Tr/startpage.qr.dll Hiiiiilfe
 

Hallo,auch ich habe mir den tr/startpage.qr.dll eingefangen.
da bei jedem user die hijack.log anders aussieht, kommt hier meine, mit der Bitte um hilfe, was ich fixen muss.
Vielen Dank schon im voraus.

Logfile of HijackThis v1.99.1
Scan saved at 14:14:48, on 17.02.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programme\AGFEO\ISDN Guard\agfguard.exe
C:\Programme\TechniSat DVB\bin\Server4PC.exe
C:\Programme\WinZip\WZQKPICK.EXE
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\Teledat\WCOM\SYSTEM\RVSINST.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SCARDS32.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOKUME~1\MEINCO~1\LOKALE~1\Temp\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOKUME~1\MEINCO~1\LOKALE~1\Temp\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Name - {1D0B9005-3526-4CB4-AE04-53BFE8950269} - C:\WINDOWS\system32\msqwi.dll
O2 - BHO: (no name) - {91B99B3F-A4B5-4221-AB5C-A9B2CD8BDD43} - C:\WINDOWS\system32\ilnb.dll
O3 - Toolbar: FreshBar - {06ABAA2D-34AB-4902-A326-409BD9B9A7A5} - C:\WINDOWS\system32\iecustom32.dll
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ISDN Guard.lnk = C:\Programme\AGFEO\ISDN Guard\agfguard.exe
O4 - Global Startup: Server4PC.lnk = C:\Programme\TechniSat DVB\bin\Server4PC.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{03A8585D-5EB8-42C9-A8D9-1B9ADFB851B6}: NameServer = 69.50.188.180,195.225.176.31
O17 - HKLM\System\CCS\Services\Tcpip\..\{09085413-1922-4DD1-A35D-1F81C6978037}: NameServer = 69.50.188.180,195.225.176.31
O17 - HKLM\System\CCS\Services\Tcpip\..\{5BB6B055-4215-4085-8B15-A87B84F3D83A}: NameServer = 69.50.188.180,195.225.176.31
O17 - HKLM\System\CCS\Services\Tcpip\..\{8D68C420-F4A4-436C-8E6C-2DD438DC2DC7}: NameServer = 69.50.188.180,195.225.176.31
O17 - HKLM\System\CS1\Services\Tcpip\..\{03A8585D-5EB8-42C9-A8D9-1B9ADFB851B6}: NameServer = 69.50.188.180,195.225.176.31
O17 - HKLM\System\CS2\Services\Tcpip\..\{03A8585D-5EB8-42C9-A8D9-1B9ADFB851B6}: NameServer = 69.50.188.180,195.225.176.31
O18 - Filter: text/html - {2A6C69D0-CD04-4783-A1DA-DD95E1BD6027} - C:\WINDOWS\system32\ilnb.dll
O18 - Filter: text/plain - {2A6C69D0-CD04-4783-A1DA-DD95E1BD6027} - C:\WINDOWS\system32\ilnb.dll
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: RvscomSv - RVS Datentechnik GmbH, München - C:\Programme\Teledat\WCOM\SYSTEM\RVSCOMSV.EXE
O23 - Service: RVS Installer (RVSINST) - RVS Datentechnik GmbH, München - C:\Programme\Teledat\WCOM\SYSTEM\RVSINST.EXE
O23 - Service: CHIPDRIVE SCARD Service (TWKSCARDSRV) - Towitoko AG - C:\WINDOWS\SCARDS32.EXE

@Jan Förster

wechsle in den abgesicherten modus und fixe mit HJT
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOKUME~1\MEINCO~1\LOKALE~1\Temp\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOKUME~1\MEINCO~1\LOKALE~1\Temp\se.dll/sp.html
O2 - BHO: Name - {1D0B9005-3526-4CB4-AE04-53BFE8950269} - C:\WINDOWS\system32\msqwi.dll
O2 - BHO: (no name) - {91B99B3F-A4B5-4221-AB5C-A9B2CD8BDD43} - C:\WINDOWS\system32\ilnb.dll
O3 - Toolbar: FreshBar - {06ABAA2D-34AB-4902-A326-409BD9B9A7A5} - C:\WINDOWS\system32\iecustom32.dll
O18 - Filter: text/html - {2A6C69D0-CD04-4783-A1DA-DD95E1BD6027} - C:\WINDOWS\system32\ilnb.dll
O18 - Filter: text/plain - {2A6C69D0-CD04-4783-A1DA-DD95E1BD6027} - C:\WINDOWS\system32\ilnb.dll

danach manuell löschen
C:\WINDOWS\system32\ilnb.dll
C:\WINDOWS\system32\msqwi.dll
C:\DOKUME~1\MEINCO~1\LOKALE~1\Temp\se.dll

neu booten, neues HJT logfile posten

chaosman