Zombie Invasion

essexboy · February 13, 2015, 2:20pm

Hallo, kann lass es mich wissen, wenn dies die Warnungen nicht mehr

Hi there, could you let me know if this stops the alerts

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: URLSearchHook: HKLM - (No Name) - {6dad39c6-f4ac-4984-8e9b-f666269b9eb1} - No File URLSearchHook: HKU\S-1-5-21-2438225267-1511450186-87623158-1000 - (No Name) - {6dad39c6-f4ac-4984-8e9b-f666269b9eb1} - No File SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2102} URL = http://dts.search-results.com/sr?src=ieb&appid=110&systemid=102&sr=0&q={searchTerms} SearchScopes: HKU\S-1-5-21-2438225267-1511450186-87623158-1000 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2102} URL = http://dts.search-results.com/sr?src=ieb&appid=110&systemid=102&sr=0&q={searchTerms} SearchScopes: HKU\S-1-5-21-2438225267-1511450186-87623158-1000 -> {BBD1DAD3-D82D-4110-83B2-2A60DE07B838} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3297265&CUI=UN49698934612452800&UM=2 BHO: No Name -> {D4027C7F-154A-4066-A1AD-4243D8127440} -> No File Toolbar: HKLM - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File Toolbar: HKU\S-1-5-21-2438225267-1511450186-87623158-1000 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File Toolbar: HKU\S-1-5-21-2438225267-1511450186-87623158-1000 -> No Name - {6DAD39C6-F4AC-4984-8E9B-F666269B9EB1} - No File FF SearchEngineOrder.1: Claro Search FF user.js: detected! => C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\y6cb9t31.default\user.js CHR StartupUrls: Default -> "hxxp://www.sweet-page.com/?type=hp&ts=1419187333&from=cor&uid=WDCXWD3200BEVT-60A23T0_WD-WX61E41DXY61DXY61" 2015-02-11 01:24 - 2015-02-11 02:25 - 00000000 ____D () C:\3590F75ABA9E485486C100C1A9D4FF06ZZ...ZZZZ.Z.ZZ.Z 2015-01-25 23:50 - 2015-01-31 10:15 - 00000000 ____D () C:\ProgramData\Browser 2015-01-24 22:51 - 2015-01-24 23:07 - 00000000 ____D () C:\ProgramData\nfDOGQpWpN 2015-02-11 15:39 - 2013-06-01 09:50 - 00000000 ____D () C:\Users\HP\AppData\Roaming\Systweak 2015-02-11 15:33 - 2013-06-01 09:51 - 00000000 ____D () C:\ProgramData\Systweak 2015-02-11 15:06 - 2013-05-26 21:59 - 00000000 ____D () C:\Users\HP\AppData\Roaming\SearchProtect 2015-02-11 14:23 - 2013-05-26 22:02 - 00000000 ____D () C:\Users\HP\AppData\Local\CRE Task: {60DFBC06-3B4E-4A26-B938-6F01CCDFDCBF} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files\Ask.com\UpdateTask.exe [2012-04-09] () <==== ATTENTION EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

THEN

Please download AdwCleaner by Xplode onto your desktop.

[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S1].txt as well.

rulessodom · February 13, 2015, 3:21pm

Hallo also ich verstehe das nicht ganz?
Soll ich mir jetzt noch den AdwCleaner downloaden und dann das Log hier auch posten?

TerraX · February 13, 2015, 3:43pm

Ja, bitte.

TerraX

rulessodom · February 13, 2015, 7:42pm

Ok hier kommt das Log vom AdwCleaner.

rulessodom · February 13, 2015, 7:45pm

please

essexboy · February 13, 2015, 8:03pm

Hast du das FRST fix überprüft?

did you run the FRST fix ?

rulessodom · February 13, 2015, 8:17pm

Also ich kann in dem Bericht vom AdwCleaner nichts verdächtiges erkennen.
Was lest Ihr daraus?
Und dieser Satz:“CAUTION : This fix is only valid for this specific machine, using it on another may break your computer” ist dort auch nicht zu sehn.
Aber Zombie Invasion wird immer noch als Programm angezeigt läßt sich aber immer noch nicht deinstallieren.

             http://www.pcrisk.de/images/stories/screenshots201501/zombie-invasion-adware.jpg

essexboy · February 13, 2015, 9:07pm

So you did not install Zombie Invasion ? As it is in your uninstall list. I can remove the programme manually if you wish

So haben Sie die Zombie-Invasion nicht installiert? So wie es in Ihrem Uninstall-Liste. Ich kann das Programm manuell entfernen, wenn Sie es wünschen

rulessodom · February 13, 2015, 9:11pm

Du essexboy: Und das FRST fix hatte ich überflogen, so gut ist mein Schulenglisch nicht das ich so was genau lesen kann.
Dafür seit Ihr die Profis dachte ich.

MfG Ronny

rulessodom · February 13, 2015, 9:15pm

Ja das klingt gut essexboy, aber wie willst Du das Programm bei mir manuell entfernen?
Mit noch mehr Antimalwaresoftware und Cleanern?

essexboy · February 13, 2015, 9:52pm

Nein ich verwende FRST und die Warnung wird sichergestellt, dass keine eine Elsae außer Ihnen das Update verwenden, wird

No I will use FRST and the warning is to ensure that no one else apart from you will use the fix

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: 2015-02-11 21:19 - 2015-02-11 21:19 - 00000497 _____ () C:\Users\HP\Desktop\Zombie Invasion4.txt.lnk 2015-02-11 20:22 - 2015-02-11 20:22 - 00031740 _____ () C:\Zombie Invasion5.txt 2015-02-11 20:22 - 2015-02-11 20:15 - 00086088 _____ () C:\Zombie Invasion6.Xml 2015-02-11 20:16 - 2015-02-11 20:15 - 00086088 _____ () C:\Zombie Invasion5.Xml 2015-02-11 20:15 - 2015-02-11 20:15 - 00031740 _____ () C:\Zombie Invasion4.txt 2015-02-11 14:18 - 2015-02-11 14:18 - 00630966 _____ () C:\Zombie Invasion4.Xml 2015-02-11 14:18 - 2015-02-11 14:18 - 00236347 _____ () C:\Zombie Invasion3.txt 2015-02-11 14:18 - 2015-02-11 14:18 - 00000049 _____ () C:\Zombie Invasion2.txt 2015-02-11 14:17 - 2015-02-11 14:17 - 00000000 _____ () C:\Zombie Invasion.Xml 2015-01-24 22:51 - 2015-01-24 22:51 - 00000000 ____D () C:\ProgramData\ZombieInvasion 2015-01-24 22:46 - 2015-02-11 14:23 - 00000000 ____D () C:\Program Files\Boost 2015-01-24 22:46 - 2015-01-24 22:46 - 00000000 ____D () C:\Users\HP\AppData\Local\Boost 2015-01-24 22:05 - 2015-01-24 22:05 - 00378590 _____ () C:\Users\HP\Downloads\playerglobal11_9.swc 2015-02-11 01:24 - 2015-02-11 02:25 - 00000000 ____D () C:\3590F75ABA9E485486C100C1A9D4FF06ZZ...ZZZZ.Z.ZZ.Z 2015-01-25 23:50 - 2015-01-31 10:15 - 00000000 ____D () C:\ProgramData\Browser 2015-01-24 22:51 - 2015-01-24 23:07 - 00000000 ____D () C:\ProgramData\nfDOGQpWpN 2015-01-24 22:01 - 2015-01-24 22:02 - 01055936 _____ (Adobe) C:\Users\HP\Downloads\install_flashplayer16x32_mssd_aaa_aih(1).exe 2015-01-24 21:34 - 2015-01-24 21:34 - 01055936 _____ (Adobe) C:\Users\HP\Downloads\install_flashplayer16x32_mssd_aaa_aih.exe 2015-01-24 21:32 - 2015-01-24 21:32 - 01055952 _____ (Adobe) C:\Users\HP\Downloads\install_reader10_de_mssd_aaa_aih(4).exe 2015-01-24 21:29 - 2015-01-24 21:29 - 01055952 _____ (Adobe) C:\Users\HP\Downloads\install_reader10_de_mssd_aaa_aih(3).exe 2015-01-24 21:27 - 2015-01-24 21:27 - 01055952 _____ (Adobe) C:\Users\HP\Downloads\install_reader10_de_mssd_aaa_aih(2).exe 2015-02-11 15:39 - 2013-06-01 09:50 - 00000000 ____D () C:\Users\HP\AppData\Roaming\Systweak 2015-02-11 15:33 - 2013-06-01 09:51 - 00000000 ____D () C:\ProgramData\Systweak 2015-02-11 15:06 - 2013-05-26 21:59 - 00000000 ____D () C:\Users\HP\AppData\Roaming\SearchProtect 2015-02-11 14:23 - 2013-05-26 22:02 - 00000000 ____D () C:\Users\HP\AppData\Local\CRE EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

rulessodom · February 14, 2015, 12:07pm

Hallo, aber das hier sind nur die von mir gespeicherten Logs:

2015-02-11 21:19 - 2015-02-11 21:19 - 00000497 _____ () C:\Users\HP\Desktop\Zombie Invasion4.txt.lnk
2015-02-11 20:22 - 2015-02-11 20:22 - 00031740 _____ () C:\Zombie Invasion5.txt
2015-02-11 20:22 - 2015-02-11 20:15 - 00086088 _____ () C:\Zombie Invasion6.Xml
2015-02-11 20:16 - 2015-02-11 20:15 - 00086088 _____ () C:\Zombie Invasion5.Xml
2015-02-11 20:15 - 2015-02-11 20:15 - 00031740 _____ () C:\Zombie Invasion4.txt
2015-02-11 14:18 - 2015-02-11 14:18 - 00630966 _____ () C:\Zombie Invasion4.Xml
2015-02-11 14:18 - 2015-02-11 14:18 - 00236347 _____ () C:\Zombie Invasion3.txt
2015-02-11 14:18 - 2015-02-11 14:18 - 00000049 _____ () C:\Zombie Invasion2.txt
2015-02-11 14:17 - 2015-02-11 14:17 - 00000000 _____ () C:\Zombie Invasion.Xml

rulessodom · February 14, 2015, 12:10pm

Ja gut und von mir aus kannst Du das FRST Programm noch mal bei mir laufen lassen.

MfG Ronny

essexboy · February 14, 2015, 12:25pm

Ja, führen Sie FRST erneut aus, und fügen Sie das Protokoll

rulessodom · February 14, 2015, 2:54pm

Ok hier ist das neue Log von FRST.Hatte es im abgesicherten Modus laufen lassen.

essexboy · February 14, 2015, 3:28pm

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:
Öffnen Sie Notepad und kopieren den Text in die Quotebox unten hinein:

CreateRestorePoint: URLSearchHook: HKLM - (No Name) - {6dad39c6-f4ac-4984-8e9b-f666269b9eb1} - No File URLSearchHook: HKU\S-1-5-21-2438225267-1511450186-87623158-1000 - (No Name) - {6dad39c6-f4ac-4984-8e9b-f666269b9eb1} - No File SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2102} URL = http://dts.search-results.com/sr?src=ieb&appid=110&systemid=102&sr=0&q={searchTerms} SearchScopes: HKU\S-1-5-21-2438225267-1511450186-87623158-1000 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2102} URL = http://dts.search-results.com/sr?src=ieb&appid=110&systemid=102&sr=0&q={searchTerms} SearchScopes: HKU\S-1-5-21-2438225267-1511450186-87623158-1000 -> {BBD1DAD3-D82D-4110-83B2-2A60DE07B838} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3297265&CUI=UN49698934612452800&UM=2 BHO: No Name -> {D4027C7F-154A-4066-A1AD-4243D8127440} -> No File Toolbar: HKLM - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File Toolbar: HKU\S-1-5-21-2438225267-1511450186-87623158-1000 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File Toolbar: HKU\S-1-5-21-2438225267-1511450186-87623158-1000 -> No Name - {6DAD39C6-F4AC-4984-8E9B-F666269B9EB1} - No File FF SearchEngineOrder.1: Claro Search FF user.js: detected! => C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\y6cb9t31.default\user.js CHR StartupUrls: Default -> "hxxp://www.sweet-page.com/?type=hp&ts=1419187333&from=cor&uid=WDCXWD3200BEVT-60A23T0_WD-WX61E41DXY61DXY61" 2015-02-11 21:19 - 2015-02-11 21:19 - 00000497 _____ () C:\Users\HP\Desktop\Zombie Invasion4.txt.lnk 2015-02-11 20:22 - 2015-02-11 20:22 - 00031740 _____ () C:\Zombie Invasion5.txt 2015-02-11 20:22 - 2015-02-11 20:15 - 00086088 _____ () C:\Zombie Invasion6.Xml 2015-02-11 20:16 - 2015-02-11 20:15 - 00086088 _____ () C:\Zombie Invasion5.Xml 2015-02-11 20:15 - 2015-02-11 20:15 - 00031740 _____ () C:\Zombie Invasion4.txt 2015-02-11 14:18 - 2015-02-11 14:18 - 00630966 _____ () C:\Zombie Invasion4.Xml 2015-02-11 14:18 - 2015-02-11 14:18 - 00236347 _____ () C:\Zombie Invasion3.txt 2015-02-11 14:18 - 2015-02-11 14:18 - 00000049 _____ () C:\Zombie Invasion2.txt 2015-02-11 14:17 - 2015-02-11 14:17 - 00000000 _____ () C:\Zombie Invasion.Xml 2015-02-11 01:24 - 2015-02-11 02:25 - 00000000 ____D () C:\3590F75ABA9E485486C100C1A9D4FF06ZZ...ZZZZ.Z.ZZ.Z 2015-01-25 23:50 - 2015-01-31 10:15 - 00000000 ____D () C:\ProgramData\Browser 2015-01-24 22:51 - 2015-01-24 23:07 - 00000000 ____D () C:\ProgramData\nfDOGQpWpN 2015-01-24 22:51 - 2015-01-24 22:51 - 00000000 ____D () C:\ProgramData\ZombieInvasion 2015-01-24 22:46 - 2015-02-11 14:23 - 00000000 ____D () C:\Program Files\Boost 2015-01-24 22:46 - 2015-01-24 22:46 - 00000000 ____D () C:\Users\HP\AppData\Local\Boost 2015-01-24 22:05 - 2015-01-24 22:05 - 00378590 _____ () C:\Users\HP\Downloads\playerglobal11_9.swc 2015-01-24 22:01 - 2015-01-24 22:02 - 01055936 _____ (Adobe) C:\Users\HP\Downloads\install_flashplayer16x32_mssd_aaa_aih(1).exe 2015-01-24 21:34 - 2015-01-24 21:34 - 01055936 _____ (Adobe) C:\Users\HP\Downloads\install_flashplayer16x32_mssd_aaa_aih.exe 2015-01-24 21:32 - 2015-01-24 21:32 - 01055952 _____ (Adobe) C:\Users\HP\Downloads\install_reader10_de_mssd_aaa_aih(4).exe 2015-01-24 21:29 - 2015-01-24 21:29 - 01055952 _____ (Adobe) C:\Users\HP\Downloads\install_reader10_de_mssd_aaa_aih(3).exe 2015-01-24 21:27 - 2015-01-24 21:27 - 01055952 _____ (Adobe) C:\Users\HP\Downloads\install_reader10_de_mssd_aaa_aih(2).exe 2015-01-24 15:30 - 2015-01-24 15:30 - 00000588 _____ () C:\Users\Public\Desktop\Zaz.lnk 2015-01-24 15:30 - 2015-01-24 15:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zaz 2015-02-11 15:39 - 2013-06-01 09:50 - 00000000 ____D () C:\Users\HP\AppData\Roaming\Systweak 2015-02-11 15:33 - 2013-06-01 09:51 - 00000000 ____D () C:\ProgramData\Systweak 2015-02-11 15:06 - 2013-05-26 21:59 - 00000000 ____D () C:\Users\HP\AppData\Roaming\SearchProtect 2015-02-11 14:23 - 2013-05-26 22:02 - 00000000 ____D () C:\Users\HP\AppData\Local\CRE EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

Speichern Sie diese als fixlist.txt, am gleichen Ort wie FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Führen Sie FRST aus, und drücken Sie Fix
Nach dem Abschluss, die ein Protokoll generiert wird bitte post, die

Run FRST and press Fix
On completion a log will be generated please post that

rulessodom · February 14, 2015, 6:22pm

Thema:FRST.exe vs Zombie Invasion
« on: Today at 07:19:56 PM »

Quote
Modify

So also mit einer Quotebox kann ich nicht viel anfangen.
Aber ich habe etwas mit dem FRST.exe Programm gearbeitet und das kam dabei heraus.
War das richtig, denn ich kann Deine Erläuterungen nicht 100%ig verstehen.

Gruß Ronny
Modify message

Addition.txt (48.6 kB - downloaded 0 times.)

rulessodom · February 14, 2015, 6:26pm

Please

DJBone · February 14, 2015, 6:39pm

Den Inhalt der Quotebox kopieren und in einer Textdatei mit dem Namen fixlist.txt im gleichen Ordner wie FRST.exe speichern.

DJBone

essexboy · February 14, 2015, 8:05pm

Thanks obviously my translations are a bit suspect

Zombie Invasion

Announcements