Prejudice | 26.06.2014 15:06 | Sweetpage und mehrere Funde von MBAM und ESET Hallöle..
Ich habe mir neulich mal den FLV-Converter runtergeladen...Seitdem hatte ich die Sweetpage installiert, die ich mit MBAM entfernen konnte. Gestern hat MBAM jedoch erneut was gefunden und auch ESET, daher habe ich Angst, dass noch mehr auf dem Rechner ist.
Anbei die Logs von MBAM und ESET: Code:
Malwarebytes Anti-Malware
www.malwarebytes.org
Suchlauf Datum: 16.06.2014
Suchlauf-Zeit: 16:37:21
Logdatei:
Administrator: Ja
Version: 2.00.2.1012
Malware Datenbank: v2014.06.16.05
Rootkit Datenbank: v2014.06.02.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert
Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Nico
Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 268721
Verstrichene Zeit: 10 Min, 22 Sek
Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert
Prozesse: 0
(No malicious items detected)
Module: 0
(No malicious items detected)
Registrierungsschlüssel: 9
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, In Quarantäne, [11146811542768cecb29251cc04216ea],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}, In Quarantäne, [11146811542768cecb29251cc04216ea],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{917CAAE9-DD47-4025-936E-1414F07DF5B8}, In Quarantäne, [11146811542768cecb29251cc04216ea],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{917CAAE9-DD47-4025-936E-1414F07DF5B8}, In Quarantäne, [11146811542768cecb29251cc04216ea],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}, In Quarantäne, [11146811542768cecb29251cc04216ea],
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, In Quarantäne, [b075ee8b067563d340ed3aaa699ab64a],
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\WOW6432NODE\sweet-pageSoftware, In Quarantäne, [c46135443f3c43f351d2df0ed92ad52b],
PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, In Quarantäne, [43e2de9bb4c77cba42ebd2122dd65aa6],
PUP.Optional.Qone8, HKU\S-1-5-21-2048815063-3532768989-2356643285-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, In Quarantäne, [22039edb6a111b1b1418776dc24126da],
Registrierungswerte: 1
PUP.Optional.QuickStart.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|quick_start@gmail.com, C:\Users\Nico\AppData\Roaming\Mozilla\Firefox\Profiles\tgi39kf4.default\extensions\quick_start@gmail.com, In Quarantäne, [879ea4d5e992c373a3d3882ef11107f9]
Registrierungsdaten: 14
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX.EXE\SHELL\OPEN\COMMAND, "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" hxxp://www.sweet-page.com/?type=sc&ts=1402866141&from=wld&uid=SAMSUNGXHM641JI_S26XJ9DB729838, Gut: (firefox.exe), Schlecht: ("C:\Program Files (x86)\Mozilla Firefox\firefox.exe" hxxp://www.sweet-page.com/?type=sc&ts=1402866141&from=wld&uid=SAMSUNGXHM641JI_S26XJ9DB729838),Ersetzt,[1a0b96e34a31e84e77e83742e1230bf5]
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.sweet-page.com/?type=sc&ts=1402866141&from=wld&uid=SAMSUNGXHM641JI_S26XJ9DB729838, Gut: (iexplore.exe), Schlecht: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.sweet-page.com/?type=sc&ts=1402866141&from=wld&uid=SAMSUNGXHM641JI_S26XJ9DB729838),Ersetzt,[53d2c0b9f78454e2f46c156431d3fe02]
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.sweet-page.com/web/?type=ds&ts=1402866141&from=wld&uid=SAMSUNGXHM641JI_S26XJ9DB729838&q={searchTerms}, Gut: (hxxp://www.google.com), Schlecht: (hxxp://www.sweet-page.com/web/?type=ds&ts=1402866141&from=wld&uid=SAMSUNGXHM641JI_S26XJ9DB729838&q={searchTerms}),Ersetzt,[d25378015e1db581f36f66136f95a35d]
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.sweet-page.com/?type=hp&ts=1402866141&from=wld&uid=SAMSUNGXHM641JI_S26XJ9DB729838, Gut: (hxxp://www.google.com), Schlecht: (hxxp://www.sweet-page.com/?type=hp&ts=1402866141&from=wld&uid=SAMSUNGXHM641JI_S26XJ9DB729838),Ersetzt,[2ff6bebbcdae7bbb520fe6935ea6d32d]
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.sweet-page.com/?type=hp&ts=1402866141&from=wld&uid=SAMSUNGXHM641JI_S26XJ9DB729838, Gut: (hxxp://www.google.com), Schlecht: (hxxp://www.sweet-page.com/?type=hp&ts=1402866141&from=wld&uid=SAMSUNGXHM641JI_S26XJ9DB729838),Ersetzt,[889df7826e0d50e6a4bf9fdab45060a0]
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[869f7306304bc96ddb192553e51f7f81]
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET\FIREFOX.EXE\SHELL\OPEN\COMMAND, "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" hxxp://www.sweet-page.com/?type=sc&ts=1402866141&from=wld&uid=SAMSUNGXHM641JI_S26XJ9DB729838, Gut: (firefox.exe), Schlecht: ("C:\Program Files (x86)\Mozilla Firefox\firefox.exe" hxxp://www.sweet-page.com/?type=sc&ts=1402866141&from=wld&uid=SAMSUNGXHM641JI_S26XJ9DB729838),Ersetzt,[73b285f48cef3df90e51dd9cd52f4fb1]
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.sweet-page.com/?type=sc&ts=1402866141&from=wld&uid=SAMSUNGXHM641JI_S26XJ9DB729838, Gut: (iexplore.exe), Schlecht: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.sweet-page.com/?type=sc&ts=1402866141&from=wld&uid=SAMSUNGXHM641JI_S26XJ9DB729838),Ersetzt,[091ca8d16a11231347197405d72d9a66]
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.sweet-page.com/web/?type=ds&ts=1402866141&from=wld&uid=SAMSUNGXHM641JI_S26XJ9DB729838&q={searchTerms}, Gut: (hxxp://www.google.com), Schlecht: (hxxp://www.sweet-page.com/web/?type=ds&ts=1402866141&from=wld&uid=SAMSUNGXHM641JI_S26XJ9DB729838&q={searchTerms}),Ersetzt,[0d18bcbd275482b4e37fd8a151b37f81]
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.sweet-page.com/?type=hp&ts=1402866141&from=wld&uid=SAMSUNGXHM641JI_S26XJ9DB729838, Gut: (hxxp://www.google.com), Schlecht: (hxxp://www.sweet-page.com/?type=hp&ts=1402866141&from=wld&uid=SAMSUNGXHM641JI_S26XJ9DB729838),Ersetzt,[30f5b9c0a5d64cea95cc5e1be71d2dd3]
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.sweet-page.com/?type=hp&ts=1402866141&from=wld&uid=SAMSUNGXHM641JI_S26XJ9DB729838, Gut: (hxxp://www.google.com), Schlecht: (hxxp://www.sweet-page.com/?type=hp&ts=1402866141&from=wld&uid=SAMSUNGXHM641JI_S26XJ9DB729838),Ersetzt,[ce57abce6813ba7c77ec9edbcc38748c]
PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[43e2681132495cdaf103eb8d6c98cc34]
PUP.Optional.SweetPage.A, HKU\S-1-5-21-2048815063-3532768989-2356643285-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.sweet-page.com/?type=hp&ts=1402866141&from=wld&uid=SAMSUNGXHM641JI_S26XJ9DB729838, Gut: (hxxp://www.google.com), Schlecht: (hxxp://www.sweet-page.com/?type=hp&ts=1402866141&from=wld&uid=SAMSUNGXHM641JI_S26XJ9DB729838),Ersetzt,[30f55d1cf982c76f164890e98282b64a]
PUP.Optional.SweetPage.A, HKU\S-1-5-21-2048815063-3532768989-2356643285-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.sweet-page.com/?type=hp&ts=1402866141&from=wld&uid=SAMSUNGXHM641JI_S26XJ9DB729838, Gut: (hxxp://www.google.com), Schlecht: (hxxp://www.sweet-page.com/?type=hp&ts=1402866141&from=wld&uid=SAMSUNGXHM641JI_S26XJ9DB729838),Ersetzt,[b76e23564f2c7abcf26be099d4300ef2]
Ordner: 26
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\weather, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\en-US, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-419, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-ES, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-BE, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CA, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CH, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-FR, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-LU, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-CH, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-IT, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pl, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt-BR, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru-MO, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\tr-TR, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\vi-VI, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-CN, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-TW, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.IePluginServices.A, C:\ProgramData\IePluginServices, In Quarantäne, [c06539407506171ffaea039c7b87f50b],
Dateien: 54
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\install.data, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\ient.json, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\RSHP.exe, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\SpAPPSv32.dll, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\SpAPPSv64.dll, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\uninstall.exe, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WebDataJs, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\data.html, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\indexIE.html, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\indexIE8.html, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\main.css, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\ver.txt, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\arrow.png, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\default_add_logo.png, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\default_add_logo_hover.png, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\default_logo.png, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\googlelogo.png, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\googlelogo2.png, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\google_trends.png, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\icon128.png, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\icon16.png, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\icon48.png, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\loading.gif, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\logo32.ico, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\weather\0.png, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\common.js, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\ga.js, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\ie8.js, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\jquery-1.11.0.min.js, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\jquery.autocomplete.js, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\js.js, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\library.js, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\xagainit.js, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\en-US\messages.json, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-419\messages.json, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-ES\messages.json, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-BE\messages.json, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CA\messages.json, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CH\messages.json, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-FR\messages.json, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-LU\messages.json, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-CH\messages.json, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-IT\messages.json, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pl\messages.json, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt\messages.json, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt-BR\messages.json, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru\messages.json, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru-MO\messages.json, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\tr-TR\messages.json, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\vi-VI\messages.json, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-CN\messages.json, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-TW\messages.json, In Quarantäne, [df4690e9304be84e9394912e778b936d],
PUP.Optional.SweetPage.A, C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\sweet-page.xml, In Quarantäne, [53d2cdace497a2944ed44e9f35cec13f],
PUP.Optional.SweetPage.A, C:\Users\Nico\AppData\Roaming\Mozilla\Firefox\Profiles\tgi39kf4.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.startup.homepage", "hxxp://www.sweet-page.com/?type=hp&ts=1402866141&from=wld&uid=SAMSUNGXHM641JI_S26XJ9DB729838");), Ersetzt,[d3520d6caad17fb7f593584f37cd916f]
Physische Sektoren: 0
(No malicious items detected)
(end) Code:
Malwarebytes Anti-Malware
www.malwarebytes.org
Suchlauf Datum: 25.06.2014
Suchlauf-Zeit: 15:34:23
Logdatei:
Administrator: Ja
Version: 2.00.2.1012
Malware Datenbank: v2014.06.25.10
Rootkit Datenbank: v2014.06.23.02
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert
Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Nico
Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 283545
Verstrichene Zeit: 9 Min, 14 Sek
Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert
Prozesse: 0
(No malicious items detected)
Module: 0
(No malicious items detected)
Registrierungsschlüssel: 0
(No malicious items detected)
Registrierungswerte: 1
PUP.Optional.QuickStart.A, HKU\S-1-5-21-2048815063-3532768989-2356643285-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS|appid, quick_start@gmail.com, In Quarantäne, [fcee89f2463537ff8b9a5d4edb27fb05]
Registrierungsdaten: 1
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://www.sweet-page.com/web/?type=ds&ts=1402866141&from=wld&uid=SAMSUNGXHM641JI_S26XJ9DB729838&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.sweet-page.com/web/?type=ds&ts=1402866141&from=wld&uid=SAMSUNGXHM641JI_S26XJ9DB729838&q={searchTerms}),Ersetzt,[b03a39426c0f73c3364de09c48bcb24e]
Ordner: 3
PUP.Optional.WPM.A, C:\ProgramData\WindowsProtectManger, In Quarantäne, [dd0d14679cdf181e20253474e022d62a],
PUP.Optional.WPM.A, C:\ProgramData\WindowsProtectManger\log, In Quarantäne, [dd0d14679cdf181e20253474e022d62a],
PUP.Optional.WPM.A, C:\ProgramData\WindowsProtectManger\update, In Quarantäne, [dd0d14679cdf181e20253474e022d62a],
Dateien: 2
PUP.Optional.WPM.A, C:\ProgramData\WindowsProtectManger\log\wprotectmanager_2014-06-15[23-02-42-408].log, In Quarantäne, [dd0d14679cdf181e20253474e022d62a],
PUP.Optional.WPM.A, C:\ProgramData\WindowsProtectManger\update\conf, In Quarantäne, [dd0d14679cdf181e20253474e022d62a],
Physische Sektoren: 0
(No malicious items detected)
(end) Zwischen dem ersten Log von MBAM und dem zweiten liegen 9 Tage. In der Zeit habe ich ab und an einen Scan durchgeführt und nix wurde gefunden, bis auf gestern dann plötzlich wieder. Code:
C:\$RECYCLE.BIN\S-1-5-21-2048815063-3532768989-2356643285-1000\$RQJIDVF.exe Win32/Bundled.Toolbar.Google.D potenziell unsichere Anwendung gelöscht - in Quarantäne kopiert Würde mich über Hilfe freuen!
Grüße! |