Nation-Zoom eingefangen: PC entwickelt Eigenleben

computer-sos

Hallo zusammen,

Beim Versuch, einen Video-Converter runterzuladen, habe ich mir Nation Zoom eingefangen (Win 7). Sowohl IE als auch Firefox haben dies jetzt als Startseite, die sich nicht mehr entfernen lässt, ständig kommen Hinweise, ich solle den Computer sichern. Der Antivir-Scan hat nichts gefunden, System Look sagt dieses:

SystemLook 30.07.11 by jpshortstuff
Log created at 18:16 on 23/12/2013 by expert
Administrator - Elevation successful

========== regfind ==========

Searching for "nationzoom"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="hxxp://www.nationzoom.com/?type=hp&ts=1387748220&from=adks&uid=WDCXWD5000BPVT-80HXZT3_WD-WXS1CB1F3997F3997"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"DisplayName"="nationzoom"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL"="hxxp://www.nationzoom.com/web/?type=ds&ts=1387748220&from=adks&uid=WDCXWD5000BPVT-80HXZT3_WD-WXS1CB1F3997F3997&q={searchTerms}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command]
@=""C:\Program Files (x86)\Mozilla Firefox\firefox.exe" hxxp://www.nationzoom.com/?type=sc&ts=1387748220&from=adks&uid=WDCXWD5000BPVT-80HXZT3_WD-WXS1CB1F3997F3997"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command]
@="C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.nationzoom.com/?type=sc&ts=1387748220&from=adks&uid=WDCXWD5000BPVT-80HXZT3_WD-WXS1CB1F3997F3997"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN]
"Default_Search_URL"="hxxp://www.nationzoom.com/web/?type=ds&ts=1387748220&from=adks&uid=WDCXWD5000BPVT-80HXZT3_WD-WXS1CB1F3997F3997&q={searchTerms}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN]
"Default_Page_URL"="hxxp://www.nationzoom.com/?type=hp&ts=1387748220&from=adks&uid=WDCXWD5000BPVT-80HXZT3_WD-WXS1CB1F3997F3997"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN]
"Start Page"="hxxp://www.nationzoom.com/?type=hp&ts=1387748220&from=adks&uid=WDCXWD5000BPVT-80HXZT3_WD-WXS1CB1F3997F3997"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN]
"Search Page"="hxxp://www.nationzoom.com/web/?type=ds&ts=1387748220&from=adks&uid=WDCXWD5000BPVT-80HXZT3_WD-WXS1CB1F3997F3997&q={searchTerms}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"DisplayName"="nationzoom"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL"="hxxp://www.nationzoom.com/web/?type=ds&ts=1387748220&from=adks&uid=WDCXWD5000BPVT-80HXZT3_WD-WXS1CB1F3997F3997&q={searchTerms}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Default_Search_URL"="hxxp://www.nationzoom.com/web/?type=ds&ts=1387748220&from=adks&uid=WDCXWD5000BPVT-80HXZT3_WD-WXS1CB1F3997F3997&q={searchTerms}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Default_Page_URL"="hxxp://www.nationzoom.com/?type=hp&ts=1387748220&from=adks&uid=WDCXWD5000BPVT-80HXZT3_WD-WXS1CB1F3997F3997"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Start Page"="hxxp://www.nationzoom.com/?type=hp&ts=1387748220&from=adks&uid=WDCXWD5000BPVT-80HXZT3_WD-WXS1CB1F3997F3997"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Search Page"="hxxp://www.nationzoom.com/web/?type=ds&ts=1387748220&from=adks&uid=WDCXWD5000BPVT-80HXZT3_WD-WXS1CB1F3997F3997&q={searchTerms}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"DisplayName"="nationzoom"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL"="hxxp://www.nationzoom.com/web/?type=ds&ts=1387748220&from=adks&uid=WDCXWD5000BPVT-80HXZT3_WD-WXS1CB1F3997F3997&q={searchTerms}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\nationzoomSoftware]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\nationzoomSoftware\nationzoomhp]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command]
@=""C:\Program Files (x86)\Mozilla Firefox\firefox.exe" hxxp://www.nationzoom.com/?type=sc&ts=1387748220&from=adks&uid=WDCXWD5000BPVT-80HXZT3_WD-WXS1CB1F3997F3997"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command]
@="C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.nationzoom.com/?type=sc&ts=1387748220&from=adks&uid=WDCXWD5000BPVT-80HXZT3_WD-WXS1CB1F3997F3997"
[HKEY_USERS\S-1-5-21-1318575848-33878307-2952365051-1001\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="hxxp://www.nationzoom.com/?type=hp&ts=1387748220&from=adks&uid=WDCXWD5000BPVT-80HXZT3_WD-WXS1CB1F3997F3997"
[HKEY_USERS\S-1-5-21-1318575848-33878307-2952365051-1001\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"DisplayName"="nationzoom"
[HKEY_USERS\S-1-5-21-1318575848-33878307-2952365051-1001\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL"="hxxp://www.nationzoom.com/web/?type=ds&ts=1387748220&from=adks&uid=WDCXWD5000BPVT-80HXZT3_WD-WXS1CB1F3997F3997&q={searchTerms}"

-= EOF =-

Malwarebytes habe ich auch pobiert bis zum Schritt "Entferne Auswahl", aber nichts ändert sich. Trotz Neustart ist Nation Zoom und der ständige Sicherheitshinweis immer noch da.

Ich bin ein absoluter Anfänger, habe mir den PC vom Laden einrichten lassen, bin froh, dass ich meine paar Anwendungen kann, und jetzt das .....

Hilfeeeeeee!