Spywarebefall

 Malwarebytes Anti-Malware  (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.12.06.03

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Riehmer :: RIEHMER-PC [Administrator]

Schutz: Deaktiviert

06.12.2013 10:01:48
mbam-log-2013-12-06 (10-01-48).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 211509
Laufzeit: 9 Minute(n), 46 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         

Zoek.exe Version 4.0.0.5 Updated 05-December-2013
Tool run by Riehmer on 06.12.2013 at 10:24:11,17.
Microsoft® Windows Vista™ Home Premium  6.0.6002 Service Pack 2 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Riehmer\Downloads\zoek\zoek.com  [Script inserted] 

==== System Restore Info ======================

06.12.2013 10:25:22 Zoek.exe System Restore Point Created Succesfully.

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-1415058074-704485446-1059558982-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{C55BBCD6-41AD-48AD-9953-3609C48EACC7} deleted successfully

==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\Riehmer\AppData\Roaming\Mozilla\Firefox\Profiles\a3m6s5vt.default\prefs.js:
user_pref("browser.search.useDBForOrder", true);

Added to C:\Users\Riehmer\AppData\Roaming\Mozilla\Firefox\Profiles\a3m6s5vt.default\prefs.js:
user_pref("browser.startup.homepage", "hxxp://www.google.com");
user_pref("browser.search.defaulturl", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "hxxp://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

ProfilePath: C:\Users\Riehmer\AppData\Roaming\Mozilla\Firefox\Profiles\a3m6s5vt.default

user.js not found
---- FireFox user.js and prefs.js backups ---- 

prefs__1038_.backup

==== Deleting Files \ Folders ======================

C:\Program Files\FoxTabPDFConverter deleted
C:\found.000 deleted
C:\Users\Riehmer\AppData\Roaming\Uniblue deleted
C:\Users\Riehmer\Downloads\FreeYouTubeToMP3Converter (1).exe deleted
C:\Users\Riehmer\Downloads\FreeYouTubeToMP3Converter (2).exe deleted
C:\Users\Riehmer\Downloads\FreeYouTubetoMP3Converter (3).exe deleted
C:\Users\Riehmer\Downloads\FreeYouTubetoMP3Converter.exe deleted
C:\Windows\system32\config\systemprofile\AppData\LocalLow\AVG Secure Search deleted
C:\Windows\wininit.ini deleted
C:\Users\Riehmer\AppData\Roaming\Mozilla\Firefox\Profiles\a3m6s5vt.default\extensions\engine@conduit.com deleted
C:\Users\Riehmer\AppData\Roaming\Mozilla\Firefox\Profiles\a3m6s5vt.default\extensions\toolbar@ask.com deleted
C:\Users\Riehmer\AppData\Roaming\Mozilla\Firefox\Profiles\a3m6s5vt.default\extensions\{33e0daa6-3af3-d8b5-6752-10e949c61516} deleted
C:\Users\Riehmer\AppData\Roaming\Mozilla\Firefox\Profiles\a3m6s5vt.default\extensions\{1FD91A9C-410C-4090-BBCC-55D3450EF433} deleted
"C:\Users\Riehmer\AppData\Roaming\GHISLER\default.bar" deleted
"C:\Users\Riehmer\AppData\Roaming\GHISLER\default.br2" deleted
"C:\Users\Riehmer\AppData\Roaming\GHISLER" deleted
"C:\Users\Riehmer\AppData\Roaming\GrabPro" deleted

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"{20a82645-c095-46ed-80e3-08825760534b}"="c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension" [17.07.2009 14:16]

==== Firefox Extensions ======================

ProfilePath: C:\Users\Riehmer\AppData\Roaming\Mozilla\Firefox\Profiles\a3m6s5vt.default
- Microsoft .NET Framework Assistant - %ProfilePath%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
- Undetermined - %ProfilePath%\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
- Undetermined - %ProfilePath%\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
- Undetermined - %ProfilePath%\extensions\{af6ac4f2-9825-4fb6-a600-92bc5361f209}
- Undetermined - %ProfilePath%\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}
- Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
- Undetermined - %ProfilePath%\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}

AppDir: C:\Program Files\Mozilla Firefox
- Default - %AppDir%\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\Riehmer\AppData\Roaming\Mozilla\Firefox\Profiles\a3m6s5vt.default
CFAF7B67C78D09D79688AEDCA3D090E2	- C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll -	Google Update
358878E398AB0FB8B1EE176C2E3EDF48	- C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll -	Google Updater
AB87EEFFD18F2BAAFC274E7075EA6C67	- c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll -	Windows Presentation Foundation / Windows Presentation Foundation
7550FC1ADE982582D5920BEA6430E3D4	- C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll -	Google Earth Plugin
4BF70B35B943BD73BD6E13EB7C1BA4B3	- C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll -	Shockwave Flash
3E167740C661271B960C47812FFF9639	- C:\Program Files\Mozilla Firefox\plugins\npnul32.dll -	Mozilla Default Plug-in
AE84791D996D1F05A2446B0C447D937A	- C:\Program Files\Adobe\Reader 9.0\Reader\browser\nppdf32.dll -	Adobe Acrobat
AE84791D996D1F05A2446B0C447D937A	- C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll -	Adobe Acrobat


==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
fnjbmmemklcjgepojigaapkoodmkgbae - C:\Program Files\DivX\DivX Plus Web Player\google_chrome\wpa\wpa.crx[]
nneajnkjbffgblleaoojgaacokifdkhm - C:\Program Files\DivX\DivX Plus Web Player\google_chrome\html5video\html5video.crx[]

HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions
nikpibnbobmbdbheedjfogjlikpgpnhp - C:\Users\Riehmer\AppData\Roaming\DVDVideoSoft\dvsYoutubeDownload.crx[]


==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://www.homburg.de/content/pages/home.htm"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&s=2&o=vp32&d=0109&m=easynote_ml65"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://www.homburg.de/content/pages/home.htm"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing  Url="hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google  Url="hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"
{7001AD53-F5C5-4239-9B99-7F1F57A0D82D} Google  Url="hxxp://www.google.de/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGLL_de"

==== Reset Google Chrome ======================

C:\Users\Riehmer\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Riehmer\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\fnjbmmemklcjgepojigaapkoodmkgbae deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\nneajnkjbffgblleaoojgaacokifdkhm deleted successfully
HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp deleted successfully

==== Empty IE Cache ======================

C:\Users\Riehmer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Riehmer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

==== Empty FireFox Cache ======================

C:\Users\Riehmer\AppData\Local\Mozilla\Firefox\Profiles\a3m6s5vt.default\Cache emptied successfully

==== Empty Chrome Cache ======================

C:\Users\Riehmer\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

No Java Cache Found

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\Public\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Users\Riehmer\AppData\Local\Temp  will be emptied at reboot
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\Riehmer\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Users\Riehmer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not found

==== EOF on 06.12.2013 at 10:48:31,07 ======================