Malwarebytes schlägt Alarm (PUP.Optional.Spigot)

-<mbam-log>


-<header>

<date>2016/08/08 00:49:42 +0200</date>

<logfile>mbam-log-2016-08-08 (00-49-38).xml</logfile>

<isadmin>yes</isadmin>

</header>


-<engine>

<version>2.2.1.1043</version>

<malware-database>v2016.08.07.05</malware-database>

<rootkit-database>v2016.05.27.01</rootkit-database>

<license>free</license>

<file-protection>disabled</file-protection>

<web-protection>disabled</web-protection>

<self-protection>disabled</self-protection>

</engine>


-<system>

<hostname>*******</hostname>

<ip>192.168.188.25</ip>

<osversion>Windows 10</osversion>

<arch>x64</arch>

<username>********</username>

<filesys>NTFS</filesys>

</system>


-<summary>

<type>threat</type>

<result>completed</result>

<objects>355711</objects>

<time>667</time>

<processes>0</processes>

<modules>0</modules>

<keys>1</keys>

<values>1</values>

<datas>2</datas>

<folders>0</folders>

<files>1</files>

<sectors>0</sectors>

</summary>


-<options>

<memory>enabled</memory>

<startup>enabled</startup>

<filesystem>enabled</filesystem>

<archives>enabled</archives>

<rootkits>disabled</rootkits>

<deeprootkit>disabled</deeprootkit>

<heuristics>enabled</heuristics>

<pup>enabled</pup>

<pum>enabled</pum>

</options>


-<items>


-<key>

<path>HKU\S-1-5-21-705768617-613293150-1868158482-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{4AD05965-FD8C-4C8B-9EA2-FBD9136D3F4C}</path>

<vendor>PUP.Optional.Spigot</vendor>

<action>success</action>

<hash>a59c3b0debafcc6a3b2f2c8ae91aec14</hash>

</key>


-<value>

<path>HKU\S-1-5-21-705768617-613293150-1868158482-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{4AD05965-FD8C-4C8B-9EA2-FBD9136D3F4C}</path>

<valuename>URL</valuename>

<vendor>PUP.Optional.Spigot</vendor>

<action>success</action>

<valuedata>https://ch.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=435371&p={searchTerms}</valuedata>

<hash>a59c3b0debafcc6a3b2f2c8ae91aec14</hash>

</value>


-<data>

<path>HKU\S-1-5-21-705768617-613293150-1868158482-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN</path>

<valuename>Start Page</valuename>

<vendor>PUP.Optional.Spigot</vendor>

<action>replaced</action>

<valuedata>https://ch.search.yahoo.com/?type=435371&fr=spigot-yhp-ie</valuedata>

<baddata>https://ch.search.yahoo.com/?type=435371&fr=spigot-yhp-ie</baddata>

<gooddata>www.google.com</gooddata>

<hash>a9982622eab01d19bee6c4b4cc38619f</hash>

</data>


-<data>

<path>HKCR\regfile\shell\open\command</path>

<valuename/>

<vendor>Broken.OpenCommand</vendor>

<action>replaced</action>

<valuedata>"regedit.exe" "%1"</valuedata>

<baddata>"regedit.exe" "%1"</baddata>

<gooddata>regedit.exe "%1"</gooddata>

<hash>ffffffffffffffffffffffffffffffff</hash>

</data>


-<file>

<path>C:\Users\******\AppData\Roaming\Mozilla\Firefox\Profiles\zyursqe4.default\prefs.js</path>

<vendor>PUP.Optional.Spigot</vendor>

<action>replaced</action>

<baddata>user_pref("keyword.URL", "https://ch.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=435371&p=");</baddata>

<gooddata/>

<hash>4cf5f94f66344de9b6ff5a3f986cdf21</hash>

</file>

</items>

</mbam-log>