browser schliesst bei sicherheitsdownloads

#1 hallo!

leider kenne ich mich nicht so gut aus und hoffe deshalb auf etwas hilfe...
wenn ich meinen browser öffne, egal ob i.e. oder mozilla, schliesst sich dieser gleich wieder,wenn ich zum beispiel ein antivirenprogramm downloaden möchte.
alles was nur irgendwie mit sicherheit zu tun hat (selbst wenn ich es nur ins google eingebe),lässt den browser sofort schliessen...
abgesehen davon werden meine aufgerufenen seiten oft zu andern umgeleitet, bzw. rufen sich selber seiten auf.

mein pc ist gestern neu aufgesetzt worden (neu formatiert und so. ich habe windows xp). es hat aber ein antivirenprogramm gefehlt. wie ich das installieren wollte, hat sich auch da sofort das fenster geschlossen, obwohl ich es von einer cd installieren wollte...

kann mir vielleicht jemand weiterhelfen?
vielen dank schon mal!

ps: habe mal spyware doctor drüberlaufen lassen, vielleicht helfen ja diese informationen...der hat 503 infizierungen gefunden, das ist wohl zuviel um hier reinzukopieren...
leider kenne ich mich nicht aus, welche informationen überhaupt hilfreich wären...
der logfile von ad aware hat folgendes ergeben:


Ad-Aware SE Build 1.06r1
Logfile Created on:Sonntag, 08. Oktober 2006 14:07:08
Created with Ad-Aware SE Personal, free for private use.
Using definitions file:SE1R125 06.10.2006
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

References detected during the scan:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Adware.Look2Me(TAC index:7):2 total references
Alexa(TAC index:5):10 total references
CoolWebSearch(TAC index:10):12 total references
IEHijacker.ZestyFind(TAC index:6):1 total references
MRU List(TAC index:0):14 total references
Other(TAC index:5):2 total references
Possible Browser Hijack attempt(TAC index:3):13 total references
Tracking Cookie(TAC index:3):3 total references
UCmore(TAC index:3):26 total references
WinAntiVirusPro(TAC index:10):6 total references
Windows(TAC index:3):1 total references
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Ad-Aware SE Settings
===========================
Set : Search for negligible risk entries
Set : Search for low-risk Thread
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan my Hosts file

Extended Ad-Aware SE Settings
===========================
Set : Unload recognized processes & modules during scan
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : During removal, unload Explorer and IE if necessary
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include reference summary in log file
Set : Include alternate data stream details in log file
Set : Play sound at scan completion if scan locates critical objects


08.10.2006 14:07:08 - Scan started. (Full System Scan)

MRU List Object Recognized!
Location: : C:\Dokumente und Einstellungen\Tania\recent
Description : list of recently opened documents


MRU List Object Recognized!
Location: : software\microsoft\directdraw\mostrecentapplication
Description : most recent application to use microsoft directdraw


MRU List Object Recognized!
Location: : S-1-5-21-1229272821-1563985344-1417001333-1003\software\microsoft\internet explorer
Description : last download directory used in microsoft internet explorer


MRU List Object Recognized!
Location: : S-1-5-21-1229272821-1563985344-1417001333-1003\software\microsoft\internet explorer\typedurls
Description : list of recently entered addresses in microsoft internet explorer


MRU List Object Recognized!
Location: : .DEFAULT\software\microsoft\mediaplayer\preferences
Description : last playlist loaded in microsoft windows media player


MRU List Object Recognized!
Location: : S-1-5-18\software\microsoft\mediaplayer\preferences
Description : last playlist loaded in microsoft windows media player


MRU List Object Recognized!
Location: : S-1-5-19\software\microsoft\mediaplayer\preferences
Description : last playlist loaded in microsoft windows media player


MRU List Object Recognized!
Location: : S-1-5-20\software\microsoft\mediaplayer\preferences
Description : last playlist loaded in microsoft windows media player


MRU List Object Recognized!
Location: : S-1-5-21-1229272821-1563985344-1417001333-1003\software\microsoft\search assistant\acmru
Description : list of recent search terms used with the search assistant


MRU List Object Recognized!
Location: : S-1-5-21-1229272821-1563985344-1417001333-1003\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru
Description : list of recent programs opened


MRU List Object Recognized!
Location: : S-1-5-21-1229272821-1563985344-1417001333-1003\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru
Description : list of recently saved files, stored according to file extension


MRU List Object Recognized!
Location: : .DEFAULT\software\microsoft\windows media\wmsdk\general
Description : windows media sdk


MRU List Object Recognized!
Location: : S-1-5-18\software\microsoft\windows media\wmsdk\general
Description : windows media sdk


MRU List Object Recognized!
Location: : S-1-5-21-1229272821-1563985344-1417001333-1003\software\microsoft\windows media\wmsdk\general
Description : windows media sdk


Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

#:1 [smss.exe]
FilePath : \SystemRoot\System32\
ProcessID : 656
ThreadCreationTime : 08.10.2006 10:06:34
BasePriority : Normal


#:2 [winlogon.exe]
FilePath : \??\C:\WINDOWS\system32\
ProcessID : 728
ThreadCreationTime : 08.10.2006 10:06:37
BasePriority : High


Adware.Look2Me Object Recognized!
Type : Process
Data : s4rs0e97eh.dll
TAC Rating : 7
Category : Adware
Comment : iieshare.dll.dmp
Object : C:\WINDOWS\system32\


Warning! Adware.Look2Me Object found in memory(C:\WINDOWS\system32\s4rs0e97eh.dll)


#:3 [services.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 772
ThreadCreationTime : 08.10.2006 10:06:38
BasePriority : Normal
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
ProductName : Betriebssystem Microsoft® Windows®
CompanyName : Microsoft Corporation
FileDescription : Anwendung für Dienste und Controller
InternalName : services.exe
LegalCopyright : © Microsoft Corporation. Alle Rechte vorbehalten.
OriginalFilename : services.exe

#:4 [lsass.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 784
ThreadCreationTime : 08.10.2006 10:06:38
BasePriority : Normal
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : LSA Shell (Export Version)
InternalName : lsass.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : lsass.exe

#:5 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 976
ThreadCreationTime : 08.10.2006 10:06:38
BasePriority : Normal
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:6 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1104
ThreadCreationTime : 08.10.2006 10:06:38
BasePriority : Normal
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:7 [spoolsv.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 1460
ThreadCreationTime : 08.10.2006 10:06:39
BasePriority : Normal
FileVersion : 5.1.2600.0 (XPClient.010817-1148)
ProductVersion : 5.1.2600.0
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Spooler SubSystem App
InternalName : spoolsv.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : spoolsv.exe

#:8 [ati2evxx.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1548
ThreadCreationTime : 08.10.2006 10:06:39
BasePriority : Normal


#:9 [lsyss.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 1600
ThreadCreationTime : 08.10.2006 10:06:39
BasePriority : Normal


#:10 [slserv.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 1684
ThreadCreationTime : 08.10.2006 10:06:40
BasePriority : Normal
FileVersion : 2.80.00(24Apr2000)
ProductVersion : 2.80.00
ProductName : Modem
FileDescription : User-Level Modem Service
InternalName : slserv
LegalCopyright : Copyright © 1999-2000
OriginalFilename : slserv.exe

#:11 [mguard.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 344
ThreadCreationTime : 08.10.2006 10:06:48
BasePriority : Normal


#:12 [pwr.exe]
FilePath : c:\windows\
ProcessID : 2860
ThreadCreationTime : 08.10.2006 10:07:00
BasePriority : Normal
FileVersion : 1.00
ProductVersion : 1.00
ProductName : Project1
InternalName : pow
OriginalFilename : pow.exe

#:13 [mscfg.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 2960
ThreadCreationTime : 08.10.2006 10:07:01
BasePriority : Normal


#:14 [pwr.exe]
FilePath : c:\windows\
ProcessID : 3340
ThreadCreationTime : 08.10.2006 10:07:04
BasePriority : Normal
FileVersion : 1.00
ProductVersion : 1.00
ProductName : Project1
InternalName : pow
OriginalFilename : pow.exe

#:15 [explorer.exe]
FilePath : C:\WINDOWS\
ProcessID : 3680
ThreadCreationTime : 08.10.2006 10:07:05
BasePriority : Normal
FileVersion : 6.00.2600.0000 (xpclient.010817-1148)
ProductVersion : 6.00.2600.0000
ProductName : Betriebssystem Microsoft® Windows®
CompanyName : Microsoft Corporation
FileDescription : Windows Explorer
InternalName : explorer
LegalCopyright : © Microsoft Corporation. Alle Rechte vorbehalten.
OriginalFilename : EXPLORER.EXE

#:16 [sgmain.exe]
FilePath : D:\Programme\SpywareGuard\
ProcessID : 1324
ThreadCreationTime : 08.10.2006 10:12:07
BasePriority : Normal
FileVersion : 2.02.0001
ProductVersion : 2.02.0001
ProductName : SpywareGuard
FileDescription : SpywareGuard
InternalName : sgmain
LegalCopyright : Copyright (C) 2002-2003 Javacool Software LLC
OriginalFilename : sgmain.exe
Comments : SpywareGuard

#:17 [sgbhp.exe]
FilePath : D:\Programme\SpywareGuard\
ProcessID : 1320
ThreadCreationTime : 08.10.2006 10:12:08
BasePriority : Normal
FileVersion : 2.02.0001
ProductVersion : 2.02.0001
ProductName : SG Browser Hijacking Protection
FileDescription : SG Browser Hijacking Protection
InternalName : sgbhp
LegalCopyright : Copyright (C) 2002-2003 Javacool Software LLC.
OriginalFilename : sgbhp.exe
Comments : SG Browser Hijacking Protection

#:18 [pwr.exe]
FilePath : c:\windows\
ProcessID : 852
ThreadCreationTime : 08.10.2006 10:13:45
BasePriority : Normal
FileVersion : 1.00
ProductVersion : 1.00
ProductName : Project1
InternalName : pow
OriginalFilename : pow.exe

#:19 [pwr.exe]
FilePath : c:\windows\
ProcessID : 3356
ThreadCreationTime : 08.10.2006 10:20:24
BasePriority : Normal
FileVersion : 1.00
ProductVersion : 1.00
ProductName : Project1
InternalName : pow
OriginalFilename : pow.exe

#:20 [pwr.exe]
FilePath : c:\windows\
ProcessID : 2544
ThreadCreationTime : 08.10.2006 10:27:03
BasePriority : Normal
FileVersion : 1.00
ProductVersion : 1.00
ProductName : Project1
InternalName : pow
OriginalFilename : pow.exe

#:21 [pwr.exe]
FilePath : c:\windows\
ProcessID : 2992
ThreadCreationTime : 08.10.2006 10:33:42
BasePriority : Normal
FileVersion : 1.00
ProductVersion : 1.00
ProductName : Project1
InternalName : pow
OriginalFilename : pow.exe

#:22 [pwr.exe]
FilePath : c:\windows\
ProcessID : 460
ThreadCreationTime : 08.10.2006 10:40:20
BasePriority : Normal
FileVersion : 1.00
ProductVersion : 1.00
ProductName : Project1
InternalName : pow
OriginalFilename : pow.exe

#:23 [pwr.exe]
FilePath : c:\windows\
ProcessID : 468
ThreadCreationTime : 08.10.2006 10:47:01
BasePriority : Normal
FileVersion : 1.00
ProductVersion : 1.00
ProductName : Project1
InternalName : pow
OriginalFilename : pow.exe

#:24 [pwr.exe]
FilePath : c:\windows\
ProcessID : 1924
ThreadCreationTime : 08.10.2006 10:53:42
BasePriority : Normal
FileVersion : 1.00
ProductVersion : 1.00
ProductName : Project1
InternalName : pow
OriginalFilename : pow.exe

#:25 [sdhelp.exe]
FilePath : D:\Programme\Spyware Doctor\
ProcessID : 572
ThreadCreationTime : 08.10.2006 11:00:20
BasePriority : Normal
FileVersion : 3.6.0.2025
ProductVersion : 3.6
ProductName : Spyware Doctor
CompanyName : PC Tools Research Pty Ltd

#:26 [pwr.exe]
FilePath : c:\windows\
ProcessID : 1436
ThreadCreationTime : 08.10.2006 11:00:21
BasePriority : Normal
FileVersion : 1.00
ProductVersion : 1.00
ProductName : Project1
InternalName : pow
OriginalFilename : pow.exe

#:27 [swdoctor.exe]
FilePath : D:\Programme\Spyware Doctor\
ProcessID : 2644
ThreadCreationTime : 08.10.2006 11:01:58
BasePriority : Normal
FileVersion : 4.0.0.2618
ProductVersion : 3.6
ProductName : Spyware Doctor
CompanyName : PC Tools Research Pty Ltd
FileDescription : Spyware Doctor
InternalName : Spyware Doctor
LegalCopyright : Copyright (c) 2005. Distributed by PC Tools Research Pty Ltd
OriginalFilename : swdoctor.exe

#:28 [pwr.exe]
FilePath : c:\windows\
ProcessID : 1880
ThreadCreationTime : 08.10.2006 11:06:57
BasePriority : Normal
FileVersion : 1.00
ProductVersion : 1.00
ProductName : Project1
InternalName : pow
OriginalFilename : pow.exe

#:29 [pwr.exe]
FilePath : c:\windows\
ProcessID : 3772
ThreadCreationTime : 08.10.2006 11:13:34
BasePriority : Normal
FileVersion : 1.00
ProductVersion : 1.00
ProductName : Project1
InternalName : pow
OriginalFilename : pow.exe

#:30 [pwr.exe]
FilePath : c:\windows\
ProcessID : 1304
ThreadCreationTime : 08.10.2006 11:20:09
BasePriority : Normal
FileVersion : 1.00
ProductVersion : 1.00
ProductName : Project1
InternalName : pow
OriginalFilename : pow.exe

#:31 [pwr.exe]
FilePath : c:\windows\
ProcessID : 4040
ThreadCreationTime : 08.10.2006 11:26:48
BasePriority : Normal
FileVersion : 1.00
ProductVersion : 1.00
ProductName : Project1
InternalName : pow
OriginalFilename : pow.exe

#:32 [pwr.exe]
FilePath : c:\windows\
ProcessID : 3280
ThreadCreationTime : 08.10.2006 11:33:23
BasePriority : Normal
FileVersion : 1.00
ProductVersion : 1.00
ProductName : Project1
InternalName : pow
OriginalFilename : pow.exe

#:33 [pwr.exe]
FilePath : c:\windows\
ProcessID : 5280
ThreadCreationTime : 08.10.2006 11:40:03
BasePriority : Normal
FileVersion : 1.00
ProductVersion : 1.00
ProductName : Project1
InternalName : pow
OriginalFilename : pow.exe

#:34 [iexplore.exe]
FilePath : C:\Programme\Internet Explorer\
ProcessID : 556
ThreadCreationTime : 08.10.2006 11:46:06
BasePriority : Normal
FileVersion : 6.00.2600.0000 (xpclient.010817-1148)
ProductVersion : 6.00.2600.0000
ProductName : Betriebssystem Microsoft® Windows®
CompanyName : Microsoft Corporation
FileDescription : Internet Explorer
InternalName : iexplore
LegalCopyright : © Microsoft Corporation. Alle Rechte vorbehalten.
OriginalFilename : IEXPLORE.EXE

#:35 [pwr.exe]
FilePath : c:\windows\
ProcessID : 4688
ThreadCreationTime : 08.10.2006 11:46:43
BasePriority : Normal
FileVersion : 1.00
ProductVersion : 1.00
ProductName : Project1
InternalName : pow
OriginalFilename : pow.exe

#:36 [rundll32.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 5608
ThreadCreationTime : 08.10.2006 11:49:45
BasePriority : Normal
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
ProductName : Betriebssystem Microsoft® Windows®
CompanyName : Microsoft Corporation
FileDescription : Eine DLL-Datei als Anwendung ausführen
InternalName : rundll
LegalCopyright : © Microsoft Corporation. Alle Rechte vorbehalten.
OriginalFilename : RUNDLL.EXE

Adware.Look2Me Object Recognized!
Type : Process
Data : guard.tmp
TAC Rating : 7
Category : Adware
Comment : iieshare.dll.dmp
Object : C:\WINDOWS\system32\


Warning! Adware.Look2Me Object found in memory(C:\WINDOWS\system32\guard.tmp)

"C:\WINDOWS\system32\rundll32.exe"Process terminated successfully

#:37 [pwr.exe]
FilePath : c:\windows\
ProcessID : 4836
ThreadCreationTime : 08.10.2006 11:53:23
BasePriority : Normal
FileVersion : 1.00
ProductVersion : 1.00
ProductName : Project1
InternalName : pow
OriginalFilename : pow.exe

#:38 [firefox.exe]
FilePath : C:\PROGRA~1\MOZILL~1\
ProcessID : 4612
ThreadCreationTime : 08.10.2006 11:57:54
BasePriority : Normal


#:39 [pwr.exe]
FilePath : c:\windows\
ProcessID : 6076
ThreadCreationTime : 08.10.2006 12:00:03
BasePriority : Normal
FileVersion : 1.00
ProductVersion : 1.00
ProductName : Project1
InternalName : pow
OriginalFilename : pow.exe

#:40 [ad-aware.exe]
FilePath : D:\Programme\Lavasoft\Ad-Aware SE Personal\
ProcessID : 5996
ThreadCreationTime : 08.10.2006 12:06:26
BasePriority : Normal
FileVersion : 6.2.0.236
ProductVersion : SE 106
ProductName : Lavasoft Ad-Aware SE
CompanyName : Lavasoft Sweden
FileDescription : Ad-Aware SE Core application
InternalName : Ad-Aware.exe
LegalCopyright : Copyright © Lavasoft AB Sweden
OriginalFilename : Ad-Aware.exe
Comments : All Rights Reserved

#:41 [pwr.exe]
FilePath : c:\windows\
ProcessID : 3352
ThreadCreationTime : 08.10.2006 12:06:43
BasePriority : Normal
FileVersion : 1.00
ProductVersion : 1.00
ProductName : Project1
InternalName : pow
OriginalFilename : pow.exe

Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 16


Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

UCmore Object Recognized!
Type : Regkey
Data :
TAC Rating : 3
Category : Data Miner
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : clsid\{44be0690-5429-47f0-85bb-3ffd8020233e}

UCmore Object Recognized!
Type : Regkey
Data :
TAC Rating : 3
Category : Data Miner
Comment :
Rootkey : HKEY_USERS
Object : .DEFAULT\software\maxthon\plugin\toolbar\{44be0690-5429-47f0-85bb-3ffd8020233e}

UCmore Object Recognized!
Type : Regkey
Data :
TAC Rating : 3
Category : Data Miner
Comment :
Rootkey : HKEY_USERS
Object : S-1-5-18\software\maxthon\plugin\toolbar\{44be0690-5429-47f0-85bb-3ffd8020233e}

Alexa Object Recognized!
Type : Regkey
Data :
TAC Rating : 5
Category : Data Miner
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}

Alexa Object Recognized!
Type : RegValue
Data :
TAC Rating : 5
Category : Data Miner
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
Value : MenuStatusBar

Alexa Object Recognized!
Type : RegValue
Data :
TAC Rating : 5
Category : Data Miner
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
Value : Script

Alexa Object Recognized!
Type : RegValue
Data :
TAC Rating : 5
Category : Data Miner
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
Value : clsid

Alexa Object Recognized!
Type : RegValue
Data :
TAC Rating : 5
Category : Data Miner
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
Value : Icon

Alexa Object Recognized!
Type : RegValue
Data :
TAC Rating : 5
Category : Data Miner
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
Value : HotIcon

Alexa Object Recognized!
Type : RegValue
Data :
TAC Rating : 5
Category : Data Miner
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
Value : ButtonText

UCmore Object Recognized!
Type : Regkey
Data :
TAC Rating : 3
Category : Data Miner
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\uninstall\ucmore - the search accelerator

UCmore Object Recognized!
Type : RegValue
Data :
TAC Rating : 3
Category : Data Miner
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\uninstall\ucmore - the search accelerator
Value : UninstallString

UCmore Object Recognized!
Type : RegValue
Data :
TAC Rating : 3
Category : Data Miner
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\uninstall\ucmore - the search accelerator
Value : DisplayVersion

UCmore Object Recognized!
Type : RegValue
Data :
TAC Rating : 3
Category : Data Miner
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\uninstall\ucmore - the search accelerator
Value : HelpLink

UCmore Object Recognized!
Type : RegValue
Data :
TAC Rating : 3
Category : Data Miner
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\uninstall\ucmore - the search accelerator
Value : Publisher

UCmore Object Recognized!
Type : RegValue
Data :
TAC Rating : 3
Category : Data Miner
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\uninstall\ucmore - the search accelerator
Value : URLInfoAbout

UCmore Object Recognized!
Type : RegValue
Data :
TAC Rating : 3
Category : Data Miner
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\uninstall\ucmore - the search accelerator
Value : Contact

UCmore Object Recognized!
Type : RegValue
Data :
TAC Rating : 3
Category : Data Miner
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\uninstall\ucmore - the search accelerator
Value : Comments

UCmore Object Recognized!
Type : RegValue
Data :
TAC Rating : 3
Category : Data Miner
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\uninstall\ucmore - the search accelerator
Value : DisplayIcon

Alexa Object Recognized!
Type : RegValue
Data :
TAC Rating : 5
Category : Data Miner
Comment : "{c95fe080-8f5d-11d2-a20b-00aa003c157a}"
Rootkey : HKEY_USERS
Object : .DEFAULT\software\microsoft\internet explorer\extensions\cmdmapping
Value : {c95fe080-8f5d-11d2-a20b-00aa003c157a}

Alexa Object Recognized!
Type : RegValue
Data :
TAC Rating : 5
Category : Data Miner
Comment : "{c95fe080-8f5d-11d2-a20b-00aa003c157a}"
Rootkey : HKEY_USERS
Object : S-1-5-18\software\microsoft\internet explorer\extensions\cmdmapping
Value : {c95fe080-8f5d-11d2-a20b-00aa003c157a}

Alexa Object Recognized!
Type : RegValue
Data :
TAC Rating : 5
Category : Data Miner
Comment : "{c95fe080-8f5d-11d2-a20b-00aa003c157a}"
Rootkey : HKEY_USERS
Object : S-1-5-21-1229272821-1563985344-1417001333-1003\software\microsoft\internet explorer\extensions\cmdmapping
Value : {c95fe080-8f5d-11d2-a20b-00aa003c157a}

CoolWebSearch Object Recognized!
Type : RegValue
Data :
TAC Rating : 10
Category : Malware
Comment : "HOMEOldSP"
Rootkey : HKEY_USERS
Object : S-1-5-21-1229272821-1563985344-1417001333-1003\software\microsoft\internet explorer\main
Value : HOMEOldSP

UCmore Object Recognized!
Type : RegValue
Data :
TAC Rating : 3
Category : Data Miner
Comment : "{44BE0690-5429-47f0-85BB-3FFD8020233E}"
Rootkey : HKEY_USERS
Object : .DEFAULT\software\microsoft\internet explorer\toolbar
Value : {44BE0690-5429-47f0-85BB-3FFD8020233E}

UCmore Object Recognized!
Type : RegValue
Data :
TAC Rating : 3
Category : Data Miner
Comment : "{44BE0690-5429-47f0-85BB-3FFD8020233E}"
Rootkey : HKEY_USERS
Object : S-1-5-18\software\microsoft\internet explorer\toolbar
Value : {44BE0690-5429-47f0-85BB-3FFD8020233E}

UCmore Object Recognized!
Type : RegValue
Data :
TAC Rating : 3
Category : Data Miner
Comment : "{44BE0690-5429-47F0-85BB-3FFD8020233E}"
Rootkey : HKEY_USERS
Object : .DEFAULT\software\microsoft\internet explorer\toolbar\webbrowser
Value : {44BE0690-5429-47F0-85BB-3FFD8020233E}

UCmore Object Recognized!
Type : RegValue
Data :
TAC Rating : 3
Category : Data Miner
Comment : "{44BE0690-5429-47F0-85BB-3FFD8020233E}"
Rootkey : HKEY_USERS
Object : S-1-5-18\software\microsoft\internet explorer\toolbar\webbrowser
Value : {44BE0690-5429-47F0-85BB-3FFD8020233E}

Windows Object Recognized!
Type : RegData
Data : explorer.exe mguard.exe
TAC Rating : 3
Category : Vulnerability
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows nt\currentversion\winlogon
Value : Shell
Data : explorer.exe mguard.exe

Registry Scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 28
Objects found so far: 44


Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Possible Browser Hijack attempt : Software\Microsoft\Internet Explorer\MainSearch Page.findthewebsiteyouneed.com

Possible Browser Hijack attempt Object Recognized!
Type : RegData
Data : "http://searchbar.findthewebsiteyouneed.com"
TAC Rating : 3
Category : Vulnerability
Comment : Possible Browser Hijack attempt
Rootkey : HKEY_LOCAL_MACHINE
Object : Software\Microsoft\Internet Explorer\Main
Value : Search Page
Data : "http://searchbar.findthewebsiteyouneed.com"
Possible Browser Hijack attempt : Software\Microsoft\Internet Explorer\SearchSearchAssistant.findthewebsiteyouneed.com

Possible Browser Hijack attempt Object Recognized!
Type : RegData
Data : "http://searchbar.findthewebsiteyouneed.com"
TAC Rating : 3
Category : Vulnerability
Comment : Possible Browser Hijack attempt
Rootkey : HKEY_LOCAL_MACHINE
Object : Software\Microsoft\Internet Explorer\Search
Value : SearchAssistant
Data : "http://searchbar.findthewebsiteyouneed.com"
Possible Browser Hijack attempt : .DEFAULT\Software\Microsoft\Internet Explorer\MainSearch Page.findthewebsiteyouneed.com

Possible Browser Hijack attempt Object Recognized!
Type : RegData
Data : "http://searchbar.findthewebsiteyouneed.com"
TAC Rating : 3
Category : Vulnerability
Comment : Possible Browser Hijack attempt
Rootkey : HKEY_USERS
Object : .DEFAULT\Software\Microsoft\Internet Explorer\Main
Value : Search Page
Data : "http://searchbar.findthewebsiteyouneed.com"
Possible Browser Hijack attempt : .DEFAULT\Software\Microsoft\Internet Explorer\MainStart Page.findthewebsiteyouneed.com

Possible Browser Hijack attempt Object Recognized!
Type : RegData
Data : "http://www.findthewebsiteyouneed.com"
TAC Rating : 3
Category : Vulnerability
Comment : Possible Browser Hijack attempt
Rootkey : HKEY_USERS
Object : .DEFAULT\Software\Microsoft\Internet Explorer\Main
Value : Start Page
Data : "http://www.findthewebsiteyouneed.com"
Possible Browser Hijack attempt : .DEFAULT\Software\Microsoft\Internet Explorer\MainSearch Bar.findthewebsiteyouneed.com

Possible Browser Hijack attempt Object Recognized!
Type : RegData
Data : "http://searchbar.findthewebsiteyouneed.com"
TAC Rating : 3
Category : Vulnerability
Comment : Possible Browser Hijack attempt
Rootkey : HKEY_USERS
Object : .DEFAULT\Software\Microsoft\Internet Explorer\Main
Value : Search Bar
Data : "http://searchbar.findthewebsiteyouneed.com"
Possible Browser Hijack attempt : .DEFAULT\Software\Microsoft\Internet Explorer\MainDefault_Search_URL.findthewebsiteyouneed.com

Possible Browser Hijack attempt Object Recognized!
Type : RegData
Data : "http://searchbar.findthewebsiteyouneed.com"
TAC Rating : 3
Category : Vulnerability
Comment : Possible Browser Hijack attempt
Rootkey : HKEY_USERS
Object : .DEFAULT\Software\Microsoft\Internet Explorer\Main
Value : Default_Search_URL
Data : "http://searchbar.findthewebsiteyouneed.com"
Possible Browser Hijack attempt : S-1-5-18\Software\Microsoft\Internet Explorer\MainSearch Page.findthewebsiteyouneed.com

Possible Browser Hijack attempt Object Recognized!
Type : RegData
Data : "http://searchbar.findthewebsiteyouneed.com"
TAC Rating : 3
Category : Vulnerability
Comment : Possible Browser Hijack attempt
Rootkey : HKEY_USERS
Object : S-1-5-18\Software\Microsoft\Internet Explorer\Main
Value : Search Page
Data : "http://searchbar.findthewebsiteyouneed.com"
Possible Browser Hijack attempt : S-1-5-18\Software\Microsoft\Internet Explorer\MainStart Page.findthewebsiteyouneed.com

Possible Browser Hijack attempt Object Recognized!
Type : RegData
Data : "http://www.findthewebsiteyouneed.com"
TAC Rating : 3
Category : Vulnerability
Comment : Possible Browser Hijack attempt
Rootkey : HKEY_USERS
Object : S-1-5-18\Software\Microsoft\Internet Explorer\Main
Value : Start Page
Data : "http://www.findthewebsiteyouneed.com"
Possible Browser Hijack attempt : S-1-5-18\Software\Microsoft\Internet Explorer\MainSearch Bar.findthewebsiteyouneed.com

Possible Browser Hijack attempt Object Recognized!
Type : RegData
Data : "http://searchbar.findthewebsiteyouneed.com"
TAC Rating : 3
Category : Vulnerability
Comment : Possible Browser Hijack attempt
Rootkey : HKEY_USERS
Object : S-1-5-18\Software\Microsoft\Internet Explorer\Main
Value : Search Bar
Data : "http://searchbar.findthewebsiteyouneed.com"
Possible Browser Hijack attempt : S-1-5-18\Software\Microsoft\Internet Explorer\MainDefault_Search_URL.findthewebsiteyouneed.com

Possible Browser Hijack attempt Object Recognized!
Type : RegData
Data : "http://searchbar.findthewebsiteyouneed.com"
TAC Rating : 3
Category : Vulnerability
Comment : Possible Browser Hijack attempt
Rootkey : HKEY_USERS
Object : S-1-5-18\Software\Microsoft\Internet Explorer\Main
Value : Default_Search_URL
Data : "http://searchbar.findthewebsiteyouneed.com"
Possible Browser Hijack attempt : S-1-5-21-1229272821-1563985344-1417001333-1003\Software\Microsoft\Internet Explorer\MainSearch Page.findthewebsiteyouneed.com

Possible Browser Hijack attempt Object Recognized!
Type : RegData
Data : "http://searchbar.findthewebsiteyouneed.com"
TAC Rating : 3
Category : Vulnerability
Comment : Possible Browser Hijack attempt
Rootkey : HKEY_USERS
Object : S-1-5-21-1229272821-1563985344-1417001333-1003\Software\Microsoft\Internet Explorer\Main
Value : Search Page
Data : "http://searchbar.findthewebsiteyouneed.com"
Possible Browser Hijack attempt : S-1-5-21-1229272821-1563985344-1417001333-1003\Software\Microsoft\Internet Explorer\MainSearch Bar.findthewebsiteyouneed.com

Possible Browser Hijack attempt Object Recognized!
Type : RegData
Data : "http://searchbar.findthewebsiteyouneed.com"
TAC Rating : 3
Category : Vulnerability
Comment : Possible Browser Hijack attempt
Rootkey : HKEY_USERS
Object : S-1-5-21-1229272821-1563985344-1417001333-1003\Software\Microsoft\Internet Explorer\Main
Value : Search Bar
Data : "http://searchbar.findthewebsiteyouneed.com"
Possible Browser Hijack attempt : S-1-5-21-1229272821-1563985344-1417001333-1003\Software\Microsoft\Internet Explorer\MainDefault_Search_URL.findthewebsiteyouneed.com

Possible Browser Hijack attempt Object Recognized!
Type : RegData
Data : "http://searchbar.findthewebsiteyouneed.com"
TAC Rating : 3
Category : Vulnerability
Comment : Possible Browser Hijack attempt
Rootkey : HKEY_USERS
Object : S-1-5-21-1229272821-1563985344-1417001333-1003\Software\Microsoft\Internet Explorer\Main
Value : Default_Search_URL
Data : "http://searchbar.findthewebsiteyouneed.com"

CoolWebSearch Object Recognized!
Type : Regkey
Data :
TAC Rating : 10
Category : Malware
Comment : C:\WINDOWS\system32\mclbui.dll
Rootkey : HKEY_CLASSES_ROOT
Object : CLSID\{655BAEE6-1F62-4F0B-A485-3C6D0CCCD94E}

CoolWebSearch Object Recognized!
Type : RegValue
Data :
TAC Rating : 10
Category : Malware
Comment : C:\WINDOWS\system32\mclbui.dll
Rootkey : HKEY_CLASSES_ROOT
Object : CLSID\{655BAEE6-1F62-4F0B-A485-3C6D0CCCD94E}
Value : IDEx

CoolWebSearch Object Recognized!
Type : File
Data : mclbui.dll
TAC Rating : 10
Category : Malware
Comment :
Object : c:\windows\system32\



CoolWebSearch Object Recognized!
Type : Regkey
Data :
TAC Rating : 10
Category : Malware
Comment : C:\WINDOWS\system32\mjvcrt40.dll
Rootkey : HKEY_CLASSES_ROOT
Object : CLSID\{E6CDC726-E8F5-4511-9DB6-5DDF6FF2B5B8}

CoolWebSearch Object Recognized!
Type : File
Data : mjvcrt40.dll
TAC Rating : 10
Category : Malware
Comment :
Object : c:\windows\system32\



Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 16
Objects found so far: 62


Started Tracking Cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


Tracking Cookie Object Recognized!
Type : IECache Entry
Data : tania@doubleclick[1].txt
TAC Rating : 3
Category : Data Miner
Comment : Hits:1
Value : Cookie:tania@doubleclick.net/
Expires : 08.10.2006 14:02:16
LastSync : Hits:1
UseCount : 0
Hits : 1

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : tania@mediaplex[1].txt
TAC Rating : 3
Category : Data Miner
Comment : Hits:1
Value : Cookie:tania@mediaplex.com/
Expires : 22.06.2009 02:00:00
LastSync : Hits:1
UseCount : 0
Hits : 1

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : tania@clickbank[1].txt
TAC Rating : 3
Category : Data Miner
Comment : Hits:1
Value : Cookie:tania@clickbank.net/
Expires : 06.04.2007 13:07:12
LastSync : Hits:1
UseCount : 0
Hits : 1

Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 3
Objects found so far: 65



Deep scanning and examining files (C
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

WinAntiVirusPro Object Recognized!
Type : File
Data : winantiviruspro2006freeinstall_de[2].exe
TAC Rating : 10
Category : Malware
Comment :
Object : C:\Dokumente und Einstellungen\Tania\Anwendungsdaten\



UCmore Object Recognized!
Type : File
Data : IUCmore.dll
TAC Rating : 3
Category : Data Miner
Comment :
Object : C:\Programme\TheSearchAccelerator\
FileVersion : 1, 0, 0, 1
ProductVersion : 1, 0, 0, 1
ProductName : IUCmore Module
FileDescription : IUCmore Module
InternalName : IUCmore
LegalCopyright : Copyright 2001
OriginalFilename : IUCmore.DLL


WinAntiVirusPro Object Recognized!
Type : File
Data : A0001253.exe
TAC Rating : 10
Category : Malware
Comment :
Object : C:\System Volume Information\_restore{CD8BD232-851A-48AB-95B7-49C2A31592AD}\RP2\



WinAntiVirusPro Object Recognized!
Type : File
Data : A0001254.exe
TAC Rating : 10
Category : Malware
Comment :
Object : C:\System Volume Information\_restore{CD8BD232-851A-48AB-95B7-49C2A31592AD}\RP2\



CoolWebSearch Object Recognized!
Type : File
Data : A0001297.dll
TAC Rating : 10
Category : Malware
Comment :
Object : C:\System Volume Information\_restore{CD8BD232-851A-48AB-95B7-49C2A31592AD}\RP3\



CoolWebSearch Object Recognized!
Type : File
Data : A0001301.dll
TAC Rating : 10
Category : Malware
Comment :
Object : C:\System Volume Information\_restore{CD8BD232-851A-48AB-95B7-49C2A31592AD}\RP3\



CoolWebSearch Object Recognized!
Type : File
Data : A0002300.dll
TAC Rating : 10
Category : Malware
Comment :
Object : C:\System Volume Information\_restore{CD8BD232-851A-48AB-95B7-49C2A31592AD}\RP3\



WinAntiVirusPro Object Recognized!
Type : File
Data : A0002319.exe
TAC Rating : 10
Category : Malware
Comment :
Object : C:\System Volume Information\_restore{CD8BD232-851A-48AB-95B7-49C2A31592AD}\RP3\



CoolWebSearch Object Recognized!
Type : File
Data : A0002324.dll
TAC Rating : 10
Category : Malware
Comment :
Object : C:\System Volume Information\_restore{CD8BD232-851A-48AB-95B7-49C2A31592AD}\RP3\



WinAntiVirusPro Object Recognized!
Type : File
Data : A0002375.exe
TAC Rating : 10
Category : Malware
Comment :
Object : C:\System Volume Information\_restore{CD8BD232-851A-48AB-95B7-49C2A31592AD}\RP3\



UCmore Object Recognized!
Type : File
Data : ucmoreiex.exe
TAC Rating : 3
Category : Data Miner
Comment :
Object : C:\



IEHijacker.ZestyFind Object Recognized!
Type : File
Data : iconu.exe
TAC Rating : 6
Category : Malware
Comment :
Object : C:\WINDOWS\



UCmore Object Recognized!
Type : File
Data : ucmoreiex[1].exe
TAC Rating : 3
Category : Data Miner
Comment :
Object : C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\M5MVWFKH\



Disk Scan Result for C:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 78


Deep scanning and examining files (D
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for D:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 78


Scanning Hosts file......
Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts".
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Hosts file scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
39 entries scanned.
New critical objects:0
Objects found so far: 78




Performing conditional scans...
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

UCmore Object Recognized!
Type : Regkey
Data :
TAC Rating : 3
Category : Data Miner
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\effective-i

UCmore Object Recognized!
Type : Folder
TAC Rating : 3
Category : Data Miner
Comment : UCmore
Object : C:\Programme\TheSearchAccelerator

UCmore Object Recognized!
Type : File
Data : INSTALL.LOG
TAC Rating : 3
Category : Data Miner
Comment :
Object : C:\Programme\thesearchaccelerator\



UCmore Object Recognized!
Type : File
Data : logo.ico
TAC Rating : 3
Category : Data Miner
Comment :
Object : C:\Programme\thesearchaccelerator\



UCmore Object Recognized!
Type : File
Data : toolbar.cfg
TAC Rating : 3
Category : Data Miner
Comment :
Object : C:\Programme\thesearchaccelerator\



UCmore Object Recognized!
Type : File
Data : UCMTSAIE.dll
TAC Rating : 3
Category : Data Miner
Comment :
Object : C:\Programme\thesearchaccelerator\
FileVersion : 4, 5, 40, 0
ProductVersion : 4, 5, 40, 0
ProductName : UCmore XP Toolbar
CompanyName : Effective-i Inc.
FileDescription : UCmore XP Toolbar
InternalName : UCmore XP Toolbar
LegalCopyright : Copyright © Effective-i Inc. 2001
LegalTrademarks : Copyright © Effective-i Inc. 2001
Comments : UCmore XP Toolbar ver 1.0


UCmore Object Recognized!
Type : File
Data : UNWISE.EXE
TAC Rating : 3
Category : Data Miner
Comment :
Object : C:\Programme\thesearchaccelerator\



CoolWebSearch Object Recognized!
Type : Regkey
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\downloadmanager

CoolWebSearch Object Recognized!
Type : RegValue
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\microsoft\internet explorer\main
Value : Search Bar

WinAntiVirusPro Object Recognized!
Type : Regkey
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\winantivirus pro 2006

Other Object Recognized!
Type : File
Data : UCMOREIEX.EXE-39BCB8D0.pf
TAC Rating : 10
Category : Malware
Comment :
Object : C:\WINDOWS\prefetch\



Other Object Recognized!
Type : File
Data : UNWISE.EXE-287895E1.pf
TAC Rating : 10
Category : Malware
Comment :
Object : C:\WINDOWS\prefetch\



Conditional scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 12
Objects found so far: 90

14:10:54 Scan Complete

Summary Of This Scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Total scanning time:00:03:46.437
Objects scanned:94831
Objects identified:76
Objects ignored:0
New critical objects:76

#2 1.
poste bitte dieses log
http://virus-protect.org/artikel/tools/combofix.html

2.
Hijackthis
http://computercops.biz/zx/Merijn/hijackthis.zip
http://virus-protect.org/hjtkurz.html
Lade/entpacke HijackThis in einem Ordner
--> None of the above just start the program --> Save--> Savelog -->es öffnet sich der Editor
nun das KOMPLETTE Log mit rechtem Mausklick abkopieren und ins Forum mit rechtem Mausklick "einfügen"

3.
Kopiere diese 6 Textdateien ab . (rechtsklick mit der Maus -> den Text markieren -> kopieren -> einfügen) Sie sind nach Datum geordnet. (kopiere nur die letzten 3 Monate ab)
http://virus-protect.org/datfindbat.html
__________
MfG Sabina

rund um die PC-Sicherheit