Win7.32bit: Im Browser werden alle LINKS auf Werbeseiten umgeleitet

Bagaluth · 03.11.2013, 15:49

Habe seit 3 Tagen das Problem, dass meine Browser nicht mehr funktionieren wie sie sollen.
Dauernde Pop Up's und in Hilfedateien werden die Hilfelinks nicht ausgeführt sondern es wird auf dubiose Werbeseiten umgeleitet.

Hinweis an die Helferin / den Helfer:

NEIN ich nutze mein System nicht professionell auch wenn ich Vollversionen des BTS habe und Dell inkl. Dockingstation benutze. Alles privat und nicht gewerblich.

Defogger:

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 14:18 on 03/11/2013 (Ralf)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

FRST:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 31-10-2013
Ran by Ralf (administrator) on BAGALUTH01 on 03-11-2013 14:24:49
Running from \\BAGALUTH01\Users\Public\Downloads
Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(AuthenTec, Inc.) C:\Program Files\Fingerprint Sensor\AtService.exe
(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_450b431403c091e3\STacSV.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Smith Micro Software, Inc.) C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe
(Microsoft Corporation) C:\Program Files\Microsoft\BingBar\SeaPort.EXE
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Dell Inc.) C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe
(Dell Inc.) c:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe
(Microsoft Corporation) C:\Program Files\Windows Home Server\esClient.exe
(Intel(R) Corporation) c:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
(Intel(R) Corporation) c:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(EnTech Taiwan) C:\Program Files\softOSD\softOSD.exe
(Wave Systems Corp.) C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
(Microsoft Corporation) C:\Program Files\Windows Home Server\WHSConnector.exe
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(Microsoft Corporation) C:\Program Files\Windows Home Server\Microsoft.HomeServer.Archive.TransferService.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Dell Inc.) C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe
(Smith Micro Software, Inc.) C:\Program Files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe
(Wave Systems Corp.) C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe
(Broadcom Corporation) C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe
(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
(Microsoft Corporation) C:\Program Files\Zune\ZuneLauncher.exe
(Adobe Systems Inc.) C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Apple Computer, Inc.) C:\Program Files\QuickTime\qttask.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Sony Corporation) D:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Dell Inc.) C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Wave Systems Corp.) C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmNotify.exe
(Microsoft Corporation) C:\Program Files\Windows Home Server\WHSTrayApp.exe
(EnTech Taiwan) C:\Windows\system32\softLCP.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(sayLsoftlite) C:\program files\lyricssay-16\lyricssay-16-bg.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Farbar) \\BAGALUTH01\Users\Public\Downloads\FRST.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [249856 2009-06-19] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray.exe [458844 2009-08-01] (IDT, Inc.)
HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe [186904 2009-08-07] (Intel Corporation)
HKLM\...\Run: [DellControlPoint] - C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe [657920 2009-11-02] (Dell Inc.)
HKLM\...\Run: [DellConnectionManager] - C:\Program Files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe [1845248 2009-12-22] (Smith Micro Software, Inc.)
HKLM\...\Run: [WavXMgr] - C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe [147328 2010-01-05] (Wave Systems Corp.)
HKLM\...\Run: [USCService] - C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe [34232 2010-01-06] (Broadcom Corporation)
HKLM\...\Run: [PDVDDXSrv] - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe [140520 2009-06-25] (CyberLink Corp.)
HKLM\...\Run: [Zune Launcher] - C:\Program Files\Zune\ZuneLauncher.exe [159456 2011-08-05] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrobat_sl.exe [41336 2013-09-03] (Adobe Systems Incorporated)
HKLM\...\Run: [Acrobat Assistant 8.0] - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrotray.exe [840568 2013-09-03] (Adobe Systems Inc.)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-05] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\qttask.exe [98304 2013-01-27] (Apple Computer, Inc.)
HKLM\...\Run: [] - [x]
HKLM\...\Run: [Reader Library Launcher] - D:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe [906648 2010-07-13] (Sony Corporation)
HKLM\...\Runonce: [Del243731640] - cmd.exe /Q /D /c del "C:\Users\Ralf\AppData\Local\Temp\0.del"
HKCU\...\Runonce: [Del243731640] - cmd.exe /Q /D /c del "C:\Users\Ralf\AppData\Local\Temp\0.del"
Lsa: [Authentication Packages] msv1_0 wvauth

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {9B7E30B1-98A4-41EC-8D65-3EE9EC23072E} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLRDF8&pc=MDDR&src=IE-SearchBox
SearchScopes: HKCU - {9B7E30B1-98A4-41EC-8D65-3EE9EC23072E} URL = 
BHO: LyricsSay-16 - {11111111-1111-1111-1111-110411411158} - C:\Program Files\LyricsSay-16\LyricsSay-16-bho.dll (sayLsoftlite)
BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: BrowserHelper Class - {9A065C65-4EE7-4DDD-9918-F129089A894A} - C:\Program Files\Windows Home Server\WHSDeskBands.dll (Microsoft Corporation)
BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM - Home Server Banner - {D73E76A3-F902-45BD-8FC8-95AE8E014671} - C:\Program Files\Windows Home Server\WHSDeskBands.dll (Microsoft Corporation)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKCU - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 arXfrSvc; C:\Program Files\Windows Home Server\Microsoft.HomeServer.Archive.TransferService.exe [239472 2011-01-10] (Microsoft Corporation)
R2 ATService; C:\Program Files\Fingerprint Sensor\AtService.exe [1803512 2009-05-15] (AuthenTec, Inc.)
R2 buttonsvc32; C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe [278304 2009-11-20] (Dell Inc.)
R2 dcpsysmgrsvc; c:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe [386848 2009-12-10] (Dell Inc.)
R2 esClient; C:\Program Files\Windows Home Server\esClient.exe [97136 2011-01-10] (Microsoft Corporation)
S3 SecureStorageService; C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe [1032192 2009-11-18] (Wave Systems Corp.)
R2 SMManager; C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe [77312 2009-12-22] (Smith Micro Software, Inc.)
R2 softOSD; C:\Program Files\softOSD\softOSD.exe [291384 2010-12-18] (EnTech Taiwan)
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_450b431403c091e3\STacSV.exe [221266 2009-08-01] (IDT, Inc.)
S2 tcsd_win32.exe; C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe [1273856 2008-11-12] ()
R2 TdmService; C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe [1148264 2009-11-24] (Wave Systems Corp.)
R2 WHSConnector; C:\Program Files\Windows Home Server\WHSConnector.exe [376688 2011-01-10] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R2 acedrv11; C:\Windows\system32\drivers\acedrv11.sys [185472 2010-02-24] (Protect Software GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88840 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136672 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-03-30] (Avira Operations GmbH & Co. KG)
S3 Blfp; C:\Windows\System32\DRIVERS\basp.sys [84992 2009-05-11] (Broadcom Corporation)
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [35560 2012-08-01] (AnchorFree Inc.)
R2 hwpsgt; C:\Windows\System32\DRIVERS\hwpsgt.sys [137344 2010-07-15] ()
R3 KMWDFILTERx86; C:\Windows\System32\DRIVERS\KMWDFILTER.sys [25088 2009-04-29] (Windows (R) Codename Longhorn DDK provider)
R2 lemsgt; C:\Windows\System32\DRIVERS\lemsgt.sys [9472 2010-07-15] ()
R0 PBADRV; C:\Windows\System32\DRIVERS\PBADRV.sys [26608 2008-06-04] (Dell Inc)
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [16472 2010-04-09] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [11104 2010-04-09] ()
S3 risdpcie; C:\Windows\system32\DRIVERS\risdpe86.sys [49152 2009-07-01] (REDC)
S3 rixdpcie; C:\Windows\system32\DRIVERS\rixdpe86.sys [38400 2009-07-05] (REDC)
R1 se32; C:\Windows\System32\Drivers\se32.sys [12112 2007-05-03] (EnTech Taiwan)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
S3 taphss; C:\Windows\System32\DRIVERS\taphss.sys [33512 2012-08-01] (AnchorFree Inc)
R2 WavxDMgr; C:\Windows\System32\DRIVERS\WavxDMgr.sys [211328 2010-01-05] (Wave Systems Corp.)
S3 NvtSp50; System32\Drivers\NvtSp50.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-03 14:24 - 2013-11-03 14:24 - 00000000 ____D C:\FRST
2013-11-03 14:21 - 2013-11-03 14:21 - 01089445 _____ (Farbar) C:\Users\Public\Downloads\FRST.exe
2013-11-03 14:18 - 2013-11-03 14:18 - 00000470 _____ C:\Users\Public\Downloads\defogger_disable.log
2013-11-03 14:15 - 2013-11-03 14:15 - 00050477 _____ C:\Users\Public\Downloads\Defogger.exe
2013-11-03 14:01 - 2013-11-03 14:05 - 00001124 _____ C:\Users\Ralf\Desktop\Continue Firefox Installation.lnk
2013-11-03 14:00 - 2013-11-03 14:00 - 00000288 _____ C:\Windows\Tasks\UpdaterEX.job
2013-11-03 14:00 - 2013-11-03 14:00 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\UpdaterEX
2013-10-31 18:19 - 2013-10-31 18:19 - 00001024 _____ C:\.rnd
2013-10-27 18:25 - 2013-10-27 18:25 - 00000000 ____D C:\Users\Ralf\AppData\Local\Adobe_Systems_Incorporate
2013-10-27 18:24 - 2013-10-27 18:24 - 00002168 _____ C:\Users\Public\Desktop\Adobe Digital Editions 2.0.lnk
2013-10-27 17:58 - 2013-10-27 17:59 - 00000000 ____D C:\Users\Ralf\AppData\Local\calibre-cache
2013-10-27 17:57 - 2013-10-27 18:01 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\calibre
2013-10-27 17:57 - 2013-10-27 17:57 - 00000932 _____ C:\Users\Public\Desktop\calibre - E-book management.lnk
2013-10-27 17:57 - 2013-10-27 17:57 - 00000000 ____D C:\Program Files\Calibre2
2013-10-27 17:15 - 2013-10-27 17:15 - 00001975 _____ C:\Users\Public\Desktop\Reader Library.lnk
2013-10-27 17:15 - 2013-10-27 17:15 - 00000000 ____D C:\Program Files\Common Files\Sony Shared
2013-10-27 17:01 - 2013-10-31 18:19 - 00001860 _____ C:\Windows\Tasks\LyricsSay-16-firefoxinstaller.job
2013-10-27 17:01 - 2013-10-31 18:19 - 00001804 _____ C:\Windows\Tasks\Plus-HD-1.6-firefoxinstaller.job
2013-10-27 17:01 - 2013-10-31 18:19 - 00001332 _____ C:\Windows\Tasks\LyricsSay-16-updater.job
2013-10-27 17:01 - 2013-10-31 18:19 - 00001238 _____ C:\Windows\Tasks\LyricsSay-16-codedownloader.job
2013-10-27 17:01 - 2013-10-31 18:19 - 00001138 _____ C:\Windows\Tasks\LyricsSay-16-enabler.job
2013-10-27 17:01 - 2013-10-27 17:01 - 00000000 ____D C:\Program Files\Plus-HD-1.6
2013-10-27 17:01 - 2013-10-27 17:01 - 00000000 ____D C:\Program Files\LyricsSay-16
2013-10-27 15:00 - 2013-11-03 13:21 - 00105176 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2013-10-27 14:59 - 2013-11-03 13:21 - 00075992 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-10-27 14:58 - 2013-10-27 14:58 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Ralf\Desktop\mbar-1.07.0.1007.exe
2013-10-27 12:57 - 2013-11-03 13:58 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\Library
2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Apple Computer
2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\AppData\Local\Apple Computer
2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\ProgramData\kinoma
2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Program Files\Sony
2013-10-27 12:11 - 2013-10-27 17:15 - 00000000 ____D C:\Users\Ralf\AppData\Local\Sony Corporation
2013-10-27 12:08 - 2013-10-27 12:08 - 00000000 ____D C:\Users\Ralf\AppData\Local\kinoma
2013-10-24 20:12 - 2013-10-24 20:13 - 00000000 ____D C:\Windows\system32\Adobe
2013-10-10 21:30 - 2013-09-23 00:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-10 21:30 - 2013-09-23 00:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-10 21:30 - 2013-09-23 00:28 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-10 21:30 - 2013-09-23 00:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-10 21:30 - 2013-09-23 00:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-10 21:30 - 2013-09-23 00:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-10 21:30 - 2013-09-23 00:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-10 21:30 - 2013-09-23 00:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-10 21:30 - 2013-09-23 00:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-10 21:30 - 2013-09-23 00:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-10 21:30 - 2013-09-23 00:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-10 21:30 - 2013-09-23 00:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-10 21:30 - 2013-09-23 00:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-10 21:30 - 2013-09-23 00:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-10 21:30 - 2013-09-21 04:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-10 21:30 - 2013-09-21 03:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-10 10:23 - 2013-09-14 01:48 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-10-10 10:23 - 2013-09-08 03:07 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-10-10 10:23 - 2013-09-08 03:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-10-10 10:23 - 2013-08-29 02:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-10-10 10:23 - 2013-08-29 02:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-10-10 10:23 - 2013-08-29 02:50 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-10-10 10:23 - 2013-08-29 02:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-10-10 10:23 - 2013-08-29 02:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-10-10 10:23 - 2013-08-28 02:04 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-10 10:23 - 2013-08-28 01:57 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-10-10 10:23 - 2013-08-01 12:03 - 00729024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-10 10:23 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-10 10:23 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-10 10:23 - 2013-07-03 04:36 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-10 10:23 - 2013-07-03 04:36 - 00025728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-10 10:23 - 2013-06-06 05:52 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-10 10:23 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-10 10:23 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-10 10:23 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-10 10:23 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-10 10:22 - 2013-07-12 11:07 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-10 10:22 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-10-10 10:22 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-10-10 10:22 - 2013-07-04 10:48 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-10-10 10:22 - 2013-06-25 23:56 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys

==================== One Month Modified Files and Folders =======

2013-11-03 14:24 - 2013-11-03 14:24 - 00000000 ____D C:\FRST
2013-11-03 14:21 - 2013-11-03 14:21 - 01089445 _____ (Farbar) C:\Users\Public\Downloads\FRST.exe
2013-11-03 14:18 - 2013-11-03 14:18 - 00000470 _____ C:\Users\Public\Downloads\defogger_disable.log
2013-11-03 14:15 - 2013-11-03 14:15 - 00050477 _____ C:\Users\Public\Downloads\Defogger.exe
2013-11-03 14:05 - 2013-11-03 14:01 - 00001124 _____ C:\Users\Ralf\Desktop\Continue Firefox Installation.lnk
2013-11-03 14:00 - 2013-11-03 14:00 - 00000288 _____ C:\Windows\Tasks\UpdaterEX.job
2013-11-03 14:00 - 2013-11-03 14:00 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\UpdaterEX
2013-11-03 13:58 - 2013-10-27 12:57 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-11-03 13:56 - 2010-10-08 17:15 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-11-03 13:56 - 2010-10-08 17:15 - 00000000 ____D C:\Program Files\Adobe
2013-11-03 13:35 - 2013-07-08 06:02 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-11-03 13:35 - 2013-03-22 19:30 - 00000000 ____D C:\Users\Ralf\Desktop\mbar
2013-11-03 13:26 - 2009-07-14 05:55 - 01478104 _____ C:\Windows\WindowsUpdate.log
2013-11-03 13:21 - 2013-10-27 15:00 - 00105176 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2013-11-03 13:21 - 2013-10-27 14:59 - 00075992 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-10-31 20:16 - 2009-07-14 05:34 - 00014256 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-31 20:16 - 2009-07-14 05:34 - 00014256 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-31 18:23 - 2010-04-23 16:09 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-31 18:20 - 2010-05-03 15:25 - 00115672 _____ C:\Users\Ralf\AppData\Local\GDIPFONTCACHEV1.DAT
2013-10-31 18:20 - 2010-05-03 15:24 - 00000000 _____ C:\Users\Ralf\AppData\Local\WavXMapDrive.bat
2013-10-31 18:19 - 2013-10-31 18:19 - 00001024 _____ C:\.rnd
2013-10-31 18:19 - 2013-10-27 17:01 - 00001860 _____ C:\Windows\Tasks\LyricsSay-16-firefoxinstaller.job
2013-10-31 18:19 - 2013-10-27 17:01 - 00001804 _____ C:\Windows\Tasks\Plus-HD-1.6-firefoxinstaller.job
2013-10-31 18:19 - 2013-10-27 17:01 - 00001332 _____ C:\Windows\Tasks\LyricsSay-16-updater.job
2013-10-31 18:19 - 2013-10-27 17:01 - 00001238 _____ C:\Windows\Tasks\LyricsSay-16-codedownloader.job
2013-10-31 18:19 - 2013-10-27 17:01 - 00001138 _____ C:\Windows\Tasks\LyricsSay-16-enabler.job
2013-10-31 18:19 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-31 18:19 - 2009-07-14 05:39 - 00132693 _____ C:\Windows\setupact.log
2013-10-31 18:18 - 2009-07-14 05:33 - 00426736 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-27 18:25 - 2013-10-27 18:25 - 00000000 ____D C:\Users\Ralf\AppData\Local\Adobe_Systems_Incorporate
2013-10-27 18:24 - 2013-10-27 18:24 - 00002168 _____ C:\Users\Public\Desktop\Adobe Digital Editions 2.0.lnk
2013-10-27 18:01 - 2013-10-27 17:57 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\calibre
2013-10-27 17:59 - 2013-10-27 17:58 - 00000000 ____D C:\Users\Ralf\AppData\Local\calibre-cache
2013-10-27 17:57 - 2013-10-27 17:57 - 00000932 _____ C:\Users\Public\Desktop\calibre - E-book management.lnk
2013-10-27 17:57 - 2013-10-27 17:57 - 00000000 ____D C:\Program Files\Calibre2
2013-10-27 17:15 - 2013-10-27 17:15 - 00001975 _____ C:\Users\Public\Desktop\Reader Library.lnk
2013-10-27 17:15 - 2013-10-27 17:15 - 00000000 ____D C:\Program Files\Common Files\Sony Shared
2013-10-27 17:15 - 2013-10-27 12:11 - 00000000 ____D C:\Users\Ralf\AppData\Local\Sony Corporation
2013-10-27 17:01 - 2013-10-27 17:01 - 00000000 ____D C:\Program Files\Plus-HD-1.6
2013-10-27 17:01 - 2013-10-27 17:01 - 00000000 ____D C:\Program Files\LyricsSay-16
2013-10-27 14:58 - 2013-10-27 14:58 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Ralf\Desktop\mbar-1.07.0.1007.exe
2013-10-27 12:57 - 2010-05-06 11:33 - 00000000 ____D C:\Users\Ralf\AppData\Local\Mozilla
2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\Library
2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Apple Computer
2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\AppData\Local\Apple Computer
2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\ProgramData\kinoma
2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Program Files\Sony
2013-10-27 12:12 - 2010-05-03 15:24 - 00000000 ____D C:\Users\Ralf
2013-10-27 12:12 - 2010-04-23 16:05 - 00000000 ____D C:\Program Files\DIFX
2013-10-27 12:08 - 2013-10-27 12:08 - 00000000 ____D C:\Users\Ralf\AppData\Local\kinoma
2013-10-24 20:14 - 2010-04-23 16:02 - 00000000 ____D C:\Windows\system32\Macromed
2013-10-24 20:13 - 2013-10-24 20:12 - 00000000 ____D C:\Windows\system32\Adobe
2013-10-21 17:28 - 2013-09-01 15:10 - 00000000 ____D C:\Users\Ralf\AppData\Local\Thunderbird
2013-10-17 18:12 - 2011-05-19 13:03 - 00028672 _____ C:\Users\Ralf\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-10-15 19:48 - 2012-03-29 18:21 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-10-15 19:48 - 2011-05-19 12:45 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-10-14 18:37 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-10-14 18:21 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-14 17:46 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-10-14 17:44 - 2010-04-23 16:23 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-10-10 21:35 - 2010-05-06 14:54 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-10 21:33 - 2013-07-31 07:45 - 00000000 ____D C:\Windows\system32\MRT
2013-10-10 21:31 - 2010-05-06 15:26 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

Some content of TEMP:
====================
C:\Users\Ralf\AppData\Local\temp\eblinstaller.exe
C:\Users\Ralf\AppData\Local\temp\ICReinstall_Firefox_Setup.exe
C:\Users\Ralf\AppData\Local\temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Ralf\AppData\Local\temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Ralf\AppData\Local\temp\Shockwave_Installer_FF.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-10-31 18:37

==================== End Of Log ============================

Addition:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 31-10-2013
Ran by Ralf at 2013-11-03 14:25:21
Running from \\BAGALUTH01\Users\Public\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

Adobe Acrobat X Standard - English, Français, Deutsch (Version: 10.1.8)
Adobe Digital Editions 2.0 (Version: 2.0)
Adobe Flash Player 11 ActiveX (Version: 11.3.300.265)
Adobe Flash Player 11 Plugin (Version: 11.9.900.117)
Adobe Shockwave Player 12.0 (Version: 12.0.4.144)
AuthenTec Fingerprint Software (Version: 8.4.2.5)
Avira Free Antivirus (Version: 13.0.0.4052)
Bing Bar (Version: 7.0.850.0)
BioAPI Framework (Version: 1.0.1)
Broadcom NetXtreme-I Netlink Driver and Management Installer (Version: 12.25.02)
calibre (Version: 1.8.0)
DCP32MMWrapper (Version: 1.6.453.66)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
Dell Control Point (Version: 1.6.453.66)
Dell ControlPoint Connection Manager (Version: 1.4.0)
Dell ControlPoint Security Manager (Version: 1.6.453.66)
Dell ControlPoint System Manager (Version: 1.4.00000)
Dell Edoc Viewer (Version: 1.0.0)
Dell Embassy Trust Suite by Wave Systems (Version: 03.05.00.079)
Dell Security Device Driver Pack (Version: 1.4.050)
Dell Touchpad (Version: 7.2.101.230)
Document Manager Lite (Version: 06.09.00.147)
EMBASSY Security Center (Version: 04.00.00.071)
EMBASSY Security Setup (Version: 04.00.00.058)
ESC Home Page Plugin (Version: 04.00.00.010)
Extended Update
GameSpy Arcade
Gemalto (Version: 01.01.00.0000)
Informaticus (Version: 1.00.000)
Intel PROSet Wireless
Intel(R) Graphics Media Accelerator Driver (Version: 8.15.10.2226)
Intel(R) PROSet/Wireless WiFi-Software (Version: 13.00.0000)
Intel(R) TV Wizard
Intel® Matrix Storage Manager
IrfanView (remove only) (Version: 4.28)
Junk Mail filter update (Version: 14.0.8089.726)
LyricsSay-16 (Version: 1.29.153.2)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Choice Guard (Version: 2.0.48.0)
Microsoft Office 2010 Service Pack 1 (SP1)
Microsoft Office Access MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Home and Student 2010 (Version: 14.0.6029.1000)
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (English) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (Italian) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Single Image 2010 (Version: 14.0.6029.1000)
Microsoft Office Word MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft PhotoDraw 2000 V2 (Version: 2.00.00.1429)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft Sync Framework Runtime Native v1.0 (x86) (Version: 1.0.1215.0)
Microsoft Sync Framework Services Native v1.0 (x86) (Version: 1.0.1215.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Mozilla Thunderbird 17.0.8 (x86 de) (Version: 17.0.8)
MSVCRT (Version: 14.0.1468.721)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
NTRU TCG Software Stack (Version: 2.1.29)
OpenOffice.org 3.2 (Version: 3.2.9502)
Partition Wizard Home Edition 5.0
Pat4Tool (Version: 1.0.0)
Patrizier 4 (Version: 1.3.0)
Patrizier II Gold
Patrizier IV - Aufstieg einer Dynastie (Version: 2.0.4.0)
Patrizier IV Demo (Version: 1.0.0)
Plus-HD-1.6 (Version: 1.29.153.0)
PowerDVD DX (Version: 8.3.5424)
Preboot Manager (Version: 03.00.00.085)
Private Information Manager (Version: 06.04.00.057)
Product Key Explorer 3.1.3
ProtectDisc Driver, Version 11 (Version: 11.0.0.14)
PRS-500 USB driver (Version: 1.0.00.08110)
Puzzle Agent - The Mystery of Scoggins (Version: 1.0.0.0)
QuickTime
Reader Library by Sony (Version: 3.3.00.07130)
Rome - Total War - Gold Edition (Version: 1.6)
Roxio Creator Audio (Version: 3.7.0)
Roxio Creator Copy (Version: 3.7.0)
Roxio Creator Data (Version: 3.7.0)
Roxio Creator DE 10.3 (Version: 10.3)
Roxio Creator DE 10.3 (Version: 3.7.0)
Roxio Creator Tools (Version: 3.7.0)
Roxio Express Labeler 3 (Version: 3.2.2)
Roxio Update Manager (Version: 6.0.0)
Security Wizards (Version: 01.07.00.023)
SO32MMWrapper (Version: 1.6.453.66)
softOSD Client (Build 1445)
Sven - Die ersten 10 Jahre (Version: 1.00)
swMSM (Version: 12.0.0.1)
System Requirements Lab for Intel (Version: 4.3.13.0)
Trusted Drive Manager (Version: 3.3.0.396)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition
Update for Microsoft Office 2010 (KB2494150)
Update for Microsoft Office 2010 (KB2553065)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition
Update for Microsoft Office 2010 (KB2566458)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition
Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition
Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition
Update for Microsoft Word 2010 (KB2827323) 32-Bit Edition
UPEK TouchChip Fingerprint Reader (Version: 1.2.0)
Vermeer 2 - Patch 1.1.0
VLC media player 1.1.7 (Version: 1.1.7)
Wave Infrastructure Installer (Version: 07.01.19.0000)
Wave Support Software (Version: 05.10.00.062)
WIDCOMM Bluetooth Software (Version: 6.2.1.100)
Windows Driver Package - Sony Corporation (PRSUSB) USB  (08/08/2006 1.0.03.08080) (Version: 08/08/2006 1.0.03.08080)
Windows Home Server-Connector (Version: 6.0.3436.0)
Windows Live Anmelde-Assistent (Version: 5.000.818.5)
Windows Live Call (Version: 14.0.8064.0206)
Windows Live Communications Platform (Version: 14.0.8064.206)
Windows Live Essentials (Version: 14.0.8089.0726)
Windows Live Essentials (Version: 14.0.8089.726)
Windows Live Fotogalerie (Version: 14.0.8081.709)
Windows Live Mail (Version: 14.0.8089.0726)
Windows Live Messenger (Version: 14.0.8089.0726)
Windows Live Movie Maker (Version: 14.0.8091.0730)
Windows Live Sync (Version: 14.0.8089.726)
Windows Live Writer (Version: 14.0.8089.0726)
Windows Live-Uploadtool (Version: 14.0.8014.1029)
Windows Mobile Device Updater Component (Version: 04.08.2345.00)
Windows-Treiberpaket - AuthenTec Inc. (ATSwpWDF) Biometric  (05/13/2009 8.4.2.0) (Version: 05/13/2009 8.4.2.0)
Windows-Treiberpaket - Dell Inc. PBADRV System  (09/11/2009 1.0.1.6) (Version: 09/11/2009 1.0.1.6)
WinRAR
WinZip
Yahoo! Detect
Youda Legend
Zune (Version: 04.08.2345.00)
Zune Language Pack (CHS) (Version: 04.08.2345.00)
Zune Language Pack (CHT) (Version: 04.08.2345.00)
Zune Language Pack (CSY) (Version: 04.08.2345.00)
Zune Language Pack (DAN) (Version: 04.08.2345.00)
Zune Language Pack (DEU) (Version: 04.08.2345.00)
Zune Language Pack (ELL) (Version: 04.08.2345.00)
Zune Language Pack (ESP) (Version: 04.08.2345.00)
Zune Language Pack (FIN) (Version: 04.08.2345.00)
Zune Language Pack (FRA) (Version: 04.08.2345.00)
Zune Language Pack (HUN) (Version: 04.08.2345.00)
Zune Language Pack (IND) (Version: 04.08.2345.00)
Zune Language Pack (ITA) (Version: 04.08.2345.00)
Zune Language Pack (JPN) (Version: 04.08.2345.00)
Zune Language Pack (KOR) (Version: 04.08.2345.00)
Zune Language Pack (MSL) (Version: 04.08.2345.00)
Zune Language Pack (NLD) (Version: 04.08.2345.00)
Zune Language Pack (NOR) (Version: 04.08.2345.00)
Zune Language Pack (PLK) (Version: 04.08.2345.00)
Zune Language Pack (PTB) (Version: 04.08.2345.00)
Zune Language Pack (PTG) (Version: 04.08.2345.00)
Zune Language Pack (RUS) (Version: 04.08.2345.00)
Zune Language Pack (SVE) (Version: 04.08.2345.00)

==================== Restore Points  =========================

24-10-2013 16:32:22 Windows Update
27-10-2013 11:11:35 Installed Reader Library by Sony.
27-10-2013 14:55:05 Removed Reader Library by Sony.
27-10-2013 16:14:55 Installed Reader Library by Sony.
27-10-2013 16:57:11 Installed calibre
31-10-2013 17:24:17 Windows Update
03-11-2013 12:56:01 Removed Adobe Reader XI (11.0.04) - Deutsch.

==================== Hosts content: ==========================

2009-07-14 03:04 - 2013-04-02 07:01 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {109DCF76-0CD3-4F08-8D35-D5B6F9BA5C08} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-11] (Microsoft Corporation)
Task: {1BF846DC-5DC4-46F8-816F-35A52A418717} - System32\Tasks\LyricsSay-16-firefoxinstaller => C:\Program Files\LyricsSay-16\LyricsSay-16-firefoxinstaller.exe [2013-10-27] (sayLsoftlite)
Task: {28311E67-8079-4D7B-BA62-DDAC2DF4CC4E} - System32\Tasks\{47526870-9D54-471C-B415-F82E5B7494F7} => C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
Task: {29234F6A-F0FA-49C7-A461-9EB03E7B6919} - System32\Tasks\{E45CE27F-DFE6-4385-B200-85DEE1A620E7} => C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
Task: {2EA79B48-FFD2-45CA-9B1E-09B40292C385} - System32\Tasks\UpdaterEX => C:\Users\Ralf\AppData\Roaming\UpdaterEX\UpdateProc\UpdateTask.exe [2013-04-12] ()
Task: {46ED8C8E-54D5-4400-B46F-295CFD313FDD} - System32\Tasks\{76772A00-FA5E-4542-97FC-2EE104466C31} => E:\SETUP.EXE
Task: {6511A7B4-CB78-4A30-95B6-5443D7ED9DBA} - System32\Tasks\LyricsSay-16-codedownloader => C:\Program Files\LyricsSay-16\LyricsSay-16-codedownloader.exe [2013-10-27] (sayLsoftlite)
Task: {8AA13A9A-A43A-471F-8799-DD49893FADAB} - System32\Tasks\{5A37C895-47DD-4A5D-91B1-22A7BBE2A98E} => C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
Task: {8ADFA22E-414A-455B-BA29-1DC3EB5D3911} - System32\Tasks\LyricsSay-16-updater => C:\Program Files\LyricsSay-16\LyricsSay-16-updater.exe [2013-10-27] (sayLsoftlite)
Task: {8FF3BAB9-DF35-437C-91BB-84AD93978519} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {9AC4CB2D-6F14-4BCD-A2FD-006275CF5A0B} - System32\Tasks\JavaUpdateSched => C:\Windows\System32\jusched.exe
Task: {9B8D7A75-26F9-4ABE-9129-7C5717699323} - System32\Tasks\{9A7AAE21-21DD-4D1B-AAC3-05848DF9000A} => E:\SETUP.EXE
Task: {BBE469BB-9807-42CC-84F5-70763F030E75} - System32\Tasks\LyricsSay-16-enabler => C:\Program Files\LyricsSay-16\LyricsSay-16-enabler.exe [2013-10-27] (sayLsoftlite)
Task: {C077D56C-D3A0-4C9E-AC36-EFEFAD7E9FF0} - System32\Tasks\{FBD94380-2320-4247-9C86-1D068164E70A} => E:\SETUP.EXE
Task: {CBB79945-871F-4295-9664-81992B0A2A55} - System32\Tasks\Plus-HD-1.6-firefoxinstaller => C:\Program Files\Plus-HD-1.6\Plus-HD-1.6-firefoxinstaller.exe [2013-10-27] (Plus HD)
Task: C:\Windows\Tasks\LyricsSay-16-codedownloader.job => C:\Program Files\LyricsSay-16\LyricsSay-16-codedownloader.exe
Task: C:\Windows\Tasks\LyricsSay-16-enabler.job => C:\Program Files\LyricsSay-16\LyricsSay-16-enabler.exe
Task: C:\Windows\Tasks\LyricsSay-16-firefoxinstaller.job => C:\Program Files\LyricsSay-16\LyricsSay-16-firefoxinstaller.exe
Task: C:\Windows\Tasks\LyricsSay-16-updater.job => C:\Program Files\LyricsSay-16\LyricsSay-16-updater.exe
Task: C:\Windows\Tasks\Plus-HD-1.6-firefoxinstaller.job => C:\Program Files\Plus-HD-1.6\Plus-HD-1.6-firefoxinstaller.exe
Task: C:\Windows\Tasks\UpdaterEX.job => C:\Users\Ralf\AppData\Roaming\UPDATE~1\UPDATE~1\UPDATE~1.EXE

==================== Loaded Modules (whitelisted) =============

2010-12-12 20:53 - 1998-10-17 07:00 - 00033792 _____ () C:\Program Files\WinZip\WZSHLEXT.DLL
2009-11-19 21:48 - 2009-11-19 21:48 - 00278528 _____ () C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\ContextMenuItem.dll
2009-11-19 21:47 - 2009-11-19 21:47 - 00249856 _____ () C:\Windows\system32\wxvault.dll
2009-08-11 22:10 - 2009-08-11 22:10 - 00132384 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll
2009-12-22 17:19 - 2009-12-22 17:19 - 00573440 _____ () C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SmithMicro.Message.XmlSerializers.dll
2009-11-13 14:17 - 2009-11-13 14:17 - 00010752 _____ () C:\Windows\system32\Wavx_ESC_Logging.dll
2008-11-12 19:29 - 2008-11-12 19:29 - 00004608 _____ () C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\TspPopup_DEU.dll
2010-07-13 01:28 - 2010-07-13 01:28 - 00856064 _____ () D:\Program Files\Sony\Reader\Data\bin\launcher\fsk.dll
2010-07-13 01:13 - 2010-07-13 01:13 - 00033792 _____ () D:\Program Files\Sony\Reader\Data\bin\FskMediaPlayers.dll
2010-07-13 01:15 - 2010-07-13 01:15 - 00233472 _____ () D:\Program Files\Sony\Reader\Data\bin\Fskin.dll
2010-07-13 01:22 - 2010-07-13 01:22 - 00020480 _____ () D:\Program Files\Sony\Reader\Data\bin\FskinLocalize.dll
2010-04-02 21:23 - 2010-04-02 21:23 - 00815104 _____ () D:\Program Files\Sony\Reader\Data\bin\FskSecurity.dll
2010-07-13 01:16 - 2010-07-13 01:16 - 00118784 _____ () D:\Program Files\Sony\Reader\Data\bin\FskDocumentViewer.dll
2010-07-13 01:22 - 2010-07-13 01:22 - 00009728 _____ () D:\Program Files\Sony\Reader\Data\bin\FskPower.dll
2010-07-13 01:26 - 2010-07-13 01:26 - 00018432 _____ () D:\Program Files\Sony\Reader\Data\bin\launcher\FskNetInterface.dll
2010-07-13 01:15 - 2010-07-13 01:15 - 00010240 _____ () D:\Program Files\Sony\Reader\Data\bin\FskMobileMediaDevice.dll
2010-07-13 01:25 - 2010-07-13 01:25 - 00008704 _____ () D:\Program Files\Sony\Reader\Data\bin\launcher\FskTimeHardware.dll
2010-07-13 01:25 - 2010-07-13 01:25 - 00028160 _____ () D:\Program Files\Sony\Reader\Data\bin\launcher\ticket.dll
2010-07-13 01:25 - 2010-07-13 01:25 - 00011776 _____ () D:\Program Files\Sony\Reader\Data\bin\launcher\ebookDeviceNotifier.dll
2010-04-02 20:44 - 2010-04-02 20:44 - 00086016 _____ () D:\Program Files\Sony\Reader\Data\bin\launcher\ebookUsb.dll
2010-07-13 01:29 - 2010-07-13 01:29 - 00143360 _____ () D:\Program Files\Sony\Reader\Data\bin\launcher\connectionDetector.dll
2010-07-13 01:10 - 2010-07-13 01:10 - 00172032 _____ () D:\Program Files\Sony\Reader\Data\bin\launcher\USBDetector.dll
2013-10-27 17:01 - 2013-10-27 17:01 - 00414208 _____ () C:\program files\lyricssay-16\LyricsSay-16-buttonutil.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\TEMP:C5760A8B

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\se32.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== Faulty Device Manager Devices =============

Name: Dell Wireless 370 Bluetooth Mini-card
Description: Dell Wireless 370 Bluetooth Mini-card
Class Guid: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974}
Manufacturer: Broadcom
Service: BTHUSB
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (10/31/2013 06:41:36 PM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005

Error: (10/27/2013 00:12:50 PM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005

Error: (10/24/2013 08:43:15 PM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005

Error: (10/24/2013 06:14:15 PM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005

Error: (10/21/2013 06:24:07 PM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005

Error: (10/21/2013 01:58:19 PM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005

Error: (10/10/2013 08:50:47 PM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005

Error: (10/10/2013 10:32:03 AM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005

Error: (10/05/2013 11:38:11 AM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005

Error: (09/30/2013 07:05:42 AM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005


System errors:
=============
Error: (11/03/2013 01:30:47 PM) (Source: mbamchameleon) (User: )
Description: olume3\PROGRAM FILES\AVIRA\ANTIVIR DESKTOP\AVWSC.EXE

Error: (11/03/2013 01:30:47 PM) (Source: mbamchameleon) (User: )
Description: \??\C:\Program Files\Avira\AntiVir Desktop\avwsc.exe

Error: (11/03/2013 01:25:56 PM) (Source: mbamchameleon) (User: )
Description: C00000BE

Error: (11/03/2013 01:25:56 PM) (Source: mbamchameleon) (User: )
Description: C00000BE

Error: (11/03/2013 01:25:56 PM) (Source: mbamchameleon) (User: )
Description: C00000BE

Error: (10/31/2013 06:20:52 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (10/31/2013 06:19:33 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "NTRU TSS v1.2.1.29 TCS" ist vom Dienst "TPM-Basisdienste" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%0

Error: (10/27/2013 07:31:02 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR19 gefunden.

Error: (10/27/2013 07:31:01 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR19 gefunden.

Error: (10/27/2013 07:31:00 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR19 gefunden.


Microsoft Office Sessions:
=========================
Error: (10/31/2013 06:41:36 PM) (Source: Customer Experience Improvement Program)(User: )
Description: 80004005

Error: (10/27/2013 00:12:50 PM) (Source: Customer Experience Improvement Program)(User: )
Description: 80004005

Error: (10/24/2013 08:43:15 PM) (Source: Customer Experience Improvement Program)(User: )
Description: 80004005

Error: (10/24/2013 06:14:15 PM) (Source: Customer Experience Improvement Program)(User: )
Description: 80004005

Error: (10/21/2013 06:24:07 PM) (Source: Customer Experience Improvement Program)(User: )
Description: 80004005

Error: (10/21/2013 01:58:19 PM) (Source: Customer Experience Improvement Program)(User: )
Description: 80004005

Error: (10/10/2013 08:50:47 PM) (Source: Customer Experience Improvement Program)(User: )
Description: 80004005

Error: (10/10/2013 10:32:03 AM) (Source: Customer Experience Improvement Program)(User: )
Description: 80004005

Error: (10/05/2013 11:38:11 AM) (Source: Customer Experience Improvement Program)(User: )
Description: 80004005

Error: (09/30/2013 07:05:42 AM) (Source: Customer Experience Improvement Program)(User: )
Description: 80004005


==================== Memory info =========================== 

Percentage of memory in use: 47%
Total physical RAM: 3539.17 MB
Available physical RAM: 1854.25 MB
Total Pagefile: 7076.63 MB
Available Pagefile: 4933.25 MB
Total Virtual: 2047.88 MB
Available Virtual: 1898.01 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:94.67 GB) (Free:55.78 GB) NTFS
Drive d: (Daten) (Fixed) (Total:123.52 GB) (Free:72.13 GB) NTFS
Drive f: (VERBATIM) (Removable) (Total:7.38 GB) (Free:7.38 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 233 GB) (Disk ID: 6F7DDDC7)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Active) - (Size=15 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=95 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=124 GB) - (Type=OF Extended)

========================================================
Disk: 1 (Size: 7 GB) (Disk ID: 00000000)
Partition 1: (Not Active) - (Size=7 GB) - (Type=0B)

==================== End Of Log ============================

Gmer:

Code:

ATTFilter

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-11-03 15:30:22
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD25 rev.11.0 232,89GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Ralf\AppData\Local\Temp\kfrcapow.sys


---- System - GMER 2.1 ----

SSDT            952538DE                                                                                                                ZwCreateSection
SSDT            952538E8                                                                                                                ZwRequestWaitReplyPort
SSDT            952538E3                                                                                                                ZwSetContextThread
SSDT            952538ED                                                                                                                ZwSetSecurityObject
SSDT            952538F2                                                                                                                ZwSystemDebugControl
SSDT            9525387F                                                                                                                ZwTerminateProcess

---- Kernel code sections - GMER 2.1 ----

.text           ntkrnlpa.exe!ZwRollbackEnlistment + 142D                                                                                82C58A15 1 Byte  [06]
.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                                  82C92212 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text           ntkrnlpa.exe!KeRemoveQueueEx + 11F7                                                                                     82C9958C 4 Bytes  [DE, 38, 25, 95]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1553                                                                                     82C998E8 4 Bytes  JMP A802816F 
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1597                                                                                     82C9992C 4 Bytes  [E3, 38, 25, 95]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1613                                                                                     82C999A8 4 Bytes  [ED, 38, 25, 95]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1667                                                                                     82C999FC 4 Bytes  [F2, 38, 25, 95]
.text           ...                                                                                                                     
.vmp2           C:\Windows\system32\drivers\acedrv11.sys                                                                                entry point in ".vmp2" section [0x9CEC269D]

---- Devices - GMER 2.1 ----

AttachedDevice  \FileSystem\fastfat \Fat                                                                                                fltmgr.sys

---- Registry - GMER 2.1 ----

Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\70f1a109efc1                                             
Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\70f1a109efc1 (not active ControlSet)                         
Reg             HKLM\SOFTWARE\Microsoft\Windows Search\UsnNotifier\Windows\Catalogs\SystemIndex@{E077A6D8-5903-11DF-8ADF-806E6F6E6963}  3133035904

---- EOF - GMER 2.1 ----

Über Hilfe wäre ich sehr dankbar.

greetings

Hein Bagaluth
Alias Ralf Tielmann

schrauber · 03.11.2013, 16:35

hi,

Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Bagaluth · 03.11.2013, 18:41

Erst einmal vielen Dank für die prompte Hilfe.

Probleme gab es bisher keine bis auf eine weitere Virenmeldung von Avira beim Aufrufen des boards, weil wieder ein verseuchtes Pop Up da war.

Combofix anschließend ausgeführt.
Hier das log:

Code:

ATTFilter

ComboFix 13-11-03.02 - Ralf 03.11.2013  18:08:03.2.2 - x86
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.3539.1963 [GMT 1:00]
ausgeführt von:: c:\users\Ralf\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\LyricsSay-16
c:\program files\LyricsSay-16\44158.xpi
c:\program files\LyricsSay-16\background.html
c:\program files\LyricsSay-16\Installer.log
c:\program files\LyricsSay-16\LyricsSay-16-bg.exe
c:\program files\LyricsSay-16\LyricsSay-16-buttonutil.dll
c:\program files\LyricsSay-16\LyricsSay-16-buttonutil.exe
c:\program files\LyricsSay-16\LyricsSay-16-codedownloader.exe
c:\program files\LyricsSay-16\LyricsSay-16-enabler.exe
c:\program files\LyricsSay-16\LyricsSay-16-firefoxinstaller.exe
c:\program files\LyricsSay-16\LyricsSay-16-helper.exe
c:\program files\LyricsSay-16\LyricsSay-16-updater.exe
c:\program files\LyricsSay-16\LyricsSay-16.ico
c:\program files\LyricsSay-16\Uninstall.exe
c:\program files\LyricsSay-16\utils.exe
c:\windows\Installer\{21E49794-7C13-4E84-8659-55BD378267D5}\WHSTrayApp.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-10-03 bis 2013-11-03  ))))))))))))))))))))))))))))))
.
.
2013-11-03 17:16 . 2013-11-03 17:16	--------	d-----w-	c:\users\Ralf\AppData\Local\temp
2013-11-03 17:16 . 2013-11-03 17:16	--------	d-----w-	c:\users\Public\AppData\Local\temp
2013-11-03 17:16 . 2013-11-03 17:16	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-11-03 17:16 . 2013-11-03 17:16	--------	d-----w-	c:\users\Administrator\AppData\Local\temp
2013-11-03 13:24 . 2013-11-03 13:24	--------	d-----w-	C:\FRST
2013-11-03 13:00 . 2013-11-03 13:00	--------	d-----w-	c:\users\Ralf\AppData\Roaming\UpdaterEX
2013-11-03 10:45 . 2013-11-03 10:45	62576	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{7AA846B5-D997-480A-8B8D-5DF39D9B12C0}\offreg.dll
2013-11-03 10:43 . 2013-10-14 06:39	7796464	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{7AA846B5-D997-480A-8B8D-5DF39D9B12C0}\mpengine.dll
2013-10-27 17:25 . 2013-10-27 17:25	--------	d-----w-	c:\users\Ralf\AppData\Local\Adobe_Systems_Incorporate
2013-10-27 16:58 . 2013-10-27 16:59	--------	d-----w-	c:\users\Ralf\AppData\Local\calibre-cache
2013-10-27 16:57 . 2013-10-27 17:01	--------	d-----w-	c:\users\Ralf\AppData\Roaming\calibre
2013-10-27 16:57 . 2013-10-27 16:57	--------	d-----w-	c:\program files\Calibre2
2013-10-27 16:15 . 2013-10-27 16:15	--------	d-----w-	c:\program files\Common Files\Sony Shared
2013-10-27 16:01 . 2013-10-27 16:01	--------	d-----w-	c:\program files\Plus-HD-1.6
2013-10-27 14:00 . 2013-11-03 12:21	105176	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2013-10-27 13:59 . 2013-11-03 12:21	75992	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2013-10-27 11:12 . 2013-10-27 11:12	--------	d-----w-	c:\users\Ralf\Library
2013-10-27 11:12 . 2013-10-27 11:12	--------	d-----w-	c:\users\Ralf\AppData\Roaming\Apple Computer
2013-10-27 11:12 . 2013-10-27 11:12	--------	d-----w-	c:\users\Ralf\AppData\Local\Apple Computer
2013-10-27 11:12 . 2013-10-27 11:12	--------	d-----w-	c:\programdata\kinoma
2013-10-27 11:12 . 2013-10-27 11:12	--------	d-----w-	c:\program files\Sony
2013-10-27 11:11 . 2013-10-27 16:15	--------	d-----w-	c:\users\Ralf\AppData\Local\Sony Corporation
2013-10-27 11:08 . 2013-10-27 11:08	--------	d-----w-	c:\users\Ralf\AppData\Local\kinoma
2013-10-24 19:12 . 2013-10-24 19:13	--------	d-----w-	c:\windows\system32\Adobe
2013-10-14 17:52 . 2013-10-14 17:52	163504	----a-w-	c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10145.bin
2013-10-10 09:23 . 2013-07-04 11:50	530432	----a-w-	c:\windows\system32\comctl32.dll
2013-10-10 09:22 . 2013-07-04 11:57	205824	----a-w-	c:\windows\system32\WebClnt.dll
2013-10-10 09:22 . 2013-07-04 11:51	81920	----a-w-	c:\windows\system32\davclnt.dll
2013-10-10 09:22 . 2013-07-04 09:48	115712	----a-w-	c:\windows\system32\drivers\mrxdav.sys
2013-10-10 09:22 . 2013-07-12 10:07	86016	----a-w-	c:\windows\system32\drivers\usbcir.sys
2013-10-10 09:22 . 2013-06-25 22:56	527064	----a-w-	c:\windows\system32\drivers\Wdf01000.sys
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-10-31 17:20 . 2010-05-03 14:24	0	----a-w-	c:\users\Ralf\AppData\Local\WavXMapDrive.bat
2013-10-15 18:48 . 2012-03-29 17:21	692616	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2013-10-15 18:48 . 2011-05-19 11:45	71048	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2013-09-05 17:22 . 2013-05-10 05:46	66144	----a-w-	c:\windows\system32\drivers\avnetflt.sys
2013-09-05 17:22 . 2012-12-22 15:04	88840	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2013-09-05 17:22 . 2012-12-22 15:04	136672	----a-w-	c:\windows\system32\drivers\avipbb.sys
2013-09-03 12:35 . 2010-05-03 15:14	238872	------w-	c:\windows\system32\MpSigStub.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EnabledUnlockedFDEIconOverlay]
@="{30D3C2AF-9709-4D05-9CF4-13335F3C1E4A}"
[HKEY_CLASSES_ROOT\CLSID\{30D3C2AF-9709-4D05-9CF4-13335F3C1E4A}]
2009-11-24 20:48	62832	----a-w-	c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmIconOverlay.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UninitializedFdeIconOverlay]
@="{CF08DA3E-C97D-4891-A66B-E39B28DD270F}"
[HKEY_CLASSES_ROOT\CLSID\{CF08DA3E-C97D-4891-A66B-E39B28DD270F}]
2009-11-24 20:48	62832	----a-w-	c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmIconOverlay.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2009-06-19 249856]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-08-01 458844]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-08-07 186904]
"DellControlPoint"="c:\program files\Dell\Dell ControlPoint\Dell.ControlPoint.exe" [2009-11-02 657920]
"DellConnectionManager"="c:\program files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe" [2009-12-22 1845248]
"WavXMgr"="c:\program files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe" [2010-01-05 147328]
"USCService"="c:\program files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe" [2010-01-06 34232]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-06-25 140520]
"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2011-08-05 159456]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2013-09-03 41336]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2013-09-03 840568]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-09-05 347192]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-11 137752]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-11 171032]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-11 172568]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2013-01-27 98304]
"Reader Library Launcher"="d:\program files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe" [2010-07-13 906648]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Del243731640"="del" [X]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-8-11 795936]
Dell ControlPoint System Manager.lnk - c:\program files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe [2009-12-10 1327392]
TdmNotify.lnk - c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmNotify.exe [2009-11-24 132456]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages	REG_MULTI_SZ   	msv1_0 wvauth
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\se32.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
R2 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2011-10-21 196176]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2010-04-23 29472]
R3 NvtSp50;NvtSp50 NDIS Protocol Driver;c:\windows\system32\Drivers\NvtSp50.sys [x]
R3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [2010-04-09 16472]
R3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [2010-04-09 11104]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 14848]
R3 rimspci;rimspci;c:\windows\system32\DRIVERS\rimspe86.sys [2009-07-02 47104]
R3 risdpcie;risdpcie;c:\windows\system32\DRIVERS\risdpe86.sys [2009-07-01 49152]
R3 rixdpcie;rixdpcie;c:\windows\system32\DRIVERS\rixdpe86.sys [2009-07-05 38400]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 49664]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2011-04-28 1343400]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2013-03-30 37352]
S1 HssDRV6;Hotspot Shield Routing Driver 6;c:\windows\system32\DRIVERS\hssdrv6.sys [2012-08-01 35560]
S1 se32;EnTech softEngine;c:\windows\system32\Drivers\se32.sys [2007-05-03 12112]
S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [2010-02-24 185472]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2013-09-05 84024]
S2 arXfrSvc;TV-Archiv-Übertragungsdienst für Windows Media Center;c:\program files\Windows Home Server\Microsoft.HomeServer.Archive.TransferService.exe [2011-01-10 239472]
S2 ATService;AuthenTec Fingerprint Service;c:\program files\Fingerprint Sensor\AtService.exe [2009-05-15 1803512]
S2 BBUpdate;BBUpdate;c:\program files\Microsoft\BingBar\SeaPort.EXE [2011-10-13 249648]
S2 buttonsvc32;Dell ControlPoint Button Service;c:\program files\Dell\Dell ControlPoint\DCPButtonSvc.exe [2009-11-20 278304]
S2 dcpsysmgrsvc;Dell ControlPoint System Manager;c:\program files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe [2009-12-10 386848]
S2 esClient;Windows Media Center-Clientdienst;c:\program files\Windows Home Server\esClient.exe [2011-01-10 97136]
S2 SMManager;Smith Micro Connection Manager Service;c:\program files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe [2009-12-22 77312]
S2 softOSD;softOSD;c:\program files\softOSD\softOSD.exe [2010-12-18 291384]
S2 WHSConnector;Windows Home Server-Connectordienst;c:\program files\Windows Home Server\WHSConnector.exe [2011-01-10 376688]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2010-03-15 127488]
S3 KMWDFILTERx86;HIDServiceDesc;c:\windows\system32\DRIVERS\KMWDFILTER.sys [2009-04-29 25088]
S3 NETw5s32;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 32-Bit;c:\windows\system32\DRIVERS\NETw5s32.sys [2009-09-15 6114816]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - kfrcapow
.
Inhalt des "geplante Tasks" Ordners
.
2013-11-03 c:\windows\Tasks\Plus-HD-1.6-firefoxinstaller.job
- c:\program files\Plus-HD-1.6\Plus-HD-1.6-firefoxinstaller.exe [2013-10-27 16:01]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:Tabs
IE: An OneNote s&enden - c:\progra~1\MIF5BA~1\Office14\ONBttnIE.dll/105
IE: An vorhandene PDF-Datei anfügen - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Anexar em PDF existente - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Bild in &Microsoft PhotoDraw öffnen - d:\progra~1\MICROS~1\Office\1031\phdintl.dll/phdContext.htm
IE: Converter destino de link em Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Converter destino de link em PDF existente - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Converter links selecionados em PDF existente - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: In Adobe PDF konvertieren - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Linkziel in Adobe PDF konvertieren - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MIF5BA~1\Office14\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MIF5BA~1\Office12\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.1.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Windows Home Server.lnk - c:\windows\Installer\{21E49794-7C13-4E84-8659-55BD378267D5}\WHSTrayApp.exe
AddRemove-LyricsSay-16 - c:\program files\LyricsSay-16\Uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'lsass.exe'(556)
c:\windows\system32\wvauth.DLL
.
Zeit der Fertigstellung: 2013-11-03  18:24:40
ComboFix-quarantined-files.txt  2013-11-03 17:24
.
Vor Suchlauf: 12 Verzeichnis(se), 59.318.444.032 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 59.670.970.368 Bytes frei
.
- - End Of File - - 32083DAA091BFB399AA83659AC8E1F3F
CDB4DE4BBD714F152979DA2DCBEF57EB

Nach combofix scheinen zumindest die verseuchten Pop Up's jetzt der Vergangenheit anzugehören.

Ralf

schrauber · 04.11.2013, 10:32

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Bagaluth · 04.11.2013, 21:23

OK done

mbam log:

Code:

ATTFilter

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.11.04.06

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 10.0.9200.16721
Ralf :: BAGALUTH01 [Administrator]

04.11.2013 20:25:13
mbam-log-2013-11-04 (20-25-13).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 218875
Laufzeit: 5 Minute(n), 58 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 7
HKCR\CrossriderApp0044158.BHO (PUP.Optional.CrossRider.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CrossriderApp0044158.BHO.1 (PUP.Optional.CrossRider.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CrossriderApp0044158.Sandbox (PUP.Optional.CrossRider.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CrossriderApp0044158.Sandbox.1 (PUP.Optional.CrossRider.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Plus-HD-1.6 (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\Software\LyricsSay-16 (PUP.Optional.LyricsSay.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Plus-HD-1.6 (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 1
C:\Program Files\Plus-HD-1.6 (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 5
C:\Windows\Tasks\Plus-HD-1.6-firefoxinstaller.job (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Plus-HD-1.6\32002.xpi (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Plus-HD-1.6\Plus-HD-1.6-firefoxinstaller.exe (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Plus-HD-1.6\Uninstall.exe (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Plus-HD-1.6\utils.exe (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Adwcleaner log:

Code:

ATTFilter

# AdwCleaner v3.011 - Bericht erstellt am 04/11/2013 um 20:54:38
# Updated 03/11/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (32 bits)
# Benutzername : Ralf - BAGALUTH01
# Gestartet von : C:\Users\Ralf\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\Ralf\AppData\Roaming\UpdaterEX

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{057AF304-F92A-4FE9-BAB2-9634F209C37E}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{28311E67-8079-4D7B-BA62-DDAC2DF4CC4E}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5DCF8606-F47C-49C2-92DC-B371C919BEAA}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C077D56C-D3A0-4C9E-AC36-EFEFAD7E9FF0}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E6890604-6054-412B-AA14-866963D254B2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220422412258}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550455415558}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660466416658}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440444414458}
Schlüssel Gelöscht : HKCU\Software\installedbrowserextensions
Schlüssel Gelöscht : HKCU\Software\InstalledThirdPartyPrograms
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKLM\Software\InstalledThirdPartyPrograms

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16720


*************************

AdwCleaner[R0].txt - [85943 octets] - [04/11/2013 20:51:05]
AdwCleaner[S0].txt - [2245 octets] - [04/11/2013 20:54:38]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2305 octets] ##########

JRT log:

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.7 (10.15.2013:3)
OS: Windows 7 Professional x86
Ran by Ralf on 04.11.2013 at 21:02:11,35
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 04.11.2013 at 21:04:24,40
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

und zu guter Letzt das neue FRST:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 31-10-2013
Ran by Ralf (administrator) on BAGALUTH01 on 04-11-2013 21:14:42
Running from C:\Users\Ralf\Desktop
Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(AuthenTec, Inc.) C:\Program Files\Fingerprint Sensor\AtService.exe
(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_450b431403c091e3\STacSV.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Smith Micro Software, Inc.) C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe
(Microsoft Corporation.) C:\Program Files\Microsoft\BingBar\BBSvc.EXE
(Microsoft Corporation) C:\Program Files\Microsoft\BingBar\SeaPort.EXE
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Dell Inc.) C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe
(Dell Inc.) c:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe
(Microsoft Corporation) C:\Program Files\Windows Home Server\esClient.exe
(Intel(R) Corporation) c:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
(Intel(R) Corporation) c:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(EnTech Taiwan) C:\Program Files\softOSD\softOSD.exe
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(Wave Systems Corp.) C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
(Microsoft Corporation) C:\Program Files\Windows Home Server\WHSConnector.exe
(Microsoft Corporation) C:\Program Files\Windows Home Server\Microsoft.HomeServer.Archive.TransferService.exe
(EnTech Taiwan) C:\Windows\system32\softLCP.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Dell Inc.) C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe
(Smith Micro Software, Inc.) C:\Program Files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe
(Wave Systems Corp.) C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe
(Broadcom Corporation) C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe
(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
(Microsoft Corporation) C:\Program Files\Zune\ZuneLauncher.exe
(Adobe Systems Inc.) C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Apple Computer, Inc.) C:\Program Files\QuickTime\qttask.exe
(Sony Corporation) D:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Dell Inc.) C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Wave Systems Corp.) C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmNotify.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [249856 2009-06-19] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray.exe [458844 2009-08-01] (IDT, Inc.)
HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe [186904 2009-08-07] (Intel Corporation)
HKLM\...\Run: [DellControlPoint] - C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe [657920 2009-11-02] (Dell Inc.)
HKLM\...\Run: [DellConnectionManager] - C:\Program Files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe [1845248 2009-12-22] (Smith Micro Software, Inc.)
HKLM\...\Run: [WavXMgr] - C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe [147328 2010-01-05] (Wave Systems Corp.)
HKLM\...\Run: [USCService] - C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe [34232 2010-01-06] (Broadcom Corporation)
HKLM\...\Run: [PDVDDXSrv] - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe [140520 2009-06-25] (CyberLink Corp.)
HKLM\...\Run: [Zune Launcher] - C:\Program Files\Zune\ZuneLauncher.exe [159456 2011-08-05] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrobat_sl.exe [41336 2013-09-03] (Adobe Systems Incorporated)
HKLM\...\Run: [Acrobat Assistant 8.0] - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrotray.exe [840568 2013-09-03] (Adobe Systems Inc.)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-05] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\qttask.exe [98304 2013-01-27] (Apple Computer, Inc.)
HKLM\...\Run: [Reader Library Launcher] - D:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe [906648 2010-07-13] (Sony Corporation)
Lsa: [Authentication Packages] msv1_0 wvauth

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {9B7E30B1-98A4-41EC-8D65-3EE9EC23072E} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLRDF8&pc=MDDR&src=IE-SearchBox
SearchScopes: HKCU - {9B7E30B1-98A4-41EC-8D65-3EE9EC23072E} URL = 
BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: BrowserHelper Class - {9A065C65-4EE7-4DDD-9918-F129089A894A} - C:\Program Files\Windows Home Server\WHSDeskBands.dll (Microsoft Corporation)
BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM - Home Server Banner - {D73E76A3-F902-45BD-8FC8-95AE8E014671} - C:\Program Files\Windows Home Server\WHSDeskBands.dll (Microsoft Corporation)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKCU - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 arXfrSvc; C:\Program Files\Windows Home Server\Microsoft.HomeServer.Archive.TransferService.exe [239472 2011-01-10] (Microsoft Corporation)
R2 ATService; C:\Program Files\Fingerprint Sensor\AtService.exe [1803512 2009-05-15] (AuthenTec, Inc.)
R2 buttonsvc32; C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe [278304 2009-11-20] (Dell Inc.)
R2 dcpsysmgrsvc; c:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe [386848 2009-12-10] (Dell Inc.)
R2 esClient; C:\Program Files\Windows Home Server\esClient.exe [97136 2011-01-10] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 SecureStorageService; C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe [1032192 2009-11-18] (Wave Systems Corp.)
R2 SMManager; C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe [77312 2009-12-22] (Smith Micro Software, Inc.)
R2 softOSD; C:\Program Files\softOSD\softOSD.exe [291384 2010-12-18] (EnTech Taiwan)
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_450b431403c091e3\STacSV.exe [221266 2009-08-01] (IDT, Inc.)
S2 tcsd_win32.exe; C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe [1273856 2008-11-12] ()
R2 TdmService; C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe [1148264 2009-11-24] (Wave Systems Corp.)
R2 WHSConnector; C:\Program Files\Windows Home Server\WHSConnector.exe [376688 2011-01-10] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R2 acedrv11; C:\Windows\system32\drivers\acedrv11.sys [185472 2010-02-24] (Protect Software GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88840 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136672 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-03-30] (Avira Operations GmbH & Co. KG)
S3 Blfp; C:\Windows\System32\DRIVERS\basp.sys [84992 2009-05-11] (Broadcom Corporation)
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [35560 2012-08-01] (AnchorFree Inc.)
R2 hwpsgt; C:\Windows\System32\DRIVERS\hwpsgt.sys [137344 2010-07-15] ()
R3 KMWDFILTERx86; C:\Windows\System32\DRIVERS\KMWDFILTER.sys [25088 2009-04-29] (Windows (R) Codename Longhorn DDK provider)
R2 lemsgt; C:\Windows\System32\DRIVERS\lemsgt.sys [9472 2010-07-15] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R0 PBADRV; C:\Windows\System32\DRIVERS\PBADRV.sys [26608 2008-06-04] (Dell Inc)
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [16472 2010-04-09] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [11104 2010-04-09] ()
S3 risdpcie; C:\Windows\system32\DRIVERS\risdpe86.sys [49152 2009-07-01] (REDC)
S3 rixdpcie; C:\Windows\system32\DRIVERS\rixdpe86.sys [38400 2009-07-05] (REDC)
R1 se32; C:\Windows\System32\Drivers\se32.sys [12112 2007-05-03] (EnTech Taiwan)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
S3 taphss; C:\Windows\System32\DRIVERS\taphss.sys [33512 2012-08-01] (AnchorFree Inc)
R2 WavxDMgr; C:\Windows\System32\DRIVERS\WavxDMgr.sys [211328 2010-01-05] (Wave Systems Corp.)
S3 catchme; \??\C:\Users\Ralf\AppData\Local\Temp\catchme.sys [x]
S3 NvtSp50; System32\Drivers\NvtSp50.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-04 21:14 - 2013-11-03 14:21 - 01089445 _____ (Farbar) C:\Users\Ralf\Desktop\FRST.exe
2013-11-04 21:07 - 2013-11-04 21:07 - 00001024 _____ C:\.rnd
2013-11-04 21:04 - 2013-11-04 21:04 - 00000624 _____ C:\Users\Ralf\Desktop\JRT.txt
2013-11-04 21:00 - 2013-11-04 21:00 - 01033335 _____ (Thisisu) C:\Users\Ralf\Desktop\JRT.exe
2013-11-04 20:57 - 2013-11-04 20:57 - 00002385 _____ C:\Users\Ralf\Desktop\AdwCleaner[S0].txt
2013-11-04 20:50 - 2013-11-04 20:54 - 00000000 ____D C:\AdwCleaner
2013-11-04 20:49 - 2013-11-04 20:49 - 01073258 _____ C:\Users\Ralf\Desktop\adwcleaner.exe
2013-11-04 20:20 - 2013-11-04 20:20 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-04 20:20 - 2013-11-04 20:20 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-11-04 20:20 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-11-04 20:19 - 2013-11-04 20:19 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Public\Downloads\mbam-setup-1.75.0.1300.exe
2013-11-04 07:39 - 2013-11-04 07:39 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Mozilla
2013-11-03 18:24 - 2013-11-03 18:24 - 00014738 _____ C:\ComboFix.txt
2013-11-03 18:07 - 2013-11-03 18:25 - 00000000 ____D C:\Qoobox
2013-11-03 18:07 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2013-11-03 18:07 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2013-11-03 18:07 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-11-03 18:07 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-11-03 18:07 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-11-03 18:07 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2013-11-03 18:07 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2013-11-03 18:07 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2013-11-03 17:58 - 2013-11-03 17:58 - 05143677 ____R (Swearware) C:\Users\Ralf\Desktop\ComboFix.exe
2013-11-03 14:33 - 2013-11-03 14:31 - 00377856 _____ C:\Users\Ralf\Desktop\gmer_2.1.19163.exe
2013-11-03 14:31 - 2013-11-03 14:31 - 00377856 _____ C:\Users\Public\Downloads\gmer_2.1.19163.exe
2013-11-03 14:24 - 2013-11-03 14:24 - 00000000 ____D C:\FRST
2013-11-03 14:21 - 2013-11-03 14:21 - 01089445 _____ (Farbar) C:\Users\Public\Downloads\FRST.exe
2013-11-03 14:18 - 2013-11-03 14:18 - 00000470 _____ C:\Users\Public\Downloads\defogger_disable.log
2013-11-03 14:15 - 2013-11-03 14:15 - 00050477 _____ C:\Users\Public\Downloads\Defogger.exe
2013-10-27 18:25 - 2013-10-27 18:25 - 00000000 ____D C:\Users\Ralf\AppData\Local\Adobe_Systems_Incorporate
2013-10-27 18:24 - 2013-10-27 18:24 - 00002168 _____ C:\Users\Public\Desktop\Adobe Digital Editions 2.0.lnk
2013-10-27 17:58 - 2013-10-27 17:59 - 00000000 ____D C:\Users\Ralf\AppData\Local\calibre-cache
2013-10-27 17:57 - 2013-10-27 18:01 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\calibre
2013-10-27 17:57 - 2013-10-27 17:57 - 00000932 _____ C:\Users\Public\Desktop\calibre - E-book management.lnk
2013-10-27 17:57 - 2013-10-27 17:57 - 00000000 ____D C:\Program Files\Calibre2
2013-10-27 17:15 - 2013-10-27 17:15 - 00001975 _____ C:\Users\Public\Desktop\Reader Library.lnk
2013-10-27 17:15 - 2013-10-27 17:15 - 00000000 ____D C:\Program Files\Common Files\Sony Shared
2013-10-27 14:59 - 2013-11-04 19:59 - 00075992 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-10-27 14:58 - 2013-10-27 14:58 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Ralf\Desktop\mbar-1.07.0.1007.exe
2013-10-27 12:57 - 2013-11-03 13:58 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\Library
2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Apple Computer
2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\AppData\Local\Apple Computer
2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\ProgramData\kinoma
2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Program Files\Sony
2013-10-27 12:11 - 2013-10-27 17:15 - 00000000 ____D C:\Users\Ralf\AppData\Local\Sony Corporation
2013-10-27 12:08 - 2013-10-27 12:08 - 00000000 ____D C:\Users\Ralf\AppData\Local\kinoma
2013-10-24 20:12 - 2013-10-24 20:13 - 00000000 ____D C:\Windows\system32\Adobe
2013-10-10 21:30 - 2013-09-23 00:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-10 21:30 - 2013-09-23 00:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-10 21:30 - 2013-09-23 00:28 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-10 21:30 - 2013-09-23 00:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-10 21:30 - 2013-09-23 00:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-10 21:30 - 2013-09-23 00:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-10 21:30 - 2013-09-23 00:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-10 21:30 - 2013-09-23 00:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-10 21:30 - 2013-09-23 00:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-10 21:30 - 2013-09-23 00:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-10 21:30 - 2013-09-23 00:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-10 21:30 - 2013-09-23 00:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-10 21:30 - 2013-09-23 00:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-10 21:30 - 2013-09-23 00:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-10 21:30 - 2013-09-21 04:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-10 21:30 - 2013-09-21 03:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-10 10:23 - 2013-09-14 01:48 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-10-10 10:23 - 2013-09-08 03:07 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-10-10 10:23 - 2013-09-08 03:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-10-10 10:23 - 2013-08-29 02:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-10-10 10:23 - 2013-08-29 02:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-10-10 10:23 - 2013-08-29 02:50 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-10-10 10:23 - 2013-08-29 02:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-10-10 10:23 - 2013-08-29 02:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-10-10 10:23 - 2013-08-28 02:04 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-10 10:23 - 2013-08-28 01:57 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-10-10 10:23 - 2013-08-01 12:03 - 00729024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-10 10:23 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-10 10:23 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-10 10:23 - 2013-07-03 04:36 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-10 10:23 - 2013-07-03 04:36 - 00025728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-10 10:23 - 2013-06-06 05:52 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-10 10:23 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-10 10:23 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-10 10:23 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-10 10:23 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-10 10:22 - 2013-07-12 11:07 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-10 10:22 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-10-10 10:22 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-10-10 10:22 - 2013-07-04 10:48 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-10-10 10:22 - 2013-06-25 23:56 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys

==================== One Month Modified Files and Folders =======

2013-11-04 21:14 - 2009-07-14 05:34 - 00014256 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-04 21:14 - 2009-07-14 05:34 - 00014256 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-04 21:11 - 2010-05-03 15:24 - 00000000 _____ C:\Users\Ralf\AppData\Local\WavXMapDrive.bat
2013-11-04 21:11 - 2010-04-23 16:09 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-04 21:07 - 2013-11-04 21:07 - 00001024 _____ C:\.rnd
2013-11-04 21:07 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-04 21:07 - 2009-07-14 05:39 - 00133029 _____ C:\Windows\setupact.log
2013-11-04 21:05 - 2009-07-14 05:55 - 01623616 _____ C:\Windows\WindowsUpdate.log
2013-11-04 21:04 - 2013-11-04 21:04 - 00000624 _____ C:\Users\Ralf\Desktop\JRT.txt
2013-11-04 21:00 - 2013-11-04 21:00 - 01033335 _____ (Thisisu) C:\Users\Ralf\Desktop\JRT.exe
2013-11-04 20:57 - 2013-11-04 20:57 - 00002385 _____ C:\Users\Ralf\Desktop\AdwCleaner[S0].txt
2013-11-04 20:56 - 2009-07-14 05:53 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-11-04 20:54 - 2013-11-04 20:50 - 00000000 ____D C:\AdwCleaner
2013-11-04 20:49 - 2013-11-04 20:49 - 01073258 _____ C:\Users\Ralf\Desktop\adwcleaner.exe
2013-11-04 20:37 - 2010-04-23 08:57 - 00112768 _____ C:\Windows\PFRO.log
2013-11-04 20:20 - 2013-11-04 20:20 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-04 20:20 - 2013-11-04 20:20 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-11-04 20:19 - 2013-11-04 20:19 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Public\Downloads\mbam-setup-1.75.0.1300.exe
2013-11-04 20:17 - 2013-07-08 06:02 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-11-04 20:17 - 2013-03-22 19:30 - 00000000 ____D C:\Users\Ralf\Desktop\mbar
2013-11-04 19:59 - 2013-10-27 14:59 - 00075992 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-11-04 07:39 - 2013-11-04 07:39 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Mozilla
2013-11-03 18:25 - 2013-11-03 18:07 - 00000000 ____D C:\Qoobox
2013-11-03 18:24 - 2013-11-03 18:24 - 00014738 _____ C:\ComboFix.txt
2013-11-03 18:16 - 2009-07-14 03:04 - 00000215 _____ C:\Windows\system.ini
2013-11-03 18:06 - 2013-04-02 06:50 - 00000000 ____D C:\Windows\erdnt
2013-11-03 17:58 - 2013-11-03 17:58 - 05143677 ____R (Swearware) C:\Users\Ralf\Desktop\ComboFix.exe
2013-11-03 14:31 - 2013-11-03 14:33 - 00377856 _____ C:\Users\Ralf\Desktop\gmer_2.1.19163.exe
2013-11-03 14:31 - 2013-11-03 14:31 - 00377856 _____ C:\Users\Public\Downloads\gmer_2.1.19163.exe
2013-11-03 14:24 - 2013-11-03 14:24 - 00000000 ____D C:\FRST
2013-11-03 14:21 - 2013-11-04 21:14 - 01089445 _____ (Farbar) C:\Users\Ralf\Desktop\FRST.exe
2013-11-03 14:21 - 2013-11-03 14:21 - 01089445 _____ (Farbar) C:\Users\Public\Downloads\FRST.exe
2013-11-03 14:18 - 2013-11-03 14:18 - 00000470 _____ C:\Users\Public\Downloads\defogger_disable.log
2013-11-03 14:15 - 2013-11-03 14:15 - 00050477 _____ C:\Users\Public\Downloads\Defogger.exe
2013-11-03 13:58 - 2013-10-27 12:57 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-11-03 13:56 - 2010-10-08 17:15 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-11-03 13:56 - 2010-10-08 17:15 - 00000000 ____D C:\Program Files\Adobe
2013-10-31 18:20 - 2010-05-03 15:25 - 00115672 _____ C:\Users\Ralf\AppData\Local\GDIPFONTCACHEV1.DAT
2013-10-31 18:18 - 2009-07-14 05:33 - 00426736 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-27 18:25 - 2013-10-27 18:25 - 00000000 ____D C:\Users\Ralf\AppData\Local\Adobe_Systems_Incorporate
2013-10-27 18:24 - 2013-10-27 18:24 - 00002168 _____ C:\Users\Public\Desktop\Adobe Digital Editions 2.0.lnk
2013-10-27 18:01 - 2013-10-27 17:57 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\calibre
2013-10-27 17:59 - 2013-10-27 17:58 - 00000000 ____D C:\Users\Ralf\AppData\Local\calibre-cache
2013-10-27 17:57 - 2013-10-27 17:57 - 00000932 _____ C:\Users\Public\Desktop\calibre - E-book management.lnk
2013-10-27 17:57 - 2013-10-27 17:57 - 00000000 ____D C:\Program Files\Calibre2
2013-10-27 17:15 - 2013-10-27 17:15 - 00001975 _____ C:\Users\Public\Desktop\Reader Library.lnk
2013-10-27 17:15 - 2013-10-27 17:15 - 00000000 ____D C:\Program Files\Common Files\Sony Shared
2013-10-27 17:15 - 2013-10-27 12:11 - 00000000 ____D C:\Users\Ralf\AppData\Local\Sony Corporation
2013-10-27 14:58 - 2013-10-27 14:58 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Ralf\Desktop\mbar-1.07.0.1007.exe
2013-10-27 12:57 - 2010-05-06 11:33 - 00000000 ____D C:\Users\Ralf\AppData\Local\Mozilla
2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\Library
2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Apple Computer
2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\AppData\Local\Apple Computer
2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\ProgramData\kinoma
2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Program Files\Sony
2013-10-27 12:12 - 2010-05-03 15:24 - 00000000 ____D C:\Users\Ralf
2013-10-27 12:12 - 2010-04-23 16:05 - 00000000 ____D C:\Program Files\DIFX
2013-10-27 12:08 - 2013-10-27 12:08 - 00000000 ____D C:\Users\Ralf\AppData\Local\kinoma
2013-10-24 20:14 - 2010-04-23 16:02 - 00000000 ____D C:\Windows\system32\Macromed
2013-10-24 20:13 - 2013-10-24 20:12 - 00000000 ____D C:\Windows\system32\Adobe
2013-10-21 17:28 - 2013-09-01 15:10 - 00000000 ____D C:\Users\Ralf\AppData\Local\Thunderbird
2013-10-17 18:12 - 2011-05-19 13:03 - 00028672 _____ C:\Users\Ralf\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-10-15 19:48 - 2012-03-29 18:21 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-10-15 19:48 - 2011-05-19 12:45 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-10-14 18:37 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-10-14 18:21 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-14 17:46 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-10-14 17:44 - 2010-04-23 16:23 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-10-10 21:35 - 2010-05-06 14:54 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-10 21:33 - 2013-07-31 07:45 - 00000000 ____D C:\Windows\system32\MRT
2013-10-10 21:31 - 2010-05-06 15:26 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

Some content of TEMP:
====================
C:\Users\Ralf\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-10-31 18:37

==================== End Of Log ============================

--- --- ---

--- --- ---

schaut ganz gut aus

greetings

Ralf

schrauber · 05.11.2013, 13:25

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Bagaluth · 06.11.2013, 21:56

OK keine Probleme

ESET log:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=aefe49275ea6404ab2f07887b2620cb6
# engine=15784
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-11-06 08:33:37
# local_time=2013-11-06 09:33:37 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 97 12719 249193307 5497 0
# compatibility_mode=5893 16776573 100 94 53894 135401208 0 0
# scanned=163173
# found=0
# cleaned=0
# scan_time=5716

sieht gut aus

Sec_checkup log:

Code:

ATTFilter

Results of screen317's Security Check version 0.99.74  
 Windows 7 Service Pack 1 x86   
 Internet Explorer 10  
``````````````Antivirus/Firewall Check:`````````````` 
Avira Desktop   
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 Malwarebytes Anti-Malware Version 1.75.0.1300  
 Adobe Flash Player 	11.9.900.117  
 Mozilla Firefox (25.0) 
 Mozilla Thunderbird (17.0.8) 
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbamgui.exe  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
 Malwarebytes' Anti-Malware mbamscheduler.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

sieht auch gut aus

und zu guter Letzt das frische

FRST:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 31-10-2013
Ran by Ralf (administrator) on BAGALUTH01 on 06-11-2013 21:46:11
Running from C:\Users\Ralf\Desktop
Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(AuthenTec, Inc.) C:\Program Files\Fingerprint Sensor\AtService.exe
(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_450b431403c091e3\STacSV.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Smith Micro Software, Inc.) C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe
(Microsoft Corporation) C:\Program Files\Microsoft\BingBar\SeaPort.EXE
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Dell Inc.) C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe
(Dell Inc.) c:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe
(Microsoft Corporation) C:\Program Files\Windows Home Server\esClient.exe
(Intel(R) Corporation) c:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
(Intel(R) Corporation) c:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(EnTech Taiwan) C:\Program Files\softOSD\softOSD.exe
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(Wave Systems Corp.) C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
(Microsoft Corporation) C:\Program Files\Windows Home Server\WHSConnector.exe
(Microsoft Corporation) C:\Program Files\Windows Home Server\Microsoft.HomeServer.Archive.TransferService.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Dell Inc.) C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe
(Smith Micro Software, Inc.) C:\Program Files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe
(Wave Systems Corp.) C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe
(Broadcom Corporation) C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe
(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
(Microsoft Corporation) C:\Program Files\Zune\ZuneLauncher.exe
(Adobe Systems Inc.) C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Apple Computer, Inc.) C:\Program Files\QuickTime\qttask.exe
(Sony Corporation) D:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Dell Inc.) C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe
(Wave Systems Corp.) C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmNotify.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(EnTech Taiwan) C:\Windows\system32\softLCP.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwsc.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [249856 2009-06-19] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray.exe [458844 2009-08-01] (IDT, Inc.)
HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe [186904 2009-08-07] (Intel Corporation)
HKLM\...\Run: [DellControlPoint] - C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe [657920 2009-11-02] (Dell Inc.)
HKLM\...\Run: [DellConnectionManager] - C:\Program Files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe [1845248 2009-12-22] (Smith Micro Software, Inc.)
HKLM\...\Run: [WavXMgr] - C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe [147328 2010-01-05] (Wave Systems Corp.)
HKLM\...\Run: [USCService] - C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe [34232 2010-01-06] (Broadcom Corporation)
HKLM\...\Run: [PDVDDXSrv] - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe [140520 2009-06-25] (CyberLink Corp.)
HKLM\...\Run: [Zune Launcher] - C:\Program Files\Zune\ZuneLauncher.exe [159456 2011-08-05] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrobat_sl.exe [41336 2013-09-03] (Adobe Systems Incorporated)
HKLM\...\Run: [Acrobat Assistant 8.0] - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrotray.exe [840568 2013-09-03] (Adobe Systems Inc.)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-05] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\qttask.exe [98304 2013-01-27] (Apple Computer, Inc.)
HKLM\...\Run: [Reader Library Launcher] - D:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe [906648 2010-07-13] (Sony Corporation)
Lsa: [Authentication Packages] msv1_0 wvauth

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {9B7E30B1-98A4-41EC-8D65-3EE9EC23072E} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLRDF8&pc=MDDR&src=IE-SearchBox
SearchScopes: HKCU - {9B7E30B1-98A4-41EC-8D65-3EE9EC23072E} URL = 
BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: BrowserHelper Class - {9A065C65-4EE7-4DDD-9918-F129089A894A} - C:\Program Files\Windows Home Server\WHSDeskBands.dll (Microsoft Corporation)
BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM - Home Server Banner - {D73E76A3-F902-45BD-8FC8-95AE8E014671} - C:\Program Files\Windows Home Server\WHSDeskBands.dll (Microsoft Corporation)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKCU - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Ralf\AppData\Roaming\Mozilla\Firefox\Profiles\ojr0abon.default
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @sony.com/eBookLibrary - D:\Program Files\Sony\Reader\Data\bin\npebldetectmoz.dll (Sony Corporation)
FF Plugin: Adobe Acrobat - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 arXfrSvc; C:\Program Files\Windows Home Server\Microsoft.HomeServer.Archive.TransferService.exe [239472 2011-01-10] (Microsoft Corporation)
R2 ATService; C:\Program Files\Fingerprint Sensor\AtService.exe [1803512 2009-05-15] (AuthenTec, Inc.)
R2 buttonsvc32; C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe [278304 2009-11-20] (Dell Inc.)
R2 dcpsysmgrsvc; c:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe [386848 2009-12-10] (Dell Inc.)
R2 esClient; C:\Program Files\Windows Home Server\esClient.exe [97136 2011-01-10] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 SecureStorageService; C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe [1032192 2009-11-18] (Wave Systems Corp.)
R2 SMManager; C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe [77312 2009-12-22] (Smith Micro Software, Inc.)
R2 softOSD; C:\Program Files\softOSD\softOSD.exe [291384 2010-12-18] (EnTech Taiwan)
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_450b431403c091e3\STacSV.exe [221266 2009-08-01] (IDT, Inc.)
S2 tcsd_win32.exe; C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe [1273856 2008-11-12] ()
R2 TdmService; C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe [1148264 2009-11-24] (Wave Systems Corp.)
R2 WHSConnector; C:\Program Files\Windows Home Server\WHSConnector.exe [376688 2011-01-10] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R2 acedrv11; C:\Windows\system32\drivers\acedrv11.sys [185472 2010-02-24] (Protect Software GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88840 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136672 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-03-30] (Avira Operations GmbH & Co. KG)
S3 Blfp; C:\Windows\System32\DRIVERS\basp.sys [84992 2009-05-11] (Broadcom Corporation)
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [35560 2012-08-01] (AnchorFree Inc.)
R2 hwpsgt; C:\Windows\System32\DRIVERS\hwpsgt.sys [137344 2010-07-15] ()
R3 KMWDFILTERx86; C:\Windows\System32\DRIVERS\KMWDFILTER.sys [25088 2009-04-29] (Windows (R) Codename Longhorn DDK provider)
R2 lemsgt; C:\Windows\System32\DRIVERS\lemsgt.sys [9472 2010-07-15] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R0 PBADRV; C:\Windows\System32\DRIVERS\PBADRV.sys [26608 2008-06-04] (Dell Inc)
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [16472 2010-04-09] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [11104 2010-04-09] ()
S3 risdpcie; C:\Windows\system32\DRIVERS\risdpe86.sys [49152 2009-07-01] (REDC)
S3 rixdpcie; C:\Windows\system32\DRIVERS\rixdpe86.sys [38400 2009-07-05] (REDC)
R1 se32; C:\Windows\System32\Drivers\se32.sys [12112 2007-05-03] (EnTech Taiwan)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
S3 taphss; C:\Windows\System32\DRIVERS\taphss.sys [33512 2012-08-01] (AnchorFree Inc)
R2 WavxDMgr; C:\Windows\System32\DRIVERS\WavxDMgr.sys [211328 2010-01-05] (Wave Systems Corp.)
S3 catchme; \??\C:\Users\Ralf\AppData\Local\Temp\catchme.sys [x]
S3 NvtSp50; System32\Drivers\NvtSp50.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-06 21:45 - 2013-11-06 21:45 - 00000924 _____ C:\Users\Ralf\Desktop\checkup.txt
2013-11-06 21:42 - 2013-11-06 21:42 - 00891167 _____ C:\Users\Ralf\Desktop\SecurityCheck.exe
2013-11-06 19:01 - 2013-11-06 19:01 - 102844835 _____ C:\Windows\system32\Ʒ᱄o
2013-11-06 19:00 - 2013-11-06 19:00 - 00001024 _____ C:\.rnd
2013-11-04 22:11 - 2013-11-04 22:11 - 00001111 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-11-04 22:11 - 2013-11-04 22:11 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-11-04 21:14 - 2013-11-03 14:21 - 01089445 _____ (Farbar) C:\Users\Ralf\Desktop\FRST.exe
2013-11-04 21:00 - 2013-11-04 21:00 - 01033335 _____ (Thisisu) C:\Users\Ralf\Desktop\JRT.exe
2013-11-04 20:50 - 2013-11-04 20:54 - 00000000 ____D C:\AdwCleaner
2013-11-04 20:49 - 2013-11-04 20:49 - 01073258 _____ C:\Users\Ralf\Desktop\adwcleaner.exe
2013-11-04 20:20 - 2013-11-04 20:20 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-04 20:20 - 2013-11-04 20:20 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-11-04 20:20 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-11-04 20:19 - 2013-11-04 20:19 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Public\Downloads\mbam-setup-1.75.0.1300.exe
2013-11-04 07:39 - 2013-11-04 22:11 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Mozilla
2013-11-03 18:24 - 2013-11-03 18:24 - 00014738 _____ C:\ComboFix.txt
2013-11-03 18:07 - 2013-11-03 18:25 - 00000000 ____D C:\Qoobox
2013-11-03 18:07 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2013-11-03 18:07 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2013-11-03 18:07 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-11-03 18:07 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-11-03 18:07 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-11-03 18:07 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2013-11-03 18:07 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2013-11-03 18:07 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2013-11-03 17:58 - 2013-11-03 17:58 - 05143677 ____R (Swearware) C:\Users\Ralf\Desktop\ComboFix.exe
2013-11-03 14:33 - 2013-11-03 14:31 - 00377856 _____ C:\Users\Ralf\Desktop\gmer_2.1.19163.exe
2013-11-03 14:31 - 2013-11-03 14:31 - 00377856 _____ C:\Users\Public\Downloads\gmer_2.1.19163.exe
2013-11-03 14:24 - 2013-11-03 14:24 - 00000000 ____D C:\FRST
2013-11-03 14:21 - 2013-11-03 14:21 - 01089445 _____ (Farbar) C:\Users\Public\Downloads\FRST.exe
2013-11-03 14:18 - 2013-11-03 14:18 - 00000470 _____ C:\Users\Public\Downloads\defogger_disable.log
2013-11-03 14:15 - 2013-11-03 14:15 - 00050477 _____ C:\Users\Public\Downloads\Defogger.exe
2013-10-27 18:25 - 2013-10-27 18:25 - 00000000 ____D C:\Users\Ralf\AppData\Local\Adobe_Systems_Incorporate
2013-10-27 18:24 - 2013-10-27 18:24 - 00002168 _____ C:\Users\Public\Desktop\Adobe Digital Editions 2.0.lnk
2013-10-27 17:58 - 2013-10-27 17:59 - 00000000 ____D C:\Users\Ralf\AppData\Local\calibre-cache
2013-10-27 17:57 - 2013-10-27 18:01 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\calibre
2013-10-27 17:57 - 2013-10-27 17:57 - 00000932 _____ C:\Users\Public\Desktop\calibre - E-book management.lnk
2013-10-27 17:57 - 2013-10-27 17:57 - 00000000 ____D C:\Program Files\Calibre2
2013-10-27 17:15 - 2013-10-27 17:15 - 00001975 _____ C:\Users\Public\Desktop\Reader Library.lnk
2013-10-27 17:15 - 2013-10-27 17:15 - 00000000 ____D C:\Program Files\Common Files\Sony Shared
2013-10-27 14:59 - 2013-11-04 19:59 - 00075992 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-10-27 14:58 - 2013-10-27 14:58 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Ralf\Desktop\mbar-1.07.0.1007.exe
2013-10-27 12:57 - 2013-11-04 22:11 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\Library
2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Apple Computer
2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\AppData\Local\Apple Computer
2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\ProgramData\kinoma
2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Program Files\Sony
2013-10-27 12:11 - 2013-10-27 17:15 - 00000000 ____D C:\Users\Ralf\AppData\Local\Sony Corporation
2013-10-27 12:08 - 2013-10-27 12:08 - 00000000 ____D C:\Users\Ralf\AppData\Local\kinoma
2013-10-24 20:12 - 2013-10-24 20:13 - 00000000 ____D C:\Windows\system32\Adobe
2013-10-10 21:30 - 2013-09-23 00:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-10 21:30 - 2013-09-23 00:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-10 21:30 - 2013-09-23 00:28 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-10 21:30 - 2013-09-23 00:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-10 21:30 - 2013-09-23 00:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-10 21:30 - 2013-09-23 00:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-10 21:30 - 2013-09-23 00:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-10 21:30 - 2013-09-23 00:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-10 21:30 - 2013-09-23 00:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-10 21:30 - 2013-09-23 00:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-10 21:30 - 2013-09-23 00:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-10 21:30 - 2013-09-23 00:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-10 21:30 - 2013-09-23 00:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-10 21:30 - 2013-09-23 00:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-10 21:30 - 2013-09-21 04:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-10 21:30 - 2013-09-21 03:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-10 10:23 - 2013-09-14 01:48 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-10-10 10:23 - 2013-09-08 03:07 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-10-10 10:23 - 2013-09-08 03:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-10-10 10:23 - 2013-08-29 02:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-10-10 10:23 - 2013-08-29 02:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-10-10 10:23 - 2013-08-29 02:50 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-10-10 10:23 - 2013-08-29 02:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-10-10 10:23 - 2013-08-29 02:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-10-10 10:23 - 2013-08-28 02:04 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-10 10:23 - 2013-08-28 01:57 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-10-10 10:23 - 2013-08-01 12:03 - 00729024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-10 10:23 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-10 10:23 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-10 10:23 - 2013-07-03 04:36 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-10 10:23 - 2013-07-03 04:36 - 00025728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-10 10:23 - 2013-06-06 05:52 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-10 10:23 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-10 10:23 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-10 10:23 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-10 10:23 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-10 10:22 - 2013-07-12 11:07 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-10 10:22 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-10-10 10:22 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-10-10 10:22 - 2013-07-04 10:48 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-10-10 10:22 - 2013-06-25 23:56 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys

==================== One Month Modified Files and Folders =======

2013-11-06 21:45 - 2013-11-06 21:45 - 00000924 _____ C:\Users\Ralf\Desktop\checkup.txt
2013-11-06 21:42 - 2013-11-06 21:42 - 00891167 _____ C:\Users\Ralf\Desktop\SecurityCheck.exe
2013-11-06 20:19 - 2009-07-14 05:55 - 01722492 _____ C:\Windows\WindowsUpdate.log
2013-11-06 19:08 - 2009-07-14 05:34 - 00014256 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-06 19:08 - 2009-07-14 05:34 - 00014256 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-06 19:05 - 2010-04-23 16:09 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-06 19:01 - 2013-11-06 19:01 - 102844835 _____ C:\Windows\system32\Ʒ᱄o
2013-11-06 19:01 - 2010-05-03 15:24 - 00000000 _____ C:\Users\Ralf\AppData\Local\WavXMapDrive.bat
2013-11-06 19:00 - 2013-11-06 19:00 - 00001024 _____ C:\.rnd
2013-11-06 19:00 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-06 19:00 - 2009-07-14 05:39 - 00133197 _____ C:\Windows\setupact.log
2013-11-04 22:11 - 2013-11-04 22:11 - 00001111 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-11-04 22:11 - 2013-11-04 22:11 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-11-04 22:11 - 2013-11-04 07:39 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Mozilla
2013-11-04 22:11 - 2013-10-27 12:57 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-11-04 21:00 - 2013-11-04 21:00 - 01033335 _____ (Thisisu) C:\Users\Ralf\Desktop\JRT.exe
2013-11-04 20:56 - 2009-07-14 05:53 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-11-04 20:54 - 2013-11-04 20:50 - 00000000 ____D C:\AdwCleaner
2013-11-04 20:49 - 2013-11-04 20:49 - 01073258 _____ C:\Users\Ralf\Desktop\adwcleaner.exe
2013-11-04 20:37 - 2010-04-23 08:57 - 00112768 _____ C:\Windows\PFRO.log
2013-11-04 20:20 - 2013-11-04 20:20 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-04 20:20 - 2013-11-04 20:20 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-11-04 20:19 - 2013-11-04 20:19 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Public\Downloads\mbam-setup-1.75.0.1300.exe
2013-11-04 20:17 - 2013-07-08 06:02 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-11-04 20:17 - 2013-03-22 19:30 - 00000000 ____D C:\Users\Ralf\Desktop\mbar
2013-11-04 19:59 - 2013-10-27 14:59 - 00075992 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-11-03 18:25 - 2013-11-03 18:07 - 00000000 ____D C:\Qoobox
2013-11-03 18:24 - 2013-11-03 18:24 - 00014738 _____ C:\ComboFix.txt
2013-11-03 18:16 - 2009-07-14 03:04 - 00000215 _____ C:\Windows\system.ini
2013-11-03 18:06 - 2013-04-02 06:50 - 00000000 ____D C:\Windows\erdnt
2013-11-03 17:58 - 2013-11-03 17:58 - 05143677 ____R (Swearware) C:\Users\Ralf\Desktop\ComboFix.exe
2013-11-03 14:31 - 2013-11-03 14:33 - 00377856 _____ C:\Users\Ralf\Desktop\gmer_2.1.19163.exe
2013-11-03 14:31 - 2013-11-03 14:31 - 00377856 _____ C:\Users\Public\Downloads\gmer_2.1.19163.exe
2013-11-03 14:24 - 2013-11-03 14:24 - 00000000 ____D C:\FRST
2013-11-03 14:21 - 2013-11-04 21:14 - 01089445 _____ (Farbar) C:\Users\Ralf\Desktop\FRST.exe
2013-11-03 14:21 - 2013-11-03 14:21 - 01089445 _____ (Farbar) C:\Users\Public\Downloads\FRST.exe
2013-11-03 14:18 - 2013-11-03 14:18 - 00000470 _____ C:\Users\Public\Downloads\defogger_disable.log
2013-11-03 14:15 - 2013-11-03 14:15 - 00050477 _____ C:\Users\Public\Downloads\Defogger.exe
2013-11-03 13:56 - 2010-10-08 17:15 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-11-03 13:56 - 2010-10-08 17:15 - 00000000 ____D C:\Program Files\Adobe
2013-10-31 18:20 - 2010-05-03 15:25 - 00115672 _____ C:\Users\Ralf\AppData\Local\GDIPFONTCACHEV1.DAT
2013-10-31 18:18 - 2009-07-14 05:33 - 00426736 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-27 18:25 - 2013-10-27 18:25 - 00000000 ____D C:\Users\Ralf\AppData\Local\Adobe_Systems_Incorporate
2013-10-27 18:24 - 2013-10-27 18:24 - 00002168 _____ C:\Users\Public\Desktop\Adobe Digital Editions 2.0.lnk
2013-10-27 18:01 - 2013-10-27 17:57 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\calibre
2013-10-27 17:59 - 2013-10-27 17:58 - 00000000 ____D C:\Users\Ralf\AppData\Local\calibre-cache
2013-10-27 17:57 - 2013-10-27 17:57 - 00000932 _____ C:\Users\Public\Desktop\calibre - E-book management.lnk
2013-10-27 17:57 - 2013-10-27 17:57 - 00000000 ____D C:\Program Files\Calibre2
2013-10-27 17:15 - 2013-10-27 17:15 - 00001975 _____ C:\Users\Public\Desktop\Reader Library.lnk
2013-10-27 17:15 - 2013-10-27 17:15 - 00000000 ____D C:\Program Files\Common Files\Sony Shared
2013-10-27 17:15 - 2013-10-27 12:11 - 00000000 ____D C:\Users\Ralf\AppData\Local\Sony Corporation
2013-10-27 14:58 - 2013-10-27 14:58 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Ralf\Desktop\mbar-1.07.0.1007.exe
2013-10-27 12:57 - 2010-05-06 11:33 - 00000000 ____D C:\Users\Ralf\AppData\Local\Mozilla
2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\Library
2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Apple Computer
2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\AppData\Local\Apple Computer
2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\ProgramData\kinoma
2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Program Files\Sony
2013-10-27 12:12 - 2010-05-03 15:24 - 00000000 ____D C:\Users\Ralf
2013-10-27 12:12 - 2010-04-23 16:05 - 00000000 ____D C:\Program Files\DIFX
2013-10-27 12:08 - 2013-10-27 12:08 - 00000000 ____D C:\Users\Ralf\AppData\Local\kinoma
2013-10-24 20:14 - 2010-04-23 16:02 - 00000000 ____D C:\Windows\system32\Macromed
2013-10-24 20:13 - 2013-10-24 20:12 - 00000000 ____D C:\Windows\system32\Adobe
2013-10-21 17:28 - 2013-09-01 15:10 - 00000000 ____D C:\Users\Ralf\AppData\Local\Thunderbird
2013-10-17 18:12 - 2011-05-19 13:03 - 00028672 _____ C:\Users\Ralf\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-10-15 19:48 - 2012-03-29 18:21 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-10-15 19:48 - 2011-05-19 12:45 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-10-14 18:37 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-10-14 18:21 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-14 17:46 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-10-14 17:44 - 2010-04-23 16:23 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-10-10 21:35 - 2010-05-06 14:54 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-10 21:33 - 2013-07-31 07:45 - 00000000 ____D C:\Windows\system32\MRT
2013-10-10 21:31 - 2010-05-06 15:26 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

Some content of TEMP:
====================
C:\Users\Ralf\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-10-31 18:37

==================== End Of Log ============================

--- --- ---

--- --- ---

sieht auch sehr gut aus

1.000 Dank scheint so als hätten wir alles erlegt was sich da ungebeten eingenistet hat.

greetings

Ralf

schrauber · 07.11.2013, 13:51

Fertig

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Bagaluth · 07.11.2013, 18:49

Kurze Rückmeldung:

Alles OK

Überweisungsträger für Kleine Spende liegt im Abtrag und wird morgen eingeworfen.

Nochmals Danke Ihr seit klasse.

greetings

Hein Bagaluth
(Alias Ralf Tielmann)

schrauber · 08.11.2013, 10:21

Gern Geschehen

08.11.2013, 10:21	#10
schrauber /// the machine /// TB-Ausbilder	Win7.32bit: Im Browser werden alle LINKS auf Werbeseiten umgeleitet Gern Geschehen __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Win7.32bit: Im Browser werden alle LINKS auf Werbeseiten umgeleitet

Log-Analyse und Auswertung: Win7.32bit: Im Browser werden alle LINKS auf Werbeseiten umgeleitet