unsicherheiten beim fixen

Sabina

fixe mit dem HijackThis

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.couldnotfind.com/search_...count_id=146274
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.couldnotfind.com/search_...count_id=146274
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redi...er=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redi...=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redi...=ie&ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.couldnotfind.com/search_...count_id=146274

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O1 - Hosts file is located at: C:\WINNT\nsdb\hosts
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINNT\nem219.dll (file missing)
O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-AB2D-8D32436313D9} - C:\WINNT\bsx5.dll
O2 - BHO: CExtension Object - {A85C4A1B-BD36-44E5-A70F-8EC347D9B24F} - C:\WINNT\bs3.dll
O4 - HKLM\..\Run: [Bsx3] RunDLL32.EXE C:\WINNT\bs3.dll,DllRun
O4 - HKLM\..\Run: [bxsx5] RunDLL32.EXE C:\WINNT\bsx5.dll,DllRun
O4 - HKLM\..\Run: [IST Service] C:\Programme\ISTsvc\istsvc.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/02b5a6683e08a4...RdxIE601_de.cab
O18 - Filter: text/html - {4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB} - C:\WINNT\System32\xplugin.dll

neustarten


#Gehe mal in die Hosts-Datei (mit Editor oeffnen)
schau mal in c:\Windows\System32\drivers\etc\hosts
Im Normalfall sollte dass hier drin stehen, alles andere loeschen.
127.0.0.1 localhost
#Orginal Host Datei

#Start<Ausfuehren<regedit
1. Click Start > Run.
2. Type:
regsvr32 /u [path to XPlugin.dll]
and click OK.
This will uninstall Adware.TMKSoft.XPlugin.
http://sarc.com/avcenter/venc/data/a...t.xplugin.html

#Loesche (am besten im abgesicherten Modus:
C:\WINNT\nem219.dll
C:\WINNT\bsx5.dll
C:\WINNT\bs3.dll
#scanne noch einmal mit mwav.exe (escan)
http://www.mwti.net/antivirus/free_utilities.asp
#Lade AdAWare (free)
http://www.lavasoft.de/support/download/

#loesche unter <Internetoptionen< die TemporaryInternetfiles.

mfg
Sabina