Windows 7 - Trojaner ADH 2 Logs im Thread

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 10.09.2014
Suchlauf-Zeit: 09:09:55
Logdatei: MBAM Log.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.09.10.03
Rootkit Datenbank: v2014.08.21.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Der Onkel

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 402875
Verstrichene Zeit: 12 Min, 31 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 6
PUP.Optional.Snapdo.T, HKU\S-1-5-21-1044421510-1673703811-609366506-1005-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006ee092-9658-4fd6-bd8e-a21a348e59f5}, In Quarantäne, [916ae704a6d54ee89611318be81aa45c], 
PUP.Optional.SunriseBrowse.A, HKLM\SOFTWARE\WOW6432NODE\SunriseBrowse, In Quarantäne, [3ac146a5aecd5cda715a8a723bc752ae], 
PUP.Optional.SunriseBrowse.A, HKU\S-1-5-21-1044421510-1673703811-609366506-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SunriseBrowse, In Quarantäne, [c635c7247ffc44f2319b14e8e81a8b75], 
PUP.Optional.FastStart.A, HKU\S-1-5-21-1044421510-1673703811-609366506-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS, In Quarantäne, [8f6c25c6ea91d85e6837807881819f61], 
PUP.Optional.SunriseBrowse.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{b110ca24-17f3-4555-b0d2-672ab034adf9}, In Quarantäne, [08f36d7e83f83501b237619b28dc0bf5], 
PUP.Optional.SunriseBrowse.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{B110CA24-17F3-4555-B0D2-672AB034ADF9}, In Quarantäne, [08f36d7e83f83501b237619b28dc0bf5], 

Registrierungswerte: 1
PUP.Optional.FastStart.A, HKU\S-1-5-21-1044421510-1673703811-609366506-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS|appid, faststartff@gmail.com, In Quarantäne, [8f6c25c6ea91d85e6837807881819f61]

Registrierungsdaten: 6
PUP.Optional.Snapdo, HKU\S-1-5-21-1044421510-1673703811-609366506-1005-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=3c63e300-4847-c39e-2440-0447d1c37dbe&searchtype=hp&installDate=25/08/2013, Gut: (www.google.com), Schlecht: (hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=3c63e300-4847-c39e-2440-0447d1c37dbe&searchtype=hp&installDate=25/08/2013),Ersetzt,[b942fdeed2a94aecbe4aa94dcb3949b7]
PUP.Optional.Snapdo, HKU\S-1-5-21-1044421510-1673703811-609366506-1005-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Bar, hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=3c63e300-4847-c39e-2440-0447d1c37dbe&searchtype=ds&q={searchTerms}&installDate=25/08/2013, Gut: (www.google.com), Schlecht: (hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=3c63e300-4847-c39e-2440-0447d1c37dbe&searchtype=ds&q={searchTerms}&installDate=25/08/2013),Ersetzt,[47b437b41e5d51e56e98a155c04428d8]
PUP.Optional.Snapdo, HKU\S-1-5-21-1044421510-1673703811-609366506-1005-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=3c63e300-4847-c39e-2440-0447d1c37dbe&searchtype=ds&q={searchTerms}&installDate=25/08/2013, Gut: (www.google.com), Schlecht: (hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=3c63e300-4847-c39e-2440-0447d1c37dbe&searchtype=ds&q={searchTerms}&installDate=25/08/2013),Ersetzt,[b4477c6fdaa12313779041b58f756799]
PUP.Optional.Snapdo, HKU\S-1-5-21-1044421510-1673703811-609366506-1005-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Default_Search_URL, hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=3c63e300-4847-c39e-2440-0447d1c37dbe&searchtype=ds&q={searchTerms}&installDate=25/08/2013, Gut: (www.google.com), Schlecht: (hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=3c63e300-4847-c39e-2440-0447d1c37dbe&searchtype=ds&q={searchTerms}&installDate=25/08/2013),Ersetzt,[6f8cedfef5869c9a56b3be38e91b4eb2]
PUP.Optional.Snapdo, HKU\S-1-5-21-1044421510-1673703811-609366506-1005-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|SearchAssistant, hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=3c63e300-4847-c39e-2440-0447d1c37dbe&searchtype=ds&q={searchTerms}&installDate=25/08/2013, Gut: (www.google.com), Schlecht: (hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=3c63e300-4847-c39e-2440-0447d1c37dbe&searchtype=ds&q={searchTerms}&installDate=25/08/2013),Ersetzt,[7c7f7e6d5823b581c24853a3c93bb848]
PUP.Optional.SnapDo.A, HKU\S-1-5-21-1044421510-1673703811-609366506-1005-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=3c63e300-4847-c39e-2440-0447d1c37dbe&searchtype=ds&q={searchTerms}&installDate=25/08/2013, Gut: (www.google.com), Schlecht: (hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=3c63e300-4847-c39e-2440-0447d1c37dbe&searchtype=ds&q={searchTerms}&installDate=25/08/2013),Ersetzt,[e71465862c4f9c9ab3ef13d93aca03fd]

Ordner: 0
(No malicious items detected)

Dateien: 0
(No malicious items detected)

Physische Sektoren: 0
(No malicious items detected)


(end)
         

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=2d8db90ed4d0e44783968f3b4b0b5898
# engine=20082
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-09-10 09:12:09
# local_time=2014-09-10 11:12:09 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Norton 360'
# compatibility_mode=3598 16777213 100 100 252368 161002825 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 35998383 161970179 0 0
# scanned=239579
# found=3
# cleaned=0
# scan_time=6106
sh=843DF0FD9F9C356D5336452FCC2B3374A2BD06DC ft=1 fh=137ef7008edb618f vn="Win32/Toolbar.Conduit.R evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Der Onkel\AppData\Roaming\OpenCandy\15468D4525DD4998BDADD9E6B405C99D\SSStub_SearchProtect_p1v0.exe.vir"
sh=C6856C32ECEF81A37AFEE5929F0AF5CBB7F4029C ft=1 fh=1edb99ab84c070e7 vn="Variante von Win32/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Der Onkel\AppData\Roaming\OpenCandy\DD9C67F773974EFD824B23A811DDC4AB\Installer.exe.vir"
sh=5E6A03871B397414C36AF1E1359FE014C7761B74 ft=1 fh=ee8c5e224a6823f5 vn="Variante von Win32/Bundled.Toolbar.Ask.A potenziell unsichere Anwendung" ac=I fn="C:\OEM\Preload\Autorun\APP\Nero 10 Essentials Packard Bell Edition\ISSetupPrerequisites\{BF80A1C0-C3FF-4B1C-ABEF-22CD4F97A0AB}\Toolbar.exe"