| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Fastsearchings.info und vermutlich weitere VirenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
10.07.2014, 15:28
| #1 |
 |  Fastsearchings.info und vermutlich weitere Viren Hallo, seit heute morgen öffnet sich Google Chrome mit der Startseite hxxp://websearch.fastsearchings.info/, wie ich festgestellt habe wohl ein Virus. Habe zunächst mit Malwarebytes Anti-Malware einen Scan gestartet, wobei noch einige weitere infizierte Objekte ausgemacht wurden (insgesamt etwa 70), diese habe ich dann allesamt in Quarantäne verschoben. Habe mich nun hier registriert da ich via Google auf folgende Anleitung gestoßen bin. http://www.trojaner-board.de/155937-...entfernen.html Jedoch finde ich schon beim entfernen aus dem Chrome-Browser in den Erweiterungen keinen Hinweis auf den Fastsearchings Virus. Würde mich freuen wenn sich jemand findet der mir dabei hilft das ganze wieder hinzubiegen. Danke schon mal im voraus  Mfg stehmi Logfile Malwarebytes Anti-Malware-Scan Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 10.07.2014 Scan Time: 14:47:42 Logfile: malware.txt Administrator: Yes Version: 2.00.2.1012 Malware Database: v2014.07.10.03 Rootkit Database: v2014.07.09.01 License: Free Malware Protection: Disabled Malicious Website Protection: Disabled Self-protection: Disabled OS: Windows 8 CPU: x64 File System: NTFS User: Lars Stehmann Scan Type: Threat Scan Result: Completed Objects Scanned: 374343 Time Elapsed: 1 hr, 0 min, 49 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 1 PUP.Optional.Booster.A, C:\ProgramData\Trusted Publisher\SW-Booster\SW-BOOSTER.EXE, 2416, , [21ba108db5c6e254fe749db0887aad53] Modules: 4 Trojan.SProtector, C:\Program Files (x86)\SW-Booster\ASSISTANTSVC.DLL, , [33a8c1dced8e0333dd8d21408e73d729], Trojan.SProtector, C:\Program Files (x86)\SW-Booster\ASSISTANT.DLL, , [5685227b7605c0762049075a51b004fc], PUP.Optional.Booster.A, C:\Program Files (x86)\SW-Booster\ASSISTANT.DLL, , [0ad1c0dde19a5cda61d1f4c1bc462cd4], PUP.Optional.Booster.A, C:\Program Files (x86)\SW-Booster\ASSISTANTSVC.DLL, , [0ad1c0dde19a5cda61d1f4c1bc462cd4], Registry Keys: 40 PUP.Optional.Booster.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\S-792098896, , [21ba108db5c6e254fe749db0887aad53], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\CLASSES\CLSID\{36E7F0A1-A669-E437-521C-E66AD58826F6}, , [508b9508f38853e34fcab1a0b74ab050], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{36E7F0A1-A669-E437-521C-E66AD58826F6}, , [508b9508f38853e34fcab1a0b74ab050], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{36E7F0A1-A669-E437-521C-E66AD58826F6}, , [508b9508f38853e34fcab1a0b74ab050], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\CLASSES\priCiechopi.priCiechopi, , [508b9508f38853e34fcab1a0b74ab050], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\CLASSES\priCiechopi.priCiechopi.3.9, , [508b9508f38853e34fcab1a0b74ab050], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\priCiechopi.priCiechopi, , [508b9508f38853e34fcab1a0b74ab050], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\priCiechopi.priCiechopi.3.9, , [508b9508f38853e34fcab1a0b74ab050], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{36E7F0A1-A669-E437-521C-E66AD58826F6}, , [508b9508f38853e34fcab1a0b74ab050], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{36E7F0A1-A669-E437-521C-E66AD58826F6}, , [508b9508f38853e34fcab1a0b74ab050], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{36E7F0A1-A669-E437-521C-E66AD58826F6}, , [508b9508f38853e34fcab1a0b74ab050], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\CLASSES\CLSID\{36E7F0A1-A669-E437-521C-E66AD58826F6}\INPROCSERVER32, , [508b9508f38853e34fcab1a0b74ab050], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\CLASSES\CLSID\{F83F9AD9-94C7-6570-453A-2D4399288917}, , [8d4e782592e9b185c5549db4f70acf31], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{F83F9AD9-94C7-6570-453A-2D4399288917}, , [8d4e782592e9b185c5549db4f70acf31], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{F83F9AD9-94C7-6570-453A-2D4399288917}, , [8d4e782592e9b185c5549db4f70acf31], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\CLASSES\MySearch.MySearch, , [8d4e782592e9b185c5549db4f70acf31], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\CLASSES\MySearch.MySearch.2.1, , [8d4e782592e9b185c5549db4f70acf31], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\MySearch.MySearch, , [8d4e782592e9b185c5549db4f70acf31], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\MySearch.MySearch.2.1, , [8d4e782592e9b185c5549db4f70acf31], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{F83F9AD9-94C7-6570-453A-2D4399288917}, , [8d4e782592e9b185c5549db4f70acf31], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{F83F9AD9-94C7-6570-453A-2D4399288917}, , [8d4e782592e9b185c5549db4f70acf31], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{F83F9AD9-94C7-6570-453A-2D4399288917}, , [8d4e782592e9b185c5549db4f70acf31], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\CLASSES\CLSID\{F83F9AD9-94C7-6570-453A-2D4399288917}\INPROCSERVER32, , [8d4e782592e9b185c5549db4f70acf31], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\CLASSES\CLSID\{79070FE0-8153-AD92-33F0-DF93A67D5B05}, , [8556326b92e91d191207fa5728d941bf], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{79070FE0-8153-AD92-33F0-DF93A67D5B05}, , [8556326b92e91d191207fa5728d941bf], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{79070FE0-8153-AD92-33F0-DF93A67D5B05}, , [8556326b92e91d191207fa5728d941bf], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\CLASSES\Adblocker.Adblocker, , [8556326b92e91d191207fa5728d941bf], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\CLASSES\Adblocker.Adblocker.1.0, , [8556326b92e91d191207fa5728d941bf], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\Adblocker.Adblocker, , [8556326b92e91d191207fa5728d941bf], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\Adblocker.Adblocker.1.0, , [8556326b92e91d191207fa5728d941bf], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{79070FE0-8153-AD92-33F0-DF93A67D5B05}, , [8556326b92e91d191207fa5728d941bf], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{79070FE0-8153-AD92-33F0-DF93A67D5B05}, , [8556326b92e91d191207fa5728d941bf], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{79070FE0-8153-AD92-33F0-DF93A67D5B05}, , [8556326b92e91d191207fa5728d941bf], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\CLASSES\CLSID\{79070FE0-8153-AD92-33F0-DF93A67D5B05}\INPROCSERVER32, , [8556326b92e91d191207fa5728d941bf], PUP.Optional.MultiPlug, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{4820778D-AB0D-6D18-C316-52A6A0E1D507}, , [da016c3192e92610a3c42c6cb74a8779], PUP.Optional.MultiPlug, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{C670DCAE-E392-AA32-6F42-143C7FC4BDFD}, , [5b80336a5e1df1455e09c8d04eb3e818], PUP.Optional.MultiPlug, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{FDB962F0-B5B8-9460-D12F-7966E97BAA43}, , [19c21c81b3c87fb75512ff9912ef9b65], PUP.Optional.SWBooster.A, HKLM\SOFTWARE\WOW6432NODE\SW-Booster, , [6e6d4558295242f45c3889334bb7b749], PUP.Optional.Booster.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{5F189DF5-2D05-472B-9091-84D9848AE48B}{d0e87c27}, , [8a51554857244ee82b1e1b9e45bd32ce], PUP.Optional.WebSearchInfo, HKU\S-1-5-21-2565124892-2511412510-2458214724-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}, , [9c3f3766f38878bec786847e31d33fc1], Registry Values: 1 PUP.Optional.WebSearchInfo, HKU\S-1-5-21-2565124892-2511412510-2458214724-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {BB74DE59-BC4C-4172-9AC4-73315F71CFFE}, , [4695336a057693a32b2314ee49bbac54] Registry Data: 2 PUP.Optional.WebSearchInfo, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://websearch.fastsearchings.info/?pid=2832&r=2014/07/10&hid=2824197954457125309&lg=EN&cc=DE&unqvl=56, Good: (www.google.com), Bad: (hxxp://websearch.fastsearchings.info/?pid=2832&r=2014/07/10&hid=2824197954457125309&lg=EN&cc=DE&unqvl=56),,[b724a7f6ccafd066992f454bf2123ec2] PUP.Optional.WebSearchInfo, HKU\S-1-5-21-2565124892-2511412510-2458214724-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://websearch.fastsearchings.info/?pid=2832&r=2014/07/10&hid=2824197954457125309&lg=EN&cc=DE&unqvl=56, Good: (www.google.com), Bad: (hxxp://websearch.fastsearchings.info/?pid=2832&r=2014/07/10&hid=2824197954457125309&lg=EN&cc=DE&unqvl=56),,[805b7e1f097296a0f3d4632d19eb827e] Folders: 3 PUP.Optional.Booster.A, C:\PROGRAMDATA\TRUSTED PUBLISHER\SW-BOOSTER, , [2bb0e5b881fa8aac155bf2c2ba48e51b], PUP.Optional.Booster.A, C:\PROGRAMDATA\TRUSTED PUBLISHER\SW-BOOSTER\792098896, , [2bb0e5b881fa8aac155bf2c2ba48e51b], PUP.Optional.Booster.A, C:\PROGRAM FILES (X86)\SW-BOOSTER, , [0ad1c0dde19a5cda61d1f4c1bc462cd4], Files: 28 Trojan.SProtector, C:\Program Files (x86)\SW-Booster\ASSISTANTSVC.DLL, , [33a8c1dced8e0333dd8d21408e73d729], Trojan.SProtector, C:\Program Files (x86)\SW-Booster\ASSISTANT.DLL, , [5685227b7605c0762049075a51b004fc], PUP.Optional.Booster.A, C:\ProgramData\Trusted Publisher\SW-Booster\SW-BOOSTER.EXE, , [21ba108db5c6e254fe749db0887aad53], PUP.Optional.MultiPlug.A, C:\Program Files (x86)\priCechhoP\YHS.X64.DLL, , [508b9508f38853e34fcab1a0b74ab050], PUP.Optional.MultiPlug.A, C:\Program Files (x86)\priCechhoP\YHs.dll, , [508b9508f38853e34fcab1a0b74ab050], PUP.Optional.MultiPlug.A, C:\Program Files (x86)\MySearch\T.X64.DLL, , [8d4e782592e9b185c5549db4f70acf31], PUP.Optional.MultiPlug.A, C:\Program Files (x86)\MySearch\T.dll, , [8d4e782592e9b185c5549db4f70acf31], PUP.Optional.MultiPlug.A, C:\Program Files (x86)\Adblocker\F.X64.DLL, , [8556326b92e91d191207fa5728d941bf], PUP.Optional.MultiPlug.A, C:\Program Files (x86)\Adblocker\F.dll, , [8556326b92e91d191207fa5728d941bf], PUP.Optional.MultiPlug, C:\ProgramData\Adblocker\ej.exe, , [da016c3192e92610a3c42c6cb74a8779], PUP.Optional.MultiPlug, C:\ProgramData\MySearch\xh.exe, , [5b80336a5e1df1455e09c8d04eb3e818], PUP.Optional.MultiPlug, C:\ProgramData\priCechhoP\s8ss.exe, , [19c21c81b3c87fb75512ff9912ef9b65], PUP.Optional.OptimumInstaller.A, C:\$Recycle.Bin\S-1-5-21-2565124892-2511412510-2458214724-1004\$RLQ7CRD.exe, , [4299ff9eed8e50e6cebd450fee13fb05], PUP.Optional.EZDownloader.A, C:\Users\Lars Stehmann\AppData\Local\Temp\594f73dd\temp\EzDownloader_setup.exe, , [1ac145581e5da591851ae43b619f7888], PUP.Optional.MultiPlug.A, C:\Users\Lars Stehmann\AppData\Local\Temp\594f73dd\temp\hpds_setup.exe, , [c318d8c59cdfe74f46c195069d64d22e], Trojan.SProtector, C:\Users\Lars Stehmann\AppData\Local\Temp\594f73dd\temp\putfu.exe, , [ab300a93fd7efe38df35d483748d7f81], PUP.Optional.Booster.A, C:\Users\Lars Stehmann\AppData\Local\Temp\594f73dd\temp\usetup.exe, , [ce0d217cfa813ef8de948ebf8a7830d0], PUP.Optional.DomaIQ, C:\Users\Lars Stehmann\Downloads\Nicht bestätigt 292945.crdownload, , [8c4fa4f916656dc904215e2aa1601be5], PUP.Optional.Booster.A, C:\Windows\Tasks\SW-BOOSTER-S-792098896.JOB, , [e0fbdac314676bcbd2d4486e32d0bf41], PUP.Optional.Booster.A, C:\Windows\System32\Tasks\SW-BOOSTER-S-792098896, , [17c45548e695d46205a24670b84afd03], PUP.Optional.Superfish.A, C:\Users\Lars Stehmann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\HTTP_WWW.SUPERFISH.COM_0.LOCALSTORAGE, , [6b70b2eb6b10a096ac15972e04fe748c], PUP.Optional.Superfish.A, C:\Users\Lars Stehmann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\HTTP_WWW.SUPERFISH.COM_0.LOCALSTORAGE-JOURNAL, , [9b4077262f4c9f97269b70555aa8bc44], PUP.Optional.FastSearchings.A, C:\Users\Lars Stehmann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\HTTP_WEBSEARCH.FASTSEARCHINGS.INFO_0.LOCALSTORAGE, , [d7040598c5b67db91c600113986c768a], PUP.Optional.FastSearchings.A, C:\Users\Lars Stehmann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\HTTP_WEBSEARCH.FASTSEARCHINGS.INFO_0.LOCALSTORAGE-JOURNAL, , [ffdcc8d51d5e54e2acd0fb19c73d2fd1], PUP.Optional.Booster.A, C:\ProgramData\Trusted Publisher\SW-Booster\792098896.ini, , [2bb0e5b881fa8aac155bf2c2ba48e51b], PUP.Optional.Booster.A, C:\Program Files (x86)\SW-Booster\Assistant.dll, , [0ad1c0dde19a5cda61d1f4c1bc462cd4], PUP.Optional.Booster.A, C:\Program Files (x86)\SW-Booster\assistantSvc.dll, , [0ad1c0dde19a5cda61d1f4c1bc462cd4], PUP.Optional.Booster.A, C:\Program Files (x86)\SW-Booster\Assistant_x64.dll, , [0ad1c0dde19a5cda61d1f4c1bc462cd4], Physical Sectors: 0 (No malicious items detected) (end) |
Baum-Darstellung