k netsvcs
[dmadmin] %SystemRoot%\System32\dmadmin.exe /com
[dmserver] %SystemRoot%\System32\svchost.exe -k netsvcs
[Dnscache] %SystemRoot%\System32\svchost.exe -k NetworkService
[ERSvc] %SystemRoot%\System32\svchost.exe -k netsvcs
[Eventlog] %SystemRoot%\system32\services.exe
[EventSystem] C:\WINDOWS\System32\svchost.exe -k netsvcs
[FastUserSwitchingCompatibility] %SystemRoot%\System32\svchost.exe -k netsvcs
[GemServ] C:\Programme\AMD\PowerNow!\GemServ.exe
[helpsvc] %SystemRoot%\System32\svchost.exe -k netsvcs
[HidServ] %SystemRoot%\System32\svchost.exe -k netsvcs
[ImapiService] C:\WINDOWS\System32\imapi.exe
[Irmon] %SystemRoot%\System32\svchost.exe -k netsvcs
[lanmanserver] %SystemRoot%\System32\svchost.exe -k netsvcs
[LanmanWorkstation] %SystemRoot%\System32\svchost.exe -k netsvcs
[LmHosts] %SystemRoot%\System32\svchost.exe -k LocalService
[Messenger] %SystemRoot%\System32\svchost.exe -k netsvcs
[mnmsrvc] C:\WINDOWS\System32\mnmsrvc.exe
[MSDTC] C:\WINDOWS\System32\msdtc.exe
[MSIServer] C:\WINDOWS\System32\msiexec.exe /V
[NetDDE] %SystemRoot%\system32\netdde.exe
[NetDDEdsdm] %SystemRoot%\system32\netdde.exe
[Netlogon] %SystemRoot%\System32\lsass.exe
[Netman] %SystemRoot%\System32\svchost.exe -k netsvcs
[Nla] %SystemRoot%\System32\svchost.exe -k netsvcs
[NtLmSsp] %SystemRoot%\System32\lsass.exe
[NtmsSvc] %SystemRoot%\system32\svchost.exe -k netsvcs
[PlugPlay] %SystemRoot%\system32\services.exe
[PolicyAgent] %SystemRoot%\System32\lsass.exe
[ProtectedStorage] %SystemRoot%\system32\lsass.exe
[RasAuto] %SystemRoot%\System32\svchost.exe -k netsvcs
[RasMan] %SystemRoot%\System32\svchost.exe -k netsvcs
[RDSessMgr] C:\WINDOWS\system32\sessmgr.exe
[RemoteAccess] %SystemRoot%\System32\svchost.exe -k netsvcs
[rpcapd] "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini"
[RpcLocator] %SystemRoot%\System32\locator.exe
[RpcSs] %SystemRoot%\system32\svchost -k rpcss
[RSVP] %SystemRoot%\System32\rsvp.exe
[SamSs] %SystemRoot%\system32\lsass.exe
[SCardSvr] %SystemRoot%\System32\SCardSvr.exe
[Schedule] %SystemRoot%\System32\svchost.exe -k netsvcs
[seclogon] %SystemRoot%\System32\svchost.exe -k netsvcs
[SENS] %SystemRoot%\system32\svchost.exe -k netsvcs
[SharedAccess] %SystemRoot%\System32\svchost.exe -k netsvcs
[ShellHWDetection] %SystemRoot%\System32\svchost.exe -k netsvcs
[SLService] slserv.exe
[Spooler] %SystemRoot%\system32\spoolsv.exe
[srservice] %SystemRoot%\System32\svchost.exe -k netsvcs
[SSDPSRV] %SystemRoot%\System32\svchost.exe -k LocalService
[stisvc] %SystemRoot%\System32\svchost.exe -k imgsvc
[SwPrv] C:\WINDOWS\System32\dllhost.exe /Processid:{EDA0203D-00C3-4C46-9226-4E8F0B2D158C}
[SysmonLog] %SystemRoot%\system32\smlogsvc.exe
[TapiSrv] %SystemRoot%\System32\svchost.exe -k netsvcs
[TermService] %SystemRoot%\System32\svchost.exe -k netsvcs
[Themes] %SystemRoot%\System32\svchost.exe -k netsvcs
[TrkWks] %SystemRoot%\system32\svchost.exe -k netsvcs
[upnphost] %SystemRoot%\System32\svchost.exe -k LocalService
[UPS] %SystemRoot%\System32\ups.exe
[VSS] %SystemRoot%\System32\vssvc.exe
[W32Time] %SystemRoot%\System32\svchost.exe -k netsvcs
[WebClient] %SystemRoot%\System32\svchost.exe -k LocalService
[winmgmt] %systemroot%\system32\svchost.exe -k netsvcs
[WmiApSrv] C:\WINDOWS\System32\wbem\wmiapsrv.exe
[wuauserv] %systemroot%\system32\svchost.exe -k netsvcs
[WZCSVC] %SystemRoot%\System32\svchost.exe -k netsvcs


**** Custom IE Search Items ****

SEARCH: [SearchAssistant] http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
SEARCH: [CustomizeSearch] http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm


**** Complete IE Options ****

IEOPT: [NoUpdateCheck]
IEOPT: [NoJITSetup]
IEOPT: [Disable Script Debugger] yes
IEOPT: [Start Page] http://www.google.com/
IEOPT: [Search Bar] http://www.google.com
IEOPT: [Use Custom Search URL]
IEOPT: [Show_ChannelBand] No
IEOPT: [Anchor Underline] yes
IEOPT: [Cache_Update_Frequency] Once_Per_Session
IEOPT: [Display Inline Images] yes
IEOPT: [Do404Search]
IEOPT: [Save_Session_History_On_Exit] no
IEOPT: [Show_FullURL] no
IEOPT: [Show_StatusBar] yes
IEOPT: [Show_ToolBar] yes
IEOPT: [Show_URLinStatusBar] yes
IEOPT: [Show_URLToolBar] yes
IEOPT: [Use_DlgBox_Colors] yes
IEOPT: [Search Page] http://www.google.com
IEOPT: [FullScreen] no
IEOPT: [Window_Placement] ,
IEOPT: [Local Page] C:\WINDOWS\SYSTEM32\blank.htm
IEOPT: [Enable_Disk_Cache] yes
IEOPT: [Cache_Percent_of_Disk]
IEOPT: [Delete_Temp_Files_On_Exit] yes
IEOPT: [Anchor_Visitation_Horizon]
IEOPT: [Use_Async_DNS] yes
IEOPT: [Placeholder_Width]
IEOPT: [Placeholder_Height]
IEOPT: [Start Page] about:blank
IEOPT: [CompanyName] Microsoft Corporation
IEOPT: [Custom_Key] MICROSO
IEOPT: [Wizard_Version] 6.0.2600.0000
IEOPT: [FullScreen] no
IEOPT: [Use Search Assistant] yes
IEOPT: [Local Page] C:\WINDOWS\SYSTEM32\blank.htm
IEOPT: [Use Search Asst] no

#337 Hallo@UhhhYeah

Start<Ausfuehren schreib rein: cmd
DOS oeffnet sich

regsvr32 /u c:\system32\ntis.dll

"enter" und PC neustarten--> in den abgesicherten Modus
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
du musst
C:\WINDOWS\system32\ntis.dll
loeschen.

dann poste das neue Log vom HijackThis und vom CWshredder
die ntis.dll darf nicht mehr erscheinen
~
Dienste daktivieren
#Windows-Dienste abschalten"!
http://www.dingens.org/

#Ad-aware SE Personal 1.05 Updated
http://fileforum.betanews.com/detail/965718306/1
Laden--> Updaten-->scannen-->PC neustarten--> noch mal scannen--> poste das Log vom Scann

#TuneUp2004 (30 Tage free)
http://www.tuneup.de/products/tuneup-utilities/
Cleanup repair -->TuneUp Diskcleaner
Cleanup repair -->Registry Cleaner

#neue Startseite
gehe zur Systemsteuerung --> Internetoptionen --> auf dem Reiter Allgemein bei Temporäre Internetdateien klickst du Dateien löschen --> auch bei Alle Offlineinhalte löschen das Häkchen setzen und mit OK bestätigen --> Auf den Reiter Programme gehen und dort auf Webeinstellungen zurücksetzen klicken, mit Ja bestätigen, fall Nachfrage kommt --> auf Übernehmen und abschließend auf OK klicken und stelle eine neue Startseite ein
__________
MfG Sabina

rund um die PC-Sicherheit

#338 Hi nochmal.

So nochmal getan was aufgetragen wurde.

remv3 log:


Files Found.................
----------------------------------------

Files Not deleted.................
----------------------------------------

Merging registry entries
-----------------------------------------------------------------
The Registry Entries Found...
-----------------------------------------------------------------


Other bad files to be Manually deleted.. Please note that this might also list legit Files, be careful while deleting
-----------------------------------------------------------------
msi.dll
Finished


Hijack log:

Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\CTHELPER.EXE
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\Softwin\BitDefender Free Edition\bdmcon.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Scan Server\bdss.exe
C:\Dokumente und Einstellungen\Nicco\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.at/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [Jet Detection] C:\Programme\Creative\SBLive\PROGRAM\ADGJDet.exe
O4 - HKLM\..\Run: [CTStartup] C:\Programme\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [BDMCon] C:\Programme\Softwin\BitDefender Free Edition\\bdmcon.exe
O4 - HKLM\..\Run: [BDNewsAgent] C:\Programme\Softwin\BitDefender Free Edition\\bdnagent.exe
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Programme\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Programme\ICQ\ICQ.exe
O23 - Service: AntiVir Service - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: BitDefender Scan Server - Unknown - C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: BitDefender Communicator - Softwin - C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Communicator\xcommsvr.exe


Danke grüße Sanji

#339 Hallo@Sanji

Nun ist alles sauber

Falls dein System langsam ist und einfriert, nimm einen von den zwei Antiviren-Tools aus dem Autostart
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Surfe nicht mehr mit dem IE
#Alternativbrowser zum IE
Firefox
http://www.mozilla-europe.org/de/
Installation+Konfiguration Firefox
http://www.pcwelt.de/know-how/software/103924/index1.html

#RegCleaner
(Tip: Lade RegCleaner, stelle das Tool in Deutsch ein und saeubere ueber <Tools<Registry saeubern<alles durchfuehren < den PC (du kannst alles angezeigte Loeschen, denn es verbleibt eine Sicherung)
http://www.chip.de/downloads/c_downloads_8830516.html
__________
MfG Sabina

rund um die PC-Sicherheit

#340 Hmm langsam is es nicht. Prob is nur das so ein Trojaner names Jepan oder so sich immer einschleicht und meine Favorieten ändert. Das is noch ein wenig lästig.

Grüße und Vielen Dank

Sanji.

#341 hi...

hab hier 3 Logs einmal von Adaware den hab ich 3,4mal laufen lassen immer neugestartet , von hijack this und von cwshredder..... wenn ich in internetoptionen auf programme gehe, und webeinstellungen zurücksetzen will sagt mir windows "Webeinstellungen können nicht zurückgesetzt werden"

hijack this

Logfile of HijackThis v1.99.0
Scan saved at 17:47:52, on 06.02.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
F:\Utils3\SygatePersonalFirewall\smc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
F:\Utils3\Antivir\AVWUPSRV.EXE
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\GEMEIN~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\PROGRA~1\GEMEIN~1\PCSuite\Services\SERVIC~1.EXE
F:\Utils3\NOKIA6~1\NOKIAP~1\TRAYAP~1.EXE
C:\WINDOWS\system32\ctfmon.exe
F:\Utils3\SwitchXP\SpeedswitchXP.exe
C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\WINDOWS\system32\wuauclt.exe
F:\hijackthis\Neuer Ordner\cwshredder.exe
F:\hijackthis\HijackThis.exe

O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\GEMEIN~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] F:\Utils3\NOKIA6~1\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [SmcService] F:\Utils3\SYGATE~1\smc.exe -startgui
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpeedswitchXP] F:\Utils3\SwitchXP\SpeedswitchXP.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - F:\Utils3\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - F:\Utils3\ICQ\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O12 - Plugin for .3gp: C:\Programme\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .m4a: C:\Programme\Internet Explorer\PLUGINS\npqtplugin5.dll
O12 - Plugin for .mov: C:\Programme\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mp3: C:\Programme\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .mpeg: C:\Programme\Internet Explorer\PLUGINS\npqtplugin3.dll
O23 - Service: AntiVir Service - H+BEDV Datentechnik GmbH - F:\Utils3\Antivir\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - F:\Utils3\Antivir\AVWUPSRV.EXE
O23 - Service: Sygate Personal Firewall Pro - Sygate Technologies, Inc. - F:\Utils3\SygatePersonalFirewall\smc.exe
O23 - Service: TuneUp WinStyler Theme Service - TuneUp Software GmbH - F:\Utils3\tuneup2005\WinStylerThemeSvc.exe

dann cwshredder

**** Run Keys ****

RUN: [DataLayer] C:\PROGRA~1\GEMEIN~1\PCSuite\DATALA~1\DATALA~1.EXE
RUN: [PCSuiteTrayApplication] F:\Utils3\NOKIA6~1\NOKIAP~1\TRAYAP~1.EXE
RUN: [SmcService] F:\Utils3\SYGATE~1\smc.exe -startgui
RUN: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
RUN: [SpeedswitchXP] F:\Utils3\SwitchXP\SpeedswitchXP.exe


**** Browser Helper Objects ****



**** IE Toolbars ****



**** IE Extensions ****

IEExt: [Web Browser Applet Control] C:\WINDOWS\system32\msjava.dll
IEExt: [ICQ Pro] F:\Utils3\ICQ\ICQ.exe
IEExt: [Messenger] C:\Programme\Messenger\msmsgs.exe


**** Hosts File Entries ****

HOSTS: 127.0.0.1 localhost
HOSTS: 127.0.0.1 localhost


**** IE Settings ****

Local Page: C:\WINDOWS\system32\blank.htm


**** IE Context Menu (Right click) ****



**** Layered Service Providers ****

LSP: MSAFD Irda [IrDA]
LSP: MSAFD Tcpip [TCP/IP]
LSP: MSAFD Tcpip [UDP/IP]
LSP: RSVP UDP Service Provider
LSP: RSVP TCP Service Provider
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{CB5FFAD4-E2E5-46F2-A3D0-00CB8EF59A4A}] SEQPACKET 0
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{CB5FFAD4-E2E5-46F2-A3D0-00CB8EF59A4A}] DATAGRAM 0
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{42BB03CF-7E47-4D5C-A3A4-638BCDF10B30}] SEQPACKET 1
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{42BB03CF-7E47-4D5C-A3A4-638BCDF10B30}] DATAGRAM 1
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{D0E4A2F8-8113-428A-AAA0-46DAD616A84E}] SEQPACKET 2
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{D0E4A2F8-8113-428A-AAA0-46DAD616A84E}] DATAGRAM 2
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{49F7611C-2BDC-468E-84B3-46D364D9A461}] SEQPACKET 3
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{49F7611C-2BDC-468E-84B3-46D364D9A461}] DATAGRAM 3
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{C1F8F1B7-B4A9-4FAF-B4BD-768A36BB7834}] SEQPACKET 4
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{C1F8F1B7-B4A9-4FAF-B4BD-768A36BB7834}] DATAGRAM 4
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{4459587C-C6B7-479E-A91D-0390C780F1E2}] SEQPACKET 5
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{4459587C-C6B7-479E-A91D-0390C780F1E2}] DATAGRAM 5
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{4EC82DDD-E9B7-4F32-8B5B-1E9D0B1E4C98}] SEQPACKET 6
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{4EC82DDD-E9B7-4F32-8B5B-1E9D0B1E4C98}] DATAGRAM 6
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{25BA4230-2E19-4E47-86EE-ABD466CA5499}] SEQPACKET 7
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{25BA4230-2E19-4E47-86EE-ABD466CA5499}] DATAGRAM 7
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{8CFBCDDA-DBED-43DC-9321-7617A052E610}] SEQPACKET 8
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{8CFBCDDA-DBED-43DC-9321-7617A052E610}] DATAGRAM 8


**** Blocked Control Panel Items ****

BLOCKED: [ncpa.cpl] No
BLOCKED: [odbccp32.cpl] No


**** Downloaded Program Files ****

DirectAnimation Java Classes []
Microsoft XML Parser for Java [file://C:\WINDOWS\Java\classes\xmldso.cab]
{8AD9C840-044E-11D1-B3E9-00805F499D93} [http://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab]
{A8658086-E6AC-4957-BC8E-7D54A7E8A78D} [http://www.microsoft.com/security/controls/DoomCln.CAB] C:\WINDOWS\Downloaded Program Files\DoomCln.dll
{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA} [http://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab]
{D27CDB6E-AE6D-11CF-96B8-444553540000} [http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab]


**** Windows Services ****

[Adobe LM Service] "C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe"
[Alerter] %SystemRoot%\System32\svchost.exe -k LocalService
[ALG] %SystemRoot%\System32\alg.exe
[AppMgmt] %SystemRoot%\system32\svchost.exe -k netsvcs
[Ati HotKey Poller] %SystemRoot%\System32\Ati2evxx.exe
[AudioSrv] %SystemRoot%\System32\svchost.exe -k netsvcs
[AVWUpSrv] F:\Utils3\Antivir\AVWUPSRV.EXE
[BITS] %SystemRoot%\System32\svchost.exe -k netsvcs
[Browser] %SystemRoot%\System32\svchost.exe -k netsvcs
[CiSvc] %SystemRoot%\system32\cisvc.exe
[ClipSrv] %SystemRoot%\system32\clipsrv.exe
[COMSysApp] C:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
[CryptSvc] %SystemRoot%\system32\svchost.exe -k netsvcs
[Dhcp] %SystemRoot%\System32\svchost.exe -k netsvcs
[dmadmin] %SystemRoot%\System32\dmadmin.exe /com
[dmserver] %SystemRoot%\System32\svchost.exe -k netsvcs
[Dnscache] %SystemRoot%\System32\svchost.exe -k NetworkService
[ERSvc] %SystemRoot%\System32\svchost.exe -k netsvcs
[Eventlog] %SystemRoot%\system32\services.exe
[EventSystem] C:\WINDOWS\System32\svchost.exe -k netsvcs
[FastUserSwitchingCompatibility] %SystemRoot%\System32\svchost.exe -k netsvcs
[GemServ] C:\Programme\AMD\PowerNow!\GemServ.exe
[helpsvc] %SystemRoot%\System32\svchost.exe -k netsvcs
[HidServ] %SystemRoot%\System32\svchost.exe -k netsvcs
[ImapiService] C:\WINDOWS\System32\imapi.exe
[Irmon] %SystemRoot%\System32\svchost.exe -k netsvcs
[lanmanserver] %SystemRoot%\System32\svchost.exe -k netsvcs
[LanmanWorkstation] %SystemRoot%\System32\svchost.exe -k netsvcs
[LmHosts] %SystemRoot%\System32\svchost.exe -k LocalService
[Messenger] %SystemRoot%\System32\svchost.exe -k netsvcs
[mnmsrvc] C:\WINDOWS\System32\mnmsrvc.exe
[MSDTC] C:\WINDOWS\System32\msdtc.exe
[MSIServer] C:\WINDOWS\System32\msiexec.exe /V
[NetDDE] %SystemRoot%\system32\netdde.exe
[NetDDEdsdm] %SystemRoot%\system32\netdde.exe
[Netlogon] %SystemRoot%\System32\lsass.exe
[Netman] %SystemRoot%\System32\svchost.exe -k netsvcs
[Nla] %SystemRoot%\System32\svchost.exe -k netsvcs
[NtLmSsp] %SystemRoot%\System32\lsass.exe
[NtmsSvc] %SystemRoot%\system32\svchost.exe -k netsvcs
[PlugPlay] %SystemRoot%\system32\services.exe
[PolicyAgent] %SystemRoot%\System32\lsass.exe
[ProtectedStorage] %SystemRoot%\system32\lsass.exe
[RasAuto] %SystemRoot%\System32\svchost.exe -k netsvcs
[RasMan] %SystemRoot%\System32\svchost.exe -k netsvcs
[RDSessMgr] C:\WINDOWS\system32\sessmgr.exe
[RemoteAccess] %SystemRoot%\System32\svchost.exe -k netsvcs
[rpcapd] "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini"
[RpcLocator] %SystemRoot%\System32\locator.exe
[RpcSs] %SystemRoot%\system32\svchost -k rpcss
[RSVP] %SystemRoot%\System32\rsvp.exe
[SamSs] %SystemRoot%\system32\lsass.exe
[SCardSvr] %SystemRoot%\System32\SCardSvr.exe
[Schedule] %SystemRoot%\System32\svchost.exe -k netsvcs
[seclogon] %SystemRoot%\System32\svchost.exe -k netsvcs
[SENS] %SystemRoot%\system32\svchost.exe -k netsvcs
[SharedAccess] %SystemRoot%\System32\svchost.exe -k netsvcs
[ShellHWDetection] %SystemRoot%\System32\svchost.exe -k netsvcs
[SLService] slserv.exe
[Spooler] %SystemRoot%\system32\spoolsv.exe
[srservice] %SystemRoot%\System32\svchost.exe -k netsvcs
[SSDPSRV] %SystemRoot%\System32\svchost.exe -k LocalService
[stisvc] %SystemRoot%\System32\svchost.exe -k imgsvc
[SwPrv] C:\WINDOWS\System32\dllhost.exe /Processid:{EDA0203D-00C3-4C46-9226-4E8F0B2D158C}
[SysmonLog] %SystemRoot%\system32\smlogsvc.exe
[TapiSrv] %SystemRoot%\System32\svchost.exe -k netsvcs
[TermService] %SystemRoot%\System32\svchost.exe -k netsvcs
[Themes] %SystemRoot%\System32\svchost.exe -k netsvcs
[TrkWks] %SystemRoot%\system32\svchost.exe -k netsvcs
[upnphost] %SystemRoot%\System32\svchost.exe -k LocalService
[UPS] %SystemRoot%\System32\ups.exe
[VSS] %SystemRoot%\System32\vssvc.exe
[W32Time] %SystemRoot%\System32\svchost.exe -k netsvcs
[WebClient] %SystemRoot%\System32\svchost.exe -k LocalService
[winmgmt] %systemroot%\system32\svchost.exe -k netsvcs
[WmiApSrv] C:\WINDOWS\System32\wbem\wmiapsrv.exe
[wuauserv] %systemroot%\system32\svchost.exe -k netsvcs
[WZCSVC] %SystemRoot%\System32\svchost.exe -k netsvcs


**** Custom IE Search Items ****

SEARCH: [SearchAssistant_bak] http://searchmyrequest.com/sp.php
SEARCH: [SearchAssistant] http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
SEARCH: [CustomizeSearch] http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm


**** Complete IE Options ****

IEOPT: [NoUpdateCheck]
IEOPT: [NoJITSetup]
IEOPT: [Disable Script Debugger] yes
IEOPT: [Start Page] about:blank
IEOPT: [Show_ChannelBand] No
IEOPT: [Anchor Underline] yes
IEOPT: [Cache_Update_Frequency] Once_Per_Session
IEOPT: [Display Inline Images] yes
IEOPT: [Do404Search]
IEOPT: [Save_Session_History_On_Exit] no
IEOPT: [Show_FullURL] no
IEOPT: [Show_StatusBar] yes
IEOPT: [Show_ToolBar] yes
IEOPT: [Show_URLinStatusBar] yes
IEOPT: [Show_URLToolBar] yes
IEOPT: [Use_DlgBox_Colors] yes
IEOPT: [FullScreen] no
IEOPT: [Use FormSuggest] no
IEOPT: [FormSuggest Passwords] yes
IEOPT: [FormSuggest PW Ask] no
IEOPT: [Window_Placement] ,
IEOPT: [NotifyDownloadComplete] no
IEOPT: [Error Dlg Displayed On Every Error] no
IEOPT: [Error Dlg Details Pane Open] yes
IEOPT: [Use Search Asst] no
IEOPT: [ShowedCheckBrowser] Yes
IEOPT: [Check_Associations] no
IEOPT: [AddToFavoritesExpanded]
IEOPT: [Use Search Assistant] no
IEOPT: [Cache_Update_Size] 170201055066900177
IEOPT: [Cache_Update_Time] 20
IEOPT: [Local Page] C:\WINDOWS\system32\blank.htm
IEOPT: [StatusBarOther]
IEOPT: [BandRest] Never
IEOPT: [Search Bar_bak] http://searchmyrequest.com/sp.php
IEOPT: [Search Page_bak] http://searchmyrequest.com/sp.php
IEOPT: [Use Search Assistant_bak] yes
IEOPT: [Save Directory] F:\InternetDownloads\
IEOPT: [AutoSearch]
IEOPT: [NoSaveAsPOSTWarning]
IEOPT: [Enable_Disk_Cache] yes
IEOPT: [Cache_Percent_of_Disk]
IEOPT: [Delete_Temp_Files_On_Exit] yes
IEOPT: [Anchor_Visitation_Horizon]
IEOPT: [Use_Async_DNS] yes
IEOPT: [Placeholder_Width]
IEOPT: [Placeholder_Height]
IEOPT: [Start Page] about:blank
IEOPT: [CompanyName] Microsoft Corporation
IEOPT: [Custom_Key] MICROSO
IEOPT: [Wizard_Version] 6.0.2600.0000
IEOPT: [FullScreen] no
IEOPT: [Use Search Assistant] yes
IEOPT: [Local Page] C:\WINDOWS\SYSTEM32\blank.htm

und adaware


Ad-Aware SE Build 1.05
Logfile Created on:Sonntag, 6. Februar 2005 17:48:17
Created with Ad-Aware SE Personal, free for private use.
Using definitions file:SE1R26 25.01.2005
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

References detected during the scan:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
MRU List(TAC index:0):16 total references
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Ad-Aware SE Settings
===========================
Set : Search for negligible risk entries
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan my Hosts file

Extended Ad-Aware SE Settings
===========================
Set : Unload recognized processes & modules during scan
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : During removal, unload Explorer and IE if necessary
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include reference summary in log file
Set : Include alternate data stream details in log file
Set : Play sound at scan completion if scan locates critical objects


06.02.2005 17:48:17 - Scan started. (Full System Scan)

MRU List Object Recognized!
Location: : S-1-5-21-689279713-645757453-568730901-1005\software\microsoft\windows\currentversion\explorer\runmru
Description : mru list for items opened in start | run


MRU List Object Recognized!
Location: : S-1-5-21-689279713-645757453-568730901-1005\software\microsoft\search assistant\acmru
Description : list of recent search terms used with the search assistant


MRU List Object Recognized!
Location: : S-1-5-21-689279713-645757453-568730901-1005\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru
Description : list of recently saved files, stored according to file extension


MRU List Object Recognized!
Location: : S-1-5-21-689279713-645757453-568730901-1005\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru
Description : list of recent programs opened


MRU List Object Recognized!
Location: : S-1-5-21-689279713-645757453-568730901-1005\software\microsoft\windows\currentversion\explorer\recentdocs
Description : list of recent documents opened


MRU List Object Recognized!
Location: : S-1-5-21-689279713-645757453-568730901-1005\software\microsoft\internet explorer\main
Description : last save directory used in microsoft internet explorer


MRU List Object Recognized!
Location: : S-1-5-21-689279713-645757453-568730901-1005\software\microsoft\internet explorer
Description : last download directory used in microsoft internet explorer


MRU List Object Recognized!
Location: : software\microsoft\directdraw\mostrecentapplication
Description : most recent application to use microsoft directdraw


MRU List Object Recognized!
Location: : S-1-5-21-689279713-645757453-568730901-1005\software\microsoft\microsoft management console\recent file list
Description : list of recent snap-ins used in the microsoft management console


MRU List Object Recognized!
Location: : S-1-5-21-689279713-645757453-568730901-1005\software\microsoft\internet explorer\typedurls
Description : list of recently entered addresses in microsoft internet explorer


MRU List Object Recognized!
Location: : S-1-5-21-689279713-645757453-568730901-1005\software\jasc\paint shop pro 8\recent file list
Description : list of recently used files in jasc paint shop pro


MRU List Object Recognized!
Location: : software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct3d


MRU List Object Recognized!
Location: : S-1-5-21-689279713-645757453-568730901-1005\software\microsoft\windows\currentversion\applets\regedit
Description : last key accessed using the microsoft registry editor


MRU List Object Recognized!
Location: : software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct X


MRU List Object Recognized!
Location: : S-1-5-21-689279713-645757453-568730901-1005\software\microsoft\windows media\wmsdk\general
Description : windows media sdk


MRU List Object Recognized!
Location: : C:\Dokumente und Einstellungen\2DooR\recent
Description : list of recently opened documents


Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

#:1 [smss.exe]
FilePath : \SystemRoot\System32\
ProcessID : 584
ThreadCreationTime : 06.02.2005 16:42:51
BasePriority : Normal


#:2 [csrss.exe]
FilePath : \??\C:\WINDOWS\system32\
ProcessID : 648
ThreadCreationTime : 06.02.2005 16:42:53
BasePriority : Normal


#:3 [winlogon.exe]
FilePath : \??\C:\WINDOWS\system32\
ProcessID : 672
ThreadCreationTime : 06.02.2005 16:42:56
BasePriority : High


#:4 [services.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 720
ThreadCreationTime : 06.02.2005 16:42:56
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Betriebssystem Microsoft® Windows®
CompanyName : Microsoft Corporation
FileDescription : Anwendung für Dienste und Controller
InternalName : services.exe
LegalCopyright : © Microsoft Corporation. Alle Rechte vorbehalten.
OriginalFilename : services.exe

#:5 [lsass.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 732
ThreadCreationTime : 06.02.2005 16:42:56
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : LSA Shell (Export Version)
InternalName : lsass.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : lsass.exe

#:6 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 892
ThreadCreationTime : 06.02.2005 16:42:57
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:7 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 976
ThreadCreationTime : 06.02.2005 16:42:57
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:8 [smc.exe]
FilePath : F:\Utils3\SygatePersonalFirewall\
ProcessID : 1112
ThreadCreationTime : 06.02.2005 16:42:58
BasePriority : Normal
FileVersion : 5.5.00.2637
ProductVersion : 5.5.00.2637
ProductName : Sygate® Security Agent and Personal Firewall
CompanyName : Sygate Technologies, Inc.
FileDescription : Sygate Agent Firewall
InternalName : Smc
LegalCopyright : Copyright © 1999 - 2003 Sygate Technologies, Inc. All rights reserved.
OriginalFilename : Smc.EXE

#:9 [explorer.exe]
FilePath : C:\WINDOWS\
ProcessID : 1220
ThreadCreationTime : 06.02.2005 16:42:59
BasePriority : Normal
FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 6.00.2900.2180
ProductName : Betriebssystem Microsoft® Windows®
CompanyName : Microsoft Corporation
FileDescription : Windows Explorer
InternalName : explorer
LegalCopyright : © Microsoft Corporation. Alle Rechte vorbehalten.
OriginalFilename : EXPLORER.EXE

#:10 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1280
ThreadCreationTime : 06.02.2005 16:43:04
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:11 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1300
ThreadCreationTime : 06.02.2005 16:43:04
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:12 [spoolsv.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 1516
ThreadCreationTime : 06.02.2005 16:43:05
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Spooler SubSystem App
InternalName : spoolsv.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : spoolsv.exe

#:13 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1596
ThreadCreationTime : 06.02.2005 16:43:05
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:14 [ati2evxx.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1624
ThreadCreationTime : 06.02.2005 16:43:05
BasePriority : Normal


#:15 [avwupsrv.exe]
FilePath : F:\Utils3\Antivir\
ProcessID : 1648
ThreadCreationTime : 06.02.2005 16:43:05
BasePriority : Normal


#:16 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1780
ThreadCreationTime : 06.02.2005 16:43:05
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:17 [alg.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 220
ThreadCreationTime : 06.02.2005 16:43:08
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Application Layer Gateway Service
InternalName : ALG.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : ALG.exe

#:18 [datala~1.exe]
FilePath : C:\PROGRA~1\GEMEIN~1\PCSuite\DATALA~1\
ProcessID : 456
ThreadCreationTime : 06.02.2005 16:43:10
BasePriority : Normal
FileVersion : 5, 0, 2, 561
ProductVersion : 5, 0
ProductName : Nokia PC Suite
CompanyName : Nokia Mobile Phones Ltd.
FileDescription : DataLayer 2.0 Module
InternalName : DataLayer 2.0
LegalCopyright : Copyright (c) 2004. Nokia. All rights reserved.
OriginalFilename : DataLayer.exe

#:19 [servic~1.exe]
FilePath : C:\PROGRA~1\GEMEIN~1\PCSuite\Services\
ProcessID : 492
ThreadCreationTime : 06.02.2005 16:43:10
BasePriority : Normal
FileVersion : 6, 0, 9, 0
ProductVersion : 6.0
ProductName : Nokia Connectivity Library
CompanyName : Nokia.
FileDescription : ServiceLayer Module
InternalName : ServiceLayer
LegalCopyright : Copyright © 2002-2004 Nokia. All Rights Reserved.
OriginalFilename : ServiceLayer.exe

#:20 [trayap~1.exe]
FilePath : F:\Utils3\NOKIA6~1\NOKIAP~1\
ProcessID : 520
ThreadCreationTime : 06.02.2005 16:43:10
BasePriority : Normal
FileVersion : 1, 0, 0, 22
ProductVersion : 1, 0, 0, 0
ProductName : Nokia Tray Application
FileDescription : Nokia Tray Application
InternalName : Nokia Tray Application
LegalCopyright : Copyright © 2001 - 2004 Nokia. All Rights Reserved.
OriginalFilename : TrayApplication.EXE

#:21 [ctfmon.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 560
ThreadCreationTime : 06.02.2005 16:43:10
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : CTF Loader
InternalName : CTFMON
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : CTFMON.EXE

#:22 [speedswitchxp.exe]
FilePath : F:\Utils3\SwitchXP\
ProcessID : 628
ThreadCreationTime : 06.02.2005 16:43:13
BasePriority : Normal
FileVersion : 1.1.0.0
ProductVersion : 1.1.0.0
ProductName : SpeedswitchXP
CompanyName : Christian Diefer
FileDescription : A CPU frequency applet for Windows XP
InternalName : SpeedswitchXP
LegalCopyright : (c) 2002/2003 Christian Diefer
OriginalFilename : SpeedswitchXP

#:23 [wincinemamgr.exe]
FilePath : C:\Programme\InterVideo\Common\Bin\
ProcessID : 652
ThreadCreationTime : 06.02.2005 16:43:14
BasePriority : Normal
FileVersion : 1.7
ProductVersion : 1, 0, 0, 1
ProductName : WinCinema Manager for InterVideo WinCinema products
FileDescription : WinCinema Manager
InternalName : WinCinema Manager
LegalCopyright : Copyright (C) 2000 InterVideo Inc.
OriginalFilename : WinCinemaMgr.EXE

#:24 [wuauclt.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 1896
ThreadCreationTime : 06.02.2005 16:43:51
BasePriority : Normal
FileVersion : 5.4.3790.2182 built by: srv03_rtm(ntvbl04)
ProductVersion : 5.4.3790.2182
ProductName : Betriebssystem Microsoft® Windows®
CompanyName : Microsoft Corporation
FileDescription : Automatische Updates
InternalName : wuauclt.exe
LegalCopyright : © Microsoft Corporation. Alle Rechte vorbehalten.
OriginalFilename : wuauclt.exe

#:25 [ad-aware.exe]
FilePath : F:\Ad-Aware SE Personal\
ProcessID : 1184
ThreadCreationTime : 06.02.2005 16:48:05
BasePriority : Normal
FileVersion : 6.2.0.206
ProductVersion : VI.Second Edition
ProductName : Lavasoft Ad-Aware SE
CompanyName : Lavasoft Sweden
FileDescription : Ad-Aware SE Core application
InternalName : Ad-Aware.exe
LegalCopyright : Copyright © Lavasoft Sweden
OriginalFilename : Ad-Aware.exe
Comments : All Rights Reserved

Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 16


Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Registry Scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 16


Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 16


Started Tracking Cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 16



Deep scanning and examining files (C
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for C:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 16


Deep scanning and examining files (E
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for E:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 16


Deep scanning and examining files (F
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for F:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 16


Scanning Hosts file......
Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts".
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Hosts file scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
1 entries scanned.
New critical objects:0
Objects found so far: 16




Performing conditional scans...
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Conditional scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 16

17:58:43 Scan Complete

Summary Of This Scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Total scanning time:00:10:26.581
Objects scanned:134884
Objects identified:0
Objects ignored:0
New critical objects:0

#342 Hallo@Sanji

eScan-Erkennungstool
eSan ist hier unter dem Namen Free eScan Antivirus Toolkit Utility kostenlos erhältlich:
http://www.mwti.net/antivirus/free_utilities.asp
oeffne den Scanner--> noch nicht scannen--> gehe in Start<Ausfuehren< schreib rein: %temp% und suche
kavupd.exe, die klickst du an--> (Update- in DOS) ausführen

gehe in den abgesicherten Modus
http://www.tu-berlin.de/www/software/virus/savemode.shtml

und den Scanner mit der "mwav.exe"[oder:MWAVSCAN.COM] starten. Alle Häkchen setzen :
Auswählen: "all files", Memory, Startup-Folders, Registry, System Folders,
Services, Drive/All Local drives, Folder [C:\WINDOWS], Include SubDirectory

• Beim Start von e-scan sollten folgende Optionen aktiviert sein:


-->und "Scan " klicken.

Gehe wieder in den Normalmodus:

mache bitte folgendes:
nun öffnest du mit dem editor, die mwav.txt und gehst unter bearbeiten -> suchen, hier gibst du infected ein



jene zeile in der infected steht, markieren, und hier einfügen, weitersuchen usw.
und ganz unten steht die zusammenfassung, diese auch hier posten
__________
MfG Sabina

rund um die PC-Sicherheit

#343 Hallo@UhhhYeah

Der IE ist noch /wieder verseucht.

What is Searchmyrequest.com?

Searchmyrequest.com is a website search engine with lots of search results for things like debt consolidation, refinancing, casinos, and more related searches generally seen in spam emails. Most searches appear to be affiliate links that make the owner of the site money through clickthroughs. It has a "search the web" option that doesnt appear to care what you type in the box, it simply shows another page of results from keywords that the site has in a database. It takes over as your start page and appears to be a variant of the CoolWebSearch homepage hijacker as well.


Gehe in die Registry
Start<Ausfuehren<regedit

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main

[Use Search Asst] no --> aendere in yes

Bearbeiten--> suchen-->loesche alles, was du findest.
searchmyrequest.com/sp.php
searchmyrequest

SEARCH: [SearchAssistant_bak] http://searchmyrequest.com/sp.php -->loeschen
Search Bar_bak] http://searchmyrequest.com/sp.php --> loeschen
Search Page_bak] http://searchmyrequest.com/sp.php -->loeschen

[Use Search Assistant_bak] yes --> hier bin ich mir nicht sicher, was zu tun ist...wir lassen es vorerst so

schliesse die Registry

Starte den PC neu und versuche die Internetexplorerer-Einstellungen zurueckzusetzen

dann scanne noch mal mit CWShredder 2.12 und escan (beim escan muss alles auber sein)
__________
MfG Sabina

rund um die PC-Sicherheit

#344 hi, bin ganz neu hier und brauch schon hilfe, kann da mal einer drüber schauen und mir erklären was ich machen muss (so das ne oma es versteht wäre gut)

thx

sandro

Logfile of HijackThis v1.99.0
Scan saved at 19:57:58, on 06.02.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svc8021x.exe
D:\Programme\Trend Micro\PC-cillin 2002\Tmntsrv.exe
C:\WINDOWS\Hcontrol.exe
C:\WINDOWS\System32\sistray.EXE
C:\WINDOWS\System32\khooker.exe
C:\WINDOWS\System32\pctspk.exe
C:\Programme\Synaptics\SynTP\SynTPLpr.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
D:\Programme\Trend Micro\PC-cillin 2002\pccguide.exe
D:\Programme\Trend Micro\PC-cillin 2002\PCCClient.exe
D:\Programme\Trend Micro\PC-cillin 2002\PCCPFW.exe
C:\WINDOWS\ATKOSD.exe
D:\Programme\Trend Micro\PC-cillin 2002\Pop3trap.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\system32\CH_Utility.exe
C:\DOKUME~1\SANDRO~1.LAP\LOKALE~1\Temp\Rar$EX00.983\HijackThis.exe
C:\WINDOWS\System32\wuauclt.exe
D:\Programme\WinRAR.exe
C:\WINDOWS\System32\wuauclt.exe
C:\DOKUME~1\SANDRO~1.LAP\LOKALE~1\Temp\Rar$EX07.224\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = http://clearsurfing.net/srch.php?qq=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\qwsxp.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\qwsxp.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\qwsxp.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\qwsxp.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {9DDDC6B1-3518-47E8-A81B-8050C397EBAC} - C:\WINDOWS\System32\qwsxp.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar2.dll
O2 - BHO: Cls - {CF021F40-3E14-23A5-CBA2-717765721316} - C:\WINDOWS\System32\wer1316.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Übersetzer - {FF284F5C-7CF9-4682-8701-D467C1DBB99F} - D:\Programme\PRMT6\PRMTIE\prmtie.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll
O3 - Toolbar: FreshBar - {06ABAA2D-34AB-4902-A326-409BD9B9A7A5} - C:\WINDOWS\System32\iesp2.dll
O4 - HKLM\..\Run: [Mirabilis ICQ] C:\Programme\ICQ\NDetect.exe
O4 - HKLM\..\Run: [Hcontrol] C:\WINDOWS\Hcontrol.exe
O4 - HKLM\..\Run: [SiS Tray] C:\WINDOWS\System32\sistray.EXE
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [pccguide.exe] "D:\Programme\Trend Micro\PC-cillin 2002\pccguide.exe"
O4 - HKLM\..\Run: [PCCClient.exe] "D:\Programme\Trend Micro\PC-cillin 2002\PCCClient.exe"
O4 - HKLM\..\Run: [Pop3trap.exe] "D:\Programme\Trend Micro\PC-cillin 2002\Pop3trap.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Chrontel TV.lnk = C:\WINDOWS\system32\CH_Utility.exe
O8 - Extra context menu item: &Google Search - res://c:\programme\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Im Cache gespeicherte Seite - res://c:\programme\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Verweisseiten - res://c:\programme\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Ähnliche Seiten - res://c:\programme\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Übersetzen - D:\Programme\PRMT6\PRMTIE\translat.htm
O8 - Extra context menu item: Übersetzungsoptionen anpassen - D:\Programme\PRMT6\PRMTIE\options.htm
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Programme\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Programme\ICQ\ICQ.exe
O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - D:\Programme\PRMT6\PRMTIE\prmtie5.htm
O9 - Extra 'Tools' menuitem: Übersetzen - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - D:\Programme\PRMT6\PRMTIE\prmtie5.htm
O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - D:\Programme\PRMT6\PRMTIE\options.htm
O9 - Extra 'Tools' menuitem: Übersetzungsoptionen anpassen - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - D:\Programme\PRMT6\PRMTIE\options.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {05317530-B882-449D-9421-18D94FA3ED34} (OSInfo Control) - http://www.sis.com/support/ocis/OSInfo.cab
O16 - DPF: {16095503-786F-4097-AED6-5D567A26D760} (SiS_OCX Control) - http://www.sis.com/support/ocis/SiSAutodetectNT.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1106418847865
O16 - DPF: {6BEA1C48-1850-486C-8F58-C7354BA3165E} (Install Class) - http://updates.lifescapeinc.com/installers/pinstall/pinstall.cab
O16 - DPF: {72D78A82-8953-67B4-4792-9C034B139753} - ms-its:mhtml:file://c:\nosuch.mht!http://www.foxik.com/chm/files.chm::/file.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall-Kontrolle) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {861FDA2A-2B57-4BDA-8B8B-305C9D5D8604} (_Multimedia Player) - http://stream.pussyharem.com/stream/mmp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{11AC9C39-4A24-44B7-A730-9FD05EA76257}: NameServer = 69.50.176.156,195.225.176.31
O17 - HKLM\System\CCS\Services\Tcpip\..\{9C60B2C8-A322-45E8-AFDB-070CA6CB46A9}: NameServer = 69.50.176.156,195.225.176.31
O17 - HKLM\System\CCS\Services\Tcpip\..\{D19EFC0A-51D1-4298-B817-AA740040E3B2}: NameServer = 69.50.176.156,195.225.176.31
O17 - HKLM\System\CS1\Services\Tcpip\..\{11AC9C39-4A24-44B7-A730-9FD05EA76257}: NameServer = 69.50.176.156,195.225.176.31
O17 - HKLM\System\CS2\Services\Tcpip\..\{11AC9C39-4A24-44B7-A730-9FD05EA76257}: NameServer = 69.50.176.156,195.225.176.31
O18 - Filter: text/html - {94152994-B9A1-4511-BFAB-DB1B4E4FFC21} - C:\WINDOWS\System32\qwsxp.dll
O18 - Filter: tœ†5�òEÆR - {605621F4-93F2-46AC-BD14-E5F51EA1163E} - C:\WINDOWS\System32\qwsxp.dll
O18 - Filter: tœ†5�òFÆR - {61C86F07-7629-4ED8-985B-2367B7F38584} - C:\WINDOWS\System32\qwsxp.dll
O18 - Filter: tœ†5�ò5EÆR - {B5BAB4C2-243A-4DA7-8031-7BDD02C13AA9} - C:\WINDOWS\System32\qwsxp.dll
O18 - Filter: tœ†5�òhDÆR - {94152994-B9A1-4511-BFAB-DB1B4E4FFC21} - C:\WINDOWS\System32\qwsxp.dll
O18 - Filter: tœ†5�òÄFÆR - {45704941-C16F-47DC-9D66-9664C4ABB9F0} - C:\WINDOWS\System32\qwsxp.dll
O18 - Filter: tœ†5�òìFÆR - {2539793A-D3D7-417F-947F-B242D70D471B} - C:\WINDOWS\System32\qwsxp.dll
O18 - Filter: tœ†5�òÏTÆR - {CF8C8E1B-FD57-4E97-B50E-A1A64DC727C0} - C:\WINDOWS\System32\qwsxp.dll
O23 - Service: PC-cillin PersonalFirewall - Trend Micro Inc. - D:\Programme\Trend Micro\PC-cillin 2002\PCCPFW.exe
O23 - Service: AEGIS Client 1.3.6.1 - Meetinghouse Data Communications - C:\WINDOWS\System32\svc8021x.exe
O23 - Service: Trend NT Realtime Service - Trend Micro Inc. - D:\Programme\Trend Micro\PC-cillin 2002\Tmntsrv.exe

#345 hi habe alles so gemacht wie besprochen, escan scannt noch, hat aber bisher nix gefunden......die webeinstellungen in den internetoptionen lassen sich leider immer noch nicht zurücksetzen und die anderen sachen (searchrequest usw) hab ich aus der registry gelöscht......ich hoffe ich bin nicht mehr weit vom ziel weg... : (

hier sind 2 logs einmal von hijack this und einmal von cshredder...

Logfile of HijackThis v1.99.0
Scan saved at 20:06:23, on 06.02.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
F:\Utils3\SygatePersonalFirewall\smc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
F:\Utils3\Antivir\AVWUPSRV.EXE
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\GEMEIN~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\PROGRA~1\GEMEIN~1\PCSuite\Services\SERVIC~1.EXE
F:\Utils3\NOKIA6~1\NOKIAP~1\TRAYAP~1.EXE
C:\WINDOWS\system32\ctfmon.exe
F:\Utils3\SwitchXP\SpeedswitchXP.exe
C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\WINDOWS\system32\wuauclt.exe
F:\hijackthis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.de
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.google.de
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\GEMEIN~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] F:\Utils3\NOKIA6~1\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [SmcService] F:\Utils3\SYGATE~1\smc.exe -startgui
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpeedswitchXP] F:\Utils3\SwitchXP\SpeedswitchXP.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - F:\Utils3\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - F:\Utils3\ICQ\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O12 - Plugin for .3gp: C:\Programme\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .m4a: C:\Programme\Internet Explorer\PLUGINS\npqtplugin5.dll
O12 - Plugin for .mov: C:\Programme\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mp3: C:\Programme\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .mpeg: C:\Programme\Internet Explorer\PLUGINS\npqtplugin3.dll
O23 - Service: AntiVir Service - H+BEDV Datentechnik GmbH - F:\Utils3\Antivir\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - F:\Utils3\Antivir\AVWUPSRV.EXE
O23 - Service: Sygate Personal Firewall Pro - Sygate Technologies, Inc. - F:\Utils3\SygatePersonalFirewall\smc.exe
O23 - Service: TuneUp WinStyler Theme Service - TuneUp Software GmbH - F:\Utils3\tuneup2005\WinStylerThemeSvc.exe


**** Run Keys ****

RUN: [DataLayer] C:\PROGRA~1\GEMEIN~1\PCSuite\DATALA~1\DATALA~1.EXE
RUN: [PCSuiteTrayApplication] F:\Utils3\NOKIA6~1\NOKIAP~1\TRAYAP~1.EXE
RUN: [SmcService] F:\Utils3\SYGATE~1\smc.exe -startgui
RUN: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
RUN: [SpeedswitchXP] F:\Utils3\SwitchXP\SpeedswitchXP.exe


**** Browser Helper Objects ****



**** IE Toolbars ****



**** IE Extensions ****

IEExt: [Web Browser Applet Control] C:\WINDOWS\system32\msjava.dll
IEExt: [ICQ Pro] F:\Utils3\ICQ\ICQ.exe
IEExt: [Messenger] C:\Programme\Messenger\msmsgs.exe


**** Hosts File Entries ****

HOSTS: 127.0.0.1 localhost
HOSTS: 127.0.0.1 localhost


**** IE Settings ****

Local Page: C:\WINDOWS\system32\blank.htm


**** IE Context Menu (Right click) ****



**** Layered Service Providers ****

LSP: MSAFD Irda [IrDA]
LSP: MSAFD Tcpip [TCP/IP]
LSP: MSAFD Tcpip [UDP/IP]
LSP: RSVP UDP Service Provider
LSP: RSVP TCP Service Provider
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{CB5FFAD4-E2E5-46F2-A3D0-00CB8EF59A4A}] SEQPACKET 0
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{CB5FFAD4-E2E5-46F2-A3D0-00CB8EF59A4A}] DATAGRAM 0
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{42BB03CF-7E47-4D5C-A3A4-638BCDF10B30}] SEQPACKET 1
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{42BB03CF-7E47-4D5C-A3A4-638BCDF10B30}] DATAGRAM 1
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{D0E4A2F8-8113-428A-AAA0-46DAD616A84E}] SEQPACKET 2
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{D0E4A2F8-8113-428A-AAA0-46DAD616A84E}] DATAGRAM 2
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{49F7611C-2BDC-468E-84B3-46D364D9A461}] SEQPACKET 3
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{49F7611C-2BDC-468E-84B3-46D364D9A461}] DATAGRAM 3
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{C1F8F1B7-B4A9-4FAF-B4BD-768A36BB7834}] SEQPACKET 4
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{C1F8F1B7-B4A9-4FAF-B4BD-768A36BB7834}] DATAGRAM 4
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{4459587C-C6B7-479E-A91D-0390C780F1E2}] SEQPACKET 5
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{4459587C-C6B7-479E-A91D-0390C780F1E2}] DATAGRAM 5
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{4EC82DDD-E9B7-4F32-8B5B-1E9D0B1E4C98}] SEQPACKET 6
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{4EC82DDD-E9B7-4F32-8B5B-1E9D0B1E4C98}] DATAGRAM 6
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{25BA4230-2E19-4E47-86EE-ABD466CA5499}] SEQPACKET 7
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{25BA4230-2E19-4E47-86EE-ABD466CA5499}] DATAGRAM 7
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{8CFBCDDA-DBED-43DC-9321-7617A052E610}] SEQPACKET 8
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{8CFBCDDA-DBED-43DC-9321-7617A052E610}] DATAGRAM 8


**** Blocked Control Panel Items ****

BLOCKED: [ncpa.cpl] No
BLOCKED: [odbccp32.cpl] No


**** Downloaded Program Files ****

DirectAnimation Java Classes []
Microsoft XML Parser for Java [file://C:\WINDOWS\Java\classes\xmldso.cab]
{8AD9C840-044E-11D1-B3E9-00805F499D93} [http://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab]
{A8658086-E6AC-4957-BC8E-7D54A7E8A78D} [http://www.microsoft.com/security/controls/DoomCln.CAB] C:\WINDOWS\Downloaded Program Files\DoomCln.dll
{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA} [http://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab]
{D27CDB6E-AE6D-11CF-96B8-444553540000} [http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab]


**** Windows Services ****

[Adobe LM Service] "C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe"
[Alerter] %SystemRoot%\System32\svchost.exe -k LocalService
[ALG] %SystemRoot%\System32\alg.exe
[AppMgmt] %SystemRoot%\system32\svchost.exe -k netsvcs
[Ati HotKey Poller] %SystemRoot%\System32\Ati2evxx.exe
[AudioSrv] %SystemRoot%\System32\svchost.exe -k netsvcs
[AVWUpSrv] F:\Utils3\Antivir\AVWUPSRV.EXE
[BITS] %SystemRoot%\System32\svchost.exe -k netsvcs
[Browser] %SystemRoot%\System32\svchost.exe -k netsvcs
[CiSvc] %SystemRoot%\system32\cisvc.exe
[ClipSrv] %SystemRoot%\system32\clipsrv.exe
[COMSysApp] C:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
[CryptSvc] %SystemRoot%\system32\svchost.exe -k netsvcs
[Dhcp] %SystemRoot%\System32\svchost.exe -k netsvcs
[dmadmin] %SystemRoot%\System32\dmadmin.exe /com
[dmserver] %SystemRoot%\System32\svchost.exe -k netsvcs
[Dnscache] %SystemRoot%\System32\svchost.exe -k NetworkService
[ERSvc] %SystemRoot%\System32\svchost.exe -k netsvcs
[Eventlog] %SystemRoot%\system32\services.exe
[EventSystem] C:\WINDOWS\System32\svchost.exe -k netsvcs
[FastUserSwitchingCompatibility] %SystemRoot%\System32\svchost.exe -k netsvcs
[GemServ] C:\Programme\AMD\PowerNow!\GemServ.exe
[helpsvc] %SystemRoot%\System32\svchost.exe -k netsvcs
[HidServ] %SystemRoot%\System32\svchost.exe -k netsvcs
[ImapiService] C:\WINDOWS\System32\imapi.exe
[Irmon] %SystemRoot%\System32\svchost.exe -k netsvcs
[lanmanserver] %SystemRoot%\System32\svchost.exe -k netsvcs
[LanmanWorkstation] %SystemRoot%\System32\svchost.exe -k netsvcs
[LmHosts] %SystemRoot%\System32\svchost.exe -k LocalService
[Messenger] %SystemRoot%\System32\svchost.exe -k netsvcs
[mnmsrvc] C:\WINDOWS\System32\mnmsrvc.exe
[MSDTC] C:\WINDOWS\System32\msdtc.exe
[MSIServer] C:\WINDOWS\System32\msiexec.exe /V
[NetDDE] %SystemRoot%\system32\netdde.exe
[NetDDEdsdm] %SystemRoot%\system32\netdde.exe
[Netlogon] %SystemRoot%\System32\lsass.exe
[Netman] %SystemRoot%\System32\svchost.exe -k netsvcs
[Nla] %SystemRoot%\System32\svchost.exe -k netsvcs
[NtLmSsp] %SystemRoot%\System32\lsass.exe
[NtmsSvc] %SystemRoot%\system32\svchost.exe -k netsvcs
[PlugPlay] %SystemRoot%\system32\services.exe
[PolicyAgent] %SystemRoot%\System32\lsass.exe
[ProtectedStorage] %SystemRoot%\system32\lsass.exe
[RasAuto] %SystemRoot%\System32\svchost.exe -k netsvcs
[RasMan] %SystemRoot%\System32\svchost.exe -k netsvcs
[RDSessMgr] C:\WINDOWS\system32\sessmgr.exe
[RemoteAccess] %SystemRoot%\System32\svchost.exe -k netsvcs
[rpcapd] "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini"
[RpcLocator] %SystemRoot%\System32\locator.exe
[RpcSs] %SystemRoot%\system32\svchost -k rpcss
[RSVP] %SystemRoot%\System32\rsvp.exe
[SamSs] %SystemRoot%\system32\lsass.exe
[SCardSvr] %SystemRoot%\System32\SCardSvr.exe
[Schedule] %SystemRoot%\System32\svchost.exe -k netsvcs
[seclogon] %SystemRoot%\System32\svchost.exe -k netsvcs
[SENS] %SystemRoot%\system32\svchost.exe -k netsvcs
[SharedAccess] %SystemRoot%\System32\svchost.exe -k netsvcs
[ShellHWDetection] %SystemRoot%\System32\svchost.exe -k netsvcs
[SLService] slserv.exe
[Spooler] %SystemRoot%\system32\spoolsv.exe
[srservice] %SystemRoot%\System32\svchost.exe -k netsvcs
[SSDPSRV] %SystemRoot%\System32\svchost.exe -k LocalService
[stisvc] %SystemRoot%\System32\svchost.exe -k imgsvc
[SwPrv] C:\WINDOWS\System32\dllhost.exe /Processid:{EDA0203D-00C3-4C46-9226-4E8F0B2D158C}
[SysmonLog] %SystemRoot%\system32\smlogsvc.exe
[TapiSrv] %SystemRoot%\System32\svchost.exe -k netsvcs
[TermService] %SystemRoot%\System32\svchost.exe -k netsvcs
[Themes] %SystemRoot%\System32\svchost.exe -k netsvcs
[TrkWks] %SystemRoot%\system32\svchost.exe -k netsvcs
[upnphost] %SystemRoot%\System32\svchost.exe -k LocalService
[UPS] %SystemRoot%\System32\ups.exe
[VSS] %SystemRoot%\System32\vssvc.exe
[W32Time] %SystemRoot%\System32\svchost.exe -k netsvcs
[WebClient] %SystemRoot%\System32\svchost.exe -k LocalService
[winmgmt] %systemroot%\system32\svchost.exe -k netsvcs
[WmiApSrv] C:\WINDOWS\System32\wbem\wmiapsrv.exe
[wuauserv] %systemroot%\system32\svchost.exe -k netsvcs
[WZCSVC] %SystemRoot%\System32\svchost.exe -k netsvcs


**** Custom IE Search Items ****

SEARCH: [SearchAssistant_bak]
SEARCH: [SearchAssistant] http://www.google.de
SEARCH: [CustomizeSearch] http://www.google.de


**** Complete IE Options ****

IEOPT: [NoUpdateCheck]
IEOPT: [NoJITSetup]
IEOPT: [Disable Script Debugger] yes
IEOPT: [Start Page] about:blank
IEOPT: [Show_ChannelBand] No
IEOPT: [Anchor Underline] yes
IEOPT: [Cache_Update_Frequency] Once_Per_Session
IEOPT: [Display Inline Images] yes
IEOPT: [Do404Search]
IEOPT: [Save_Session_History_On_Exit] no
IEOPT: [Show_FullURL] no
IEOPT: [Show_StatusBar] yes
IEOPT: [Show_ToolBar] yes
IEOPT: [Show_URLinStatusBar] yes
IEOPT: [Show_URLToolBar] yes
IEOPT: [Use_DlgBox_Colors] yes
IEOPT: [FullScreen] no
IEOPT: [Use FormSuggest] no
IEOPT: [FormSuggest Passwords] yes
IEOPT: [FormSuggest PW Ask] no
IEOPT: [Window_Placement] ,
IEOPT: [NotifyDownloadComplete] no
IEOPT: [Error Dlg Displayed On Every Error] no
IEOPT: [Error Dlg Details Pane Open] yes
IEOPT: [Use Search Asst] yes
IEOPT: [ShowedCheckBrowser] Yes
IEOPT: [Check_Associations] no
IEOPT: [AddToFavoritesExpanded]
IEOPT: [Use Search Assistant] yes
IEOPT: [Cache_Update_Size] 170201055066900177
IEOPT: [Cache_Update_Time] 20
IEOPT: [Local Page] C:\WINDOWS\system32\blank.htm
IEOPT: [StatusBarOther]
IEOPT: [BandRest] Never
IEOPT: [Search Bar_bak]
IEOPT: [Search Page_bak]
IEOPT: [Use Search Assistant_bak] yes
IEOPT: [AutoSearch]
IEOPT: [NoSaveAsPOSTWarning]
IEOPT: [Enable_Disk_Cache] yes
IEOPT: [Cache_Percent_of_Disk]
IEOPT: [Delete_Temp_Files_On_Exit] yes
IEOPT: [Anchor_Visitation_Horizon]
IEOPT: [Use_Async_DNS] yes
IEOPT: [Placeholder_Width]
IEOPT: [Placeholder_Height]
IEOPT: [Start Page] about:blank
IEOPT: [CompanyName] Microsoft Corporation
IEOPT: [Custom_Key] MICROSO
IEOPT: [Wizard_Version] 6.0.2600.0000
IEOPT: [FullScreen] no
IEOPT: [Use Search Assistant] yes
IEOPT: [Local Page] C:\WINDOWS\SYSTEM32\blank.htm