Startseite ändert sich immer wieder in about:blank

hilfe!!!
Gast

« am: 11.05.04, 22:58:21 »

hallo zusammen

ich habe ein problem und ich hoffe, dass ihr mir helfen könnt. wie ich lesen könnte hatten einige erfolge.

um das obengenannte problem zu beseitigen habe ich schon folgende programme benutzt: Ad-aware6.0,NoAdware und Spybot - Search & Destroy. Die haben was gefunden, aber das problem mit dem about:blank ist immernoch vorhanden.

mit dem hijackthis kam folgendes raus:

R1 - HKCU\Sofware\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\ien.dll/sp.html (obfuscated)
R1 - HKCU\Sofware\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\ien.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\ien.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDWOS\System32\ien.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\ien.dll/sp.html (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\ien.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {B407394B-E503-4065-9775-6480AB36D7B2} - C:\WINDOWS\System32\ien.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 – HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 – HKLM\..\Run: [HotKeysCmds] C:\WINDWOS\System32\hkcmd.exe
O4 – HKLM\..\Run: [Chotkey] mHotkey.exe
O4 – KKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe –s
O4 – HKLM\..\Run: [NeroFilterCheck] C:\WINDWOS\system32\NeroCheck.exe
O4 – HKLM\..\Run: [AntivirusRegistration] C:\Programme\Excid.com Aps\eTrust Antivirus Registaration\EzAntivirusRegistrationCheck.exe
O4 – HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 – Global Startup: hp psc 1000 series.Ink = ?
O4 – Global Startup: hpoddt01.exe.Ink = ?
O4 – Global Starup: Microsoft Office.Ink = C:\Programme\Microsoft Office\Office10\OSA.EXE
O8 – Extra context menu item: Nach Microsoft &Excel exportieren – res://C:\PROGRA~1/MICROS~3\Office10\EXCEL.EXE/3000
O9 – Extra button: Messenger (HKLM)
O9 – Extra Tools menuitem: Windows Messenger (HKLM)
O9 – Extra button: MEDION (HKCU)
O14 – IERESET.INF:START_PAGE_URL=http://www.microsoft.com/
O16 – DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) – http://fpdownload.macromedia.com/pub/shockwave/cabs/director/swdir.cab
O16 – DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) – http://office.microsoft.com/officeupdate/content/opuc.cab
O16 – DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) – http://v.4windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37926.3102662037
O16 – DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwafe Flash Object) – http://fpdownload.macomedia.com/pup/shockwave/cabs/flash/swflash.cab

es wäre echt super wenn mir jemand helfen könnte!

danke

hilfe!!!

Moderator informieren

Antworten zu Startseite ändert sich immer wieder in about:blank:

Nighty
Gast

Re: Startseite ändert sich immer wieder in about:blank

« Antwort #1 am: 12.05.04, 00:34:01 »

Fixen:

R1 - HKCU\Sofware\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\ien.dll/sp.html (obfuscated)
R1 - HKCU\Sofware\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\ien.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\ien.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDWOS\System32\ien.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\ien.dll/sp.html (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\ien.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

O2 - BHO: (no name) - {B407394B-E503-4065-9775-6480AB36D7B2} - C:\WINDOWS\System32\ien.dll

Vor dem fixen oflline gehen und alle browserfenster schliessen

Dann die ien.dll löschen im abgesicherten Modus

Gruß

Moderator informieren

yesorno
Gast

Re: Startseite ändert sich immer wieder in about:blank

« Antwort #2 am: 12.05.04, 12:44:40 »

Vielen Dank für die Hilfe!!!

Funktioniert wieder wie es sollte!

Super!!!!

Danke

Moderator informieren

fitz
Gast

Re: Startseite ändert sich immer wieder in about:blank

« Antwort #3 am: 13.05.04, 12:54:27 »

kann mir auch jemand helfen?

danke für alle feedbacks! hab alle programme (Ad-aware 6.0, Spybot - Search & Destroy, CWShredder, HijackThis) aktuell durchlaufen lassen! was und wie muss ich was löschen?

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\jgjk.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\jgjk.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\jgjk.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\jgjk.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\jgjk.dll/sp.html (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\jgjk.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.isurf.ch/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {39128DB8-1605-46F6-A802-B1577BF24EA2} - C:\WINNT\system32\hhkoi.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\PROGRA~1\WS_FTP\wsbho2k0.dll
O2 - BHO: (no name) - {7C758F95-0711-4089-816A-D94F272958B2} - C:\WINNT\system32\jgjk.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar1.dll
O2 - BHO: (no name) - {C1B92C16-721C-4E8A-812E-0279580B22D0} - C:\WINNT\system32\dpdini.dll (file missing)
O2 - BHO: (no name) - {D14D72CD-49C7-48DD-B55C-5824581FC970} - C:\WINNT\system32\ddfbi.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll
O4 - HKLM\..\Run: [TrackPointSrv] tp4serv.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [AEIWLSTA.EXE] AEIWLSTA.EXE
O4 - HKLM\..\Run: [LTSMMSG] LTSMMSG.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [TPTRAY] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [PRPCMonitor] PRPCUI.exe
O4 - HKLM\..\Run: [dla] C:\WINNT\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ConfigSafe] C:\CFGSAFE\NTFSCLUP.EXE
O4 - HKLM\..\Run: [CSScheduleCheck] C:\CFGSAFE\SCHWIZEX.EXE -CHECK
O4 - HKLM\..\Run: [ftpqueue] C:\Programme\WS_FTP\ftpqueue.exe -tray
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programme\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [MMTray] C:\Programme\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\eTrust\INOCUL~1\realmon.exe
O4 - HKLM\..\Run: [Tgcmd] "C:\Programme\Support.com\bin\tgcmd.exe /server"
O4 - HKLM\..\Run: [HP Network Registry Agent] C:\WINNT\System32\hpnra.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Internet Explorer Updater] C:\WINNT\system32\lexbac.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [XTNDConnect PC - ErPhn2] C:\PROGRA~1\GEMEIN~1\XCPCSync\TRANSL~1\ErPhn2\ErTray.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\regedit.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [vwpix] C:\WINNT\vwpix.exe
O4 - HKLM\..\Run: [sjidcp] C:\WINNT\sjidcp.exe
O4 - HKCU\..\Run: [DayDisplay] C:\Programme\DayDisplay\DayDisplay.exe
O4 - HKLM\..\RunOnce: [Ad-aware] "C:\PROGRA~1\LAVASOFT\AD-AWA~1\Ad-aware.exe" "+b1"
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - Startup: HotSync Manager.lnk = C:\Programme\Palm\HOTSYNC.EXE
O4 - Startup: FileBox eXtender.lnk = C:\Programme\FileBX\FileBX.exe
O4 - Global Startup: BTTray.lnk = C:\Programme\IBM\Bluetooth Software\BTTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programme\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://C:\Programme\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Programme\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Programme\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\Programme\Google\GoogleToolbar1.dll/cmsimilar.html
O9 - Extra 'Tools' menuitem: Sun Java Konsole (HKLM)
O9 - Extra button: ICQ Lite (HKLM)
O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {2F0D1DA3-F3E4-4C67-BB5C-5AFD70C1A4A5} (UDConnect Class) - http://01.sharedsource.org/html/UDConn.cab
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {402EE96E-2CE8-482D-ADA5-CECEEA07E16D} (TurnTool Scene) - http://www.turntool.com/ViewerInstall.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall-Kontrolle) - http://a840.g.akamai.net/7/840/537/7d90ae05585062/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - http://www-306.ibm.com/pc/support/IbmEgath.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://hpt1.bluewin.ch/app/static/activex/msxml4.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37913.967650463
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = globalfood.ch
O17 - HKLM\System\CCS\Services\Tcpip\..\{D52E859B-D12A-4E99-8753-4E193061858D}: NameServer = 195.186.1.111,195.186.4.111
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = globalfood.ch
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = globalfood.ch