|
|
|
24Start.nl oder 24Start.com.24web
Die Startzeite wird übernommen durch 24Start und es wird ein Dialer installiert 0,80 Euro pro Minute
Es ist lästig diesen Hijacker zu entfernen, da er regelmässig in Windows
den Namen wechselt
Aber mit Hijack This kann man diesen Hijacker entfernen
Geh in den abgesicherten Modus
MS-Connect
R0 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
file:///C:/Program%20Files/MS-Connect/Portal/portal.html
R1 HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina =
file:///C:/Program%20Files/MS-Connect/Portal/portal.html
O4 HKLM\..\Run: [MS-Connect] C:\WINDOWS\System32\msite18.exe
O4 HKLM\..\Run: [MS-Connect] C:\WINNT\System32\cdm.exe
O4 HKLM\..\Run: [MS-Connect] C:\WINDOWS\System32\game.exe
O4 HKLM\..\Run: [MS-RunKey] C:\WINDOWS\System32\arr.exe
Startportal:
R0 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Program%20Files/Startportal/Portal/portal.html
R1 HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina = file:///C:/Program%20Files/Startportal/Portal/portal.html
O4 HKLM\..\Run: [Diskstart] C:\WINNT\system32\code.exe
O4 HKLM\..\Run: [Diskstart] C:\WINDOWS\System32\cat.exe
O4 HKLM\..\Run: [Diskstart] C:\WINDOWS\SYSTEM\HIT.EXE
O4 HKLM\..\Run: [Diskstart] C:\WINDOWS\SYSTEM32\snt.exe
QuickPage:
R0 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Program%20Files/QuickPage/Portal/portal.html
R1 HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina = file:///C:/Program%20Files/QuickPage/Portal/portal.html
O4 HKLM\..\Run: [Quicktlme] C:\WINDOWS\System32\ru.exe
O4 HKLM\..\Run: [Quicktlme] C:\WINDOWS\System\ru.exe
O4 HKLM\..\Run: [Quicktlme] C:\WINDOWS\System32\cp.exe
OnlineDirect:
R0 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Program%20Files/Onlinedirect/Portal/portal.html
R1 HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina = file:///C:/Program%20Files/Onlinedirect/Portal/portal.html
O4 HKLM\..\Run: [CLSID] C:\WINDOWS\System32\sed.exe
O4 HKLM\..\Run: [CLSID] C:\WINDOWS\System32\msgplus.exe
NowOnline:
R0 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Program%20Files/NowOnline/Portal/portal.html
R1 HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina = file:///C:/Program%20Files/NowOnline/Portal/portal.html
O4 HKLM\..\Run: [CLSID] C:\WINDOWS\System32\com.exe
FirstEnter:
R0 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Program%20Files/FirstEnter/Portal/portal.html
R1 HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina = file:///C:/Program%20Files/FirstEnter/Portal/portal.html
O4 HKLM\..\Run: [CLSID] C:\WINDOWS\System32\dll.exe
O4 HKLM\..\Run: [CLSID] C:\WINDOWS\System32\plugin.exe
First2Enter
R0 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Program%20Files/First2Enter/Portal/portal.html
R1 HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina = file:///C:/Program%20Files/First2Enter/Portal/portal.html
O4 HKLM\..\Run: [Open2Enter] C:\WINDOWS\System32\runme.exe
O4 HKLM\..\Run: [Open2Enter] C:\WINDOWS\System32\runme2.exe
O4 HKLM\..\Run: [Classes] C:\WINDOWS\System32\run_21.exe
O4 HKLM\..\Run: [Classes] C:\WINDOWS\System32\srv.exe
Plus18Point
R0 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Program%20Files/Plus18Point/Portal/portal.html
R1 HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina = file:///C:/Program%20Files/Plus18Point/Portal/portal.html
O4 HKLM\..\Run: [Classes] C:\WINDOWS\System32\srv.exe
O4 HKLM\..\Run: [Classes] C:\WINDOWS\System32\srv2.exe
O4 HKLM\..\Run: [Classes] C:\WINDOWS\System32\intl.exe
O4 HKLM\..\Run: [Classes] C:\WINDOWS\System32\int1.exe
MStartEnter
R0 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Program%20Files/MStartEnter/Portal/portal.html
R1 HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina = file:///C:/Program%20Files/MStartEnter/Portal/portal.html
O4 HKLM\..\Run: [Classes] C:\WINDOWS\System32\mstar2.exe
O4 HKLM\..\Run: [Classes] C:\WINDOWS\system32\mstart.exe
MStart2Page
R0 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Program%20Files/MStart2Page/Portal/portal.html
R1 HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina = file:///C:/Program%20Files/MStart2Page/Portal/portal.html
O4 HKLM\..\Run: [OpenMstart] C:\WINDOWS\System32\mcmgr32.exe
O4 HKLM\..\Run: [OpenMstart] C:\WINDOWS\system32\mmgr32.exe
EnterOne
R0 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Program%20Files/EnterOne/Portal/portal.html
R1 HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina = file:///C:/Program%20Files/EnterOne/Portal/portal.html
O4 HKLM\..\Run: [NvCplD] C:\WINDOWS\System32\m2gr32.exe
O4 HKLM\..\Run: [NvCplD] C:\WINDOWS\system32\ntcpl.exe
O4 HKLM\..\Run: [NvCplD] C:\WINDOWS\system32\ntopengl.exe
EnterOne
R0 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Program%20Files/EnterOne/Portal/portal.html
R1 HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina = file:///C:/Program%20Files/EnterOne/Portal/portal.html
O4 HKLM\..\Run: [Updater] C:\WINDOWS\system32\adservernow.exe
O4 HKLM\..\Run: [NvCplD] C:\WINDOWS\system32\ntcpl.exe
EnterOne
R0 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Program%20Files/EnterOne/Portal/portal.html
R1 HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina
file:///C:/Program%20Files/EnterOne/Portal/portal.html
O4 HKLM\..\Run: [Updater] C:\WINNT\system32\adservernow.exe
O4 HKLM\..\Run: [NvCplD] C:\WINNT\system32\ntopengl.exe
PageOn1
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina = file:///C:/Program%20Files/PageOn1/Portal/portal.html
O4 - HKLM\..\Run: [rCron] C:\WINDOWS\System32\rcron.exe
O4 - HKLM\..\Run: [rCron] C:\WINDOWS\System32\dservice.exe
Make125
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Program%20Files/Make125/Portal/portal.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina = file:///C:/Program%20Files/Make125/Portal/portal.html
O4 - HKLM\..\Run: [Updater] C:\WINDOWS\System\Adservernow.exe
O4 - HKLM\..\Run: [sVideo2] C:\WINDOWS\System\Vxdrun6.exe
Emakesv
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Program%20Files/eMakeSV/Portal/portal.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina =
file:///C:/Program%20Files/ eMakeSV/Portal/portal.html
O4 - HKLM\..\Run: [eMakeSV] C:\WINDOWS\SYSTEM\EMAKESV.EXE
Emakes
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Program%20Files/eMakeSV/Portal/portal.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina = file:///C:/Program%20Files/eMakeSV/Portal/portal.html
O4 - HKLM\..\Run: [eMakeSV] C:\WINDOWS\system32\emake2b.exe
Switch - xcallswitch
Regedit
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\SWITCH
Entferne unter Software(Add/Remove) Switch oder xcallswitch
und entferne in c:\Program Files\Portal
|
|
|
