Probleme mit Adware in der Registry BoBrowser Crossbrowser und YTdownloader

Sahara83

Hallo an alle , ich hoffe ihr könnt mitr helfen .. ich habe mir durch einen Download die Adware Crossbrowser Bobrowser und YTdownloader angelacht. Ich habe bereits mit Systemlook gesucht und wurde fündig aber da ich mich nicht so gut auskenne mit Reg etc wollte ich mal fragen ob ihr mir helfen könnt ... hier die Daten

SystemLook 30.07.11 by jpshortstuff
Log created at 09:03 on 07/10/2015 by Barney
Administrator - Elevation successful

========== regfind ==========

Searching for "BoBrowser"
[HKEY_CURRENT_USER\Software\Classes\BoBrowsHTML.TEE7EFJAALBCY7DXIFOKNYHGZM]
@="BoBrowser HTML Document"
[HKEY_CURRENT_USER\Software\Classes\BoBrowsHTML.TEE7EFJAALBCY7DXIFOKNYHGZM\DefaultIcon]
@="C:\Users\Barney\AppData\Local\BoBrowser\Application\bobrowser.exe,0"
[HKEY_CURRENT_USER\Software\Classes\BoBrowsHTML.TEE7EFJAALBCY7DXIFOKNYHGZM\shell\open\command]
@=""C:\Users\Barney\AppData\Local\BoBrowser\Application\bobrowser.exe" "%1""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BoBrowsHTML.TEE7EFJAALBCY7DXIFOKNYHGZM]
@="BoBrowser HTML Document"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BoBrowsHTML.TEE7EFJAALBCY7DXIFOKNYHGZM\DefaultIcon]
@="C:\Users\Barney\AppData\Local\BoBrowser\Application\bobrowser.exe,0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BoBrowsHTML.TEE7EFJAALBCY7DXIFOKNYHGZM\shell\open\command]
@=""C:\Users\Barney\AppData\Local\BoBrowser\Application\bobrowser.exe" "%1""
[HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications]
"BoBrowser.TEE7EFJAALBCY7DXIFOKNYHGZM"="Software\Clients\StartMenuInternet\BoBrowser.TEE7EFJAALBCY7DXIFOKNYHGZM\Capabilities"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{B5CB9CED-E70F-4022-AA36-EFBC0EB568D2}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|LPort=5353|App=C:\Users\Barney\AppData\Local\BoBrowser\Application\bobrowser.exe|Nam e=Chromium (mDNS-In)|Desc=Eingangsregel für die Zulassung von mDNS-Verkehr in Chromium|EmbedCtxt=BoBrowser|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{B5CB9CED-E70F-4022-AA36-EFBC0EB568D2}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|LPort=5353|App=C:\Users\Barney\AppData\Local\BoBrowser\Application\bobrowser.exe|Nam e=Chromium (mDNS-In)|Desc=Eingangsregel für die Zulassung von mDNS-Verkehr in Chromium|EmbedCtxt=BoBrowser|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{B5CB9CED-E70F-4022-AA36-EFBC0EB568D2}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|LPort=5353|App=C:\Users\Barney\AppData\Local\BoBrowser\Application\bobrowser.exe|Nam e=Chromium (mDNS-In)|Desc=Eingangsregel für die Zulassung von mDNS-Verkehr in Chromium|EmbedCtxt=BoBrowser|"
[HKEY_USERS\S-1-5-21-969184727-1135292377-1946218581-1000\Software\Classes\BoBrowsHTML.TEE7EFJAALBCY7DXIFOKNYHGZM]
@="BoBrowser HTML Document"
[HKEY_USERS\S-1-5-21-969184727-1135292377-1946218581-1000\Software\Classes\BoBrowsHTML.TEE7EFJAALBCY7DXIFOKNYHGZM\DefaultIcon]
@="C:\Users\Barney\AppData\Local\BoBrowser\Application\bobrowser.exe,0"
[HKEY_USERS\S-1-5-21-969184727-1135292377-1946218581-1000\Software\Classes\BoBrowsHTML.TEE7EFJAALBCY7DXIFOKNYHGZM\shell\open\command]
@=""C:\Users\Barney\AppData\Local\BoBrowser\Application\bobrowser.exe" "%1""
[HKEY_USERS\S-1-5-21-969184727-1135292377-1946218581-1000_Classes\BoBrowsHTML.TEE7EFJAALBCY7DXIFOKNYHGZM]
@="BoBrowser HTML Document"
[HKEY_USERS\S-1-5-21-969184727-1135292377-1946218581-1000_Classes\BoBrowsHTML.TEE7EFJAALBCY7DXIFOKNYHGZM\DefaultIcon]
@="C:\Users\Barney\AppData\Local\BoBrowser\Application\bobrowser.exe,0"
[HKEY_USERS\S-1-5-21-969184727-1135292377-1946218581-1000_Classes\BoBrowsHTML.TEE7EFJAALBCY7DXIFOKNYHGZM\shell\open\command]
@=""C:\Users\Barney\AppData\Local\BoBrowser\Application\bobrowser.exe" "%1""

-= EOF =-


SystemLook 30.07.11 by jpshortstuff
Log created at 09:17 on 07/10/2015 by Barney
Administrator - Elevation successful

========== regfind ==========

Searching for "ytd"
[HKEY_CURRENT_USER\Software\GreenTree Applications\YTD]
[HKEY_CURRENT_USER\Software\GreenTree Applications\YTD]
@="C:\Program Files\GreenTree Applications\YTD Video Downloader"
[HKEY_CURRENT_USER\Software\GreenTree Applications\YTD]
"kitType"="ytd"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\53c930d3_0]
@="{0.0.0.00000000}.{575d2ed6-63bb-4731-925b-7840d1f499b7}|\Device\HarddiskVolume2\Program Files\GreenTree Applications\YTD Video Downloader\ytd.exe%b{00000000-0000-0000-0000-000000000000}"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList]
"a"="ytd.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF74FB2A-DBB2-4c8d-9C8E-0424AB05C810}]
@="DolbyTDAS Class (Analog)"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109030000000000000000F01FEC\Features]
"XDocsProgrammabilityFiles"="n{[L@L2e,A5i3&)ESZxz)dUKG'6CN@iiRcpgqH$M}JDvt$pSB@[ZuuxDasG3Ez[4SEbw*9f[rHC9kHs,S0]m[+VP5=uv73u]=Uuby!(uzex5V?GuA.(+l=q[u7=n[(cLJ9fET%XWdQn1H~%6tpZ{g8sYTKg=pQi.1H$Gk1N^j@YVvaEM_)]Y]zhzcv9k[@wxRZWt7Z)c9[^c+rNjU@M!k-hYR?b8Km66DOnK{8dwU&V'?yhhzl}ESEBx'9dcw,_Y$BndNgX5ue{%o@)hYAu!O'&ZQIH3%k&aBA]Fm^,zZPEg7R_.Hmf+C9$(VhNTI.s2O$`wl%bx}=l.Opyvlb2xAH3pyed`1@JJL&JIsO!x`=2YWAwLy=_`B}xS2c)6hb(ht)z)l9$XJqD8KM5jD8yAN$pxi9~8p6A201@lPTT@5KGZ5@kt=g&apg^!c bzd&&[7c?[z%gk_?K9zMu)]r7g?dA&6tFs6W4Y2,-G)OHs[r@x(V2GxM(x)+=C3HWaCL9Z8x{iuAwx9HaN,Y9a8`?lRdk,H2N*E$pAAQdC*A=9`Pg-i21H$Vs[Jzv6TO?O9bi2F%eonINx6FxUK=Ac]v3,%{eWZ*4P}wkQ`9A*B@Q2ytdozxy@Q)l(7$Ad4qvS=A.ME&38i_{Y*1Af%M'?m`W[DBxn*o`('L=2SnOFnpLBn`)[VR9E'h@yZh67s7`YC~L]q[zIV?@)Axv%WP)m$6OIBc~FlE@fk&$tDEq^cn!l11k4SD?kkw(Daw''.0s9m4d?]XA9*brRMP-nPu2-7+Cuw^8Yy&4onS[-Z=E%=HlB)B?F9h~59hBra_1h'Es-Qc?DK7eUSj$jJffM~dKKdk@~Q
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA71301B744CAF070E41400\Features]
"ReaderProgramFiles"="._FU*(*_2@0slVZ*5.z_UEGQHxYJi=YP2un8M9'?bmATmLaTs@95d6UnKJrTy*Jw,EXK@=SefnUt'--t**.)=iNr$9nx@`*Rqv1.gt,sjnwl{?Yut6qK}wQohJ^OXo9109XsPvqp}ObZOYp?+pNaL@z*.K,$TcBSlZj%Uh[W%9_ti)VmJ@I+j-_rQuc3P=s&VZwQO}.II]Sx?d%JV=tCY=!Qpy]2r*NNsSI]s9u&W[h.n+@?YJzJ+gSH5(N32&(jF{)!50bJl4chS@.CFU=z7XY9u+bKa)B~TAV?e@vJ4`k3b=194Dy`K@s.h4d@le2hC?OaVN&E}8!+o8IP}@y^j-wi?_mHq8_e1em8Cq`keL%]f[e}$A.Kaf4j[.(XPq]8nhe+UAj_=GVT=BFjJdnnNi-d?AjlR&UdQ%RRe{aW%9OVS9Gz'S8K0u&SH5s^n,Q~@@GK8CTMTal(PuMUX~Y..@&58ZK=A0tddfQUdX^g[=,sqBg]B*AkzI4x7!*32AK4F2bqgNGv}]^Qd-LQA?7wisgeG}LxOtDZJ[~}M@NcXfj)?Ppy-X?LDM71+@qP?h+'SxpL^mo_Yse3v8*tl(iR}wi_TYeb('5YXAX.0V@!2u.s_QYe0sBt??CX%pr$P[^p(,KZgi{qb?{@xnq_5XX`RGRqGqgM?94tmlZG+HHsS3.sicYZR=CRPJKY`)bZU5R!(]a@U@Dt]yjX[E!Iy2j~cq_5-=Ydky!9G8}Tbfc2Q[$K^?4u?3%1C&QKf2xvD5k&V=21*ndh=Oe*Y'LBbd5V=@%w'R4OZPBYTSp[-gRtTA==]p?,NP9=5tJ'$D!Us@Xw[TT^^VCYn=B1Z`VZ%@3r?8ZtrD7
[HKEY_USERS\S-1-5-21-969184727-1135292377-1946218581-1000\Software\GreenTree Applications\YTD]
[HKEY_USERS\S-1-5-21-969184727-1135292377-1946218581-1000\Software\GreenTree Applications\YTD]
@="C:\Program Files\GreenTree Applications\YTD Video Downloader"
[HKEY_USERS\S-1-5-21-969184727-1135292377-1946218581-1000\Software\GreenTree Applications\YTD]
"kitType"="ytd"
[HKEY_USERS\S-1-5-21-969184727-1135292377-1946218581-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\53c930d3_0]
@="{0.0.0.00000000}.{575d2ed6-63bb-4731-925b-7840d1f499b7}|\Device\HarddiskVolume2\Program Files\GreenTree Applications\YTD Video Downloader\ytd.exe%b{00000000-0000-0000-0000-000000000000}"
[HKEY_USERS\S-1-5-21-969184727-1135292377-1946218581-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList]
"a"="ytd.exe"

-= EOF =-

SystemLook 30.07.11 by jpshortstuff
Log created at 09:20 on 07/10/2015 by Barney
Administrator - Elevation successful

========== regfind ==========

Searching for "crsbrwshtml"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.htm]
@="CRSBRWSHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.html]
@="CRSBRWSHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.shtml]
@="CRSBRWSHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.xht]
@="CRSBRWSHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.xhtml]
@="CRSBRWSHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.xhtml\OpenWithProgIds]
"CRSBRWSHTML"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\CRSBRWSHTML]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared\HTML]
"KnownIDs"="htmlfile;CRSBRWSHTML"

-= EOF =-


Ich hoffe ihr könnt mir helfen bin ziemlich verzweifelt da Bobrowser mittlerweile hunderte Bilder und html dokumente infiziert hat und er sich sogar auf die Spiele Dvds übertragen hat.

gruss