adware.elex verschwindet auch nach mehrmaliger Säuberung nicht vom PC.

Quadon

Hallo zusammen, erster Post hier und ich hoffe, dass nicht mehr folgen werden.

Mein momentanes Problem steht grob im Titel beschrieben. Ich habe mir, wie auch immer (vermutlich irgendwann mal im angetrunken Zustand) eine ziemlich hartnäckige Adware (so glaube ich) eingefangen.

Zur Folge hatte ich dann eine veränderte "Neuer-Tab-Seite" und Startseite (amisites.com), was an sich nichts unbekanntes war, weshalb ich erstmal zu meinen üblichen Schritten gegriffen hab. (adwcleaner und malwarebytes Anti-Malware zur Beseitigung), was dieses Mal leider nicht zur Bereinigung zu reichen scheint.

Immer wieder schließt sich mein Browser automatisch während des Betriebs und sobald ich ihn neustarte, ist "amisites.com" wieder die Neuer-Tab- und Startseite. Dieses Problem ist jetzt zum 5. Mal innerhalb einiger Wochen aufgetreten, bisher hab ich einfach wieder die beiden Programme benutzt, aber langsam wirds doch nervig, weshalb ich hier nach einer Lösung suche.

Hier nochmal aufgelistet alle Funde von "Anti-Malware", gerade eben benutzt,vielleicht hilfts's ja (Dies sind grob die selben Suchergebnisse, die auch bei den vergangenen Scans gefunden worden sind) :
Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 29/12/2016
Scan Time: 17:39
Logfile:
Administrator: Yes

Version: 2.2.1.1043
Malware Database: v2016.12.29.05
Rootkit Database: v2016.11.20.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 10
CPU: x64
File System: NTFS
User: Bjarne

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 448850
Time Elapsed: 4 min, 43 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 2
Adware.Elex.Generic, C:\Users\Bjarne\AppData\Roaming\beibe\UVCONVERTER.EXE, 2208, , [0e0b25c8079368ced2d36f431de353ad]
Adware.Elex, C:\Program Files (x86)\Gubed_WMI\GUBED_WMI.EXE, 2180, , [d148d4191d7dfb3badc27650dc240ff1]

Modules: 4
Adware.Elex, C:\Program Files (x86)\Common Files\Services\iThemes.dll, , [8d8cdf0e2a700e2872c75d3f9c645aa6],
PUP.Optional.Elex, C:\Program Files (x86)\WinArcher\Archer.dll, , [d742628b5b3f45f19f930c66ae520df3],
PUP.Optional.Elex, C:\ProgramData\WinSAPSvc\WinSAP.dll, , [8693de0fd3c7a09601917cfd936d629e],
Adware.Elex, C:\Program Files (x86)\Gubed\GubedZL.dll, , [16039558b9e19f97adeaf6d041bf44bc],

Registry Keys: 10
Adware.Elex, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\iThemes5, , [8d8cdf0e2a700e2872c75d3f9c645aa6],
Adware.Elex.Generic, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Convxxxx, , [0e0b25c8079368ced2d36f431de353ad],
PUP.Optional.WinTool, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{5CCAE49B-F4B9-4E37-A75F-EAFA411D3409}, , [6cad1ad3bddd4de92420b2fac73907f9],
PUP.Optional.WinTool, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\WinTOOL, , [081111dc5248b383410cf6b6b14fea16],
PUP.Optional.Amisites.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\amisitesSoftware, , [df3ab23bedad1a1c0c89396eef1140c0],
PUP.Optional.Elex, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Archer, , [6cad16d7108ab08633963f49c53ba45c],
Adware.Elex, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\GubedZL, , [0217ea035c3e5adc2b6a6066be42a55b],
Adware.Elex, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Gubed_WMI, , [d148d4191d7dfb3badc27650dc240ff1],
PUP.Optional.Elex, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WinSAPSvc, , [46d312db6f2bd561342e6225d030fd03],
PUP.Optional.Amisites.ShrtCln, HKU\S-1-5-21-1495893475-136969731-4274491207-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, , [8f8ac627cfcb9c9a32f72f6b9e62966a],

Registry Values: 3
PUP.Optional.WinTool, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{5CCAE49B-F4B9-4E37-A75F-EAFA411D3409}|Path, \WinTOOL, , [6cad1ad3bddd4de92420b2fac73907f9]
Trojan.Elex, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\THEMES|DependOnService, iThemes5^^, , [bc5d07e623772c0a5814be0aa15f629e]
PUP.Optional.Amisites.ShrtCln, HKU\S-1-5-21-1495893475-136969731-4274491207-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|URL, hxxp://www.amisites.com/search/?type=ds&ts=1483029066&z=d681314729ad7d82b93e03bgez3b3cfe1o3tfefq0b&from=che0812&uid=SamsungXSSDX840XEVOX120GB_S1BUNYAD800753X&q={searchTerms}, , [8f8ac627cfcb9c9a32f72f6b9e62966a]

Registry Data: 13
PUP.Optional.Amisites.ShrtCln, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\SHELL\OPEN\COMMAND, "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" hxxp://www.amisites.com/?type=sc&ts=1483029066&z=d681314729ad7d82b93e03bgez3b3cfe1o3tfefq0b&from=che0812&uid=SamsungXSSDX840XEVOX120GB_S1BUNYAD800753X, Good: (Chrome.exe), Bad: ("C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" hxxp://www.amisites.com/?type=sc&ts=1483029066&z=d681314729ad7d82b93e03bgez3b3cfe1o3tfefq0b&from=che0812&uid=SamsungXSSDX840XEVOX120GB_S1BUNYAD800753X),,[42d708e54a50cf6700283d5d0af66b95]
PUP.Optional.Amisites.ShrtCln, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.amisites.com/?type=hp&ts=1483029066&z=d681314729ad7d82b93e03bgez3b3cfe1o3tfefq0b&from=che0812&uid=SamsungXSSDX840XEVOX120GB_S1BUNYAD800753X, Good: (www.google.com), Bad: (hxxp://www.amisites.com/?type=hp&ts=1483029066&z=d681314729ad7d82b93e03bgez3b3cfe1o3tfefq0b&from=che0812&uid=SamsungXSSDX840XEVOX120GB_S1BUNYAD800753X),,[0e0bfaf3fd9ded493008cdcdcc348878]
PUP.Optional.Amisites.ShrtCln, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.amisites.com/search/?type=ds&ts=1483029066&z=d681314729ad7d82b93e03bgez3b3cfe1o3tfefq0b&from=che0812&uid=SamsungXSSDX840XEVOX120GB_S1BUNYAD800753X&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://www.amisites.com/search/?type=ds&ts=1483029066&z=d681314729ad7d82b93e03bgez3b3cfe1o3tfefq0b&from=che0812&uid=SamsungXSSDX840XEVOX120GB_S1BUNYAD800753X&q={searchTerms}),,[1108af3e702a142273c57525e818d030]
PUP.Optional.Amisites.ShrtCln, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://www.amisites.com/search/?type=ds&ts=1483029066&z=d681314729ad7d82b93e03bgez3b3cfe1o3tfefq0b&from=che0812&uid=SamsungXSSDX840XEVOX120GB_S1BUNYAD800753X&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://www.amisites.com/search/?type=ds&ts=1483029066&z=d681314729ad7d82b93e03bgez3b3cfe1o3tfefq0b&from=che0812&uid=SamsungXSSDX840XEVOX120GB_S1BUNYAD800753X&q={searchTerms}),,[28f124c9d3c72c0a61d7d9c1f60aca36]
PUP.Optional.Amisites.ShrtCln, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.amisites.com/?type=hp&ts=1483029066&z=d681314729ad7d82b93e03bgez3b3cfe1o3tfefq0b&from=che0812&uid=SamsungXSSDX840XEVOX120GB_S1BUNYAD800753X, Good: (www.google.com), Bad: (hxxp://www.amisites.com/?type=hp&ts=1483029066&z=d681314729ad7d82b93e03bgez3b3cfe1o3tfefq0b&from=che0812&uid=SamsungXSSDX840XEVOX120GB_S1BUNYAD800753X),,[b564b637386269cdd860792127d9ca36]
PUP.Optional.Amisites.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\SHELL\OPEN\COMMAND, "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" hxxp://www.amisites.com/?type=sc&ts=1483029066&z=d681314729ad7d82b93e03bgez3b3cfe1o3tfefq0b&from=che0812&uid=SamsungXSSDX840XEVOX120GB_S1BUNYAD800753X, Good: (Chrome.exe), Bad: ("C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" hxxp://www.amisites.com/?type=sc&ts=1483029066&z=d681314729ad7d82b93e03bgez3b3cfe1o3tfefq0b&from=che0812&uid=SamsungXSSDX840XEVOX120GB_S1BUNYAD800753X),,[c7525a93e9b1c86ef434c1d932ce9070]
PUP.Optional.Amisites.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.amisites.com/?type=hp&ts=1483029066&z=d681314729ad7d82b93e03bgez3b3cfe1o3tfefq0b&from=che0812&uid=SamsungXSSDX840XEVOX120GB_S1BUNYAD800753X, Good: (www.google.com), Bad: (hxxp://www.amisites.com/?type=hp&ts=1483029066&z=d681314729ad7d82b93e03bgez3b3cfe1o3tfefq0b&from=che0812&uid=SamsungXSSDX840XEVOX120GB_S1BUNYAD800753X),,[8396ed004654ee487eba6f2ba060966a]
PUP.Optional.Amisites.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.amisites.com/search/?type=ds&ts=1483029066&z=d681314729ad7d82b93e03bgez3b3cfe1o3tfefq0b&from=che0812&uid=SamsungXSSDX840XEVOX120GB_S1BUNYAD800753X&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://www.amisites.com/search/?type=ds&ts=1483029066&z=d681314729ad7d82b93e03bgez3b3cfe1o3tfefq0b&from=che0812&uid=SamsungXSSDX840XEVOX120GB_S1BUNYAD800753X&q={searchTerms}),,[6eab12db6f2bd85e3404dbbf4eb20af6]
PUP.Optional.Amisites.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://www.amisites.com/search/?type=ds&ts=1483029066&z=d681314729ad7d82b93e03bgez3b3cfe1o3tfefq0b&from=che0812&uid=SamsungXSSDX840XEVOX120GB_S1BUNYAD800753X&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://www.amisites.com/search/?type=ds&ts=1483029066&z=d681314729ad7d82b93e03bgez3b3cfe1o3tfefq0b&from=che0812&uid=SamsungXSSDX840XEVOX120GB_S1BUNYAD800753X&q={searchTerms}),,[4acfa944c0da1e1871c70793b848e11f]
PUP.Optional.Amisites.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.amisites.com/?type=hp&ts=1483029066&z=d681314729ad7d82b93e03bgez3b3cfe1o3tfefq0b&from=che0812&uid=SamsungXSSDX840XEVOX120GB_S1BUNYAD800753X, Good: (www.google.com), Bad: (hxxp://www.amisites.com/?type=hp&ts=1483029066&z=d681314729ad7d82b93e03bgez3b3cfe1o3tfefq0b&from=che0812&uid=SamsungXSSDX840XEVOX120GB_S1BUNYAD800753X),,[df3aec015d3d39fde652148623ddbd43]
PUP.Optional.Amisites.ShrtCln, HKU\S-1-5-21-1495893475-136969731-4274491207-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.amisites.com/?type=hp&ts=1483029066&z=d681314729ad7d82b93e03bgez3b3cfe1o3tfefq0b&from=che0812&uid=SamsungXSSDX840XEVOX120GB_S1BUNYAD800753X, Good: (www.google.com), Bad: (hxxp://www.amisites.com/?type=hp&ts=1483029066&z=d681314729ad7d82b93e03bgez3b3cfe1o3tfefq0b&from=che0812&uid=SamsungXSSDX840XEVOX120GB_S1BUNYAD800753X),,[b564c726b4e6d85ecc6be5b5b947f50b]
PUP.Optional.Amisites.ShrtCln, HKU\S-1-5-21-1495893475-136969731-4274491207-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.amisites.com/?type=hp&ts=1483029066&z=d681314729ad7d82b93e03bgez3b3cfe1o3tfefq0b&from=che0812&uid=SamsungXSSDX840XEVOX120GB_S1BUNYAD800753X, Good: (www.google.com), Bad: (hxxp://www.amisites.com/?type=hp&ts=1483029066&z=d681314729ad7d82b93e03bgez3b3cfe1o3tfefq0b&from=che0812&uid=SamsungXSSDX840XEVOX120GB_S1BUNYAD800753X),,[9d7cac41b7e3989ef1460c8ee31d7b85]
PUP.Optional.Amisites.ShrtCln, HKU\S-1-5-21-1495893475-136969731-4274491207-1001_Classes\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\STORAGE\MICROSOFT.MICROSOFTEDGE_8WEKYB3D8BBWE\MICROSOFTEDGE\MAIN|HomeButtonPage, hxxp://www.amisites.com/?type=hp&ts=1483029066&z=d681314729ad7d82b93e03bgez3b3cfe1o3tfefq0b&from=che0812&uid=SamsungXSSDX840XEVOX120GB_S1BUNYAD800753X, Good: (hxxp://www.google.com), Bad: (hxxp://www.amisites.com/?type=hp&ts=1483029066&z=d681314729ad7d82b93e03bgez3b3cfe1o3tfefq0b&from=che0812&uid=SamsungXSSDX840XEVOX120GB_S1BUNYAD800753X),,[ef2af3fac4d6023436e2297148b8cf31]

Folders: 7
PUP.Optional.Elex, C:\Program Files (x86)\WinArcher, , [d742628b5b3f45f19f930c66ae520df3],
PUP.Optional.Elex, C:\ProgramData\WinSAPSvc, , [8693de0fd3c7a09601917cfd936d629e],
PUP.Optional.Elex, C:\ProgramData\WinSAPSvc\winsap_update, , [8693de0fd3c7a09601917cfd936d629e],
PUP.Optional.WinTool, C:\ProgramData\wintools, , [78a13bb2dcbeca6ced4a8d1fdc24ae52],
Adware.Elex.Generic, C:\Users\Bjarne\AppData\Roaming\beibe, , [0e0b25c8079368ced2d36f431de353ad],
Adware.Elex, C:\Program Files (x86)\Gubed, , [16039558b9e19f97adeaf6d041bf44bc],
Adware.Elex, C:\Program Files (x86)\Gubed_WMI, , [09101fce3d5da1951274ebdb1de3dd23],

Files: 18
Adware.Elex, C:\Program Files (x86)\Common Files\Services\iThemes.dll, , [8d8cdf0e2a700e2872c75d3f9c645aa6],
PUP.Optional.WinTool, C:\ProgramData\wintools\wintool.exe, , [c85131bc0a9053e3e7ea149a90709f61],
PUP.Optional.Elex, C:\Program Files (x86)\WinArcher\Archer.dll, , [d742628b5b3f45f19f930c66ae520df3],
PUP.Optional.Elex, C:\ProgramData\WinSAPSvc\WinSAP.dll, , [8693de0fd3c7a09601917cfd936d629e],
PUP.Optional.Elex, C:\ProgramData\WinSAPSvc\winsap_update\data.bin, , [8693de0fd3c7a09601917cfd936d629e],
PUP.Optional.Amisites.ShrtCln, C:\Users\Bjarne\AppData\Roaming\Mozilla\Firefox\Profiles\lq3c9q6n.default\searchplugins\amisites.xml, , [9f7a89645a40ea4c0857dac034cc718f],
PUP.Optional.WinTool, C:\Windows\System32\Tasks\WinTOOL, , [8990c12cf3a7c274df50eebeed13847c],
PUP.Optional.WinTool, C:\ProgramData\wintools\UPDATEMODULE.EXE, , [78a13bb2dcbeca6ced4a8d1fdc24ae52],
PUP.Optional.WinTool, C:\ProgramData\wintools\CHROME_DATA, , [78a13bb2dcbeca6ced4a8d1fdc24ae52],
PUP.Optional.WinTool, C:\ProgramData\wintools\Down.log, , [78a13bb2dcbeca6ced4a8d1fdc24ae52],
PUP.Optional.WinTool, C:\ProgramData\wintools\icc.dll, , [78a13bb2dcbeca6ced4a8d1fdc24ae52],
PUP.Optional.WinTool, C:\ProgramData\wintools\sqlite3.dll, , [78a13bb2dcbeca6ced4a8d1fdc24ae52],
Adware.Elex.Generic, C:\Users\Bjarne\AppData\Roaming\beibe\UVCONVERTER.EXE, , [0e0b25c8079368ced2d36f431de353ad],
Adware.Elex.Generic, C:\Users\Bjarne\AppData\Roaming\beibe\main, , [0e0b25c8079368ced2d36f431de353ad],
Adware.Elex.Generic, C:\Users\Bjarne\AppData\Roaming\beibe\UniKeyNT.exe, , [0e0b25c8079368ced2d36f431de353ad],
Adware.Elex, C:\Program Files (x86)\Gubed\GubedZL.dll, , [16039558b9e19f97adeaf6d041bf44bc],
Adware.Elex, C:\Program Files (x86)\Gubed_WMI\GUBED_WMI.EXE, , [d148d4191d7dfb3badc27650dc240ff1],
PUP.Optional.Amisites.ShrtCln, C:\Users\Bjarne\AppData\Roaming\Mozilla\Firefox\Profiles\lq3c9q6n.default\prefs.js, Good: (user_pref("browser.startup.homepage", "https://www.malwarebytes.org/restorebrowser/), Bad: (user_pref("browser.startup.homepage", "hxxp://www.amisites.com/?type=hp&ts=1483029066&z=d681314729ad7d82b93e03bgez3b3cfe1o3tfefq0b&from=che0812&uid=SamsungXSSDX840XEVOX120GB_S1BUNYAD800753X"), ,[54c5b637bae0f6402e33058de51b56aa]

Physical Sectors: 0
(No malicious items detected)


(end)

Hoffe, dass das nicht zu viel Spam ist und danke im Voraus

LG