HILFE !!! HILFE!!! HILFE!!! Internet Explorer dreht durch!!!

[T_Dino]

Hi Leute ,
also ich habe da so ein Problem mit IE 6.0. Meine Startseite (anfangs war es mal google.de) wurde beim Besuch der homepage supremetemplates.com in www.whazit.com geändert. Naja das Ändern der Startseite in den Internetoptionen bringt nichts. In der Registry habe ich auch nichts gefunden und ebenfals auch kein Progi, dass die Startseite immer ändert. Wäre also net wenn weiner von euch mir helfen könnte !
DANKE !!!!!!!!!!!

[Exxtreme]

Klingt stark nach einem Trojaner oder nach einer Adware.

Lad dir mal einen aktuellen Virenscanner runter und Ad-Aware würde ich auch nutzen.

[..,-]

Originally posted by T_Dino
Naja das Ändern der Startseite in den Internetoptionen bringt nichts.
Was genau heißt "bringt nichts"?

Wird die Einstellung der Startseite wieder zurückgeändert, oder bleibt die Startseiteneinstellung so, wie du sie vorgenommen hast, ohne dass die Seite aufgerufen wird?

Welche Seite hast du überhaupt als neue Startseite eingetragen? Eine echte Webseiet oder "Leere Seite"?

Guck auch mal in den Registry-Schlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs

edit:
Zu langsam. Aber mach vorher ruhig mal, was Exxtreme empfiehlt.

[T_Dino]

Also danke erstmal für das schnelle Antworten!!!

..... also ich verwende zuzeit Norton 2003 und Anti Trojan 5.5 <-- beide haben nach mehrfachen Scans nichts gefunden !!!

Es wurde jedoch die Registry stark verändert. Also mehrfach habe ich den Eintrag der Startseite gefunden die sich immer wieder nach meiner Änderund als Startseite einträgt (www.whazit.com) desweiteren wurden zu dem Zeitpunkt als das Problem began diese Dateien verändert oder neu erstellt:

C:\winnt: < Win 2000 pro
nem210.dll
eula.txt
bho.dll
regadd706.reg
ShellIconCache
internal.php
tinybar.exe
Um auf deine Frage zu Antworten ..,- -> ich ändere die Startseite in den Internetoptionen auf www.google.de -> beim ersten Start der IE 6 ist die Startseite noch google.de, aber wenn ich da schon in die Internetoptionen schaue ist die Sartseite wieder geändert in www.whazit.com also bein nächsten Sart ist die Startseite wieder verändert !!!

Hier der Inhalt der eula.txt Datei:
You may accept this end user license agreement only if you agree to these folloing terms:
1) I am an adult in the country from which I originate.
2) I am the owner of this computer, or am authorized by the owner of this computer to install software on this system.
3) I understand that by accepting these terms and conditions, this program will be installed on my computer and my web browser home and search page will be changed in order to allow me access.
4) I further understand that an accessory tool bar will be added to my web browser which will remain visible as long as the software is installed and agree that I wish to use your search engine for my web browsers auto search option and default error page. Defualt error page changes include adding a domain name suffix to your dns setting if you do not already have this option set.
5) To insure you always have the latest version and for your convenience this software will automatically update itself from time to time once installed.
6) If you decide to change your homepage at a later date our passthrough toolbar will be installed in your webbrowser. This toolbar will remain active as long as this software is installed on your system.
7) I understand that, by accepting these terms and conditions, bookmarks that may lead to content of an adult and/or sexual nature will be added to my system, which may be removed manually or via un-installation of the software.
8) In order for us to keep this software free from time to time promotional offers from our sponsors will be displayed to you.
9) To prevent your browser from becoming cluttered when our toolbar is installed, any other toolbars you currently have visible will be deactivated. They can be restored manually through the IE view menu.
10) Once installed if you decide to change your start or search page this information will be sent back to our server.
11) Bookmarking to a page on this server/site whereby this warning page is by-passed shall constitute an implicit acceptance of the foregoing terms herein set forth.
12) I understand the standards and laws of the community, site and computer to which I am transporting this material, and am solely responsible for my actions.
13) If I use these services in violation of the above agreement, I understand I may be in violation of local and/or federal laws and am solely responsible for my actions.
14) By accepting these terms and conditions, I will have released and discharged the providers, owners and creators of this software/site from any and all liability which might arise.

End User License Agreement (EULA)
The Comparison/Alternative Shopping Engine is powered by 180Solutions. All
relevant license and privacy issues are covered in the "n-CASE License and
Privacy Policy."
n-CASE License and Privacy Policy
(Last Revised May 15, 2002)
By installing n-CASE, you grant permission for 180Solutions to
occasionally display interstitial advertising and to collect
non-personally identifiable information about you, including the websites
you visit while connected to the Internet. Specific information related to
privacy practices can be found below.
This privacy policy describes the information gathering, use and
disclosure practices of 180Solutions.com with regard to the n-CASE
software product. Please read this policy before you use or download our
software. By installing our software, you are consenting to the
information collection, use and disclosure practices described in this
policy as modified by us from time to time. If we decide to change our
privacy policy, we will post a new policy on our web site and note the
date the policy was revised. Therefore, we encourage you to check our
privacy policy for any updates or changes.
This policy can be found at
http://www.180solutions.com/n-case/privacy.htm.
180Solutions' n-CASE product provides a connection between the end user
"You" and advertisers, researchers and content providers. End users
support free software developers or earn various incentives by allowing
180Solutions to monitor online behavior and deliver advertisements based
on the end-user's demographic profile and Internet activity. 180Solutions
will only release generalized cumulative information to sponsors and the
industry, and does not collect any personally identifiable information.
If you decide to take advantage of an offer from a sponsor or advertiser
in the n-CASE product, you need to submit your personal information
yourself, directly to that sponsor, and you need to be comfortable with
that sponsor or advertiser's privacy policy. 180Solutions maintains no
responsibility for relationships that may arise between you and an
individual advertiser, including, but not limited to, breach of contract,
violation of privacy policies, defective products or fraud.
Information We Collect and How We Use It
Personal Information
180Solutions does not collect or store your name, address, email address,
or any other data defined as "personally identifiable information".
180Solutions may collect non-personally identifiable information, linked
to a distinct user ID. This may include, but is not limited to, your age,
sex, geographic region and interests. Occasionally, 180Solutions may
display additional questions to you, inviting you to answer. Any answers
you supply are covered by this privacy policy. 180Solutions uses this
information to learn more about its audience. 180Solutions also uses this
information to provide you with content and information most likely to be
relevant to you.
Tracking
When n-CASE is actively running on your computer, the software generates
logs of your surfing activity, including web pages you have visited and
the order in which you visited these pages. These logs are then uploaded
to 180Solutions' secure servers. We use these logs for market research
purposes and to provide you with offers and content specifically targeted
to your interests and habits. 180Solutions stores these logs on our
servers, for our use. While complete URLs are collected by the software
and uploaded to our servers, any personally identifiable information in
those URLs is stripped away before storage in our database. We may
aggregate information from these surfing logs and share the data with
third parties. However, this aggregate data will never identify you
individually. 180Solutions' n-CASE product also puts a "cookie" on your
machine so that our technology can recognize you and display appropriate
advertisements.

Third Party Collection
We may use other third-party services to assist us in providing
advertisements to you. These services may place cookies on your hard drive
and use the cookies to tailor advertisements to you by profiling your use
of a site or advertisements that you select. We do not supply and do not
allow these services to directly collect any personally identifying
information; however, the services may collect information such as your IP
address, your browser type and the date and time that advertisements were
served to you.
You should refer to the web sites of the services we use, which may
include, but are not limited to: http://www.pro-market.net,
http://www.doubleclick.com, http://www.fastclick.com and http://www.cj.com
to learn how they collect and use information.

Additional Information Disclosures
We reserve the right to disclose information we have collected from you if
required to do so by law, or in the good faith belief that such action is
reasonably necessary to comply with legal process, respond to claims, or
to protect the rights, property or safety of our company, our employees,
customers, or the public. In addition, any information that we collect or
compile may be provided to a third party in conjunction with the sale of
our company or a portion of our assets to a third party.

Linking to Other Sites/Advertisers
A link from the 180Solutions web site or an n-CASE advertisement does not
imply our endorsement of that site, advertiser or product. We do not
control the sites to which we link and assume no responsibility for their
content or privacy policies. Therefore, you should carefully review the
privacy policies that apply to any sites you access from our site or any
advertisers you respond to.

Child Protection Policy
You must be at least 13 years of age to use 180Solutions' n-CASE software.
180Solutions does not intend to accept or store any personal information
from children under the age of 13.

Opt-in/Opt-out Communications
In some versions of the n-CASE software, you may be able to disable the
display of advertising. Be aware that certain distributors require the
n-CASE software to have ad display enabled in order for their software to
function properly. For the most current information on disabling n-CASE
advertisements, please visit
http://www.180solutions.com/n-CASE/consumers/Remove.asp.


Cancellation
If at any point you wish to remove the n-CASE software from your computer,
you may do so. Be aware that certain distributors require the n-CASE
software to be present and active on your system in order for their
software to function properly. For the most current information on
removing n-CASE, please visit
http://www.180solutions.com/n-CASE/consumers/Remove.asp. Once you have
removed n-CASE from your system, we will no longer collect information
from you. However, non-personally identifiable information we have
collected may be saved in our archives.

[Exxtreme]

Hmmm, lad dir mal Ad-Aware runter und scanne dein System damit.

[Hacki_P3D]

und vor allem => benutz einen ANDEREN Browser!

ich empfehle Mozilla..

[T_Dino]

...ach ja das habe ich auch noch in der einen Datei gefunden:

REGEDIT4


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D5B72AED-E54A-11D6-B1B2-444553540000}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.whazit.com"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.whazit.com"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://www.whazit.com"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Bar"="http://www.whazit.com"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer]
"SearchURL"="http://www.whazit.com"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]
"CustomizeSearch"="http://www.whazit.com"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://www.whazit.com"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://www.whazit.com"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Search Bar"="http://www.whazit.com"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer]
"SearchURL"="http://www.whazit.com"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]
"CustomizeSearch"="www.whazit.com"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://www.whazit.com"

......... habe aber alle diese Einträge wieder in www.google.de geändert !!

[Exxtreme]

Nochmal, benutze Ad-Aware.

[T_Dino]

...danke für die schnelle Antwort ..
hast Du eventuell einen Tip welche Software da besoders gut ist?

[Exxtreme]

Originally posted by T_Dino
...danke für die schnelle Antwort ..
hast Du eventuell einen Tip welche Software da besoders gut ist?
Die Software heisst Ad-Aware. :)

Gibt's hier kostenlos zum DL:
http://www.lavasoftusa.com/

[Denniss]

Spybot wäre besser - hat bei mir und anderen Rechnern nach Ad-Aware6-Scan (mit aktuellen Signaturen) noch eine Menge gefunden

http://security.kolla.de/