Hat dir diese Antwort geholfen?
1 Leser hat sich bedankt
Okay, hab mal Malwarebytes drüber laufen lassen.
Infizierte Dateien:0
avast! hat jedoch einen JS:Iframe-EX [Tri] gefunden. Keine Ahnung was das ist.
der Virus befindet sich in:
E:\Documents and Settings\Dave\Local Settings\Application Data\Mozilla\Firefox\Profiles\22s6c9iz.default\Cache\5\9E\2A3BEd01
Zum AdwCleaner:
hier ist der Log
Zitat
# AdwCleaner v2.003 - Logfile created 10/03/2012 at 20:23:35
# Updated 23/09/2012 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : Dave - DAVE-D051D08F78
# Boot Mode : Normal
# Running from : E:\Documents and Settings\Dave\My Documents\Downloads\adwcleaner.exe
# Option [Search]
***** [Services] *****
Found : Browser Manager
***** [Files / Folders] *****
File Found : E:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
File Found : E:\user.js
Folder Found : E:\Documents and Settings\All Users\Application Data\Babylon
Folder Found : E:\Documents and Settings\All Users\Application Data\Browser Manager
Folder Found : E:\Documents and Settings\Dave\Application Data\Babylon
Folder Found : E:\Documents and Settings\Dave\Start Menu\Programs\Browser Manager
***** [Registry] *****
Data Found : HKLM\..\Windows [AppInit_DLLs] = e:\docume~1\alluse~1\applic~1\browse~1\22643~1.41\{16cdf~1\browse~1.dll
Key Found : HKCU\Software\BrowserMngr
Key Found : HKCU\Software\DataMngr
Key Found : HKCU\Software\DataMngr_Toolbar
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Found : HKLM\Software\Babylon
Key Found : HKLM\Software\BabylonToolbar
Key Found : HKLM\Software\BrowserMngr
Key Found : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Key Found : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Key Found : HKLM\Software\DataMngr
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\BabylonToolbar
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693}
Key Found : HKU\S-1-5-21-1409082233-1343024091-1606980848-1003\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Value Found : HKCU\Software\Mozilla\Firefox\Extensions [{b64982b1-d112-42b5-b1e4-d3867c4533f8}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{98889811-442D-49DD-99D7-DC866BE87DBC}]
***** [Internet Browsers] *****
-\\ Internet Explorer v8.0.6001.18702
[HKCU\Software\Microsoft\Internet Explorer\Main - BrowserMngr Start Page] = hxxp://search.babylon.com/?affID=115303&tt=270912_7a_3912_6&babsrc=HP_ss&mntrId=000000000000000000000013d3f1c328
[HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://search.babylon.com/?affID=115303&tt=270912_7a_3912_6&babsrc=NT_ss&mntrId=000000000000000000000013d3f1c328
-\\ Mozilla Firefox v15.0.1 (de)
Profile name : default
File : E:\Documents and Settings\Dave\Application Data\Mozilla\Firefox\Profiles\22s6c9iz.default\prefs.js
Found : user_pref("browser.search.defaultenginename", "Search the web (Babylon)");
Found : user_pref("browser.search.order.1", "Search the web (Babylon)");
Found : user_pref("browser.startup.homepage", "hxxp://search.babylon.com/?affID=115303&tt=270912_7a_3912_6&b[...]
*************************
AdwCleaner[R1].txt - [3608 octets] - [03/10/2012 20:23:35]
########## EOF - E:\AdwCleaner[R1].txt - [3668 octets] ##########
