Author Topic: Infection:URL:Mal  (Read 3552 times)

0 Members and 1 Guest are viewing this topic.

canox250

  • Guest
Infection:URL:Mal
« on: December 09, 2013, 11:12:38 PM »
hello,

since 3 days i become this message every 15minutes :

"Infection blocked
URL:   hxxp://www.tracknl.info/installmate/php/sprotector.php
infection:   URL:Mal"

and
"infection blocked
URL:   hxxp://amazingsoftware.info/installmate/php/sprotect.php
infection:   URL:Mal"

i made a Scan with Adwcleoner and this is the report

"# AdwCleaner v3.014 - Bericht erstellt am 09/12/2013 um 22:55:53
# Updated 01/12/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Can - DIEMACHINE
# Gestartet von : C:\Users\Can\Desktop\adwcleaner.exe
# Option : Suchen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Datei Gefunden : C:\Users\Can\AppData\Roaming\Mozilla\Firefox\Profiles\rkimstvb.default\searchplugins\WebSearch.xml
Ordner Gefunden C:\Program Files (x86)\MocaFlix
Ordner Gefunden C:\Program Files (x86)\myfree codec
Ordner Gefunden C:\ProgramData\Microsoft\Windows\Start Menu\Programs\myfree codec
Ordner Gefunden C:\ProgramData\Partner
Ordner Gefunden C:\ProgramData\Premium
Ordner Gefunden C:\ProgramData\Uniblue\DriverScanner
Ordner Gefunden C:\Users\Can\AppData\Local\Mail.Ru
Ordner Gefunden C:\Users\Can\AppData\Local\PackageAware
Ordner Gefunden C:\Users\Can\AppData\LocalLow\PriceGong
Ordner Gefunden C:\Users\Can\AppData\Roaming\DesktopIconForAmazon
Ordner Gefunden C:\Users\Can\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gefunden C:\Users\Can\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mail.Ru
Ordner Gefunden C:\Users\Can\AppData\Roaming\OCS
Ordner Gefunden C:\Users\Can\AppData\Roaming\OpenCandy
Ordner Gefunden C:\Users\Can\AppData\Roaming\SendSpace

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gefunden : HKCU\Software\AppDataLow\SProtector
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MyFreeCodec
Schlüssel Gefunden : HKCU\Software\Myfree Codec
Schlüssel Gefunden : HKCU\Software\OCS
Schlüssel Gefunden : HKCU\Software\YahooPartnerToolbar
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
Schlüssel Gefunden : [x64] HKCU\Software\Myfree Codec
Schlüssel Gefunden : [x64] HKCU\Software\OCS
Schlüssel Gefunden : [x64] HKCU\Software\YahooPartnerToolbar
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{5C3B5DAA-0AFF-4808-90FB-0F2F2D760E36}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{64697678-0000-0010-8000-00AA00389B71}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{FD501041-8EBE-11CE-8183-00AA00577DA2}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\driverscanner
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{E69D4A59-73DE-4E38-9FB3-740EC4D9060D}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\driverscanner_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\driverscanner_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\sweetim_rasapi32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\sweetim_rasmancs
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\sweetimsetup_rasapi32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\sweetimsetup_rasmancs
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D85FFE92-BF14-4E9B-BCCD-E5C16069E65F}_is1
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SP_8e4eb48d
Schlüssel Gefunden : HKLM\Software\Myfree Codec
Schlüssel Gefunden : HKLM\Software\SP Global
Schlüssel Gefunden : HKLM\Software\SProtector
Schlüssel Gefunden : HKLM\Software\Uniblue
Schlüssel Gefunden : HKLM\Software\Uniblue\DriverScanner
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16736

Einstellung Gefunden : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search] - hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd

-\\ Mozilla Firefox v25.0.1 (de)

[ Datei : C:\Users\Can\AppData\Roaming\Mozilla\Firefox\Profiles\rkimstvb.default\prefs.js ]

Zeile gefunden : user_pref("aol_toolbar.default.homepage.check", false);
Zeile gefunden : user_pref("aol_toolbar.default.search.check", false);
Zeile gefunden : user_pref("browser.search.defaultenginename,S", "WebSearch");
Zeile gefunden : user_pref("browser.search.defaulturl", "hxxp://websearch.mocaflix.com/?l=1&q=");
Zeile gefunden : user_pref("browser.search.order.1", "WebSearch");
Zeile gefunden : user_pref("browser.search.order.1,S", "WebSearch");
Zeile gefunden : user_pref("browser.search.selectedEngine,S", "WebSearch");
Zeile gefunden : user_pref("extensions.BabylonToolbar.prtkDS", 0);
Zeile gefunden : user_pref("extensions.BabylonToolbar.prtkHmpg", 0);
Zeile gefunden : user_pref("icqtoolbar.installsource", "1");
Zeile gefunden : user_pref("keyword.URL", "hxxp://websearch.mocaflix.com/?l=1&q=");
Zeile gefunden : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
Zeile gefunden : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");
Zeile gefunden : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "");
Zeile gefunden : user_pref("sweetim.toolbar.previous.keyword.URL", "");
Zeile gefunden : user_pref("sweetim.toolbar.scripts.1.domain-blacklist", "");
Zeile gefunden : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_DS", "");
Zeile gefunden : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_HP", "");
Zeile gefunden : user_pref("sweetim.toolbar.searchguard.enable", "");

-\\ Google Chrome v

[ Datei : C:\Users\Can\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Gefunden : homepage
Gefunden : homepage

*************************

AdwCleaner[R0].txt - [7743 octets] - [09/12/2013 22:53:15]
AdwCleaner[R1].txt - [7635 octets] - [09/12/2013 22:55:53]

########## EOF - C:\AdwCleaner\AdwCleaner[R1].txt - [7695 octets] ##########
"

can anybody help me and say what i have to do?

thanks


Offline magna86

  • Anti Malware Fighter
  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 4235
    • Ambulanta MyCity Forum - ASAP Member
Re: Infection:URL:Mal
« Reply #1 on: December 09, 2013, 11:28:52 PM »
Hi,

Post MBAM, OTL and aswMBR logs ...
http://forum.avast.com/index.php?topic=53253.0

Machiavelli

  • Guest
Re: Infection:URL:Mal
« Reply #2 on: December 10, 2013, 08:45:42 PM »
Canox) .. There's already a topic from you (about the same problem) in the german forum on Avast ... Please tell us at which forum (German or in this topic)  you like to stay.
« Last Edit: December 10, 2013, 08:47:16 PM by Machiavelli »