| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Komischer Pop Up Virus?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
05.01.2019, 19:12
| #3 |
 |  Komischer Pop Up Virus? Was ich damit meinte war: Problem besteht weiterhin. Muss ich davon ausgehen, dass es ein Virus ist? Mittlerweile habe ich das Problem glaub ich bisschen in den Griff bekommen. Die Pop-Ups scheinen weg zu sein, ich habe das Windows Benachrichtigungscenter überprüft und paar Sachen deaktiviert, seitdem keine neuen Anzeigen mehr bekommen. Trotzdem bin ich mir nicht sicher, woher das überhaupt kam und ob es das jetzt war. Kann ich beruhigt sein, da ich ja auch schon Spybot und Adwcleaner laufen hab lassen. Adwcleaner hat auch ein Logfile erstellt, stimmt, ich kenne mich aber so 0 mit sowas aus, dass mir das gar nix sagt und ich wusste nicht, wo und wann ich das Logfile posten soll.
__________________Hier die logs: Scan: Code:
ATTFilter # -------------------------------
# Malwarebytes AdwCleaner 7.2.6.0
# -------------------------------
# Build: 12-18-2018
# Database: 2019-01-02.1 (Cloud)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Scan
# -------------------------------
# Start: 01-05-2019
# Duration: 00:01:00
# OS: Windows 10 Pro
# Scanned: 32243
# Detected: 47
***** [ Services ] *****
No malicious services found.
***** [ Folders ] *****
PUP.Optional.FoxTab C:\Program Files (x86)\FoxTab
PUP.Optional.FoxTab C:\Users\User\AppData\Roaming\FoxTab
PUP.Optional.Legacy C:\Users\User\AppData\Roaming\dvdvideosoftiehelpers
***** [ Files ] *****
PUP.Optional.DriverWhiz C:\Users\User\Downloads\Driverwhiz.exe
PUP.Optional.Legacy C:\END
PUP.Optional.Reimage C:\Windows\Reimage.ini
***** [ DLL ] *****
No malicious DLLs found.
***** [ WMI ] *****
No malicious WMI found.
***** [ Shortcuts ] *****
No malicious shortcuts found.
***** [ Tasks ] *****
PUP.Optional.FoxTab C:\Windows\Tasks\FoxTab.job
PUP.Optional.FoxTab C:\Windows\System32\Tasks\FoxTab
***** [ Registry ] *****
PUP.CrossRider.Heuristic HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{75ce0034-cbde-41dd-a27d-bb7989021866}
PUP.CrossRider.Heuristic HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{75ce0034-cbde-41dd-a27d-bb7989021866}
PUP.Optional.FoxTab HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3BFC4082-B0EE-4BDA-85BF-B9365845A14A}
PUP.Optional.FoxTab HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3BFC4082-B0EE-4BDA-85BF-B9365845A14A}
PUP.Optional.FoxTab HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\FoxTab
PUP.Optional.Legacy HKCU\Software\Microsoft\Windows\CurrentVersion\Run|Web Companion
PUP.Optional.Legacy HKLM\Software\Wow6432Node\Classes\CLSID\{E2B98EEA-EE55-4E9B-A8C1-6E5288DF785A}
PUP.Optional.Legacy HKLM\Software\Wow6432Node\Classes\CLSID\{61F47056-E400-43D3-AF1E-AB7DFFD4C4AD}
PUP.Optional.Legacy HKLM\Software\Wow6432Node\Classes\CLSID\{3CCC052E-BDEE-408A-BEA7-90914EF2964B}
PUP.Optional.Legacy HKLM\Software\Wow6432Node\Classes\AppID\{28FF42B8-A0DA-4BE5-9B81-E26DD59B350A}
PUP.Optional.Legacy HKLM\Software\Classes\AppID\{28FF42B8-A0DA-4BE5-9B81-E26DD59B350A}
PUP.Optional.Legacy HKLM\Software\Wow6432Node\Classes\TypeLib\{FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36}
PUP.Optional.Legacy HKLM\Software\Classes\TypeLib\{FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36}
PUP.Optional.Legacy HKLM\Software\Wow6432Node\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}
PUP.Optional.Legacy HKLM\Software\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}
PUP.Optional.Legacy HKLM\Software\Wow6432Node\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}
PUP.Optional.Legacy HKLM\Software\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}
PUP.Optional.Legacy HKLM\Software\Classes\CLSID\{801B440B-1EE3-49B0-B05D-2AB076D4E8CB}
PUP.Optional.Legacy HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10ECCE17-29B5-4880-A8F5-EAD298611484}
PUP.Optional.Legacy HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules|{30BFCBA5-7763-43E1-9542-8CA19CAABF11}
PUP.Optional.Legacy HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules|{555355FD-C60F-431A-9B25-D9353633BBB6}
PUP.Optional.Legacy HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
PUP.Optional.Legacy HKCU\Software\Microsoft\Internet Explorer\Main|Start Page
PUP.Optional.Legacy HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\search.avira.com
PUP.Optional.Legacy HKCU\Software\Microsoft\Internet Explorer\Main|Default_Page_URL
PUP.Optional.Legacy HKCU\Software\Microsoft\Internet Explorer\Main|Default_Search_URL
PUP.Optional.Legacy HKCU\Software\Microsoft\Internet Explorer\Main|Search Page
PUP.Optional.Legacy HKLM\Software\Microsoft\Internet Explorer\Main|Start Page
PUP.Optional.Legacy HKLM\Software\Microsoft\Internet Explorer\Main|Search Page
PUP.Optional.Legacy HKLM\Software\Microsoft\Internet Explorer\Main|Default_Search_URL
PUP.Optional.Legacy HKLM\Software\Microsoft\Internet Explorer\Main|Default_Page_URL
PUP.Optional.SlimCleanerPlus HKCU\Software\Microsoft\Internet Explorer\DOMStorage\cdn.castplatform.com
PUP.Optional.SlimCleanerPlus HKCU\Software\Microsoft\Internet Explorer\DOMStorage\castplatform.com
PUP.Optional.SofTonicAssistant HKCU\Software\Softonic
PUP.Optional.WebCompanion HKCU\Software\Lavasoft\Web Companion
PUP.Optional.WebCompanion HKLM\Software\Wow6432Node\Lavasoft\Web Companion
PUP.Optional.WebCompanion HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\webcompanion.com
***** [ Chromium (and derivatives) ] *****
PUP.Optional.Legacy bopakagnckmlgajfccecajhnimjiiedh
***** [ Chromium URLs ] *****
No malicious Chromium URLs found.
***** [ Firefox (and derivatives) ] *****
No malicious Firefox entries found.
***** [ Firefox URLs ] *****
PUP.Conduit.Heuristic hxxp://www.bing.com/?pc=COSP&ptag=D010419-N0600A9FCDBB39EF&form=CONMHP&conlogo=CT3335799
########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S00].txt ##########
Code:
ATTFilter # -------------------------------
# Malwarebytes AdwCleaner 7.2.6.0
# -------------------------------
# Build: 12-18-2018
# Database: 2019-01-02.1 (Cloud)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start: 01-05-2019
# Duration: 00:00:06
# OS: Windows 10 Pro
# Cleaned: 47
# Failed: 0
***** [ Services ] *****
No malicious services cleaned.
***** [ Folders ] *****
Deleted C:\Program Files (x86)\FoxTab
Deleted C:\Users\User\AppData\Roaming\FoxTab
Deleted C:\Users\User\AppData\Roaming\dvdvideosoftiehelpers
***** [ Files ] *****
Deleted C:\Users\User\Downloads\Driverwhiz.exe
Deleted C:\END
Deleted C:\Windows\Reimage.ini
***** [ DLL ] *****
No malicious DLLs cleaned.
***** [ WMI ] *****
No malicious WMI cleaned.
***** [ Shortcuts ] *****
No malicious shortcuts cleaned.
***** [ Tasks ] *****
Deleted C:\Windows\Tasks\FoxTab.job
Deleted C:\Windows\System32\Tasks\FoxTab
***** [ Registry ] *****
Deleted HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{75ce0034-cbde-41dd-a27d-bb7989021866}
Deleted HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{75ce0034-cbde-41dd-a27d-bb7989021866}
Deleted HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3BFC4082-B0EE-4BDA-85BF-B9365845A14A}
Deleted HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3BFC4082-B0EE-4BDA-85BF-B9365845A14A}
Deleted HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\FoxTab
Deleted HKCU\Software\Microsoft\Windows\CurrentVersion\Run|Web Companion
Deleted HKLM\Software\Wow6432Node\Classes\CLSID\{E2B98EEA-EE55-4E9B-A8C1-6E5288DF785A}
Deleted HKLM\Software\Wow6432Node\Classes\CLSID\{61F47056-E400-43D3-AF1E-AB7DFFD4C4AD}
Deleted HKLM\Software\Wow6432Node\Classes\CLSID\{3CCC052E-BDEE-408A-BEA7-90914EF2964B}
Deleted HKLM\Software\Wow6432Node\Classes\AppID\{28FF42B8-A0DA-4BE5-9B81-E26DD59B350A}
Deleted HKLM\Software\Classes\AppID\{28FF42B8-A0DA-4BE5-9B81-E26DD59B350A}
Deleted HKLM\Software\Wow6432Node\Classes\TypeLib\{FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36}
Deleted HKLM\Software\Classes\TypeLib\{FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36}
Deleted HKLM\Software\Wow6432Node\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}
Deleted HKLM\Software\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}
Deleted HKLM\Software\Wow6432Node\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}
Deleted HKLM\Software\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}
Deleted HKLM\Software\Classes\CLSID\{801B440B-1EE3-49B0-B05D-2AB076D4E8CB}
Deleted HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10ECCE17-29B5-4880-A8F5-EAD298611484}
Deleted HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules|{30BFCBA5-7763-43E1-9542-8CA19CAABF11}
Deleted HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules|{555355FD-C60F-431A-9B25-D9353633BBB6}
Deleted HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Deleted HKCU\Software\Microsoft\Internet Explorer\Main|Start Page
Deleted HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\search.avira.com
Deleted HKCU\Software\Microsoft\Internet Explorer\Main|Default_Page_URL
Deleted HKCU\Software\Microsoft\Internet Explorer\Main|Default_Search_URL
Deleted HKCU\Software\Microsoft\Internet Explorer\Main|Search Page
Deleted HKLM\Software\Microsoft\Internet Explorer\Main|Start Page
Deleted HKLM\Software\Microsoft\Internet Explorer\Main|Search Page
Deleted HKLM\Software\Microsoft\Internet Explorer\Main|Default_Search_URL
Deleted HKLM\Software\Microsoft\Internet Explorer\Main|Default_Page_URL
Deleted HKCU\Software\Microsoft\Internet Explorer\DOMStorage\cdn.castplatform.com
Deleted HKCU\Software\Microsoft\Internet Explorer\DOMStorage\castplatform.com
Deleted HKCU\Software\Softonic
Deleted HKCU\Software\Lavasoft\Web Companion
Deleted HKLM\Software\Wow6432Node\Lavasoft\Web Companion
Deleted HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\webcompanion.com
***** [ Chromium (and derivatives) ] *****
Deleted bopakagnckmlgajfccecajhnimjiiedh
***** [ Chromium URLs ] *****
No malicious Chromium URLs cleaned.
***** [ Firefox (and derivatives) ] *****
No malicious Firefox entries cleaned.
***** [ Firefox URLs ] *****
Deleted hxxp://www.bing.com/?pc=COSP&ptag=D010419-N0600A9FCDBB39EF&form=CONMHP&conlogo=CT3335799
*************************
[+] Delete Tracing Keys
[+] Reset Winsock
*************************
AdwCleaner[S00].txt - [5871 octets] - [05/01/2019 10:37:28]
########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C00].txt ##########
Geändert von cosinus (05.01.2019 um 22:06 Uhr) Grund: code tags |
| Themen zu Komischer Pop Up Virus? |
| anhang, ausgeführt, bereinigt, bildschirm, bleibe, gestern, google, hilfe!, klick, klickt, komische, komischer, malwarebytes, neues, nichts, pop up, pop ups, screenshot, spybot, suche, tool, ups, virus, virus?, windows |
Baum-Darstellung