Beim starten des IE kommt jedesmal diese startseite: htt*://aifind.info
Mein LOG:
Logfile of HijackThis v1.97.7
Scan saved at 18:57:26, on 31.05.2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Stardock\WindowBlinds\wbload.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programme\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\sstray.exe
C:\Programme\Microsoft Hardware\Mouse\point32.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
D:\programme\Quicktime\qttask.exe
D:\Programme\PestPatrol4\PPMemCheck.exe
D:\Programme\PestPatrol4\CookiePatrol.exe
D:\Programme\PestPatrol4\PPControl.exe
C:\Programme\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\dokume~1\home\anwend~1\services.exe
C:\Programme\McAfee\McAfee VirusScan\VsStat.exe
C:\Programme\McAfee\McAfee VirusScan\Avconsol.exe
D:\Programme\ICQ\Icq.exe
C:\WINDOWS\explorer.exe
C:\Dokumente und Einstellungen\Home\Lokale Einstellungen\Temporary Internet Files\Content.IE5\H8WVD54X\dpc[1].exe
C:\Dokumente und Einstellungen\Home\Anwendungsdaten\ttcc.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
Z:\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://opti.riviera.cc (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://opti.riviera.cc (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.gu-videogames.de/uni-gaming/index.php3
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O1 - Hosts: 213.159.117.235 auto.search.msn.com
O2 - BHO: (no name) - {00000000-0000-0000-0000-000000000000} - C:\WINDOWS\System32\msxslab.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - C:\Programme\McAfee\McAfee VirusScan\VSCShellExtension.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "D:\programme\Quicktime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [zSPGuard] d:\programme\spguard\spguard.exe /s /r
O4 - HKLM\..\Run: [PPMemCheck] D:\Programme\PestPatrol4\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] D:\Programme\PestPatrol4\CookiePatrol.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] D:\Programme\PestPatrol4\PPControl.exe
O4 - HKLM\..\Run: [hsim] C:\DOKUME~1\Home\LOKALE~1\Temp\isearch.exe r 5
O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\System32\bridge.dll",Load
O4 - HKLM\..\Run: [intdctrr] C:\WINDOWS\System32\idctup20.exe
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Programme\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - HKCU\..\Run: [System Update] c:\dokume~1\home\anwend~1\services.exe
O4 - HKCU\..\Run: [Aear] C:\Dokumente und Einstellungen\Home\Anwendungsdaten\ttcc.exe
O4 - HKLM\..\RunOnce: [SpybotSnD] "D:\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\RunOnce: [ICQ] D:\Programme\ICQ\Icq.exe -trayboot
O4 - Startup: Download Plus.lnk = C:\Dokumente und Einstellungen\Home\Anwendungsdaten\DownloadPlus.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Programme\Office\Office10\OSA.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\programme\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\programme\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\programme\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Download with GetRight - D:\PROGRA~1\GETRIGHT\GRdownload.htm
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://D:\PROGRA~1\Office\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - D:\PROGRA~1\GETRIGHT\GRbrowse.htm
O8 - Extra context menu item: Si&milar Pages - res://c:\programme\google\GoogleToolbar2.dll/cmsimilar.html
O9 - Extra button: ICQ Pro (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/games/clients/y/ct1_x.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab28177.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {11111111-1111-1111-1111-111111111123} - ms-its:mhtml:file://C:\bla.MHT!http://216.115.95.98//38ble.chm::/wincfgid.exe
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/04a30f04300bfbf27206/netzip/RdxIE601_de.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20040105/qtinstall.info.apple.com/mickey/de/win/QuickTimeInstaller.exe
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab28177.cab
O16 - DPF: {97154128-DC4C-4D5B-AF7C-CA7356238EC9} (Hanmail FileUpload Control) - http://wwl280.daum.net/hanmail-ax/HM_fileupload.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3BCA4372-F6D3-4064-A15F-8421494EEC2D}: NameServer = 192.168.1.1,194.25.2.130
starring Gast |
