|
Mystart incredibar eingefangen. wie werde ich es wieder los? Hallo, meine Schwester hat irgendwas runtergeladen oder getan und mir mystar incredibar aufm laptop geladen. Könnt Ihr mir mit dem löschen des Programms helfen? Ich hab schon unter Systemsteuerung 2 programme (incredibar und web...) gelöscht. Bin auch auf Firefox gegangen (da dieser davon befallen ist) und bin auf Adds-ons gegeangen dort incredibar gelöscht. hab auch schon malware runtergeladen und eine quick-prüfung durchgeführt. Keine Viren etc. mehr weiß ich auch nicht neben bei ich hab null ahnung von computern etc. wenn ihr mir was erklärt bitte bitte schritt für schritt für dummies :wtf: danke im voraus für eure hilfe |
:hallo: 1. Schritt Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.danach: 2. Schritt Downloade Dir bitte AdwCleaner auf deinen Desktop.
|
Vielen Dank!!! Also nach dem Malware scan kam folgendes raus: Malwarebytes Anti-Malware (Test) 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.08.23.07 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Najib :: NAJIB-VAIO [Administrator] Schutz: Aktiviert 23.08.2012 19:35:53 mbam-log-2012-08-23 (19-35-53).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 329267 Laufzeit: 51 Minute(n), 17 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) jetzt starte ich das andere programm. Und das kam bei dem AdwCleaner raus: # AdwCleaner v1.801 - Logfile created 08/23/2012 at 20:57:43 # Updated 14/08/2012 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits) # User : Najib - NAJIB-VAIO # Boot Mode : Normal # Running from : C:\Users\Najib\Downloads\adwcleaner.exe # Option [Search] ***** [Services] ***** ***** [Files / Folders] ***** Folder Found : C:\Users\Najib\AppData\Local\APN Folder Found : C:\Users\Najib\AppData\Roaming\Babylon Folder Found : C:\ProgramData\Ask Folder Found : C:\ProgramData\Babylon File Found : C:\Users\Najib\AppData\Roaming\Mozilla\Firefox\Profiles\7zs4tkti.default\searchplugins\MyStart Search.xml File Found : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml File Found : C:\user.js ***** [Registry] ***** Key Found : HKCU\Software\IM Key Found : HKCU\Software\ImInstaller Key Found : HKCU\Software\Softonic Key Found : HKLM\SOFTWARE\Babylon Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd Key Found : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32 Key Found : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS Key Found : HKLM\SOFTWARE\Software Key Found : HKLM\SOFTWARE\Web Assistant Value Found : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}] [x64] Key Found : HKCU\Software\IM [x64] Key Found : HKCU\Software\ImInstaller [x64] Key Found : HKCU\Software\Softonic [x64] Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd [x64] Key Found : HKLM\SOFTWARE\Web Assistant [x64] Value Found : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}] ***** [Registre - GUID] ***** Key Found : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826} Key Found : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB} Key Found : HKLM\SOFTWARE\Classes\Interface\{7D86A08B-0A8F-4BE0-B693-F05E6947E780} Key Found : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48} Key Found : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5} Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9} Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A} [x64] Key Found : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826} [x64] Key Found : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB} [x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48} [x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5} [x64] Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9} [x64] Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A} ***** [Internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16421 [OK] Registry is clean. -\\ Mozilla Firefox v12.0 (de) Profile name : default File : C:\Users\Najib\AppData\Roaming\Mozilla\Firefox\Profiles\7zs4tkti.default\prefs.js Found : user_pref("browser.search.order.1", "Search the web (Babylon)"); Found : user_pref("browser.startup.homepage", "hxxp://mystart.incredibar.com/mb178?a=6R8By41Ke7&i=26"); Found : user_pref("extensions.BabylonToolbar.admin", false); Found : user_pref("extensions.BabylonToolbar.aflt", "babsst"); Found : user_pref("extensions.BabylonToolbar.dfltLng", "en"); Found : user_pref("extensions.BabylonToolbar.excTlbr", false); Found : user_pref("extensions.BabylonToolbar.id", "00e76804000000000000a639e5ba4d41"); Found : user_pref("extensions.BabylonToolbar.instlDay", "15555"); Found : user_pref("extensions.BabylonToolbar.instlRef", "sst"); Found : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar"); Found : user_pref("extensions.BabylonToolbar.prtnrId", "babylon"); Found : user_pref("extensions.BabylonToolbar.tlbrId", "base"); Found : user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "hxxp://www.google.com/search?babsrc=TB_ggl&q="); Found : user_pref("extensions.BabylonToolbar.vrsn", "1.5.29.1"); Found : user_pref("extensions.BabylonToolbar.vrsni", "1.5.29.1"); Found : user_pref("extensions.BabylonToolbar_i.babExt", ""); Found : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=112542&tt=010812_nich_3112_7"); Found : user_pref("extensions.BabylonToolbar_i.newTab", true); Found : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?affID=112542&tt=01081[...] Found : user_pref("extensions.BabylonToolbar_i.smplGrp", "none"); Found : user_pref("extensions.BabylonToolbar_i.srcExt", "ss"); Found : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.29.116:02:40"); Found : user_pref("extensions.incredibar.admin", false); Found : user_pref("extensions.incredibar.aflt", "orgnl"); Found : user_pref("extensions.incredibar.cntry", "DE"); Found : user_pref("extensions.incredibar.dfltLng", ""); Found : user_pref("extensions.incredibar.dfltSrch", false); Found : user_pref("extensions.incredibar.did", "10643"); Found : user_pref("extensions.incredibar.envrmnt", "production"); Found : user_pref("extensions.incredibar.excTlbr", false); Found : user_pref("extensions.incredibar.hdrMd5", "6841124F9510DF49C15DDD5409725805"); Found : user_pref("extensions.incredibar.hmpg", false); Found : user_pref("extensions.incredibar.id", "00e76804000000000000a639e5ba4d41"); Found : user_pref("extensions.incredibar.installerproductid", "26"); Found : user_pref("extensions.incredibar.instlDay", "15561"); Found : user_pref("extensions.incredibar.instlRef", ""); Found : user_pref("extensions.incredibar.isDcmntCmplt", true); Found : user_pref("extensions.incredibar.lastVrsnTs", "1.5.11.1412:49:00"); Found : user_pref("extensions.incredibar.mntrvrsn", "1.2.0"); Found : user_pref("extensions.incredibar.newTab", false); Found : user_pref("extensions.incredibar.noFFXTlbr", false); Found : user_pref("extensions.incredibar.ppd", "1"); Found : user_pref("extensions.incredibar.prdct", "incredibar"); Found : user_pref("extensions.incredibar.productid", "26"); Found : user_pref("extensions.incredibar.prtnrId", "Incredibar"); Found : user_pref("extensions.incredibar.sg", "none"); Found : user_pref("extensions.incredibar.smplGrp", "none"); Found : user_pref("extensions.incredibar.tlbrId", "base"); Found : user_pref("extensions.incredibar.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6R8By41Ke7&loc=IB_T[...] Found : user_pref("extensions.incredibar.upn2", "6R8By41Ke7"); Found : user_pref("extensions.incredibar.upn2n", "92824850607184731"); Found : user_pref("extensions.incredibar.vrsn", "1.5.11.14"); Found : user_pref("extensions.incredibar.vrsnTs", "1.5.11.1412:49:00"); Found : user_pref("extensions.incredibar.vrsni", "1.5.11.14"); Found : user_pref("extensions.incredibar_i.aflt", "orgnl"); Found : user_pref("extensions.incredibar_i.dfltLng", ""); Found : user_pref("extensions.incredibar_i.did", "10643"); Found : user_pref("extensions.incredibar_i.excTlbr", false); Found : user_pref("extensions.incredibar_i.id", "00e76804000000000000a639e5ba4d41"); Found : user_pref("extensions.incredibar_i.installerproductid", "26"); Found : user_pref("extensions.incredibar_i.instlDay", "15561"); Found : user_pref("extensions.incredibar_i.instlRef", ""); Found : user_pref("extensions.incredibar_i.ms_url_id", ""); Found : user_pref("extensions.incredibar_i.newTab", false); Found : user_pref("extensions.incredibar_i.ppd", "1"); Found : user_pref("extensions.incredibar_i.prdct", "incredibar"); Found : user_pref("extensions.incredibar_i.productid", "26"); Found : user_pref("extensions.incredibar_i.prtnrId", "Incredibar"); Found : user_pref("extensions.incredibar_i.smplGrp", "none"); Found : user_pref("extensions.incredibar_i.tlbrId", "base"); Found : user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6R8By41Ke7&loc=IB[...] Found : user_pref("extensions.incredibar_i.upn2", "6R8By41Ke7"); Found : user_pref("extensions.incredibar_i.upn2n", "92824850607184731"); Found : user_pref("extensions.incredibar_i.vrsn", "1.5.11.14"); Found : user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1412:49:00"); Found : user_pref("extensions.incredibar_i.vrsni", "1.5.11.14"); Found : user_pref("keyword.URL", "hxxp://mystart.incredibar.com/mb178/?loc=IB_DS&a=6R8By41Ke7&&i=26&search="[...] Found : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_whiteList", "{\"search.babylon.com\[...] -\\ Google Chrome v21.0.1180.83 File : C:\Users\Najib\AppData\Local\Google\Chrome\User Data\Default\Preferences Found : "hxxp://mystart.incredibar.com/mb178?a=6R8By41Ke7&i=26" Found : "icon_url" : "hxxp://mystart.incredibar.com/mb178/favicon.ico", Found : "keyword" : "mystart.incredibar.com/mb178", Found : "name" : "MyStart Search", Found : "search_url" : "hxxp://mystart.incredibar.com/mb178/?loc=IB_DS&search={searchTerms}&a=6R8By41K[...] Found : "hxxp://mystart.incredibar.com/", Found : "hxxp://mystart.incredibar.com/", Found : "hxxp://search.incredibar.com/", Found : "hxxp://mystart.incredibar.com/", Found : "hxxp://search.incredibar.com/", Found : "description" : "The fastest way to search the web.", Found : "hxxp://mystart.incredibar.com/mb178?a=6R8By41Ke7&i=26" ************************* AdwCleaner[R1].txt - [9624 octets] - [23/08/2012 20:57:43] ########## EOF - C:\AdwCleaner[R1].txt - [9752 octets] ########## wat nu?:wtf: ich dacht ich hätt babylon schon gelöscht :heulen: aus mir wird ne richtige expertin :heulen: |
Sehr gut! :daumenhoc
danach: Malware-Scan mit Emsisoft Anti-Malware Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm. Lade über Jetzt Updaten die aktuellen Signaturen herunter. Wähle den Freeware-Modus aus. Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers. Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten. Anleitung: http://www.trojaner-board.de/103809-...i-malware.html |
hab´s gemacht! und was nu? # AdwCleaner v1.801 - Logfile created 08/24/2012 at 18:39:18 # Updated 14/08/2012 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits) # User : Najib - NAJIB-VAIO # Boot Mode : Normal # Running from : C:\Users\Najib\Downloads\adwcleaner.exe # Option [Delete] ***** [Services] ***** ***** [Files / Folders] ***** Folder Deleted : C:\Users\Najib\AppData\Local\APN Folder Deleted : C:\Users\Najib\AppData\Roaming\Babylon Folder Deleted : C:\ProgramData\Ask Folder Deleted : C:\ProgramData\Babylon File Deleted : C:\Users\Najib\AppData\Roaming\Mozilla\Firefox\Profiles\7zs4tkti.default\searchplugins\MyStart Search.xml File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml File Deleted : C:\user.js ***** [Registry] ***** Key Deleted : HKCU\Software\IM Key Deleted : HKCU\Software\ImInstaller Key Deleted : HKCU\Software\Softonic Key Deleted : HKLM\SOFTWARE\Babylon Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS Key Deleted : HKLM\SOFTWARE\Software Key Deleted : HKLM\SOFTWARE\Web Assistant Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}] [x64] Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd [x64] Key Deleted : HKLM\SOFTWARE\Web Assistant ***** [Registre - GUID] ***** Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7D86A08B-0A8F-4BE0-B693-F05E6947E780} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A} [x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48} [x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5} ***** [Internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16421 [OK] Registry is clean. -\\ Mozilla Firefox v12.0 (de) Profile name : default File : C:\Users\Najib\AppData\Roaming\Mozilla\Firefox\Profiles\7zs4tkti.default\prefs.js C:\Users\Najib\AppData\Roaming\Mozilla\Firefox\Profiles\7zs4tkti.default\user.js ... Deleted ! Deleted : user_pref("browser.search.order.1", "Search the web (Babylon)"); Deleted : user_pref("browser.startup.homepage", "hxxp://mystart.incredibar.com/mb178?a=6R8By41Ke7&i=26"); Deleted : user_pref("extensions.BabylonToolbar.admin", false); Deleted : user_pref("extensions.BabylonToolbar.aflt", "babsst"); Deleted : user_pref("extensions.BabylonToolbar.dfltLng", "en"); Deleted : user_pref("extensions.BabylonToolbar.excTlbr", false); Deleted : user_pref("extensions.BabylonToolbar.id", "00e76804000000000000a639e5ba4d41"); Deleted : user_pref("extensions.BabylonToolbar.instlDay", "15555"); Deleted : user_pref("extensions.BabylonToolbar.instlRef", "sst"); Deleted : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar"); Deleted : user_pref("extensions.BabylonToolbar.prtnrId", "babylon"); Deleted : user_pref("extensions.BabylonToolbar.tlbrId", "base"); Deleted : user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "hxxp://www.google.com/search?babsrc=TB_ggl&q="); Deleted : user_pref("extensions.BabylonToolbar.vrsn", "1.5.29.1"); Deleted : user_pref("extensions.BabylonToolbar.vrsni", "1.5.29.1"); Deleted : user_pref("extensions.BabylonToolbar_i.babExt", ""); Deleted : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=112542&tt=010812_nich_3112_7"); Deleted : user_pref("extensions.BabylonToolbar_i.newTab", true); Deleted : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?affID=112542&tt=01081[...] Deleted : user_pref("extensions.BabylonToolbar_i.smplGrp", "none"); Deleted : user_pref("extensions.BabylonToolbar_i.srcExt", "ss"); Deleted : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.29.116:02:40"); Deleted : user_pref("extensions.incredibar.admin", false); Deleted : user_pref("extensions.incredibar.aflt", "orgnl"); Deleted : user_pref("extensions.incredibar.cntry", "DE"); Deleted : user_pref("extensions.incredibar.dfltLng", ""); Deleted : user_pref("extensions.incredibar.dfltSrch", false); Deleted : user_pref("extensions.incredibar.did", "10643"); Deleted : user_pref("extensions.incredibar.envrmnt", "production"); Deleted : user_pref("extensions.incredibar.excTlbr", false); Deleted : user_pref("extensions.incredibar.hdrMd5", "6841124F9510DF49C15DDD5409725805"); Deleted : user_pref("extensions.incredibar.hmpg", false); Deleted : user_pref("extensions.incredibar.id", "00e76804000000000000a639e5ba4d41"); Deleted : user_pref("extensions.incredibar.installerproductid", "26"); Deleted : user_pref("extensions.incredibar.instlDay", "15561"); Deleted : user_pref("extensions.incredibar.instlRef", ""); Deleted : user_pref("extensions.incredibar.isDcmntCmplt", true); Deleted : user_pref("extensions.incredibar.lastVrsnTs", "1.5.11.1412:49:00"); Deleted : user_pref("extensions.incredibar.mntrvrsn", "1.2.0"); Deleted : user_pref("extensions.incredibar.newTab", false); Deleted : user_pref("extensions.incredibar.noFFXTlbr", false); Deleted : user_pref("extensions.incredibar.ppd", "1"); Deleted : user_pref("extensions.incredibar.prdct", "incredibar"); Deleted : user_pref("extensions.incredibar.productid", "26"); Deleted : user_pref("extensions.incredibar.prtnrId", "Incredibar"); Deleted : user_pref("extensions.incredibar.sg", "none"); Deleted : user_pref("extensions.incredibar.smplGrp", "none"); Deleted : user_pref("extensions.incredibar.tlbrId", "base"); Deleted : user_pref("extensions.incredibar.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6R8By41Ke7&loc=IB_T[...] Deleted : user_pref("extensions.incredibar.upn2", "6R8By41Ke7"); Deleted : user_pref("extensions.incredibar.upn2n", "92824850607184731"); Deleted : user_pref("extensions.incredibar.vrsn", "1.5.11.14"); Deleted : user_pref("extensions.incredibar.vrsnTs", "1.5.11.1412:49:00"); Deleted : user_pref("extensions.incredibar.vrsni", "1.5.11.14"); Deleted : user_pref("extensions.incredibar_i.aflt", "orgnl"); Deleted : user_pref("extensions.incredibar_i.dfltLng", ""); Deleted : user_pref("extensions.incredibar_i.did", "10643"); Deleted : user_pref("extensions.incredibar_i.excTlbr", false); Deleted : user_pref("extensions.incredibar_i.id", "00e76804000000000000a639e5ba4d41"); Deleted : user_pref("extensions.incredibar_i.installerproductid", "26"); Deleted : user_pref("extensions.incredibar_i.instlDay", "15561"); Deleted : user_pref("extensions.incredibar_i.instlRef", ""); Deleted : user_pref("extensions.incredibar_i.ms_url_id", ""); Deleted : user_pref("extensions.incredibar_i.newTab", false); Deleted : user_pref("extensions.incredibar_i.ppd", "1"); Deleted : user_pref("extensions.incredibar_i.prdct", "incredibar"); Deleted : user_pref("extensions.incredibar_i.productid", "26"); Deleted : user_pref("extensions.incredibar_i.prtnrId", "Incredibar"); Deleted : user_pref("extensions.incredibar_i.smplGrp", "none"); Deleted : user_pref("extensions.incredibar_i.tlbrId", "base"); Deleted : user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6R8By41Ke7&loc=IB[...] Deleted : user_pref("extensions.incredibar_i.upn2", "6R8By41Ke7"); Deleted : user_pref("extensions.incredibar_i.upn2n", "92824850607184731"); Deleted : user_pref("extensions.incredibar_i.vrsn", "1.5.11.14"); Deleted : user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1412:49:00"); Deleted : user_pref("extensions.incredibar_i.vrsni", "1.5.11.14"); Deleted : user_pref("keyword.URL", "hxxp://mystart.incredibar.com/mb178/?loc=IB_DS&a=6R8By41Ke7&&i=26&search="[...] Deleted : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_whiteList", "{\"search.babylon.com\[...] -\\ Google Chrome v21.0.1180.83 File : C:\Users\Najib\AppData\Local\Google\Chrome\User Data\Default\Preferences Deleted : "hxxp://mystart.incredibar.com/mb178?a=6R8By41Ke7&i=26" Deleted : "icon_url" : "hxxp://mystart.incredibar.com/mb178/favicon.ico", Deleted : "keyword" : "mystart.incredibar.com/mb178", Deleted : "name" : "MyStart Search", Deleted : "search_url" : "hxxp://mystart.incredibar.com/mb178/?loc=IB_DS&search={searchTerms}&a=6R8By41K[...] Deleted : "hxxp://mystart.incredibar.com/", Deleted : "hxxp://mystart.incredibar.com/", Deleted : "hxxp://search.incredibar.com/", Deleted : "hxxp://mystart.incredibar.com/", Deleted : "hxxp://search.incredibar.com/", Deleted : "description" : "The fastest way to search the web.", Deleted : "hxxp://mystart.incredibar.com/mb178?a=6R8By41Ke7&i=26" ************************* AdwCleaner[R1].txt - [9729 octets] - [23/08/2012 20:57:43] AdwCleaner[R2].txt - [9789 octets] - [23/08/2012 21:03:41] AdwCleaner[S1].txt - [9438 octets] - [24/08/2012 18:39:18] ########## EOF - C:\AdwCleaner[S1].txt - [9566 octets] ########## |
Schaue bitte in der Anleitung (http://www.trojaner-board.de/103809-...i-malware.html) nach, wo du die Logfiles finden kannst. Poste das Logfile bitte. |
und das ist der Bericht vom emsisoft anti-malware: Emsisoft Anti-Malware - Version 6.6 Letztes Update: 24.08.2012 18:49:58 Scan Einstellungen: Scan Methode: Detail Scan Objekte: Rootkits, Speicher, Traces, C:\ Archiv Scan: An ADS Scan: An Scan Beginn: 24.08.2012 18:51:12 C:\Users\Najib\Downloads\BeautifulESvonSchriftartenFontsde_downloader_by_SchriftartenFontsde.exe gefunden: Riskware.Win32.Somoto.AMN!E1 C:\Users\Najib\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\767c7ff8-723a7e99 -> Wiki.class gefunden: Exploit.Java.CVE-2011-3544!E2 Gescannt 585607 Gefunden 2 Scan Ende: 24.08.2012 19:27:32 Scan Zeit: 0:36:20 hallo, ich hab´s gerade eben nochmals mit der anleitung gemacht und bekam dashier als ergebnis Emsisoft Anti-Malware - Version 6.6 Letztes Update: 25.08.2012 08:30:09 Scan Einstellungen: Scan Methode: Detail Scan Objekte: Rootkits, Speicher, Traces, C:\ Archiv Scan: An ADS Scan: An Scan Beginn: 25.08.2012 08:36:24 C:\Users\Najib\Downloads\BeautifulESvonSchriftartenFontsde_downloader_by_SchriftartenFontsde.exe gefunden: Riskware.Win32.Somoto.AMN!E1 C:\Users\Najib\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\767c7ff8-723a7e99 -> Wiki.class gefunden: Exploit.Java.CVE-2011-3544!E2 Gescannt 585870 Gefunden 2 Scan Ende: 25.08.2012 09:12:29 Scan Zeit: 0:36:05 C:\Users\Najib\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\767c7ff8-723a7e99 -> Wiki.class Quarantäne Exploit.Java.CVE-2011-3544!E2 C:\Users\Najib\Downloads\BeautifulESvonSchriftartenFontsde_downloader_by_SchriftartenFontsde.exe Quarantäne Riskware.Win32.Somoto.AMN!E1 Quarantäne 2 |
Sehr gut! :daumenhoc Lasse die Funde loeschen, dann: Deinstalliere: Emsisoft Anti-Malware ESET Online Scanner Vorbereitung
|
hallo, vielen Dank für die Infos. Ich komme jetzt aber nicht mehr weiter :confused: ich hab jetzt den "eset" scan durchgeführt und hab dann versuch den C:\Programme\Eset\log.txt zu öffen und bin kläglich gescheitert. :wtf: isch nix verstehen :heulen: könnten sie es mir nochmal erklären??? viele grüße |
Schau mal hier: C:\Programme (x86)\Eset\log.txt :) |
Hallo, das geht auch nicht :wtf: weiß echt nicht weiter:confused: |
Was geht nicht???? |
ich hab grad alles parallel gemacht, da ich auch das Problem habe/hatte :balla:, die gesuchte logfile befand sich bei mir (win7) unter c:/programme(x86)/eset mfg |
Zitat:
|
also mein logfile sieht so aus von eset ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=49dcb971fe408f47b91df04b3e60ab3b # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2012-09-10 05:06:46 # local_time=2012-09-10 07:06:46 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=5893 16776573 100 94 502 98854256 0 0 # compatibility_mode=8192 67108863 100 0 161 161 0 0 # scanned=237193 # found=2 # cleaned=2 # scan_time=29200 G:\$RECYCLE.BIN\S-1-5-21-1255324413-4081458231-182762020-1001\$RU9C814.exe a variant of Win32/SoftonicDownloader.D application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C G:\Downloads\Programme\SoftonicDownloader_fuer_virtual-clonedrive.exe Win32/SoftonicDownloader.D application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 01:03 Uhr. |
Copyright ©2000-2025, Trojaner-Board