hi all,
ive a big prob and hope u can help me out. since a few days my ie got a new startpage: martfinder.com . im sure i didnt bookmarked it, lol. and first i thought its my outlook, but thats wrong. nm if u checked mails or not, i still get this page again. first i edited it back to blank with the ie settings, of course i had no luck. after that i searched in ur forums and used SpyBot S&D and also HiJackThis which worked fine. i restarted the pc and the startpage was blank again ... but not for long. after a few mins surfing the page is back. like just right now: i was on ur forums only, and now its back again.
this is the log after cleaning and reboot the pc:
Logfile of HijackThis v1.97.7
Scan saved at 00:02:53, on 21.04.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\System32\rcapi.exe
d:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
D:\WINDOWS\Explorer.EXE
D:\PROGRA~1\PANICW~1\POP-UP~1\dpps2.exe
D:\Programme\Messenger Plus! 2\MsgPlus.exe
D:\Programme\RVS\WCOM\SYSTEM\RVSINST.EXE
D:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
d:\progra~1\mcafee.com\vso\mcvsescn.exe
d:\programme\mcafee.com\agent\mcagent.exe
D:\WINDOWS\System32\svchost.exe
D:\Programme\SDIII\NTService.exe
D:\Programme\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
D:\WINDOWS\win32.exe
D:\WINDOWS\System32\RUNDLL32.EXE
D:\WINDOWS\system32\usrbridg.exe
D:\WINDOWS\System32\MsPMSPSv.exe
D:\Programme\RVS\WCOM\SYSTEM\RVSCC.EXE
D:\Programme\RVS\WCOM\SYSTEM\CCSRV.EXE
D:\Programme\Palm-Software\Palm Desktop\HOTSYNC.EXE
D:\Programme\RVS\WCOM\SYSTEM\ccui.exe
d:\PROGRA~1\mcafee.com\vso\mcshield.exe
D:\PROGRA~1\RVS\WCOM\SYSTEM\ADBSERV.EXE
D:\Programme\RVS\WCOM\SYSTEM\RVSRmd.exe
D:\Dokumente und Einstellungen\Sweet-Kim\Desktop\hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programme\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {CF021F40-3E14-23A5-CBA2-717765721306} - D:\WINDOWS\System32\wer1306.dll
O2 - BHO: (no name) - {cf541f0d-3a2e-45fd-a4f2-311425482057} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - d:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Pop-Up Stopper] "D:\PROGRA~1\PANICW~1\POP-UP~1\dpps2.exe"
O4 - HKLM\..\Run: [MessengerPlus2] "D:\Programme\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [VSOCheckTask] "d:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "d:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] d:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] D:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [CTSysVol] D:\Programme\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [win32.exe] D:\WINDOWS\win32.exe
O4 - HKLM\..\RunServices: [RegisterDropHandler] D:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\RunOnce: [CommCenter] "D:\Programme\RVS\WCOM\SYSTEM\ccui.exe"
O4 - Startup: HotSync Manager.lnk = D:\Programme\Palm-Software\Palm Desktop\HOTSYNC.EXE
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherchieren (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/ad...asselbande.de/Lara Aalyah/ThumbnailFrame.html
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37914.6384027778
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A0F15D4B-99A2-4ED4-A18E-987938290CCA}: NameServer = 192.168.99.216,192.168.99.215
O17 - HKLM\System\CCS\Services\Tcpip\..\{AB8DCA92-6879-4395-970C-6A7D2151834B}: NameServer = 192.168.99.215,192.168.99.216
O19 - User stylesheet: D:\WINDOWS\win32.bmp (file missing)
and this after 10 mins on this board:
Logfile of HijackThis v1.97.7
Scan saved at 00:08:54, on 21.04.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\System32\rcapi.exe
d:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
D:\WINDOWS\Explorer.EXE
D:\PROGRA~1\PANICW~1\POP-UP~1\dpps2.exe
D:\Programme\Messenger Plus! 2\MsgPlus.exe
D:\Programme\RVS\WCOM\SYSTEM\RVSINST.EXE
D:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
d:\progra~1\mcafee.com\vso\mcvsescn.exe
d:\programme\mcafee.com\agent\mcagent.exe
D:\WINDOWS\System32\svchost.exe
D:\Programme\SDIII\NTService.exe
D:\Programme\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
D:\WINDOWS\System32\RUNDLL32.EXE
D:\WINDOWS\system32\usrbridg.exe
D:\WINDOWS\System32\MsPMSPSv.exe
D:\Programme\RVS\WCOM\SYSTEM\RVSCC.EXE
D:\Programme\RVS\WCOM\SYSTEM\CCSRV.EXE
D:\Programme\Palm-Software\Palm Desktop\HOTSYNC.EXE
D:\Programme\RVS\WCOM\SYSTEM\ccui.exe
d:\PROGRA~1\mcafee.com\vso\mcshield.exe
D:\PROGRA~1\RVS\WCOM\SYSTEM\ADBSERV.EXE
D:\Programme\RVS\WCOM\SYSTEM\RVSRmd.exe
D:\Programme\Internet Explorer\IEXPLORE.EXE
D:\Programme\Internet Explorer\IEXPLORE.EXE
D:\Programme\Internet Explorer\IEXPLORE.EXE
D:\Programme\Internet Explorer\IEXPLORE.EXE
D:\Programme\Internet Explorer\IEXPLORE.EXE
D:\Programme\Internet Explorer\IEXPLORE.EXE
D:\Programme\Microsoft Office\OFFICE11\OUTLOOK.EXE
D:\Programme\Internet Explorer\IEXPLORE.EXE
D:\Dokumente und Einstellungen\Sweet-Kim\Desktop\hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://martfinder.com/index.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programme\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {CF021F40-3E14-23A5-CBA2-717765721306} - D:\WINDOWS\System32\wer1306.dll
O2 - BHO: (no name) - {cf541f0d-3a2e-45fd-a4f2-311425482057} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - d:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Pop-Up Stopper] "D:\PROGRA~1\PANICW~1\POP-UP~1\dpps2.exe"
O4 - HKLM\..\Run: [MessengerPlus2] "D:\Programme\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [VSOCheckTask] "d:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "d:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] d:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] D:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [CTSysVol] D:\Programme\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [win32.exe] D:\WINDOWS\win32.exe
O4 - HKLM\..\RunServices: [RegisterDropHandler] D:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\RunOnce: [CommCenter] "D:\Programme\RVS\WCOM\SYSTEM\ccui.exe"
O4 - Startup: HotSync Manager.lnk = D:\Programme\Palm-Software\Palm Desktop\HOTSYNC.EXE
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherchieren (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/ad...asselbande.de/Lara Aalyah/ThumbnailFrame.html
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37914.6384027778
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A0F15D4B-99A2-4ED4-A18E-987938290CCA}: NameServer = 192.168.99.216,192.168.99.215
O17 - HKLM\System\CCS\Services\Tcpip\..\{AB8DCA92-6879-4395-970C-6A7D2151834B}: NameServer = 192.168.99.215,192.168.99.216
O19 - User stylesheet: D:\WINDOWS\win32.bmp (file missing)
here we go again:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://martfinder.com/index.htm
plz, help me, i really dont know what to do. and this startpage is making me crazy .. lol .. oh, and if u find more stuff i can remove without losing my progs i need plz lemme know.
thx thx thx, Sweet*Kim
ive a big prob and hope u can help me out. since a few days my ie got a new startpage: martfinder.com . im sure i didnt bookmarked it, lol. and first i thought its my outlook, but thats wrong. nm if u checked mails or not, i still get this page again. first i edited it back to blank with the ie settings, of course i had no luck. after that i searched in ur forums and used SpyBot S&D and also HiJackThis which worked fine. i restarted the pc and the startpage was blank again ... but not for long. after a few mins surfing the page is back. like just right now: i was on ur forums only, and now its back again.
this is the log after cleaning and reboot the pc:
Logfile of HijackThis v1.97.7
Scan saved at 00:02:53, on 21.04.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\System32\rcapi.exe
d:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
D:\WINDOWS\Explorer.EXE
D:\PROGRA~1\PANICW~1\POP-UP~1\dpps2.exe
D:\Programme\Messenger Plus! 2\MsgPlus.exe
D:\Programme\RVS\WCOM\SYSTEM\RVSINST.EXE
D:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
d:\progra~1\mcafee.com\vso\mcvsescn.exe
d:\programme\mcafee.com\agent\mcagent.exe
D:\WINDOWS\System32\svchost.exe
D:\Programme\SDIII\NTService.exe
D:\Programme\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
D:\WINDOWS\win32.exe
D:\WINDOWS\System32\RUNDLL32.EXE
D:\WINDOWS\system32\usrbridg.exe
D:\WINDOWS\System32\MsPMSPSv.exe
D:\Programme\RVS\WCOM\SYSTEM\RVSCC.EXE
D:\Programme\RVS\WCOM\SYSTEM\CCSRV.EXE
D:\Programme\Palm-Software\Palm Desktop\HOTSYNC.EXE
D:\Programme\RVS\WCOM\SYSTEM\ccui.exe
d:\PROGRA~1\mcafee.com\vso\mcshield.exe
D:\PROGRA~1\RVS\WCOM\SYSTEM\ADBSERV.EXE
D:\Programme\RVS\WCOM\SYSTEM\RVSRmd.exe
D:\Dokumente und Einstellungen\Sweet-Kim\Desktop\hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programme\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {CF021F40-3E14-23A5-CBA2-717765721306} - D:\WINDOWS\System32\wer1306.dll
O2 - BHO: (no name) - {cf541f0d-3a2e-45fd-a4f2-311425482057} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - d:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Pop-Up Stopper] "D:\PROGRA~1\PANICW~1\POP-UP~1\dpps2.exe"
O4 - HKLM\..\Run: [MessengerPlus2] "D:\Programme\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [VSOCheckTask] "d:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "d:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] d:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] D:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [CTSysVol] D:\Programme\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [win32.exe] D:\WINDOWS\win32.exe
O4 - HKLM\..\RunServices: [RegisterDropHandler] D:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\RunOnce: [CommCenter] "D:\Programme\RVS\WCOM\SYSTEM\ccui.exe"
O4 - Startup: HotSync Manager.lnk = D:\Programme\Palm-Software\Palm Desktop\HOTSYNC.EXE
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherchieren (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/ad...asselbande.de/Lara Aalyah/ThumbnailFrame.html
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37914.6384027778
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A0F15D4B-99A2-4ED4-A18E-987938290CCA}: NameServer = 192.168.99.216,192.168.99.215
O17 - HKLM\System\CCS\Services\Tcpip\..\{AB8DCA92-6879-4395-970C-6A7D2151834B}: NameServer = 192.168.99.215,192.168.99.216
O19 - User stylesheet: D:\WINDOWS\win32.bmp (file missing)
and this after 10 mins on this board:
Logfile of HijackThis v1.97.7
Scan saved at 00:08:54, on 21.04.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\System32\rcapi.exe
d:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
D:\WINDOWS\Explorer.EXE
D:\PROGRA~1\PANICW~1\POP-UP~1\dpps2.exe
D:\Programme\Messenger Plus! 2\MsgPlus.exe
D:\Programme\RVS\WCOM\SYSTEM\RVSINST.EXE
D:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
d:\progra~1\mcafee.com\vso\mcvsescn.exe
d:\programme\mcafee.com\agent\mcagent.exe
D:\WINDOWS\System32\svchost.exe
D:\Programme\SDIII\NTService.exe
D:\Programme\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
D:\WINDOWS\System32\RUNDLL32.EXE
D:\WINDOWS\system32\usrbridg.exe
D:\WINDOWS\System32\MsPMSPSv.exe
D:\Programme\RVS\WCOM\SYSTEM\RVSCC.EXE
D:\Programme\RVS\WCOM\SYSTEM\CCSRV.EXE
D:\Programme\Palm-Software\Palm Desktop\HOTSYNC.EXE
D:\Programme\RVS\WCOM\SYSTEM\ccui.exe
d:\PROGRA~1\mcafee.com\vso\mcshield.exe
D:\PROGRA~1\RVS\WCOM\SYSTEM\ADBSERV.EXE
D:\Programme\RVS\WCOM\SYSTEM\RVSRmd.exe
D:\Programme\Internet Explorer\IEXPLORE.EXE
D:\Programme\Internet Explorer\IEXPLORE.EXE
D:\Programme\Internet Explorer\IEXPLORE.EXE
D:\Programme\Internet Explorer\IEXPLORE.EXE
D:\Programme\Internet Explorer\IEXPLORE.EXE
D:\Programme\Internet Explorer\IEXPLORE.EXE
D:\Programme\Microsoft Office\OFFICE11\OUTLOOK.EXE
D:\Programme\Internet Explorer\IEXPLORE.EXE
D:\Dokumente und Einstellungen\Sweet-Kim\Desktop\hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://martfinder.com/index.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programme\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {CF021F40-3E14-23A5-CBA2-717765721306} - D:\WINDOWS\System32\wer1306.dll
O2 - BHO: (no name) - {cf541f0d-3a2e-45fd-a4f2-311425482057} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - d:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Pop-Up Stopper] "D:\PROGRA~1\PANICW~1\POP-UP~1\dpps2.exe"
O4 - HKLM\..\Run: [MessengerPlus2] "D:\Programme\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [VSOCheckTask] "d:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "d:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] d:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] D:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [CTSysVol] D:\Programme\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [win32.exe] D:\WINDOWS\win32.exe
O4 - HKLM\..\RunServices: [RegisterDropHandler] D:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\RunOnce: [CommCenter] "D:\Programme\RVS\WCOM\SYSTEM\ccui.exe"
O4 - Startup: HotSync Manager.lnk = D:\Programme\Palm-Software\Palm Desktop\HOTSYNC.EXE
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherchieren (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/ad...asselbande.de/Lara Aalyah/ThumbnailFrame.html
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37914.6384027778
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A0F15D4B-99A2-4ED4-A18E-987938290CCA}: NameServer = 192.168.99.216,192.168.99.215
O17 - HKLM\System\CCS\Services\Tcpip\..\{AB8DCA92-6879-4395-970C-6A7D2151834B}: NameServer = 192.168.99.215,192.168.99.216
O19 - User stylesheet: D:\WINDOWS\win32.bmp (file missing)
here we go again:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://martfinder.com/index.htm
plz, help me, i really dont know what to do. and this startpage is making me crazy .. lol .. oh, and if u find more stuff i can remove without losing my progs i need plz lemme know.
thx thx thx, Sweet*Kim